Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I find this submission of this article interesting because it underscores inconsistent handling of I18N/punycode domains. The domain is "thiébaud.fr". Should submission sites (like HN) show the sites in ASCII? Is there a fraud risk? Should the web browser show the domain in ASCII?

For me - at no point was I shown the domain decoded to ASCII (either on HN or in the browser). I recognized the pattern and decoded it manually. For users who are not technical - this is a failed experience because the domain looks suspicious and at no point was it decoded.

I wonder when punycode decoding will begin to get attention from developers. Last year's Google IO had a great talk about how Google realized the inconsistency of their domain handling with regard to I18N:

https://www.google.com/events/io/schedule/session/22ce27dc-7...



It's a vector for putting in disruptive utf-8 characters, such as a huge stack of accents, or spoofing a reputable domain. It's not clear yet that the benefits to HN outweigh the risks. But if we start seeing a lot of quality content from domains that look better with punycode decoded, it'll be considered.


I'm on firefox, and it showed me the decoded domain.


Also on FF, 37.0.2 Linux x64 build, and I see `xn--thibaud-dya.fr` on HN but `thiébaud.fr` in the status/address bars.


38.0.1 Linux x64


It's actually quite different how all the browsers handle the Punycode domains in different places: http://blog.dubbelboer.com/2015/05/10/unicode-domain-support...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: