UTF-8 characters that behave oddly when the case is changed | Hacker News Reader

UTF-8 characters that behave oddly when the case is changed

gist.github.com

72 pointsRendello63 comments

I generated this list from a Python script I wrote a few months back for use in property tests in a Rust codebase. Its meant to break parsers that make bad assumptions about UTF-8, like assuming that upper- or lowercasing a character will always result in the character encoding having the same size in bytes, or even that it will result in one character.

The "ﬀ" ligature, for example, is uppercased by Python as "FF", meaning it both becomes two separate characters, and is one byte smaller overall. I hope it's interesting.

Thanks for the insight. I had never considered this even though i researched quite some oddities in UTF-8 parsing myself over the years. It's the gift that keeps on giving when it comes to ways to breaking things in software, i find. Time to go over my code again.

The implication of this is that there are also "roundtrip-unsafe" characters, i.e. flip_case(flip_case(x)) != x, right?

Not sure I wanted to know...

> Not sure I wanted to know...

Oh that's Unicode for you. It's not that they're "roundtrip unsafe", it's just that Unicode is a total and complete clusterfuck.

Bruce Schneier in 2000 on Unicode security risks:

https://www.schneier.com/crypto-gram/archives/2000/0715.html...

Of course the attacks he envisioned materialized, like homoglyph attacks using internationalized domain names.

My favorite line from Schneier: "Unicode is just too complex to ever be secure".

And, no matter if you love Unicode or not, there's lots of wisdom in there.

When design-by-committee gives birth to something way too complex, insecurity is never far behind.

> it's just that Unicode is a total and complete clusterfuck

[...]

> When design-by-committee gives birth to something way too complex, insecurity is never far behind.

Human writing is (and has historically been) a "clusterfuck". Any system that's designed to encode every single known human writing system is bound to be way too complex.

I almost always side with blaming systems that are too complex or insecure by design as opposed to blaming the users (the canonical example being C++), but in the case of Unicode there's no way to make a simpler system; we'll keep having problems until people stop treating Unicode text as something that works more or less like English or Western European text.

In other words: if your code is doing input validation over an untrusted Unicode string in the year of our Lord 2024, no one is to blame but yourself.

(That's not to say the Unicode committee didn't make some blunders along the way -- for instance the Han unification was heavily criticized -- but those have nothing to do with the problems described by Schneier).

Unicode is worse than design-by-committee. It's a design-by-committee attempt to represent several hundred design-by-culture systems in one unified whole. Desgin-by-culture is even messier than design-by-committee, since everyone in the culture contributes to the design and there's never a formal specification, you just have to observe how something is used!

How could you ever make it simple given that the problem domain itself is complex as fuck? Should we all just have stuck with code pages and proprietary character encodings? Or just have people unable to use their own languages? Or even to spell their own names? It’s easy for a culturally blind English speaker to complain that text should be simple, must be due to design by committee that it isn’t!

Could you try an argument that unicode is insecure compared to roll-your-own support for the necessary scripts? You may consider "necessary" to mean "the ones used in countries where at least two of Microsoft, Apple and Sun sold localised OSes".

If you tried to come up with a “lightweight” Unicode alternative it would almost certainly evolve right back into the clusterfuck that Unicode is. In fact the odds would mean it would probably be even worse.

Unicode is complex because capturing all the worlds writing systems into a single system is categorically complex. Because human meatspace language is complex.

And even then if you decided to “rewrite the worlds language systems themselves” to conform to a simpler system it too would eventually evolve right back into the clusterfuck that is the worlds languages.

It’s inescapable. You cannot possibly corral however many billion people live on this planet into something less complex. Humans are too complex and the ideas and emotions they need to express are too complex.

The fact that Unicode does as good of a job as it does and has stuck around for so long is a pretty big testament to how well designed and versatile it is! What came before it was at least an order of magnitude worse and whatever replaces it will have to be several orders of magnitude better.

Whatever drives a Unicode replacement would have to demonstrate a huge upset to how we do things… like having to communicate with intelligent life on other planets or something and even then they probably have just as big of a cluster fuck as Unicode to represent whatever their writing system is. And even then Unicode might be able to support it!

A standard example here is the Turkish dotless I, which yields "ı" → "I" → "i" with most case-conversion libraries.

It feels like unifying it with the ASCII i is the mistake here. There should have just been 4 turkish characters in 2 pairs, rather than trying to reuse I/i

It's not like we insist Α (Greek) is the same as A (Latin) or А (Cyrillic) just because they're visually identical.

But even with separate characters, you aren't safe because the ASCII "unification" isn't just Unicode's fault to begin with, in some cases it is historic/cultural in its own ways: German ß has distinct upper and lower case forms, but also has a complicated history of sometimes, depending on locale, the upper case form is "SS" rather than the upper-case form of ß. In many of those same locales the lower-case form of "SS" is "ss", not ß. It doesn't even try to round-trip, and that's sort of intentional/cultural.

Uppercase ẞ exists since 2017, so before that using SS as a replacement was the correct way of doing things. That is relatively recent wh3n it comes tonthat kind of change

When do you think that first mistake happened?

(Pick a year, then think about why it didn't happen in that year.)

When Unicode was being specced out originally I guess. There was more interest in unifying characters at that stage (see also the far more controversial Han unification)

Uh-huh. At that time roundtrip compatiblity with all widely used 8-bit encodings was a major design criterion. Roundtrip meaning that you could take an input string in e.g. iso 8859-9, convert it to unicode, convert it back, and get the same string, still usable for purposes like database lookups. Would you have argued to break database lookups at the time?

ISO-8859-9 actually does have what I suggest:

FD/49 are lower/upper dotless ı/I

DD/69 are upper/lower dotted İ/i.

There's nothing around the capability to round trip that through unicode that required 49 in ISO-8859-9 to be assigned the same unicode codepoint as 49 in ISO-8859-1 because they happen to be visually identical

There is a reason: ISO-8859-9 is an extended ASCII character set. The shared characters are not an accident, they are by definition the same characters. Most ISO character sets follow a specific template with fixed ranges for shared and custom characters. Interpreting that i as anything special would violate the spec.

In practical terms:

Back in those days, people would store a mixture of ASCII and other data in the same database, e.g. ASCII in some rows, ISO-8859-9 in others. (My bank at the time did that, some customers had all-ASCII names, some had names with ø and so on.) If unicode were only mostly compatible with the combination, it wouldn't have been safe to start migrating software that accessed databases/servers/… For example, using UTF8 for display and a database's encoding to access a DBMS would have had difficult-to-understand limitations.

You can fix all kinds of bugs if you're able to disregard compatibility with old data or old systems. But you can't. And that's why unicode is constrained by e.g. the combination of a decision made in Sweden hundreds of years ago with one made in Germany around the same time. Compatibility with both leads to nontrivial choices and complexity, incompatibility leads to the scrap heap of software.

This stems from the earlier Turkish 8-bit character sets like IBM code page 857, which Unicode was designed to be roundtrip-compatible with.

Aside from that, it‘s unlikely that authors writing both Turkish and non-Turkish words would properly switch their input method or language setting between both, so they would get mixed up in practice anyway.

There is no escape from knowing (or best-guessing) which language you are performing transformations on, or else just leave the text as-is.

The transliteration of this specific character was also involved in a violent attack and suicide:

https://languagelog.ldc.upenn.edu/nll/?p=73

Hardly fair to call it a murder-suicide. Ramazan killed Emine in self-defense.

You’re absolutely right, I misremembered the details. Thanks for the correction!

So, uh, is this actually desirable per the Turkish language? Or is it more-or-less a bug?

I'm having trouble imagining a scenario where you wouldn't want uppercase and lowercase to map 1-to-1, unless the entire concept of "uppercase" and "lowercase" means something very different in that language, in which case maybe we shouldn't be calling them by those terms at all.

My understanding is it's a bug that the case changes don't round trip correctly, in part due to questionable Unicode design that made the upper and lower case operations language dependent.

This stack overflow has more details - but apparently Turkish i and I are not their own Unicode code points which is why this ends up gnarly.

https://stackoverflow.com/questions/48067545/why-does-unicod...

Ah, I see the problem now!

In Turkish:

• Lowercase dotted I ("i") maps to uppercase dotted I ("İ")

• Lowercase dotless I ("ı") maps to uppercase dotless I ("I")

In English, uppercase dotless I ("I") maps to lowercase dotted I ("i"), because those are the only kinds we have.

Ew! So it's a conflict of language behavior. There's no "correct" way to handle this unless you know which language is currently in use!

Even if you were to start over, I'm not convinced that using different unicode point points would have been the right solution since the rest of the alphabet is the same.

Me and someone else in the thread ran into the same string searching bug with that same character:

https://news.ycombinator.com/item?id=42016936

Yeah, making a specific "Turkish lowercase dotted i" character which looks and behaves exactly like the regular i except for uppercasing feels like introducing even more unexpected situations (and also invites the next homograph attack)

I guess it's a general situation: If you have some data structure which works correctly for 99.99% of all cases, but there is one edge case that cannot be represented correctly, do you really want to throw out the whole data structure?

yup. lowercase and uppercase operations depend on language. It's rough.

In some apis this distinction shows through - e.g. javascript's Intl.Collator is a language-aware sorting interface in JS.

In practice, the best bet is usually to try to not do any casing conversions and just let the users handle uppercase vs lowercase on their own. But if you have to do case-insensitive operations, lots more questions about which normalization you should use, and if you want to match user intuition you are going to want to take the language of the text into consideration.

Indeed, the parent already gives one: flip_case(flip_case("ﬀ")) = "ff". (Since it's hard to tell with what I guess is default ligature formation, at least in my browser, the first is an 'ﬀ' ligature and the second is two 'f's.)

> flip_case(flip_case(x)) == x

Falsehoods programmers believe about strings...

I know Halloween was yesterday but let's discover this horror together with some terrifying Python[1]! Turns out, yep.

For upper → lower → upper we have:

Ω ω Ω

İ i̇ İ

K k K

Å å Å

ẞ ß SS

ϴ θ Θ

For lower → upper → lower there are a lot more.

1. https://gist.github.com/rendello/4d8266b7c52bf0e98eab2073b38...

This is really cool! Thanks a lot for the effort!

But yeah, I got the idea from GP's "ff" example, but I'm kinda shocked there are so many.

Lowercasing the symbols for Ohm, Kelvin or Ångström makes no sense.

For the Greek alphabet cases, isn't there canonical forms for this kind of stuff?

Are those first two something other than Greek Omega and ascii K?

Yes, the Ohm, Kelvin and Ångström have their codepoints in Unicode.

fuck I hate unicode they are not different symbols

Another assumption worth testing is that casing round-trips:

    >>> 'ẞ'.lower().upper()
    'SS'

I ended up playing with just that in another thread:

https://news.ycombinator.com/item?id=42020476

This doesn't include the oddest of all: sigma.

When lowercasing Σ (U+03A3 Greek capital letter sigma) it is context-sensitive (on whether it is at the end of a word) whether it becomes σ (U+03C3 Greek small letter sigma) or ς (U+03C2 Greek small letter final sigma).

That reminds me of the old 'long S'[1] that used to exist in English and survives in the symbol for integration. That worked in a ſimlar way for writing Engliſh, at the ſtart and middle of words you'd use the long s but not at the end so you end up with 'poſſeſs' for 'possess'. There were other rules around it too, I think you'd always use the usual S for a capital.

[1]https://en.wikipedia.org/wiki/Long_s

Not only in English. My local newspaper (in Trondheim, Norway) shows its name as Adresſeaviſen on the front page (in a fractur font to boot).

True! This list could more accurately be described as "Unicode codepoints that expand or contract when case is changed in UTF-8", which is exactly what I was testing in my program. I had built a parser that was relying on some assumptions that I felt was not correct, so I built some tests with this data.

For those interested, this was the generation script. I'm sure there was a way to do it better or simpler, and I wish I could just say this was a quick-and-dirty script, but in fact I spent quite a few hours on it (this is the fourth rewrite):

https://gist.github.com/rendello/b06ca3d976d26fa011897bd1603...

Σ now shows up on my Unicode round-trip horror show ;)

https://news.ycombinator.com/item?id=42020476

In one of my work projects it was the Turkish İ that gave us trouble. In some case-insensitive text searching code, we matched the lowercase query against the lowercase text, and had to handle cases like that specially to avoid reporting the wrong matching span in the original text, since the lowercase string would have a different length than the uppercase string. This was one of my first real-world projects and opened my eyes a bit to the importance of specifications and standards.

In PHP the Turkish locale caused quite some trouble. In some situations a different locale was used for compiling and for runtime while handling "case-insensiteve" identifiers, fo that sometimes names with an "I" could not be found anymore.

Can't mention the Turkish case situation without mentioning the actual murder that took place because of it: https://languagelog.ldc.upenn.edu/nll/?p=73

The murder is a tragedy, of course, but I would hesitate to blame the cellphone. There’s overreactions, and then there’s… this.

I had this exact bug with the same character:

https://github.com/rendello/layout/issues/8#issuecomment-235...

Raymond Chen's "Old New Thing" blog just commented on a similar issue: What has case distinction but is neither uppercase nor lowercase?

https://devblogs.microsoft.com/oldnewthing/20241031-00/?p=11...

This isn't "odd" behavior. It's a consequence of using a multibyte encoding scheme. Also, when dealing with case mapping, you can't assume that the character count will remain constant. This is because in Unicode full case mappings can map a character to multiple characters, meaning you might end up with more characters than you started with, regardless of the encoding used.

That's exactly right. My comment here is related:

https://news.ycombinator.com/item?id=42018937

It's not UTF-8 characters but Unicode.

If you look at the list, it’s primarily (but not completely) about oddities in their UTF-8 encoding. Most of them appear to be on the boundary of adding additional bytes when the case is changed. That’s not really Unicode’s concern.

There are also some that appear to change from single characters to grapheme clusters, which would be a Unicode quirk.

The byte-changes listed are for the UTF-8 encoding though, so it's about UTF-8 in that sense

It's both.

UTF-8 is simply an encoding; "UTF-8 characters" is just not correct use of language. Just like, say, "binary number"; a number has the same value regardless of the base you use to write it, and the base is a scheme for representing it, not a system for defining what a number is. This is a common imprecision in language which I have seen cause serious difficulties in learning concepts properly.

"unicode codepoint sequences whose codepoint lengths and/or utf8-code-unit-lengths behave oddly when you change their case" would not fit in a HN title, however

I (OP) said above that "Unicode codepoints that expand or contract when case is changed in UTF-8" would have worked fine, I've changed the Gist title to that in any case. I'm curious if it would've affected the attention it received on HN.

In another comment I said that a more accurate title would have been "Unicode codepoints that expand or contract when case is changed in UTF-8", which I think covers it well.

The canonical source data for this is https://www.unicode.org/Public/16.0.0/ucd/CaseFolding.txt, by the way.

I wrote another comment relating to case folding: https://news.ycombinator.com/item?id=41784627

Reply on news.ycombinator.com