127

I stumbled over a user whose username looks like this:

Screenshot of usercard showing Zalgo text

For the sake of reproducibility, it's observable on this question. (The username has since been cleared.) Comments work fine, but it breaks on questions and answers—the username can't be clicked (at least in FF 67.0.1 or Chrome 74).

20
  • 121
    Note that the gravatar is always clickable. Presumably, the real bug here is that we allow people to put that kind of nonsense as a display name.
    – Cody Gray Mod
    Commented Jun 9, 2019 at 21:19
  • 19
    @CodyGray: Is there a good algorithm for de-Zalgo-ing, or even detecting Zalgo, text? Because the basic idea behind it is perfectly valid: Unicode combining characters can stack, and there are valid uses for this. So is there a way to tell when some text uses it too much? Commented Jun 9, 2019 at 23:00
  • 37
    @Nicol Yeah, that's a fair point. My cursory research suggests that the most reliable approach is to have a human moderator make the judgment call. That also solves the problem of "but my mother gave me this name!" Now...where can we find a human moderator?
    – Cody Gray Mod
    Commented Jun 10, 2019 at 0:12
  • 33
    While I agree a dumb algorithm against Combining characters would be bad, here the bug is caused by the fact there are only such combining characters, which leads to a computed width of 0. It's true I didn't checked in all languages using such combining characters, but from the few I am familiar with and from what my gut tells, I think it's safe to require at least one non-combining character.
    – Kaiido
    Commented Jun 10, 2019 at 1:16
  • 7
    In my opinion only A-z should be allowed. When someone uses Russian characters or Arabic then you can't @ them in comments.
    – Andreas
    Commented Jun 10, 2019 at 7:20
  • 13
    I didn't know one could do this. Everyone Zalgo their usernames!
    – halfer
    Commented Jun 10, 2019 at 7:21
  • 50
    @Andreas last time I checked, non-latin chars in someone's name results in it showing up right after you type @. Banning everything except a-z seems like overkill Commented Jun 10, 2019 at 7:22
  • 3
    I don't mean ban, just enforce on new users and perhaps ask others to change. Don't know. Haven't thought about it really. That perhaps works, but not on mobile devices (not on mine). I need to type the first letter for the name to show up
    – Andreas
    Commented Jun 10, 2019 at 7:23
  • 13
    Who knows - if there is any sound attached to that kind of name it might be his/hers : Falsehoods programmers believe about names Commented Jun 10, 2019 at 7:28
  • 20
    .user-details > a { min-width: 1em } Commented Jun 10, 2019 at 7:59
  • 4
    Related, How does Zalgo text work?
    – jww
    Commented Jun 10, 2019 at 13:24
  • 19
    @CodyGray Just rename them to "Parsing HTML With Regex". Problem solved
    – Machavity Mod
    Commented Jun 10, 2019 at 13:33
  • 30
    Good suggestion, @Machavity. From now on, I shall rename all accounts with Zalgo text in the user name to: “I Tried to Parse HTML with Regex and Lost”. Unless that’s too long, then I’ll just shorten it to “Loser”.
    – Cody Gray Mod
    Commented Jun 10, 2019 at 20:04
  • 29
    @Andreas Would you ban apostrophes, as in O'Reilly? Accented characters? People should be able to use their real names. If that causes problems on mobile devices, then we should address that. Commented Jun 11, 2019 at 0:28
  • 5
    Fun part is that Chrome thinks most of this post is in Vietnamese, and would like to translate it into English for me.
    – Luuklag
    Commented Jun 11, 2019 at 6:47

3 Answers 3

11

We've now implemented a restriction on using Unicode combining diacritical marks. This still allows known unicode characters such as ç, é and ö, but will block Zalgo text.

I admit, and as the comments here point out, it's not a perfect solution. However, we already validate the name by blocking offensive words, names under 3 characters, and special characters such as >, & and /. It doesn't feel too unreasonable to extend this to combining diacritical marks.

2
  • Just so we understand correctly, is Zalgo text blocked only on usernames? Or is it blocked in any input box on the site?
    – TylerH
    Commented Oct 9 at 13:39
  • 2
    This change only blocks it in display names.
    – Connell StaffMod
    Commented Oct 9 at 16:14
128

I had a look at the zalgo on that username, and I don't like it. I can't detect any non-whitespace base character, so the name actually occupies zero characters.

I think we have a real bug here; if a username contains only combining characters and RTL/LTR override characters and other zero-width characters, we should ban it, preferably by code so nobody creates these again.

15
  • 213
    I think we should give this user an award for ingenuity and then ban the user for making a mockery of us.
    – matt
    Commented Jun 10, 2019 at 4:01
  • 24
    @matt: ban on what grounds? Did he break any of the rules a new user has to accept when registering on SO? And who are these "us" that feel they're being mocked? I don't. Commented Jun 10, 2019 at 13:26
  • 74
    @VioletGiraffe I think Matt's tongue was in his cheek at the time of writing, I could be wrong, but I doubt it...
    – StudioTime
    Commented Jun 10, 2019 at 13:37
  • 6
    There's not very lot of elegance in solving technical issues with administrative approach. Meh. Why not prohibit spaces in usernames in case our software fails to quote properly?
    – Vlad
    Commented Jun 10, 2019 at 14:56
  • 6
    @Vlad: In this case the software is the browser, and this is more akin to banning names consisting of just spaces. If we had a unique name rule (which we do not), I'd be saying names should be unique after Trim().
    – Joshua
    Commented Jun 10, 2019 at 15:02
  • 4
    @Joshua: Has the possibility to work around the browser's problems been considered? E. g. put a clickable background under the name text or whatever (I', not a web developer).
    – Vlad
    Commented Jun 10, 2019 at 15:11
  • 7
    @Vlad That argument would be more persuasive to me if you could come up with a valid justification for a user name like this. Until that time, I have no qualms with an administrative solution. Spaces in user names are altogether different; most people have them in their names.
    – Cody Gray Mod
    Commented Jun 10, 2019 at 19:35
  • 9
    @CodyGray: I don't see why a name must have a justification. There are not too many users having username, say, Cody Gray (but there's a bunch of Vlads), but I don't think you needed a justification for using such a rare username, did you?
    – Vlad
    Commented Jun 10, 2019 at 21:26
  • 5
    @Vlad I don't know what that has to do with anything. User names are not required to be unique. However, I think it's a reasonable expectation that user names not be nonsense text created by abusing Unicode combining characters.
    – Cody Gray Mod
    Commented Jun 11, 2019 at 0:49
  • 5
    @CodyGray: My point was that you are requiring the username in question to have a justification because, well, it's a rare name, no one is using names like that. (The fact that our code fails to properly represent usernames like that is a bug report and not a real reason.) Right? If we would adopt this point of view, than your username, being unique and therefore sufficiently rare, would require justification as well. Right? Or we would need to invent a new (quite ad hoc) rule which would allow your username but disallow theirs.
    – Vlad
    Commented Jun 11, 2019 at 11:25
  • 6
    @CodyGray: Re "reasonable expectation that user names not be nonsense text" -- surely you don't want to ban nonsense names, do you? So let's either omit the word "nonsense" or create a rule that the username must make sense. Re "by abusing Unicode combining characters" -- again, "abusing" is personal judgement: combining characters are allowed by Unicode standard. So it's again a poor justification for prohibiting particular patterns of using combining characters.
    – Vlad
    Commented Jun 11, 2019 at 11:36
  • 17
    @CodyGray: nonsense names, like user123456789, for instance? My point being, one man's nonsense is the next man's default. Commented Jun 11, 2019 at 12:01
  • 7
    There's "nonsense", stuff that doesn't mean anything, and "nonsense", stuff that is obnoxious and doesn't serve any purpose other than to be obnoxious and cause issues. The former is whatever, the latter causes harm and should be dealt with.
    – user4639281
    Commented Jun 11, 2019 at 18:39
  • 6
    @Vlad: I don't even want to ban combining characters or most Zalgo. I only want to ban the lack of a base to put it on. I want some actual characters for @ to lock onto.
    – Joshua
    Commented Jun 11, 2019 at 19:59
  • 2
    Offensive user names are banned long time ago, but in this case it's not even offensive... it's no harder to read (to an English user) than - say, a Chinese user name. So why making a (huge issue) about this? (p/s. an empty @ lists all non-ascii usernames for completion)
    – user202729
    Commented Jun 12, 2019 at 14:45
74

Why should anybody care what username other user have?

If you need names to fit in a reasonably-sized clickable block, then simply render it in such an inline div that have minimum/maximum width, hides overflow and make this entire block is clickable link to profile.

There are tons of technical solutions to limit size of displayed text without need to invent new filters every time somebody discovers some funny combination in Unicode.

15
  • 8
    And this is a proposed solution to address the bug. It's a perfectly valid answer to the question, although folks may certainly disagree with its recommendation. @Ville-Valtteri
    – Cody Gray Mod
    Commented Jun 11, 2019 at 8:32
  • 7
    Why should anybody care what username other user have? Because we may want to communicate with them. With non-latin names I can't even recognize them. Very impolite to use such names in an English-only site.
    – TaW
    Commented Jun 11, 2019 at 17:20
  • 4
    @TaW Names don't have to be in English. You can't reasonably ban CJK names even though you can't type them.
    – bjb568
    Commented Jun 11, 2019 at 17:22
  • 3
    You can't reasonably ban I can't ban but I did reason that they should be banned. I can't type them, I can't read them, they don't fit this community. Ever allowing them was a mistake. And, of course, they are names so they need not be in English. But they should be in a readable western charcter set.
    – TaW
    Commented Jun 11, 2019 at 18:02
  • 3
    I do agree that what usernames users pick are up to themselves, but there are extremes. Taking it the way TaW suggests essentially excludes the majority of the world. It's also extremely unrealistic, and not to forget unfair to users with non-English names. What should be done is make pinging easier for non-English names (similarly to how it's done in chat, assuming that isn't already implemented - I couldn't find anywhere to test). However, ignoring it entirely results in bugs like this. I'm not saying "ban all names that don't use latin letters" but blatant abuse of unicode should be handled Commented Jun 11, 2019 at 18:20
  • One way is simply limiting size, but that only covers overflow. 0-width names should be disallowed, or there should at least be a patch pushed to avoid overflow and perceived effects of a 0 width username (i.e. meta.stackoverflow.com/questions/385906/…). Commented Jun 11, 2019 at 18:22
  • 13
    @TaW where do you want to type them? I don't know if you know, but just typing @ recommends you any non-ascii starting username. So, I can't buy your communication argument. Also, post owners are always notified of all comments on their posts.
    – Braiam
    Commented Jun 11, 2019 at 19:51
  • 1
    @Braiam I think the issue is that you have to type the first character after @ to get the name completion to start. If you don't know how to type in the first character of the recipient's name then you can't use name completion. Commented Jun 12, 2019 at 8:53
  • 1
    @DonCruickshank no, you don't have to i.sstatic.net/J1rTq.jpg
    – Braiam
    Commented Jun 12, 2019 at 9:05
  • 3
    @Braiam OK - But I'm not seeing that on desktop Firefox or Edge Dev Channel. I'm seeing this: imgur.com/a/uXj7fWX Commented Jun 12, 2019 at 9:35
  • 1
    @DonCruickshank that migth be a bug. meta.stackexchange.com/a/168155/213575
    – Braiam
    Commented Jun 12, 2019 at 9:46
  • 8
    "Why should anybody care what username other user have?" I guess the answer to that question depends on the answers to "Why do we have usernames at all?" and "How are usernames used?". Commented Jun 12, 2019 at 10:34
  • 2
    "Anybody" would care if such usernames cause problems for them. And that is exactly the case presented here. What manner of response, if any, the scope, nature, or severity of such problems warrants from moderators or the SE network is a different question, but it is in no way foreclosed by any inherent right for a user to have whatever username they want, no matter what. Commented Jun 12, 2019 at 15:31
  • @Zoe do you want to review every Unicode update to every browser ever to determine all the combinations that not only marked "zero-width" but percieved as zero-width under some OS/some browser/some font? Properly formatting container for user name unambiguously solves all problems forever. Commented Jul 19, 2019 at 12:42
  • @OlegV.Volkov I know, and I said that was another alternative. There's lots of ways to solve the problem, and I have no idea which would be the easiest to implement and keep fixed Commented Jul 19, 2019 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .