Slashdot Mirror
Mozilla Drops Support for International Domains
tsu doh nimh writes "Netcraft has the story that Mozilla has decided to drop support for international domain names in future versions of its Firefox Web browser. The decision comes after demonstrations by the Schmoo Group that the feature can be used to aid in phishing scams and other browser naughtiness." From the article: "The attack can be disabled in Firefox and Mozilla by setting 'network.enableIDN' to false in the browser's configuration (enter about:config in the address bar to access the configuration functions). The Mozilla development team today made this the default setting. Users who want IDN support will be able to turn it on, but will be warned about the risks involved."
They've disabled it by default until they come up with a long term solution. That's hardly dropping.
I don't get it. What's the problem here?
There's a difference between "drops support" and "sets that option to 'off' by default", you know.
You can't take the sky from me...
They're not dropping support for it, they're going to stop enabling it by default. It says that in the text you quoted, for crying out loud!
What I'm listening to now on Pandora...
It will be turned of in the 1.0.1 But for 1.1 and further releases they will look for a more cleaner way to fix the spoofing issue. And thus brining back IDN support. Here is a link to the Mozillazine article: http://www.mozillazine.org/talkback.html?article=6 073
Isn't this the "fix" that everyone found stopped working after you restarted the browser?
"People that quote themselves in their signatures bother me" - athakur999
How is "turned off my default" the same as "dropped support".
:o
Can we mod the title as flamebait ?
If you ever go to an international domain name you such be looking out for scams anyway.
From Chris Smith via BoingBoing
1) Goto your Firefox address bar. Enter about:config and press enter. Firefox will load the (large!) config page.
2) Scroll down to the line beginning network.enableIDN -- this is International Domain Name support, and it is causing the problem here. We want to turn this off -- for now. Ideally we want to support international domain names, but not with this problem.
3) Double-click the network.enableIDN label, and Firefox will show a dialog set to 'true'. Change it to 'false' (no quotes!), click Ok. You are done.
4) Go check out the shmoo demo again and notice it no longer works.
How does "Turned Off by Default" get to be equal to "Drops Support"?
A leaf falls from a tree and the next thing you know, the sky is falling.
We should start referring to processes which run in the background by their correct technical name... paenguins.
It is good that after all the media news about Firefox actually having a security issue that the team moved to correct it, even if very short term. Unfortunetly I don't think this will get as much media coverage as the previous stories on it, but it is a step in the right direction. So, at least we don't have to wait for a fix, they will disable the issue, fix it, then reinable it. Sounds like good software development to me.
Not .cx!!?!? Don't drop support for .cx!!!
Wouldn't rendering the characters in question as black-on-red in the status and location bar be a more effective solution? Or the entire background changes to red to warn the user that the characters they can read aren't the "actual" characters in the domain name?
This was discussed before, but the temporary fix, of setting it to off, doesn't work in current versions. Apperently the setting wasn't reloaded when the browser was restarted. I hope they fix that as well. In the mean time, please do NOT recommend the temporary fix to people, because it makes them think they are safe when they are not!
-- these are only opinions and they might not be mine.
What's this "international" thing people keep talking about?
It's where you go to fight wars.
support for international domains is dying
Perhaps some of the international versions of Mozilla will have Int'l name _enabled_ by default. A quick peek at $CHARSET would do.
I assume there will be an extension to do this shortly. I'm too lazy plus I have to do this on a few computers. It would be better if I could load it on a USB stick and go around installing it instead of editing some file.
International domains are dying, and Netcraft confirms it?
In Repressive Burma, it's not just your connection that dies. slashdot.org/comments.pl?sid=314547&cid=20819199
The submitter SHOULD have mentioned that Mozilla has decided to disable internationalIZED domain names, ones made of "funny" unicode characters.
.uk .au, and our favorite, .cx, are of course still supported.
International domain names like
IDN will be disabled by default in the upcoming releases from this current trunk freeze (Firefox 1.0.1, Thunderbird 1.0.1, Mozilla 1.7.6) but it has been explicitly said many times if you bothered to look on planet.mozilla.org that a permanent solution for this problem is upcoming and hopefully will make it into Firefox 1.1. Users will be able to change this setting (with an extention and a warning dialog that explains the situation) and this should be included with most of the internationalized builds.
Saying that Mozilla has dropped support for IDN is completely wrong.
Slashdot in 5 Paragraphs
Has anyone actually seen a legitimate IDN in the wild?
With most of the phishing scams targeted at English-speaking users, I don't see this as such a horrible decision.
p
In Korea, long hair is for old people!
yousa moran
prevent the "phishy" domain names to get registered? There must be something that can be done by the registering companies!! :p, but what about all those poor non-Firefox users?
Firefox users may be safer from now on
This isn't about turning off domains like .kr. Rather, it's about turning off Unicode support in domain names - currently, in browsers which support IDN, it's possible to send someone to a URL which looks like "https://www.paypal.com" but really has a letter replaced with a non-English Unicode character which looks the same. This deactivation turns off support for Unicode domain names, not national domains.
That's it. I'm no longer part of Team Sanity.
I see that two other people have used this subject line, so I guess it must be the next big "fp" kind of thingy, and I just want to get in on it before everybody starts doing it.
Sheesh, evil *and* a jerk. -- Jade
Indeed. Not many. :)
have they not read this?
MilkMiruku
The average user who would fall for one of these scams (clicking on a paypal or citi bank link) is not going to be smart enough to edit some "strange file" in a "strange place" with "strange contents".
Doesn't Slashdot have editors that are supposed to analyze and edit user postings. "Dropping" and "disabling" mean two different actions. I got confused for a second or two. Lately, Slashdot quality has been going down the tubes.
Dude, you're going to be waiting a loooong time...
If Christmas Island's domain is blocked I'm switching back to IE6!
They would drop support for IP. I hear this internet protocol has a gaping hole where your address is broadcast TO THE WORLD! Unbelievable but true.
In Soviet Russia, dirty foreigner is you
Then how are you going to algorithmicaly delimit an URL ? Remember that your computer doesn't understand what you tell him. As for the %20 issue it's the same problem. You can't use a space to both separate arguments with it and use it in your arguments.
I don't want to end with some XML style tagging just to use spaces in addresses...
I have set this to false in Firefox 1.0 and the spoof still works.
_ test/
http://secunia.com/multiple_browsers_idn_spoofing
There is a difference. They're not disabling something.ch, foobar.uk, etc. but addresses with unicode characters in them.
Let me know if you have an open postdoc position. -braney
Do you really see this as a serious issue? I think the right thing is to prevent spaces from being used. When there is more than one way of doing things, you end up with more problems. If the spec had been changed 10 years ago, that would be one thing, but now everyone is used to no spaces being allowed. I know it wouldn't be hard to maintain backwards compatibility if the spec were changed, but this is something that can be handled entirely on the client side without changing the spec at all.
Why don't they just make it obvious you're visiting an IDN? Similar to how they handle SSL sites, the location bar background turns yellow. Maybe for IDNs, they can make it red and flashing or something similar, so it's obvious to the user that something may be wrong. Maybe they could check and see if there is an equivalent looking domain name in english and then making it red and flashing to let the user know that it may not be the site they think they're visiting.
There just seems to be other ways to handle it, since it really is more of a 'user beware' issue.
Things you think are in the Constitution, but are not.
That's just UnAmerican. In so many ways!
ba da bing
peek $CHARSET, find "UTF8", conclude, what precisely?
D. J. Bernstein (djbdns, qmail, ...) saw this problem coming back in 2002. He proposed an alternative to IDNA called IDNC3 which he claimed wouldn't cause this kind of mess. Looks like nobody listened to him though.
would be to have international domain names show up in red and regular ascii show up in blue.
No, that's called censorship. And it wouldn't solve anything, either. Most spam crap I get points to .com addresses ...
EagerEyes.org: Visualization and Visual Communication
demonstrations by the Schmoo Group
The problem is that you can't always easily identify an international domain name. In particular, IDNs contain characters that are nearly identical to Latin character set but are treated differently. Slashdot won't let me put in examples, but examples here.
The paypal.com one is particularly scary. It looks like paypal.com in your status bar when you hover over the link. It reads paypal.com in your address bar. But it isn't Paypal. That's because the "a" isn't an "a" but is really Unicode D0B0 If they'd put any effort into making it look like Paypal, it would be easy for somebody to direct you there and steal your Paypal password.
In Firefox and IE they're indistinguishable. Even if they added a clue that something was different (e.g. colors to indicate an IDN) you'd have to look closely, and if IDNs became common you'd start to ignore the color coding. If the only difference between "paypal.com" and an identical spoof were small, you'd get tired of looking closely, and forget. If the warning was unignorable, like a popup, you'd turn it off.
So the upshot is, yeah, beware of web sites you don't know, but with IDNs you don't always know whom you know.
...was because the about:config 'fix' apparently doesn't work.
I'm not good in groups. It's difficult to work in a group when you're omnipotent. - Q
How about this for a solution..
1) No IDN address containing more than one charset should work, at all. I can't see a reason why you would need english and japanese in the same domain for instance. That would cure the problem like demonstrated with the fake paypal site where one or more characters way cyrillic.
2) If the domain was completely in a character set, but say using japanese romaji to display "paypal.com" it would check your browser/system region if it matched. If not then it should highlight the address bar red, and note the charset in the address bar as well such as (Shift_JIS) or (Japanese) etc.
Seems atleast like a good start to me.
IDN is WRONG. The look up library should be a part of the OS, not the application. As gethostbyname, but with support for more than 7-bit ascii.
Another one bites the dust
In other news... Microsoft drops support for Word...
Not International domain names. Internationalized domain names.
What is so smart about not supporting a well needed feature of the internet?
Would you also disable the IP protocol by default? Afterall, there are malicions websites on the net?
Solve the problem, not pull the plug!
Well, you wouldn't trust a site that doesn't present a valid certificate. The problem is that obtaining such is too expensive for many.
We need a reliable way for the a domain owner to get a certificate issued for that domain. This is mostly a bureaucratic problem, which could be solved, people willing.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
Damn. That's right. Only American domains are pure and perfect. Indeed America should have borders to stop all international internet traffic. It should be illegal to visit a foreign domain. damn. If you support international domains you support terrorism.
Damn. Now were did I leave that URL for my Russian Viagra supplier. damn
I believe the stats are smth like 80% of slashdot users. you dumb piece of shit.
Damn. If you support Unicode you support terrorism. Unicode is used by terrorists and corrupts American children. Damn. Good ol' American ASCII is what our founding fathers like John Wayne used. Damn.
A real solution for this problem is posted here
:-
/[^\x20-\xFF]/
The applicable part is:
1. Install the Adblock Firefox extension.
here
2. Look at the Adblock 'Preferences' and go to 'Adblock Options'
3. Tick 'Site Blocking'
4. Add the following filter
Necessity is the mother of invention.
Laziness is the father.
I was about to say, "Wow, is it April 1st already?"
SHMOO
NO C.
S H M O O
Though this may surprise some of the more 'jaded' readers, I am really surprised that this one slipped by the editors. . .
So maybe Zonk is next?
...a Firefox extension!
Singularity: a belief in the "God" idea with the "demiurge" relation inverted.
Just once I'd like to read a Slashdot article about software or robots or something that hasn't been used to make a smug political statement about the evils of America's foreign policy.
You sure he's not posting from there?
BTW, Bill if you're listening, thank you sooo much for allowing any source to install browser helper objects by default. I mean how could it go wrong, right guys? CWS variants pretty much destroyed my parents' PC's usability/trustworthiness.
-- I'm not a pessimist, I'm a realist. It's not my fault that life sucks so much. --
URL which looks like "https://www.paypal.com" but really has a letter replaced with a non-English Unicode character which looks the same
In what way? To my knowledge, there is only one way to encode the latin letters in UTF-8. They don't have any redundant code positions in Unicode, do they?
Or do you mean, almost the same? Like, https://www.päýpâ1.com/?
Same people who feed Linux to their cats and use KDE and GNOME.
There are websites that use IDN characters... IN JAPAN!
Singularity: a belief in the "God" idea with the "demiurge" relation inverted.
From your home directory, enter the .mozilla/firefox/*.default folder; then with vim open compreg.dat, and search for the string: "idn-service;1" (use the / function). Change the 1 to 0 in both the strings you find. Now, restart Firefox.
The url will still appear spoofed at the bottom-left corner of the browser, but if you click on the proof-of-concept link it won't work.
Who modded this +4 informative? It doesn't work!
Tested the parent's suggestion with Mozilla 1.7.5 on Linux and Firefox 1.0 on Windows, the exploit still works on both platforms.
0 1 - just my two bits
A very simple solution is to require that domain names be written in one set of characters, rather than a combination. This way, normal english characters mixed with cryllic, for example, would be disallowed.
It's like curing calluses by chopping the legs off. It's about time that someone with a brain came in and fixed this phishing problem once and forever. Disabling international domains is not a solution. Remember, majority of the population of this planet doesn't speak English. Why should they NOT use their native alphabet?
This is the approach they take. I have tried to warn them in several different bugs that if they start trying to protect the user from themselves, they are going to soon be shipping a crippled product. No one listens. Now Firefox appends file extensions to downloads that already have an extension, they have disabled international domains, what next? Someone call me when the fools in charge get fired.
.. both of which have miniscule market shares. They have no experience doing what people want.
Can we blame them though? Most of the team are from Unix and Mac
Wouldn't rendering the characters in question as black-on-red in the status and location bar be a more effective solution? Or the entire background changes to red to warn the user that the characters they can read aren't the "actual" characters in the domain name?
Pink, not red, to help the color-blind. But still, how would a pink background help people living in Eastern Europe distinguish a legit mixed-Latin-and-Cyrillic IDN from a phishing mixed-Latin-and-Cyrillic IDN? Take Yandex.ru for instance; an IDN alias for the domain would probably use the Cyrillic letter Ya (which resembles a reversed Latin R) and Latin letters N, D, E, and X.
Slashdot is now run by a cat fed with Linux who runs python using wind power. Get with it dude.
Think about it: the aim of the IDN is so that the native readers of a non-ASCII language can use domains which make sense to them. If ASCII doesn't make sense, then what about the ".com"?
This whole IDN thing was designed improperly. I can't imagine why the designers didn't bother to take a look at the myriad character sets floating around out there. Just a cursory glance at the Unicode book would have given them second thoughts.
It will make coding very hard in most situations and impossible in others. Now we'll have to have delimiters everytime we mention a domain name or a URL and the computer has to recognize it. There are protocols and applications which do not use delimiters for domain names, and they won't work because of this. And do we really need spaces in domain names? Aren't hyphens enough?
If they can't type their domain name in regular old English letters, what are the odds that they'll have any good content on their site for this English reader?
Phones around the world have 0-9* and #... why must DNS addressing be Balkanized?
tone
Here we have an apparent tradeoff between generality and security, manifested as a phishing exploit. Support for international character sets seems innocent enough it itself, but it turns out to have some potential to mislead the human observer.
However, precisely the same security problem exists even without reference to international character sets. In plain ASCII, the characters "0" and "O" are nearly homologous, as are "1" and "I".
In general, phishing attacks exploit any kind of substitution which can at least temporarily deceive a human observer. A plausible, but deceptive, domain name would do just as well.
It's not clear, therefore, that an effective security solution to phishing can ever be automated. Instead, it will have to create more favorable conditions for human perception.
Parity: What to do when the weekend comes.
They don't, but they do have multiple code points that are commonly rendered to the same glyph (yet have different collation behavior, etc.) In these example exploits, the Cyrillic "o" (о = о = U+043E [*]) is used in place of the Latin "o". It looks identical, but it's a different domain.
[*] - It's in this Unicode code chart.
I really don't want to scare you, but right now - when you were posting this as an Anonymous Coward - your computer was broadcasting an IP address! They know who you are.
If your comment title says 'Re: Foo', I'm not likely to read it.
This is just an alternate title to "Gaping security hole discovered in Firefox, experts say switch to IE"
Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
I must admit that's the first time I've ever seen that phrase used, and actually thought it was somewhat funny, instead of just wanting to punch the person who came up with it.
It's used to send me money, of course.
Thanks,
Qal
paintball
I have the network.enableIDN key set to "false" in both FireFox 1.0 and Mozilla 1.7.5. Guess what? It still lets the exploit occur! BEWARE!
Test your browser here:
http://www.shmoo.com/idn/
or here:
http://secunia.com/advisories/14163/
-- Game Developers: Stop porting badly-textured games from crappy console systems!
Only replying to this because of your sig. I don't know how to send a private message.
0 4/ firefly-coming-to-big-screen/
Firefly rocks.
http://www.mshiltonj.com/blog/archives/2004/03/
I've bought the DVD set and loaned it out to a number of friends, most of which (literally, all but a couple) have went out and bought their own set.
Many people in my circle are now waiting on the movie. And the fact they most have bought their own sets creates a big multiplier affect.
Posting AC but my username is mshiltonj
To everyone else, sorry for the off topic thread.
When a user browses a bookmarked or frequently visited domain a 'star' (or some other simple symbol) appears at the end of the URL (or next to where the SSL Padlock icon appears in the browser). The user could now easily identify that they are indeed browsing on one of their favoured websites. The browser itself is able to know this because it can grab a list of domains from the users bookmarks and look in the users history to see frequently accessed domains, for example sites accessed on more that 10 separate occasions (this figure could be set to something more suitable, it is just an initial guess at a good figure).
If you are a Paypal user for example you are likely to have Paypal bookmarked or at the very least you will probably visit it regularly. If some website or email links to a fake Paypal then when the site loads the star will be missing from the address bar field since it will be the first time you have used this fake site. Hence it is easy for the user to see something is wrong. Hopefully users would get used to the idea that their favourite sites always display a star in the address bar, so this would start to become obvious.
Maybe it would require educating the users about what the star is and why it appears there but this had to be done when the SSL padlock was first added to the browser. I reckon people would pick this up in no time.
I have suggested this on the Opera forums (I'm an Opera user). I may also suggest it on some of the Mozilla forums. Even if Firefox/Mozilla did not make it default perhaps someone could create a plugin (which is currently beyond me).
I have had some criticisms of the idea. For example someone pointed out that the first time you visit a new safe website no star would be present. Also, not all people use bookmarks extensively. My response has generally been along these lines:
When you first visit a site you don't know if you can trust the site anyway. I'm usually cautious of new sites the first few times. I am that little bit more nervous about giving them personal data or credit card information hence I check the site out more carefully. I bet most people are the same. Furthermore after you have come back and used that site a few times and hence presumably are happy with it, it would move to one of your most frequently visited sites (or you might even bookmark it). After this point a star would display.
Regarding bookmarks, it is true that many people don't use bookmarks and in the age of Google you might even say why bother but many people do and if people knew that by bookmarking a site they could later verify it was the same site they had been to previously they may be willing to start bookmarking again, even if only for financial sites. Instead of bookmarking (or even in addition to bookmarking) you might also have the option of clicking on a button to say, "remember this as a known domain name", form that point on it would also show a star.
Another thought was that "you'd have to be careful as to what you count as hits to prevent sites from tricking the user into a couple of hits to their website, or some javascript to loop pages". I'm thinking of sites being automatically added only after a user has visited them on 10 separate days.
It does not solve all issues but it makes it a damn sight easier to pick out when you are on a fake version of one of your favourite sites, which is the main issue as far as I can tell. Also, it requires little user effort (worst case, you do the one time action of bookmarking the sites you are worried might be spoofed).
Finally an extra advantage of this method is that it helps prevent other types of spoofing, for example when fraudsters substitute ASCII characters (e.g. '0' for 'o').
Anyway if you think it is a good idea feel free to spread it around as a suggestion to anyone who you think might be influential in development of any of the popular browsers. Or anyone good at writing plugins!
Agreed. And the best way for that to happen is stopping most of the evil in America's foreign policy.
If I want to visit a website in the UK (that has a .uk domain) and this feature is turned off, will FF not go there?
I mod down so you can mod up. Your welcome.
Anti-slash is in no way responsible for this glorious event. In addition to your web site being down for weeks, your organization has been totally ineffective and irrelevant, and I'd be surprised if there were more than one or two of you who actually were active in Anti-slash.
I realize that you *tried* to expose editor injustices, but your months-old, hastily written, totally incomplete little list of Michael's offenses, along with whatever goatse'ing or other juvenile shit you might have done, was of no use. Instead, it was my repeated assault of detailed, informative anti-michael first-posts that likely made the difference.
In response to the comments about delineation of URLs, you do have a point. While I think it would be possible to create a decent way to aprse out whether something's a URL, it would require a bit of effort and older software would have trouble.
I could probably post this anonymously and cowardly, but I'll keep my name on it. *shrug* What use is only expressing your opinion when you think it's safe to do so?
This sig has absolutely no significance and serves only to take up screen space and waste the time of the reader.
I forgot to mention that falling for such a ridiculous, idiotic troll further illustrates how inept anti-slash has become.
Hell, I'll settle for articles that are spell-checked and fact-checked. It's related, you know ... nothing brings in the trolls like lack of professionalism.
It isn't IDN that's broken, it's users who don't read carefully before clicking a button.
Karma: It's all a bunch of tree-huggin' hippy crap!
> In what way? To my knowledge, there is only one way to encode the latin letters in UTF-8. They don't have any redundant code positions in Unicode, do they?
They have many, but they're not redundant, they're the same letterform in different alphabets. There's several homographs for the letter "A" alone, and we're not talking almost, we're talking looking exactly the same. I believe the shmoo example uses a homograph for a lowercase "p".
Why bother with these savages speaking funny
languages! Next step is disable support for any
non-ASCII characters in browser.
When even the Slashdot headline writers don't understand the difference between a Unicode (internationalized) domain name and an international domain name, how can we expect ordinary users to make sense of this?
Actually, it would help the users of other languages if the language abbreviation of the codepage used was displayed.
For example, if someone uses the Russian language to render www.paypal.com, not only should the color change (if the user wants it), but it should display an icon to the left of the site's icon with the letters RU. So, if the letters US appears to the right of the paypal icon with the address http://www.paypal.com/ then you would know it is the right place. But if you see RU with the paypal icon and http://www.paypal.com/ then you know you are in the wrong place.
This would allow it so that if you DO want to go to another language version, the codepage icon with the letters will help you identify that you are going to the correct language version of the URL. This also helps complement against color spoofing if you do want to use the color method. Some people are color-blind.
when firefox is connected to an encrypted site, the url bar is highlighted yellow.
Perhaps characters or URLs that contain unicode characters could be highlighted red? or blue, or whatever.
I'll assume that was a joke.
"Firefox to Disable IDN Support as Phishing Defense"
Comment removed based on user account deletion
One is the problem of spoofing browser users. And this could be done as easy as someone else pointed out: using "www.payqal.com" instead of "www.paypal.com". Etc.
The other is connected to the fact that two different characters in different languages character sets uses the same glyph. (A glyph is the visual form of a character.) And this is not necessarely a problem isolated to internet usage. (Although it's more difficult to use it for deceiveful purposes utside of internet.)
The solution of the former is some combination of browser standards that make it clear for all but the most dumb users where they are going and some international regulations that e g protects sensitive sites like banking (paypal.com) to be used by/connected to/directed to other sites (like paqpal.com).
The solution of the latter is probably an international standardization of the characters glyphs. That is: a specific glyph should be clearly distinguished from other glyphs and be represented by only one character.
(The eventual problem with sort orders etc. should be solved by depending on the actual usage/situation.)
Mundus Vult Decipi
What about glyphs that are nearly the same (as in one or two pixels out)? I think a better solution is to highlight the address red (with a clickable warning icon next to it - similar to how firefox handles ssl) if there are characters that aren't in the current locale.
When the plug is the problem, there is not a lot of choice but to either pull it or live with it. You can't have internationalized domain names without some different characters (e.g. the Latin and Cyrillic lowercase "a") looking identical.
I personally would like to have "my.co.ck" which leads to wonderful sub-domains like "lick.my.co.ck", "suck.my.co.ck", "look-at.my.co.ck", "do-you-like.my.co.ck" etc.
Of course, then whoever gets "your.co.ck" can set up quite a nice rivalry.
Surprisingly, "hard", and "stiff" are still open, so I guess the Cook Islands don't have any companies on the net selling viagra. "large", "small", "big", "little" etc are also still open, which means the p3ni5 3nl4rg3m3n7 companies haven't gotten there yet either...
Just out of serious, off-topic curiosity, does anyone know what kind of guidelines need to be followed to get a .co.ck domain?
;p
"Empathise with stupidity, and you're halfway to thinking like an idiot." - Iain M. Banks
The solution to this whole mess is so simple! Just use numeric addresses!
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Ummm...
I assumed it wasn't.
(New Zealander, and I don't feel like getting flamed by half of the American slashdotters)
perhaps change the colour of the bar its in, like it does for https to a red or something ?
Or you could put the relevent characters in red and bold with a caution icon next to the url?
theres no way of making it foolproof that i can see, only to make it harder to do convincingly
so i went and changed the enableIDN entry to false. then i saw the "network.dns.ipv4OnlyDomains = .doubleclick.net" entry. does this mean that i'm actually using doubleclick's DNS servers instead of my own, thus letting doubleclick know where i go everytime i use firefox? i thought firefox was a "good" thing...
no sig = no personality(?)
American? Hmm. Lead Developer was in my class in Auckland, New Zealand.
dominionrd.blogspot.com - Restaurants on
Anyone know what (Chinese deleted, won't show up - please see http://notabilis.org/arti/Technology_and_its_Merit s.html) means? I mean other than the meaning of its punycode representation?
I don't know anything about the Adblock Firefox extension, but if it blocks all domains whose name matches the filter (containing any ascii characters between 0x20 and 0xFF) it would be a BAD idea.
Especially since the ascii characters for normal addresses don't start until 0x41 or so.
This looks like it would block access to ANY websites.
But then again I could be wrong...
Does this mean del.icio.us won't work, or is US not considered international?
(1) In Win2K, shut down Firefox.
. dat
in your favorite ascii editor.
n - service;1 ..." to become ..."
(2) Open \Documents and Settings\YOURUSERNAME\Application Data\Mozilla\Firefox\Profiles\default.XXX\compreg
(3) Search for 'idn' in Note/Wordpad. Comment out with a '#' the line that says
"{NUMBERSLETTERSDASHES},@mozilla.org/network/id
"#{NUMBERSLETTERSDASHES},
(4) Don't worry. Browse happy.
I've been a long-time web user, can speak French and German, have done a lot of trawling German sites for information, yet had no idea that anything other than ASCII was available for URLs. I think it's a good solution for most English speakers, especially monolingual English speakers until something better can be worked out.
I’m old enough to remember 16K of memory being described as “whopping”
I know that this isn't necessarily trivial to accomplish due to redirects and the like but it might be worthwhile considering.
I don't want knowledge. I want certainty. - Law, David Bowie
This doesn't seem to be the first time that there is no version number change for Firefox, yet there appears to be different versions with differences, identified as v1.0. What gives? Is there a way of upgrading? Or do you just re-install the lastest (same) version?
I thought Ffox was supposed to fight _AGAINST_ proprietarization. Seriously, if someone is smart enough to get Ffox, they are smart enough to see that they are viewing a page on an international TLD. But then again, they are probably smart enough to disable this *feature* as well. Hmm...
I can't let you do that Qal
Sucks that you can't add an anonymous coward to your 'friend' list...
Bravo!
You know, what with this one and my other gag catching so many mod points, I almost wish I hadn't been a chicken-shit AC today.
Maybe the plugin could be modified just to send up an alert only if individual words (serarated by full-stops) were comprised of mixed character sets. This way, most world addresses could be used normally, and the range of spoofable addresses reduced considerably, that is, paypal.com couldn't be spoofed, but ABC.com could (with Cyrillic ABC).
...shouldn't domain names usually contain names from ONE character set, meaning one "set" from unicode?
I mean, say japanese have a letter that looks quite similar to l. Now a japanese company %#%l.com (to us) wouldn't be a problem. And an ASCII version like toshiba.com shouldn't be a problem. The problem only exists if you can mix and match freely from any number of subsets.
There are a few cases that this wouldn't fix 100%, like paypäl.com... but there'd be no subset with two identical letters, wouldn't make any sense. So you would have most of the protection intact, and the few latin-1 cases like ö ä ñ è etc. would be "known" quite quickly.
Kjella
Live today, because you never know what tomorrow brings
I know this may look like a strange jump, bear with me ;-)
;-).
(1) the IDN "bug" isn't actually a bug - it's an abuse of multilingual facilities although I'd have to ask why a new character ID should be used for something that looks identical to something in English. But I digress.
(2) that IE isn't sensitve to the problem is bacsue it's behind in standards compliance. Not an unusual situation for MS when it comes to standards that aren't theirs, it just sits lower on their priority list. Now pay attention because this where it gets interesting.
(3) given that support for IDN at MS is still in its infancy, doesn't that imply that Windows code in general is a bit ignorant about the non-English world "out there"? Or, read in a different way, that MS code is actually incapable of rendering some international URLs correctly?
In summary - if MS can't really handle other languages it implies their search engine is unlikely to act differently - it implies the search engine wouldn't even be able to handle or present URLs in other charactersets, and presto, that part of the wordl doesn't exist according to MS.
Just an idea - tell me where I've gone wrong
= Ch =
Insert
I really do not like the Mozilla's policy to disable whatever they can disable... I'm web developer and sometimes I regret that I have choosen the Gecko technology for our project. Instead of solving security issues Mozilla disables things like int. domain names support or drag and drop for remote application or you cannot even refresh or reload your own remote RDF resources because you do not have rights... Today I found that I do not have right to read properties on javascript textbox elements in events under certain circumstances... It is clear how they get the "hight security level" they repeat over and over in media: Threre is no security risk where are no features to secure. Is it risky? Disable it! Are you unsure about potenticial risk? Disable it to be sure!
On the other hand I everyday try to say to myself - do not give up - there is always some workaround and the technology is really great! And believe me - it IS GREAT. But mozilla seems to be too young... I'm really glad that things are moving so fast...
elixon
Well, I've got to get back to work. When I stop rowing, the slave ship just goes in circles.
1. Mixed scripts can be legit.
2. Therefore, turning IDL/mixed scripts completely is bad.
3. So, let's just show an icon indicating a mixed script/IDL use/whatever.
Point 1. gives a clue why the "solution" won't work. It won't prevent spoofing a legit domain name that is mix-scripted. The user would have to notice that the accent over 'e' is tilted the wrong way or something equally hard to spot.
This "solution" actually makes matters worse by giving false sense of security, just like any half-baked security measure.
Everybody knew those were fundamentally a bad idea in the first place.
.uk, and so forth), but this is talking about
I read "international domain names" and was thinking of anything in the
two-character-tld space (.us,
*unicode* domain names, which is a whole nother animal.
Cut that out, or I will ship you to Norilsk in a box.
flamebait? what fucking retard modded that? that's a statistic. an actual one. and that guy is a dumb piece of shit. that's a fact. whoever modded this, do you know what flamebait means? you dumb fat ugly loser fuck. bite me.