I discovered it by accident here.

I guess I'm not the only one who fixed non-breakable unicode space U+00A0 to something like Alt+Space. So it's pretty easy to circumvent your prevention without even really trying. After all, non-breakable space simply makes sense there.

I think the solution is to:

  1. Only test at the end of the title (only white characters and small misleading ones after [on hold] should allow the test to return positive and block posting) - this will allow discussions on meta to have it spelled properly (see linked question).

  2. Forbid all and every white characters and 0-width characters between [on and hold] - this would be a real fix.

  • Why would someone want to put "on hold" in the title maliciously? Is there a point in preventing this? – interjay Dec 3 '13 at 9:53
  • @interjay if there is a lock against it in place, it strongly suggest to me that devs here believed there is a reason, even if we can't guess it. I don't want to discuss the need of this lock, feel free to ask that separately. I just think now it's buggy so I'm reporting it, that's all. – Mołot Dec 3 '13 at 9:54
  • Well, there's a difference between simple prevention (as they have currently) that was probably implemented in a minute, and wasting a lot of time thinking about every possible way it can be circumvented (e.g. someone can write [on hoId]). – interjay Dec 3 '13 at 9:59
  • 1
    @interjay with the current font I can see the difference between I and l in title. But that's not the point. The point is that I was able to write it without even thinking what I'm doing, using the character that is simply most correct typographically in that place. And in regular expressions there is short notation for all whitespace characters, that could be used to prevent this without wasting a lot of time - it's well known to anyone who uses them regularly. Depending on regex implementation it may be as simple as writing \s. – Mołot Dec 3 '13 at 10:05
  • Jeff's on record as not caring about people playing Unicode tricks, so long as it isn't done to abusive excess... I would dig out a link but it was just a comment on meta I think. – AakashM Dec 3 '13 at 10:07
  • 1
    @AakashM it's not a trick if all it takes is to use correct character, is it? But if it'll get "won't fix" or "works as designed" tag, I'll accept it. – Mołot Dec 3 '13 at 10:07
  • 1
    trying hard to abstain of casting close vote and triggering closure, just to see how title would look like when it is really closed... – gnat Dec 3 '13 at 10:17
  • @gnat thank you for not doing it. I just felt I need to illustrate my point, no sinister intentions (this time ;) ). – Mołot Dec 3 '13 at 10:43

Ummm okay, so please don't do that?

We can't prevent every malicious case, nor do we care to. Just like users mis-spell profanity to get around a language filter there will always be a slightly different way to post content to get around any filters. For the few that try ridiculous stuff there are other mechanisms to stop that behavior. We have a few immediate choices for these situations:

  • Spend a lot of dev time trying to think and counter every possible case
  • Spend 5 seconds banning repeat offenders

Option #2, if we ever even have to do it, is a much better use of resources. This hasn't been an issue as far as I'm aware, so yes it's something you can do, but it's not really a problem.

  • 5
    How can you decline a bug? Doesn't it simply status-bydesign then? :) – Shadow The Vaccinated Wizard Dec 3 '13 at 12:03
  • Well, my point was not every case, just the case that may happen pretty much unknowingly. I still don't see how writing \s instead of space in regex is a lot of dev time, but I can accept you will not change that. Just... as @ShaWizDowArd says, why declined? wont fix or by design would make sense. – Mołot Dec 3 '13 at 12:06
  • @Mołot non-breakable space added unknowingly? That's highly unlikely. Nick's point (with which I agree) is that those who do this will find other way to bypass the filter. And proper way is to deal with them one by one, by editing out the improper text and if it's repeating too much inform a moderator who can officially warn them. – Shadow The Vaccinated Wizard Dec 3 '13 at 12:10
  • 1
    @ShaWizDowArd Not added unknowingly. When I discovered it, I pressed alt+space knowingly. On the reflex. I used to have it to paste   back in ISO-8859-2 times, and now it pastes UTF character for it. I just do it on reflex where it is a proper character to use. I simply didn't know or expect it will work. As you can see, it was a dare. – Mołot Dec 3 '13 at 12:17
  • @Mołot ALT+SPACE cause ordinary space for me. – Shadow The Vaccinated Wizard Dec 3 '13 at 12:19
  • @ShaWizDowArd for most regular users. But not for those who type much and who can get rebuked for not using proper typography at work ;p Or at least not in the company I learned to set this up. But maybe it's really so uncommon? I wanted to clear what I had in mind, not dispute "bydesigness" of this issue here. – Mołot Dec 3 '13 at 12:47
  • 1
    @Mołot fair enough. Unless you see it happening a lot think we can put it behind us. – Shadow The Vaccinated Wizard Dec 3 '13 at 12:50

Not the answer you're looking for? Browse other questions tagged .