Alright, we've all been having fun with the Unicode mirror character here on meta.

And now we all know how to do it.

Yes, I'm a culprit here as well, and I accept that.

But I just realized that it can be used to spoof usernames (at a glance, that comment looks like it came from our mod)

Please can it be stripped from comments? (keep it on MSO if you wish, the link styles are different so it doesn't work)

Unicode info page

Note that it can also be used to spoof links in posts (see the "what can it be used for" section here)

This cannot be easily "waved away" as being caught on a per-case basis. SO has many posts which receive little or no attention, and a malicious user can easily play the Nigerian-prince trick on a newbie (Ask him for contact details/password/whatnot). Additionally, a clever username change can make it look legit even for more experienced users:

enter image description here

(No, I didn't actually change my username, I just Chrome inspector'd it ^.^)

So why not just strip it from comments? (and possibly posts)

  • 2
    Please do not remove it in meta! Please!!! Commented May 8, 2012 at 14:36
  • 1
    @Kobobby: Because it may not be easily detected. I could comment "I am a MODERATOR you have to award the bounty to me otherwise I'll ban you!!" on a ghost-town post(i.e., no visits from higher-reps) of a newbie. Or do more serious stuff like asking for contact details. A newbie may not notice that it's spoofed. Especially if you change your own username to "yadot" (will display as "today", will remove nearly all traces of suspicion) Commented May 8, 2012 at 14:36
  • @AnishGupta: MSO can keep it, since the styling is different. I guess. Commented May 8, 2012 at 14:37
  • This can be handled on a case-by-case basis—that's what flags are for. But I'm hardly attached enough to it that I care whether it sticks around at all. Commented May 9, 2012 at 6:35
  • @TheEstablishment: You will flag only if you notice it. And, like I said, it could be used on a newbie post with less activity easily. Commented May 9, 2012 at 6:36
  • xkcd.com/1137
    – ale
    Commented Nov 21, 2012 at 16:02

2 Answers 2


I'm against filtering this. Not because that it can be abused, but because it's unnecessary and an unnecessary additional technical restraint. The team stated in the past that filtering out Unicode is a little bit...well, not exactly worth the hassle. I think this is not different.

I can also impersonate Moderators and Developers by changing my Username and Gravatar to match that of the desired user. And contrary to that, I think that LTR thingy is a poor mans solution and not really worth to think about.

May I suggest a different approach instead: We keep the policy that this is only a nice joke on Meta, tell everyone who does it on the main sites to stop doing that or face consequences...and everyone who impersonates Moderators or Developers get a free nuke along with their say-hello-to-my-friend-permaban greeting card.

  • 4
    See comment above: meta.stackexchange.com/questions/131818/… . It's not necessary that someone may notice it. And remember, you can change your username but it won't have a diamond. Commented May 8, 2012 at 14:39
  • 3
    One point in favor of banning this character is the ability to append a diamond to your user name. Also: Your answer is wrong. Please delete it.‮‮♦sinneD
    – Dennis
    Commented May 8, 2012 at 15:01
  • @Dennis: You could have at least linked it against your profile so that it looks less out of place. ;) On the other side...links won't get the username-style...mhh... Commented May 8, 2012 at 15:02
  • 7
    @den - Heh - looks like a deleted mod account :P
    – Lix
    Commented May 8, 2012 at 15:05
  • @Kobobby: I agree that it's easy to distinguish spoofed comments from real ones. But comments aren't easily controlled (new comments don't bump questions), and people fall for worse scams. I don't think filtering this character should be top priority, but it seems easy enough to implement.
    – Dennis
    Commented May 8, 2012 at 15:08
  • 1
    @Dennis: Exactly my point. Also: I'm your Nigerian benefactor, gimme your SSN. Commented May 8, 2012 at 15:17
  • 2
    @Manishearth: Joke's on you. We don't have any kind of social security here.
    – Dennis
    Commented May 8, 2012 at 15:18
  • @Dennis (2up) not exactly that easy if you change your username to something like "today" Commented May 8, 2012 at 15:29
  • 1
    Except that the joke is still on us when it comes to the permaban greeting card. :-( Commented May 8, 2012 at 23:55
  • @Dennis With our luck, anti-social security is the norm here.
    – nanofarad
    Commented Aug 20, 2012 at 14:18

In the long run you'll probably be able to use the html5 <bdi> tag or the unicode-bidi css property to wrap the comment, preventing it from spilling over. But I don't think browser support is available yet.

The requirements on handling the bdi element for the bidirectional algorithm may be implemented indirectly through the style layer. For example, an HTML+CSS user agent could implement these requirements by implementing the CSS 'unicode-bidi' property. [CSS]

This element is especially useful when embedding user-generated content with an unknown directionality.

In this example, usernames are shown along with the number of posts that the user has submitted. If the bdi element were not used, the username of the Arabic user would end up confusing the text (the bidirectional algorithm would put the colon and the number "3" next to the word "User" rather than next to the word "posts").

 <li>User <bdi>jcranmer</bdi>: 12 posts.
 <li>User <bdi>hober</bdi>: 5 posts.
 <li>User <bdi>إيان</bdi>: 3 posts.

(Quoted from the html5 spec)

See also: w3.org - CSS vs. markup for bidi support

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .