3

I discovered it by accident here.

I guess I'm not the only one who fixed non-breakable unicode space U+00A0 to something like Alt+Space. So it's pretty easy to circumvent your prevention without even really trying. After all, non-breakable space simply makes sense there.

I think the solution is to:

  1. Only test at the end of the title (only white characters and small misleading ones after [on hold] should allow the test to return positive and block posting) - this will allow discussions on meta to have it spelled properly (see linked question).

  2. Forbid all and every white characters and 0-width characters between [on and hold] - this would be a real fix.

Improve this question
8
  • Why would someone want to put "on hold" in the title maliciously? Is there a point in preventing this?
    – interjay
    Dec 3, 2013 at 9:53
  • @interjay if there is a lock against it in place, it strongly suggest to me that devs here believed there is a reason, even if we can't guess it. I don't want to discuss the need of this lock, feel free to ask that separately. I just think now it's buggy so I'm reporting it, that's all.
    – Mołot
    Dec 3, 2013 at 9:54
  • Well, there's a difference between simple prevention (as they have currently) that was probably implemented in a minute, and wasting a lot of time thinking about every possible way it can be circumvented (e.g. someone can write [on hoId]).
    – interjay
    Dec 3, 2013 at 9:59
  • 1
    @interjay with the current font I can see the difference between I and l in title. But that's not the point. The point is that I was able to write it without even thinking what I'm doing, using the character that is simply most correct typographically in that place. And in regular expressions there is short notation for all whitespace characters, that could be used to prevent this without wasting a lot of time - it's well known to anyone who uses them regularly. Depending on regex implementation it may be as simple as writing \s.
    – Mołot
    Dec 3, 2013 at 10:05
  • Jeff's on record as not caring about people playing Unicode tricks, so long as it isn't done to abusive excess... I would dig out a link but it was just a comment on meta I think.
    – AakashM
    Dec 3, 2013 at 10:07
  • 1
    @AakashM it's not a trick if all it takes is to use correct character, is it? But if it'll get "won't fix" or "works as designed" tag, I'll accept it.
    – Mołot
    Dec 3, 2013 at 10:07
  • 1
    trying hard to abstain of casting close vote and triggering closure, just to see how title would look like when it is really closed...
    – gnat
    Dec 3, 2013 at 10:17
  • @gnat thank you for not doing it. I just felt I need to illustrate my point, no sinister intentions (this time ;) ).
    – Mołot
    Dec 3, 2013 at 10:43

1 Answer 1

Reset to default
7

Ummm okay, so please don't do that?

We can't prevent every malicious case, nor do we care to. Just like users mis-spell profanity to get around a language filter there will always be a slightly different way to post content to get around any filters. For the few that try ridiculous stuff there are other mechanisms to stop that behavior. We have a few immediate choices for these situations:

  • Spend a lot of dev time trying to think and counter every possible case
  • Spend 5 seconds banning repeat offenders

Option #2, if we ever even have to do it, is a much better use of resources. This hasn't been an issue as far as I'm aware, so yes it's something you can do, but it's not really a problem.

Improve this answer
7
  • 5
    How can you decline a bug? Doesn't it simply status-bydesign then? :)
    – Shadow Wizard Love Zelda
    Dec 3, 2013 at 12:03
  • Well, my point was not every case, just the case that may happen pretty much unknowingly. I still don't see how writing \s instead of space in regex is a lot of dev time, but I can accept you will not change that. Just... as @ShaWizDowArd says, why declined? wont fix or by design would make sense.
    – Mołot
    Dec 3, 2013 at 12:06
  • @Mołot non-breakable space added unknowingly? That's highly unlikely. Nick's point (with which I agree) is that those who do this will find other way to bypass the filter. And proper way is to deal with them one by one, by editing out the improper text and if it's repeating too much inform a moderator who can officially warn them.
    – Shadow Wizard Love Zelda
    Dec 3, 2013 at 12:10
  • 1
    @ShaWizDowArd Not added unknowingly. When I discovered it, I pressed alt+space knowingly. On the reflex. I used to have it to paste   back in ISO-8859-2 times, and now it pastes UTF character for it. I just do it on reflex where it is a proper character to use. I simply didn't know or expect it will work. As you can see, it was a dare.
    – Mołot
    Dec 3, 2013 at 12:17
  • @Mołot ALT+SPACE cause ordinary space for me.
    – Shadow Wizard Love Zelda
    Dec 3, 2013 at 12:19
  • @ShaWizDowArd for most regular users. But not for those who type much and who can get rebuked for not using proper typography at work ;p Or at least not in the company I learned to set this up. But maybe it's really so uncommon? I wanted to clear what I had in mind, not dispute "bydesigness" of this issue here.
    – Mołot
    Dec 3, 2013 at 12:47
  • 1
    @Mołot fair enough. Unless you see it happening a lot think we can put it behind us.
    – Shadow Wizard Love Zelda
    Dec 3, 2013 at 12:50

Not the answer you're looking for? Browse other questions tagged .