20 points robin_reala 4 hours ago 1 comments
TacticalCoder 3 minutes ago | parent
Bruce Schneier wrote about it more than two decades ago:
"Unicode is too complex to ever be secure".
Systems created by people who have zero understanding of security and who cannot realize that complex systems cannot possibly ever be secure is already bad.
But to then see the same people implement "security mechanisms" for the mess they created for in the first place is just sad.
FWIW I love Unicode, where it belongs: in translation / properties files.
I've got hooks verifying that all source code files are ASCII-only.
I've got rules for my LLMs to only ever emit ASCII in source code.
I've got firewall rules blocking any domain using punnycode (aka Unicode domain names). A bit tricky to do that one.
I've got my editor configured so that any single non-visible ASCII char (except space and enter) and every single Unicode character appears in bold fluo magenta on a dark background. All zero-width chars are forced to have a width.
I wonder how people who disagree with those who believe that Unicode is too complex to ever be secure reconcile with the fact that we have something titled:
"Unicode® Technical Standard #39 Unicode Security Mechanisms"
The question is: how the heck did we end up here?
What mindset led to this clusterfuck?
Who, in his right mind, decided that it was a good thing to have Unicode chars in URLs? Certainly not security experts.
The homoglyph attacks were predicted by Bruce Schneier (and others) decades ago. Countless people got tricked and lost their live savings because URLs allow an 'a' to not be an 'a'. It's sad.
And it's of course not the only attack using Unicode: there are plenty.
It's really just all a sad joke and many of us saw it coming from day one.