http://giorgiosironi.blogspot.com/2010/08/google-never-remov...
I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index.
e.g. http://www.google.com/search?sourceid=chrome&ie=UTF-8...
I'm thinking of a system that combines aspects of virus checking, malware detection, bayesian spam filtering, and spell checking.
A Unicode system can be supplied with tables of characters that could easily be mistaken (visually) for one another. These tables, combined with dictionaries, could spot words that could look like dictionary entries visually but are not spelled in the ordinary way. This approach could even spot things that have been problems for years in pure ASCII: confusion of 0 and O, of l and 1 and I, of rn and m, etc, It could also spot insertions of non-visible characters into such things as URLs and filenames.
Such a system would be able to spot .exe files that had names written in such a way that the .exe extension was not visually displayed at the end of the name. If you double-clicked such a file the first time, it could ask you if you realized that it is program you are about to run and not a ".jpg" as the name might suggest. In fact, it could ask you about any file whose real extension and apparent visual extension differed.
There will still be problems that will sneak through, just as today you can phish people with subtle misspellings that don't require anything more than ASCII.
But making this a part of the system's evolving general malware detection system, with human-created tables and heuristics borrowed from malware detectors, spam filters, and spell checkers, is the best solution, IMO.
How about the OS adopting the convention that any codes outside of a few trusted (expected) alphabets get displayed in a way that makes it obvious to a human that they aren't what they look like (eg, a bright red border or something).
How about the OS adopting the convention that any codes outside of a few trusted (expected) alphabets get displayed in a way that makes it obvious to a human that they aren't what they look like (eg, a bright red border or something).
AIUI, there are two major reasons this wasn't done in the first place, and why more complex solutions are necessary:
1. Those few trusted alphabets would probably include Greek, Cyrillic, and Latin, all of which have similar or identical characters with different Unicode code points.
2. The goal of Unicode support, localized domain names, etc. is for software to be equally easy to use for all languages, rather than to favor some languages over others.
That said, it might be advantageous to have a locale-specific approach, so that characters not used by the current language will be highlighted. But, that could be seen as hindering the ability of sites in one region to reach users in another region, doesn't work well for text that includes multiple languages, and malware writers will probably find a way to mark their characters as expected anyway.
Edit: also, the two words "get displayed" paper over a vast amount of complexity in the way operating systems and applications display text. It would probably be just as much work as any of the other solutions proposed.
Suggestions like this should get you a professional penalty, like a yellow card.
"Saw a specific problem, suggested an Are-you-sure dialog for this specific case, on top of that, one most people can't answer".
HOWEVER, what I find extremely worrying, is that the URL in the URL bar remained the same all the time, with the embedded query string site%3Anеws.ycombinator.com, and IT DIDN'T CHANGE TO ASCII when I changed the encoding of the web page. Haven't they/we learned yet, that this is a very serious security issue?