What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

Alright, we've all been having fun with the Unicode mirror character here on meta.

And now we all know how to do it.

Yes, I'm a culprit here as well, and I accept that.

But I just realized that it can be used to spoof usernames (at a glance, that comment looks like it came from our mod)

Please can it be stripped from comments? (keep it on MSO if you wish, the link styles are different so it doesn't work)

Unicode info page

Note that it can also be used to spoof links in posts (see the "what can it be used for" section here)


This cannot be easily "waved away" as being caught on a per-case basis. SO has many posts which receive little or no attention, and a malicious user can easily play the Nigerian-prince trick on a newbie (Ask him for contact details/password/whatnot). Additionally, a clever username change can make it look legit even for more experienced users:

enter image description here

(No, I didn't actually change my username, I just Chrome inspector'd it ^.^)

So why not just strip it from comments? (and possibly posts)

share|improve this question
2  
Please do not remove it in meta! Please!!! –  Anish Gupta May 8 '12 at 14:36
1  
@Kobobby: Because it may not be easily detected. I could comment "I am a MODERATOR you have to award the bounty to me otherwise I'll ban you!!" on a ghost-town post(i.e., no visits from higher-reps) of a newbie. Or do more serious stuff like asking for contact details. A newbie may not notice that it's spoofed. Especially if you change your own username to "yadot" (will display as "today", will remove nearly all traces of suspicion) –  Manishearth May 8 '12 at 14:36
    
@AnishGupta: MSO can keep it, since the styling is different. I guess. –  Manishearth May 8 '12 at 14:37
    
This can be handled on a case-by-case basis—that's what flags are for. But I'm hardly attached enough to it that I care whether it sticks around at all. –  Cody Gray May 9 '12 at 6:35
    
@TheEstablishment: You will flag only if you notice it. And, like I said, it could be used on a newbie post with less activity easily. –  Manishearth May 9 '12 at 6:36
    
xkcd.com/1137 –  Al E. Nov 21 '12 at 16:02

2 Answers 2

up vote 12 down vote accepted

I'm against filtering this. Not because that it can be abused, but because it's unnecessary and an unnecessary additional technical restraint. The team stated in the past that filtering out Unicode is a little bit...well, not exactly worth the hassle. I think this is not different.

I can also impersonate Moderators and Developers by changing my Username and Gravatar to match that of the desired user. And contrary to that, I think that LTR thingy is a poor mans solution and not really worth to think about.

May I suggest a different approach instead: We keep the policy that this is only a nice joke on Meta, tell everyone who does it on the main sites to stop doing that or face consequences...and everyone who impersonates Moderators or Developers get a free nuke along with their say-hello-to-my-friend-permaban greeting card.

share|improve this answer
4  
See comment above: meta.stackexchange.com/questions/131818/… . It's not necessary that someone may notice it. And remember, you can change your username but it won't have a diamond. –  Manishearth May 8 '12 at 14:39
2  
One point in favor of banning this character is the ability to append a diamond to your user name. Also: Your answer is wrong. Please delete it.‮‮♦sinneD –  Dennis May 8 '12 at 15:01
    
@Dennis: You could have at least linked it against your profile so that it looks less out of place. ;) On the other side...links won't get the username-style...mhh... –  Time Traveling Bobby May 8 '12 at 15:02
5  
@den - Heh - looks like a deleted mod account :P –  Lix May 8 '12 at 15:05
    
@Kobobby: I agree that it's easy to distinguish spoofed comments from real ones. But comments aren't easily controlled (new comments don't bump questions), and people fall for worse scams. I don't think filtering this character should be top priority, but it seems easy enough to implement. –  Dennis May 8 '12 at 15:08
1  
@Dennis: Exactly my point. Also: I'm your Nigerian benefactor, gimme your SSN. –  Manishearth May 8 '12 at 15:17
2  
@Manishearth: Joke's on you. We don't have any kind of social security here. –  Dennis May 8 '12 at 15:18
    
@Dennis (2up) not exactly that easy if you change your username to something like "today" –  Manishearth May 8 '12 at 15:29
1  
Except that the joke is still on us when it comes to the permaban greeting card. :-( –  Cody Gray May 8 '12 at 23:55
    
@Dennis With our luck, anti-social security is the norm here. –  hexafraction Aug 20 '12 at 14:18

In the long run you'll probably be able to use the html5 <bdi> tag or the unicode-bidi css property to wrap the comment, preventing it from spilling over. But I don't think browser support is available yet.

The requirements on handling the bdi element for the bidirectional algorithm may be implemented indirectly through the style layer. For example, an HTML+CSS user agent could implement these requirements by implementing the CSS 'unicode-bidi' property. [CSS]

This element is especially useful when embedding user-generated content with an unknown directionality.

In this example, usernames are shown along with the number of posts that the user has submitted. If the bdi element were not used, the username of the Arabic user would end up confusing the text (the bidirectional algorithm would put the colon and the number "3" next to the word "User" rather than next to the word "posts").

<ul>
 <li>User <bdi>jcranmer</bdi>: 12 posts.
 <li>User <bdi>hober</bdi>: 5 posts.
 <li>User <bdi>إيان</bdi>: 3 posts.
</ul>

(Quoted from the html5 spec)

See also: w3.org - CSS vs. markup for bidi support

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .