Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

paultendo.github.io

Post reply on HN
Print view View original

11–20 of 60 posts

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#11

Post by tuwtuwtuwtuw »

tstrimple wrote: post #9
doctorpangloss wrote: post #6

well, you didn't really do anything, did you? Claude Code rendered these things and wrote the blog post haha > "This is not theoretical. It is a measured property of the font files shipping on every Mac." some patterns of speech are so recognizably LLM, i am convinced that the AI detection startups have a very strong chance to succeed on text.

[flagged]

Maybe not. I checked OPs blog and he seem to be putting up 2-3 longer posts per day. Since it is LLM content, I have no idea whether it's mainly hallucinations or based on facts. So what did I learn from reading the article? Maybe nothing, maybe it's just made up.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#12

Post by chii »

> A domain using only Cyrillic characters that happen to spell a Latin word (like “аpple” in all-Cyrillic) may still render in the address bar’s font and look identical.

that is very interesting.

I imagine the browser could take some context clues and switch rendering to puny code if the locale of the user is nowhere near a cyrillic region. But that is only going to patch some edge cases and miss others.

Ideally, the solution is password managers everywhere, which don't have this vulnerability, instead of using human eyes to visually recognize web urls and thus is vulnerable.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#13

Post by pmontra »

tuwtuwtuwtuw wrote: post #11
tstrimple wrote: post #9

Earlier quoted context omitted.

[flagged]

Maybe not. I checked OPs blog and he seem to be putting up 2-3 longer posts per day. Since it is LLM content, I have no idea whether it's mainly hallucinations or based on facts. So what did I learn from reading the article? Maybe nothing, maybe it's just made up.

If you have a Mac you can follow the steps at the end of the post and reproduce the results https://paultendo.github.io/posts/confusable-vision-visual-s...

I don't have a Mac.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#14

Post by thih9 »

hinkley wrote: post #4
apothegm wrote: post #2

Maybe not at super large font sizes. But even lowercase i and l are easy enough to confuse at a glance mid-word in most sans-serif fonts, not to mention uppercase I and lowercase l. You don’t even need “confusable” glyphs to create a domain name that will stand up to a casual visual confirmation from a busy user in a phishing context.

Every Albert, Alfred, or Alphonso who goes by “Al” getting confused with bots right now…

Perhaps there are people named “Alexa” who started using “Al” after Amazon’s launch. Talk about bad luck.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#16

Post by recursivecaveat »

This seems misguided. The fact that 'ρ' isn't a pixel for pixel match for 'p' doesn't mean they're not confusable. The threat model is not being unable to solve a spot-the-difference puzzle. Unless you are familiar with every pixel of your system fonts, and carefully scrutinize every character on your screen, the lack of an exact match in jρmorgan[.]com in a URL is going to do very little for you. There are many english characters that have multiple totally distinct ways to write them, so you can have two 'a' variants that are distinct but equally 'normal' looking. I guess if you get an LLM to write your blog posts they don't have to make much sense to begin with.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#17

Post by sheept »

Cool_Caribou wrote: post #15

Why are all the descending letters truncated in the titles? Not sure if it's a css glitch or terrible font choice. A bit ironic on an article about fonts.

It appears to be part of the font[0]. It looks a bit weird, but display fonts usually can get away with being more eccentric.

[0]: https://fonts.google.com/specimen/Syne

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#18

Post by ordu »

But what about 'Ы'? It looks like 'bl', doen't it? 'Ы' is one codepoint and one glyph, though 'bl' is a sequence of two letters. I believe that the method described will miss such things. Cyrillic also has 'Ю', I suppose it is possible to design a font that make it look like 'lO'? Are there any fonts like this in a wild?

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#20

Post by jcynix »

doctorpangloss wrote: post #6

well, you didn't really do anything, did you? Claude Code rendered these things and wrote the blog post haha > "This is not theoretical. It is a measured property of the font files shipping on every Mac." some patterns of speech are so recognizably LLM, i am convinced that the AI detection startups have a very strong chance to succeed on text.

Yes, some patterns of speech are recognizable … The "That's LLM generated" pattern is one of those. And while I can understand the motivation behind this, I find it more irritating now than LLM texts, if these contain useful information, which make me curious.

This text made me curious, I liked the approach the author has taken. And it made me think how I would do it. My first idea would be to use ImageMagick to render text and then use ImageMagick's https://imagemagick.org/script/compare.php to somehow calculate the risk of confounding glyphs.

So: Don't be snarky? Maybe we need another rule here, to limit comments on "LLM style" https://news.ycombinator.com/newsguidelines.html

Post reply on HN