Tavern on the Meta

12:00 AM

<h2>Couldn't find xn--dta-6cd.stackexchange.com</h2>

From the returned HTML via cURL.

Weird. status-norepro

$ curl --version | head -n1

curl 7.52.1 (x86_64-pc-linux-gnu) libcurl/7.52.1 OpenSSL/1.0.2s zlib/1.2.8 libidn2/0.16 libpsl/0.17.0 (+libidn2/0.16) libssh2/1.7.0 nghttp2/1.18.1 librtmp/2.3

curl 7.35.0 (x86_64-pc-linux-gnu) libcurl/7.35.0 OpenSSL/1.0.1f zlib/1.2.8 libidn/1.28 librtmp/2.3

specifically, libidn2/0.16 vs libidn/1.28 may be doing it

12:02 AM

That's exactly what I'm thinking.

But, TL;DR: if you can persuade something to send a request with an IDN homoglyph without converting it to punycode first, you can get back a 404 that looks like data.stackexchange.com.

But when I did that using Firefox, the server returned 400 as expected.

Whether that's real or we're being trolled, who knows. But, on a Vista system with an old Firefox, it wouldn't surprise me too much if that's possible.

Actually... let me try that using the cryllic. When I tested I used an emoji unicode.

Anyone got a Vista VM they can spin up? :)

@forest That might make a difference - 4 bytes vs 2

Awesome Poodles

12:05 AM

@ArtOfCode I could do it in a few hours, but you'd have to wire me hazard pay first.

gnu.org/software/libidn/libidn2/coverage/libidn2/…

(nevermind, just tested that)

oh!

I had a typo in my Host command lol.

@ArtOfCode Now I can reproduce it.

That makes sense

curl -s stackexchange.com -H "Host: dаta.stackexchange.com"

Out of curiosity, what's dig +short data.stackexchange.com show for you?

12:10 AM

<h2>Couldn't find dаta.stackexchange.com</h2>

Without or without cryllic?

Without

192.111.0.23

Huh, likewise. If you visit that IP, you get the offline page.

And $ curl http://192.111.0.23/ -H "Host: data.stackexchange.com" gets you nothing, which is odd

Right, but sending an invalid subdomain gives you 151.101.1.69, which does work.

Plain old stackexchange.com on the other hand is 151.101.129.69 (slight difference).

Try a valid subdomain

12:13 AM

Valid gives a different IP for different subdomains.

I only tried one, but I got 4 results for it

I hope OP does end up uploading the HAR file.

Btw, libidn is IDNA2003 encoding, whereas libidn2 is IDNA2008.

Awesome Poodles

@forest Or trying a new profile, or admitting that he's punking us or goofed.

yup

Although I'm mostly curious to see exactly what his browser is sending.

Regardless of exactly what is causing it.

Btw, if his browser and OS are old, he's using IDNA2003, not IDNA2008.

blogs.msdn.microsoft.com/shawnste/2013/09/09/…

> IDNA2008 removed the symbols that were permitted in IDNA2003

So perhaps a cryllic "a" was permitted under IDNA2003.

Though I guess it also does for IDNA2008, as I can now reproduce it with libidn2...

5 hours later…

Journeyman Geek

5:13 AM

@forest cause they are lazy and the deadline is 2 hours ago

5:26 AM

lel

Sonic the Anonymous WizHog

lol

6:13 AM

@Shree Flagged; was the last one to nuke it

@SonictheAnonymousWizHog thanks.

→ 10 messages moved to Chimney

6:30 AM

@SonictheAnonymousWizHog don't ping rule applied, sorry. Just want to know what I am wrong in recent answer. I aware about DV on meta but want to know about opinion. /cc @rene

Sonic the Anonymous WizHog

@AwesomePoodles yeah, when it worked on other browsers and in private mode I realized I turned into the local computer service desk for which I'm highly unqualified nor have the patience to flip them through a zillion of options where they could have screwed up their computer.

@Shree Unlike many others, I am perfectly fine with such pings, as long as they're not unreasonable. I'm writing a counter-answer - wait for that.

Thanks.

@Shree the answer looks fine but in burnination requests you always run the risk to have two camps that are hard to win over: the ones that believe every tag has value and the ones that believe every tag needs to go. Both camps are good at bringing in valid arguments. The outcome sometimes a lottery.

6:45 AM

When rene say, looks fine . It's bonus, no need to worry about DV :)

@ShaWiz your thought ?

@Shree hmm? About?

Q: Time for [regression] to make an egression?

I just noticed that one of my questions was tagged regression. I think that's a meta-tag, not a proper Meta tag: Avoid meta-tags Do not use meta-tags in questions. Here are some tips to help you determine whether a tag is a meta-tag: If the tag can’t work as the only tag on a que...

@Shree agree it should go.

Thanks.

2 hours later…

8:52 AM

Turns out gaining Twitter followers is easier than gaining SE rep.

Just take part in silly games, and you get thousands in few days.

9:17 AM

barely have time to finish a mod flag these days ...

Mod flagged anyway

Mithrandir

@ShaWiz There's something to be said for quality of followers as well...