The ironic twist is that in 2022, both Firefox and Chrome reverted to displaying punycode instead of Unicode, following incidents involving fake Apple websites. Surprisingly, Apple continued to show Unicode despite being a genuine victim of homograph attacks.
Just small note. Originally all browsers were showing Unicode characters in the address bar. But when malicious actors started registering domains with homographs, Chrome/Firefox switched back to showing raw punycode. Only Safari is still showing Unicode for unknown reasons.
firefox does not show the punycode by default. If you want it to render the punycode you have to set the option network.IDN_show_punycode in about:config manually
Right off the top of my head, I can say: While you _can_ definitely use any unicode character in a domain name these days, doing so almost always breaks accessibility for somebody - and I don't mean for disabled people, but simply for people in parts of the world who don't have that specific character on their local keyboard layout. For me, typing an Ü or an ß is easy, but for an US citizen, it might be a great big hassle to do so. The one best, most compelling reason to restrict oneself to 7-bit-ascii characters in one's domain names is to maximize the potential visitor base.
protip: there's a difference between "a" and "an" and they're not interchangeable. "a" goes before stressed syllables and consonants, "an" goes before unstressed syllables and vowels. So for example: "If you throw up at school, *a* nurse might give you *an* ice pack"
Dear Mr. Skeletal I am writing this letter to express my heartfelt gratitude for the incredible impact you have had on my life. Your presence, along with your newfound trumpet, has brought a melody of joy and transformation into my world, and I am forever changed because of you. When I first met you, Mr. Skeletal, I was captivated by your skeletal form and the air of mystery that surrounded you. But it was when you picked up that trumpet and began to play that I truly saw the magic within you. Your music has been a source of inspiration and comfort to me. It has lifted my spirits on the darkest of days and filled my heart with hope and joy. Your trumpet has a way of reaching deep into my soul, touching me in ways that words cannot express. But more than your music, Mr. Skeletal, it is your spirit that has touched me the most. Despite the challenges you face, you approach life with a sense of humor and lightness that is truly infectious. You have shown me that no matter what obstacles we may encounter, we can always find a way to make beautiful music out of them. You have also taught me the importance of embracing our talents and passions. Your love for music is evident in every note you play, and it has inspired me to pursue my own passions with the same fervor and dedication. So, thank you, Mr. Skeletal, for being such an amazing and inspiring presence in my life. Your music, along with your trumpet, has changed me in ways I never thought possible, and for that, I am eternally grateful. With heartfelt thanks and a song in my heart❤️
Just wanted to say, I liked this video so much, I actually signed-in to give it another watch and a like. It's rare for me to like tech-based videos outside the small group of CZcamsrs I watch, and even rarer for a video on networking/internet to teach me so many new things! I loved just about every part, even the sponsor bit was well done! And I got an unreasonable amount of joy to hear somebody else also pronounces Ko-Fi that way! I _am_ questioning your choice in terminal font though... but I can't blame you too much, those 7s look sweet.
Also usually you are not allowed to have letters from different scripts, ie alphabets, in a domain name, in order to avoid things like the little o vs little omicron example shown in the video
For years I've known about how this works on the backend, but no one ever explained the attack vector that is why there is arbitrary restriction. The restriction still doesn't match the attack vector, but at least I now know there is a valid reason for it.
FUN FACT: the HOSTS file still exists in Windows TO THIS DAY and still takes priority over DNS. We IT people occasionally still use it, albeit once in a blue moon.
The idea that a data broker who traffics in information that can be used to steal someone's identity would ever actually remove your data from their systems is patently absurd. They have no motivation to comply with the request and every motivation to not comply.
@@LionTheFish They're also legally required to not be selling identities. Do you really expect people whose entire business is breaking the law to not break the law? You remind me of when Trump recently declared he'd solve crime in DC by establishing "crime free zones"... Like I have news for you, crime is already illegal.
@@LionTheFish They're legally required to not be selling people's identities. So what exactly is your point? That criminals will stop doing crimes if you ask nicely?
@@BerryTheBnnuy While shady and legally dubious, data brokering is legal in most countries, including but not limited to, the US, UK, EU, and Australia.
@@LionTheFishOh, you're right, criminals in UK, EU, and AU trading in people's identities are law abiding citizens. It's only the criminals in America that don't abide by the law. My mistake.
This reminds me of that one part in "To the bone". Papyrus: Alas, I'll hit him with my Special Attack Sans:*trombone sounds* Papyrus: Leave me alone! Sans: You know I've got a knack for the trom-bone Papyrus: One more pun, and I'll be done Sans: But ain't two skulls better than one?
I suggest "some history of the skull trumpet" link to a playlist featuring the 2 Videos by Jeffiot regarding the skeleton origins instead of just the first one that's all from me Great video btw!!
This is cool, thanks! When I first saw non-ascii domains I just assumed DNS was updated with UTF-8 support but I should've known better, with something like DNS or IP the inertia is too strong to just globally update it.
5:29 Wow this is crazy because my brother visited a site that was a USPS scam, and the link looked right, but when clicked and opened, it turned into letter scramble. I assume it was an embeded hyperlink in the text, but it was likely what was explained here.
Honestly its not even only languages that don’t use the Roman letters, basically any language apart from English has some sort of umlaut or special character. ASCII is so incredibly outdated in my opinion.
@@alok.01 Meta sued Freenom, forcing them to disable domain registration My Freenom domain suddenly stopped working when I checked with a dns checker it was unconfigured like no one owned it
the problem with the idea of storing the whole internet locally includes archiving tons of illegal content but hell, at least your search history won't be tracked
Haha, interesting video! It makes me wonder why, in all these years that I've been going online, I had never tried an Emoji in a URL or e-mail address to see what it does until now! But now I know, heheh!
So you're not the guy who found the origin of that GIF. Huh. I would have thought he would have made the website. Cool that you included his video as a link, though. Nice to honor the actual creator.
Also, using Emojis in your address would tend to be quite bad for business! Who wants to hunt around and type those dang things just to get somewhere? Ughhh!
Yep, your browser only ever talks to whatever dns server it has configured, dns servers look up anything they don't know at a more authoritative. Root servers would die if everyone would use them directly
Thanks again Aura for sponsoring this video! Check them out at aura.com/devdetour.
You should have thanked mr skeltal
your welcome
sigma
"tk" is close enough to "thank" so the domain reads as "skull trumpet thank" which is still fine
RIP .TK
🫠
tk is tokelau
a small island in Oceania
@@ItsSeatedtrue
Being able to use the trumpet with no lips is commendable! Cheers to Mr. Skeltal
He got more thanks than the vid got views.
The ironic twist is that in 2022, both Firefox and Chrome reverted to displaying punycode instead of Unicode, following incidents involving fake Apple websites. Surprisingly, Apple continued to show Unicode despite being a genuine victim of homograph attacks.
"homograph" finally an attack with a name that actually sounds threatening.
@@BlackbeltHitoshi what a phobe
@@Raderade1-pt3omwhat do you mean?
@@BlackbeltHitoshi Because you included the word "homo"
I doubt you were meaning it that way though.
@@MidnightTheKittenisn't it called a homograph attack? And I'm pretty sure I mean it considering the way I talked about traumatizededgeworth.
"418 im a teapot"
i was not expecting to ever actually see that.
Ah, nice catch.
Status codes continue to impress me even as a pro web dev
reading the code? lmao
I saw the same thing just now and went to the comments to see if anyone else saw it. Never thought I'd ever see the "I'm a tea pot" error in the wild.
I think it's just not configured right, as it does respond with "thank mr skeltal"
Just small note. Originally all browsers were showing Unicode characters in the address bar. But when malicious actors started registering domains with homographs, Chrome/Firefox switched back to showing raw punycode. Only Safari is still showing Unicode for unknown reasons.
I cannot believe I had to use google to understand this instead of just realising that "holograph" is supposed to say "homograph".
firefox does not show the punycode by default. If you want it to render the punycode you have to set the option network.IDN_show_punycode in about:config manually
Cuz apple users are apparently the most basic people? Idk
Cause apple is always form over function. Nicer looks is more important than safety apparently
@@mega_gamer93 mine shows punicode and I've never messed with configs
you should add a chat so people can thank mr skeltal in their own words
That would be nice but it'd need to be moderated
not practical cuz moderation would be a nightmare.
@@tankfire20you just hate Mr skeletal smh
There are node js libraries that auto censor so its not that bad@@tankfire20
There are already 4mil thanks out there
"A branded email adress like *You@🌚👉👈* shows you take your business seriously." is the best part of this whole video.
thank mr skeltal
bout to make it hit a billion thanks in a second
418 response to the post request ahaha nice
@@kieraisverybored I'm a teapot
@@kieraisverybored time to spam the website with post requests 😈
Update: I stopped the script but the counter is still going upwards of 2.5 million thanks
Right off the top of my head, I can say: While you _can_ definitely use any unicode character in a domain name these days, doing so almost always breaks accessibility for somebody - and I don't mean for disabled people, but simply for people in parts of the world who don't have that specific character on their local keyboard layout. For me, typing an Ü or an ß is easy, but for an US citizen, it might be a great big hassle to do so. The one best, most compelling reason to restrict oneself to 7-bit-ascii characters in one's domain names is to maximize the potential visitor base.
Üß we got those on samsung in the US ik it was just an example I just wanted to share
@@Piperonis what about physical keyboards?
@@Piperonis what about physical keyboards?
protip: there's a difference between "a" and "an" and they're not interchangeable. "a" goes before stressed syllables and consonants, "an" goes before unstressed syllables and vowels.
So for example: "If you throw up at school, *a* nurse might give you *an* ice pack"
@@SnoFitzroy sounds kinda like an skill issue to me
Dear Mr. Skeletal
I am writing this letter to express my heartfelt gratitude for the incredible impact you have had on my life. Your presence, along with your newfound trumpet, has brought a melody of joy and transformation into my world, and I am forever changed because of you.
When I first met you, Mr. Skeletal, I was captivated by your skeletal form and the air of mystery that surrounded you. But it was when you picked up that trumpet and began to play that I truly saw the magic within you.
Your music has been a source of inspiration and comfort to me. It has lifted my spirits on the darkest of days and filled my heart with hope and joy. Your trumpet has a way of reaching deep into my soul, touching me in ways that words cannot express.
But more than your music, Mr. Skeletal, it is your spirit that has touched me the most. Despite the challenges you face, you approach life with a sense of humor and lightness that is truly infectious. You have shown me that no matter what obstacles we may encounter, we can always find a way to make beautiful music out of them.
You have also taught me the importance of embracing our talents and passions. Your love for music is evident in every note you play, and it has inspired me to pursue my own passions with the same fervor and dedication.
So, thank you, Mr. Skeletal, for being such an amazing and inspiring presence in my life. Your music, along with your trumpet, has changed me in ways I never thought possible, and for that, I am eternally grateful.
With heartfelt thanks and a song in my heart❤️
Thank you Mr. ChatGPT.
@@RichardHennigan ah shoot, you caught me
It might be good if you clicked the link and watched the video. Then you could -have ChatGPT- write something to honor the creator.
Thanks for leading me to a 40min documentary (link on the website) that made me cry, that was awesome haha
If you haven't seen it the creator has a sequel for the source of the 3d models used to construct the gif
Super cool video, can't wait to share this newfound knowledge with some unlucky individual at a house party.
honestly same
you worded it perfectly 😂💀🎺
Just wanted to say, I liked this video so much, I actually signed-in to give it another watch and a like. It's rare for me to like tech-based videos outside the small group of CZcamsrs I watch, and even rarer for a video on networking/internet to teach me so many new things!
I loved just about every part, even the sponsor bit was well done! And I got an unreasonable amount of joy to hear somebody else also pronounces Ko-Fi that way! I _am_ questioning your choice in terminal font though... but I can't blame you too much, those 7s look sweet.
This is the amount of info I learn in one month in school compressed into 6min and explained better
Cool 👍🏼
Maybe you're not paying enough attention
Crazy what happens when you dont watch tiktok in class bozo
@@ssgoko88 jokes on u I play clash of clans
(That was a joke I pay attention)
I just thanked mr skeltal and JESUS THAT'S LOUD
No half-measures. Mr Skeltal goes full doot
Jeez
I'm a teapot 🫖
you made me watch entire video of skull trimpet's history that I had no idea about!
Also usually you are not allowed to have letters from different scripts, ie alphabets, in a domain name, in order to avoid things like the little o vs little omicron example shown in the video
summary: because it isn't allowed
thank
i was under the impression that .tk domains were no longer registerable, where did you register this at?
what if he traveled all the way to Tokelau to register it
For years I've known about how this works on the backend, but no one ever explained the attack vector that is why there is arbitrary restriction. The restriction still doesn't match the attack vector, but at least I now know there is a valid reason for it.
Guy broke into your car defies stereotypes.
The impostor was allowed as a crewmate, it is 2024 and now I can't take this out of my head please help
I can't thank mr skeltal, my antivirus won't let me.
came onto this video to talk about the doot doot 💀🎺 and ended up learning how URLs and domains work
I love how in the beginning of the video Mr Skeltal has just 250 thanks and currently he has over 120 million.
Bro this video is so good you deserve more subs 🔥
3:37 the eggplant emoji in frequently used 💀
Self caught in 4k
Grow up
@@XxZeldaxXXxLinkxXWhy are you so boring
@@XxZeldaxXXxLinkxX grow as a person
FUN FACT: the HOSTS file still exists in Windows TO THIS DAY and still takes priority over DNS. We IT people occasionally still use it, albeit once in a blue moon.
1:42 guy: “when-ever you ask to browser to go to a website” background: *asks google to go to a website quite literally*
I thanked the skeleton, and he thanked me.
This is a very strange sequel to the documentary on the origin of the trumpet gif, but I'll take it
How did you even get a tk TLD?
All websites that claim to be registers for tk domain don't work.
.TK has it's own registrar, and it's free. You can't get it through subsidiaries as a result.
@@deadoonyea but the shut down like a few months ago, not sure if they came back tho
.TK has it's own registrar, and it's free. You can't get it through subsidiaries as a result.@@diamonddynamite1557
The idea that a data broker who traffics in information that can be used to steal someone's identity would ever actually remove your data from their systems is patently absurd. They have no motivation to comply with the request and every motivation to not comply.
they are legally required to comply
@@LionTheFish They're also legally required to not be selling identities. Do you really expect people whose entire business is breaking the law to not break the law?
You remind me of when Trump recently declared he'd solve crime in DC by establishing "crime free zones"... Like I have news for you, crime is already illegal.
@@LionTheFish They're legally required to not be selling people's identities. So what exactly is your point? That criminals will stop doing crimes if you ask nicely?
@@BerryTheBnnuy While shady and legally dubious, data brokering is legal in most countries, including but not limited to, the US, UK, EU, and Australia.
@@LionTheFishOh, you're right, criminals in UK, EU, and AU trading in people's identities are law abiding citizens. It's only the criminals in America that don't abide by the law. My mistake.
gotta love these random tidbits i come across being surprising discoveries on how browsers fetch data as an introductory guide! cheers mate
This reminds me of that one part in "To the bone".
Papyrus: Alas, I'll hit him with my Special Attack
Sans:*trombone sounds*
Papyrus: Leave me alone!
Sans: You know I've got a knack for the trom-bone
Papyrus: One more pun, and I'll be done
Sans: But ain't two skulls better than one?
I thank mr skeltal
I suggest "some history of the skull trumpet" link to a playlist featuring the 2 Videos by Jeffiot regarding the skeleton origins instead of just the first one
that's all from me
Great video btw!!
My web protect (built into my wifi) dosent let me 😭
Moral of the story: Be extra careful with websites from Samoa, Tonga, Tokelau.
"How do we prevent Homograph Attacks?"
I don't know, but we might be able to prevent homograph attacks.
How did you get a .tk domain? I read the domain registar was closed?
No idea
it used to work years ago but now I think its paid
@@mattia222 I just tried, it won't even let me select a domain name or register an account.
@@anonymoususer6294 Apparently they closed on March 2023
How did you register a .tk domain? I thought freenom was down currently
Chrome might or should only convert the domain name to punny code visually if it contains any disallowed characters
This is cool, thanks! When I first saw non-ascii domains I just assumed DNS was updated with UTF-8 support but I should've known better, with something like DNS or IP the inertia is too strong to just globally update it.
5:29 Wow this is crazy because my brother visited a site that was a USPS scam, and the link looked right, but when clicked and opened, it turned into letter scramble. I assume it was an embeded hyperlink in the text, but it was likely what was explained here.
6:03 i said "fuck that o" without even knowing
thank you mr skeltal and thank you cathy jarboe for creating him
They killed my TK domain ...
Honestly its not even only languages that don’t use the Roman letters, basically any language apart from English has some sort of umlaut or special character. ASCII is so incredibly outdated in my opinion.
the counter is pure genius
💀🎺
*lol skelly playing the trumpet*
freenom got nuked and the .tk tld can't be used
how did you get one and how is it still up? the fuck
Freedom got nuked?
@@alok.01 freenom
@@alok.01 Meta sued Freenom, forcing them to disable domain registration
My Freenom domain suddenly stopped working
when I checked with a dns checker it was unconfigured like no one owned it
Something something Tokelau
i somehow made a bot that makes the total thanks go brrrrrrrrrrrrr to make mr skeletal happy
JESUS THATS A LOUD TRUMPET
I just Got into 40 min vid and bro...... now IDK..... ITS JUST A GIF BUT THE LORE BRO THE LORE IS DEEPER THAN THE DEEPEST MAN MADE HOLE
1:39 that's such a sweet kind old grandma thing to google 😢😩
the problem with the idea of storing the whole internet locally includes archiving tons of illegal content but hell, at least your search history won't be tracked
1:20 WASHINGTON STATE MENTIONEDD RAHHH!!!!!
unrelated to the video but i'm so glad you put the history video of doot doot on the website lol
0:06 what is this effect called?
could be mercury + stacked motion blur
90 million thanks to skeletal is my counter going crazy
THOUSANDS PER SECOND.
❌ Domain name server
✔Domain name system
P Sherman 42 Wallaby Ln Sydney Australia is the address of my dentist.
time to get some malaware!
Amazing video. Thank you so much for the information!
fun fact if you look in console and go to network and click thank and look at the request it will say 418 im a teapot
my question is how the heck do you have a .tk domain i thought they shut it down
Thank you mr skeltal!
You need to do an update to this video addressing handshake (HNS) domains….
i think i was too thankful i just sent like infinite thanks at once
20k to be exact
Haha, interesting video! It makes me wonder why, in all these years that I've been going online, I had never tried an Emoji in a URL or e-mail address to see what it does until now! But now I know, heheh!
7:41 guys the amongus is allowed we chill
The fact that Mr. Skeltal has roughly half of the views this video has is amazing.
when i go to your website, my antivirus flares up and tell me ur site is sus af
mine too
and also it says its pretty sure
I had no idea about this "puny code"... Thanks! 👍
underrated
2:56 omaiwa mo shinde iru
.com
So you're not the guy who found the origin of that GIF. Huh. I would have thought he would have made the website.
Cool that you included his video as a link, though. Nice to honor the actual creator.
"First introduced..."?
How many times was it?
Also, using Emojis in your address would tend to be quite bad for business! Who wants to hunt around and type those dang things just to get somewhere? Ughhh!
The actual question is how did you manage to get a .tk domain
Bro Mr. Skeltal has no reason to be this LOUD
So it's a big domain conspiracy ...
this was unique and cool... i ❤ learning lol appreciate the knowledge friend
it would be so good if you put the name of the skull emoji creator, that lady. +1 for linking the documentary of the guy finding that out.
1:15 washington mentioned
did you really think you were going to trick me into a DNS class with a dumb title? no, thanks
Спасибо, мистер Дудец!💀🎺
I understood and I never coded before. A true eli5 teacher ty
the skull and trumpet emojis aren't easily mistaken for any others though...
bro why did my weeb ass think that at 0:43 he was gonna say domian expansion...
50 million total thanks so far
Currently the Skeleton has over 90 million thanks wow!
Wouldn’t it ask a recursive nameserver not a root nameserver
Yep, your browser only ever talks to whatever dns server it has configured, dns servers look up anything they don't know at a more authoritative. Root servers would die if everyone would use them directly
Why is there 500 million thanks to mr sketal
Thanks mr skeltal, doot doot
the honk burnt my ears
6:48 WHERES THE SAMSUNG ONES