Kill Unicode bidirectional override in comments

Question

Alright, we've all been having fun with the Unicode mirror character here on meta.

And now we all know how to do it.

Yes, I'm a culprit here as well, and I accept that.

But I just realized that it can be used to spoof usernames (at a glance, that comment looks like it came from our mod)

Please can it be stripped from comments? (keep it on MSO if you wish, the link styles are different so it doesn't work)

Unicode info page

Note that it can also be used to spoof links in posts (see the "what can it be used for" section here)

---

This cannot be easily "waved away" as being caught on a per-case basis. SO has many posts which receive little or no attention, and a malicious user can easily play the Nigerian-prince trick on a newbie (Ask him for contact details/password/whatnot). Additionally, a clever username change can make it look legit even for more experienced users:

(No, I didn't actually change my username, I just Chrome inspector'd it ^.^)

So why not just strip it from comments? (and possibly posts)

Answer 1

I'm against filtering this. Not because that it can be abused, but because it's unnecessary and an unnecessary additional technical restraint. The team stated in the past that filtering out Unicode is a little bit...well, not exactly worth the hassle. I think this is not different.

I can also impersonate Moderators and Developers by changing my Username and Gravatar to match that of the desired user. And contrary to that, I think that LTR thingy is a poor mans solution and not really worth to think about.

May I suggest a different approach instead: We keep the policy that this is only a nice joke on Meta, tell everyone who does it on the main sites to stop doing that or face consequences...and everyone who impersonates Moderators or Developers get a free nuke along with their say-hello-to-my-friend-permaban greeting card.

Answer 2

In the long run you'll probably be able to use the html5 <bdi> tag or the unicode-bidi css property to wrap the comment, preventing it from spilling over. But I don't think browser support is available yet.

The requirements on handling the bdi element for the bidirectional algorithm may be implemented indirectly through the style layer. For example, an HTML+CSS user agent could implement these requirements by implementing the CSS 'unicode-bidi' property. [CSS]

This element is especially useful when embedding user-generated content with an unknown directionality.

In this example, usernames are shown along with the number of posts that the user has submitted. If the bdi element were not used, the username of the Arabic user would end up confusing the text (the bidirectional algorithm would put the colon and the number "3" next to the word "User" rather than next to the word "posts").

<ul>
 <li>User <bdi>jcranmer</bdi>: 12 posts.
 <li>User <bdi>hober</bdi>: 5 posts.
 <li>User <bdi>إيان</bdi>: 3 posts.
</ul>

(Quoted from the html5 spec)

See also: w3.org - CSS vs. markup for bidi support