#DiVOC R2R - Emoji domains and how wonderfully broken they are

Intro

Herald: So welcome to this evening's next
talk with the wonderfully broken title, I

love it, "Emoji domains and how
wonderfully broken they are" by a very,

very wonderful person, Jennifer, who is a
web developer, and you wouldn't believe

it, her nick is "unicorn", here is a
unicorn! ... Hi! Jennifer this is, tell us

everything about emoji domains, and why
they are so rotten broken. You go!

dysphoricUnicorn: Yeah, thank you a lot.
Exactly - are we speaking about these

wonderfully broken things and the talk
will be kind of like... I start with a bit

of an intro dump about the history of
emoji domains and what they actually are

and then I will talk about my personal
experience breaking things with them. So

yeah, let's start right of with the
history. So, DNS were standardized in

1987, with a very limited character set.
So, you can see, like, only roman naturals

and some numbers, and, like, four non-
letters. So these are definitely not

sufficient for many languages and it's a
very euro-centric view, or not even just

euro-centric, but it's actually very
centered on the english language and it

was clear that this won't suffice so in
1996, internationalized domain names were

posed, which allow encoding characters
that are not supported or that are not

officially supported into this very small
character set so that browsers could

simply convert them on the fly. This...
sources kind of disagree when this exactly

went live or when you could start it, when
you were able to use it for the first

time. The IDNA2003 standard allowed the
support, but the first emoji domains were

actually registered in 2001. Interesting
about these is that, in 2001, emojis

weren't part of Unicode yet. So you can
see these examples, like the "hot springs"

those do show as emoji. which is because
they are both emoji and Unicode pictographs.

So, not actually emoji domains at the
time, but right now, they were kind of

converted into emojis. Back then, they
were just pictographs. I couldn't really

find out if those domains actually
resolved if you entered the pictographs

back then or if it was just someone who
just was hoping they would rise in price

once IDNA2003 or whatever standard would
implement it, went live. So there was also

an IDNA2003 normalization, but that is not
too interesting for us because we just

want to look at the emoji side of things.
IDNA2008 actually banned emoji for most

major TLDs, because of concerns that it
would be used for phishing domains that

looked very similiar to actual, other
domains. Like every character exists as an

emoji, to be able to make to make country
flags, so that could be used for phishing

and they decided to ban it for most major
TLDs that comply with IDNA2003. Important

to my little story, in 2020, the emoji 13
standard added transgender pride flag

emoji. You'll see why that's important
later. So what actually is this punycode

encoding? It's non-human readable representation
of Unicode characters. So you can see this

symbol here would be translated x-n-dash-
dash C-8-H, which obviously doesn't make

much sense to type in but your browser
would take care of this. So, DNS didn't have to

be changed, it's only inside your browser
that these conversions happen. Compatible

browsers, depending on which browser you
use, will either intransparently or

semitransparently translate, Firefox for
example, as a mitigation to these phishing

attempts, does allow you to enter emoji or
other Unicode characters, but as soon as

you hit enter it will, the URL bar will
show this xn-dash-dash domain. Safari, as

far as I know, does not do it
transparently, so you will not know what

exactly the punycode representation is of
what you were just enterin'. And different

TLDs only support a specific subset as I
said, IDNA2008 actually banned it. Fun

fact, I forgot on the last slide: IDNA2008
went live in 2010 which is kind of

confusing, but whatever. Different TLDs
only support specific charsets, most don't

support emoji, but there are TLDs that
have "supporting emoji" as their main

selling point. TLDs that most people
wouldn't want to use unless they just

simply are interested in emoji. Why did I
end up breaking things with it? In early

2011... not 2011, 2021... this year - I
was unemployed and looking for interesting

ways to build my portfolio. I knew that
emoji were somewhat supported but I didn't

know what, how exactly it worked, I just
knew that there were some people that had

emoji domains and I was kind of happy that
there was a transgender pride emoji

added, so I decided, well, maybe it's a
good idea to add some domain that contains

this transgender pride emoji to also kind
of become less interesting for bigoted

potential employers. So, yeah, let's
register domain with that emoji. Well...

that seems to be a bit more difficult
because these domains, even though you

never really counter them, seemed to be
sold out. Nothing that I looked up worked,

and actually the web interface broke a
bit, but more to that later. Well... none

of these domains actually resolve to
anything: .dev does not support emoji at

all and namecheap doesn't support emoji
even with top-level domains that do

support them. So, I had to go to another
registrar, which was a bit annoying

because I thought, well, I like everything
in one place, not specifically I love

namecheap or anything. But, whatever. Few
months later, I am now the proud owner of

"transgender pride flag purple heart .
ws". At least, that what I think. So, I

just set up to build a small demo page for
it, and deploy it on my server and test it

and - wow. My server usually isn't that
slow. Timeouts... the route looks okay

inside my reverse proxy, trying again, and
after long time, I end up with this

wonderful error message. So we're sorry,
that domain is invalid. It also does not

show the transgender pride flag anymore,
but that could be down to the simply their

webfont not supporting it yet because it
was just added to emoji 13, at least

that's what I thought at that point.
Obviously, I was a bit scared because,

well I just spent 10 euros at something
and... I didn't really know when I would

have a stable income again so I did this
to find a new job and german unemployment

benefits are really difficult to get, so I
was a bit scared, but godaddy didn't sell

me some invalid domain or they also
definitely did not scam me, because if you

enter these exact characters that
apparently are invalid, it does resolve to

my server. So when I looked at the
godaddy web interface, it also showed

these three characters, the purple heart,
the white flag and the transgender symbol.

It's simply not the domain that I had
entered into the emoji domain search

engine. Wasn't just their webfont that
doesn't support it. And that is caused by

the wonderful zero-width joiners. To avoid
having tons of similar emoji, each with

their own code, many emoji are created by
combining others. So you have the skintone

modifiers for example or the country
flags, that are a combination of different

emoji with a zero-width joiner. The
transgender pride flag is a combination of

a white flag and a transgender symbol with
a zero-width joiner inbetween. And the

thing is, punycode does not really support
them so it was simply just dropped during

conversion while I bought my domain. But
that's not everything. Because I still had

this project, I still wanted emoji domains
and my interest was peaked so I wanted to

try out what else I could break. To avoid
spending even more money on this

project, I just moved my testing to sub
domains which was a good idea because I

have way more control over sub domains
than I have over regular ones. I can

register them with any registrar, so I
could use my go-to registrar. I can

register whatever strings I want, so even
invalid punycode. I can register them

under a TLD that does not allow it because
it's not a second-level domain but a

third-level domain. And, yeah, let's see
what browsers do about that. So I created

the sub domain "transgender pride flag .
dysphoric . dev". Firefox converts it to

xn-- and I'm not gonna say all that.
Chromium converts it to a different

string. Which, if you plug any of those
into a converter, it will tell you

that both are invalid punycode. However,
both are understood and routed, so I just

simply added an [unintelligible] all-route
to my reverse proxy, so that both would

work. If you use dig, which is a command-
line tool that lets you look up domain

records - first of all, it doesn't do the
punycode conversion at all, so I had to

use one of the strings that one of my
browsers gave me, but when I use that

string it also gave me this "It's not a
valid IDNA2008 name. Disable validation

using these tool parameters." also didn't
tell me that I needed both. So I added the

first and then, oh, you still need the
second. But, whatever. Once both were

added, I was able to get correct results
and my site was reachable. The next thing

I thought of was, what if I will move my
domain to a non-supported registrar,

because as I just talked about, namecheap
does not actually allow emoji domains and I

was interested to see how their web interface
would handle it. Sadly, it simply did not

handle at all, because they don't support
.ws domains. I wasn't really going to

contact their support team to try and
still get it because this was only a

simple thing that I will probably just
simply not interested in hosting that

domain because it breaks their web
interface if you try to. Or other things

about emoji domains break their web
interface, so I don't really see why their

support team would actually be on my side
here. So, what about email? Because,

apparently, email clients really enjoy
breaking. From my experience at least. Do

they break with emoji? When trying to add
an emoji domain as a sender, my mail

server actually broke because validation
was run after punycode to unicode

conversion, which caused an uncaught
exception, which was suprising, it's

already fixed but the patch is not
released yet so I couldn't yet test it.

But there's still the local part which I
could already control as much as I wanted

to and the [unintelligible] so Thunderbird
simply ignored it and showed the punycode

and Apple Mail dropped the zero-width
joiner and also showed the punycode under

the thing where it shows the exact domain.
So, mixed results, nothing too spectacular,

no exceptions or crashing clients or
anything interesting like that, sadly.

What did I learn doing this? Well,
obviously emoji domains are very buggy.

Implementations vary from browser to
browser so you can have the same input

string and get different punycodes out of
it, so testing in just one browser

definitely is not enough, well, it never
is, but here especially it isn't. And, you

may be able to buy a domain that won't
work as you would think which can cause

quite the annoyance. But it's still a lot
of fun to mess around with this stuff,

just not for productive use. I like to end
my talks but telling people to join a

labor union that doesn't have anything to
do with this but that's what I do for some

reason. And I've got also a blog post
about this where I've written it up and I

would publish the slides under the
wonderful domain "poop emoji nycode . ws".

It's just a link to my regular blog for
now. I'm sorry. I think I went a bit fast

but I still thank you for your time and
I'm open to questions.

Herald: [talks, but no sound is audible]
Herald: I'm online... oops, I'm sorry. I'm

awfully sorry, my machine is slow. I muted
myself about half a minute ago. Thank you

for that beautiful talk, Jennifer. I had
to grin a couple of times, because it was

great and it made my day. And actually we
have a question. The question is in

German, I'll say it in English: why is DNSSec
so complicated for emoji domains?

dysphoricUnicorn: Well, because no one
actually really likes emoji domains except

the people who sell them. At least that
was my experience looking up things for

that. So, they are kind of disallowed in the
standard, but just some of top level domains just

ignore the standard and still let you register
them and it's just something that people

will implement things don't want to think
about at all. I haven't actually tried

DNSSec, but it's just something that is
easilly forgotten because it shouldn't

actually exist, which may
be a bit harsh, but...

Herald: Is - you remember the ringtone
fads when smartphones didn't exist yet -

is this just a fad like this ringtone
thing and it will just disappear within

the next couple of years or would you
think emojis are here to stay? Is this

serious?
dysphoricUnicorn: I think emojis are here

to stay but not within domains or... like,
it was possible since 2001, kind of, but

at least since 2011 where the first actual
emoji domain was registered. But most

domains that are, like, popular examples
already don't resolve anymore or resolve

to sites that say "emoji domains". So,
emoji domains definitely are not much more

than a fad or a nice, funny thing to just
look at for a bit. However, emojis as a

whole are such a large part of our
culture, I don't think they're going to go

away any time soon because it's been more
than ten years and the annoying

downloadable ringtones were popular
for a bit less time, I think.

Herald: This is a question that I actually
wanted to ask myself as well, because I

run my own email server as well and...
which email server software do you talk

about? Do you know about
supporting the others?

dysphoricUnicorn: Errm...
Herald: What do you use as a software on

your email server?
dysphoricUnicorn: My email server is

running on mailhue, which is a set of
Docker containers that are specially made

to work together to make setting up an
email server as painless as possible for

free. So I haven't actually tested any
other servers, however in theory they

shouldn't actually have any issues. So, the part
of mailhue that failed wasn't actually the

mail server part. It was simply a parser.
So, in theory, with another mail server,

it should work, if they didn't also mess
up parsing at some point.

Herald: Somebody asked here, is there a
list of top-level domains that support

emojis and somebody posted and answering
Wikipedia, is that correct? Wikipedia has

such a list?
dysphoricUnicorn: It has, but it isn't

actually correct, the list, that it has it
is the english Wikipedia. It lists at

least one domain that no longer supports
emojis which is actually kind of a big

political thing where they removed
support. So, the Wikipedia list is not

complete or contains too much. There are,
however, registrars, that are specialized

in emoji domains and those will have
current lists. So, I had .ws as one of

them. It's not the red heart emoji, though
because that's invalid punycode and so I

don't really know what to enter in my URL
bar to get to them other than searching

it on Google, so...
Herald: laughs Next question, is there a

difference between single punycode and
multiple emoji chained together as a

second or third level domain?
dysphoricUnicorn: It's just different

punycode, depending on how many emoji you
have but theoretically, the implementation

for this would just, I think the technical
term was ASCII-to-Unicode something, which

is like, an algorithm to convert it, does
handle multiple emoji similarly. Or - it

should work without any
issues if one of the two works.

Herald: Are there any emoji
first-level domains?

dysphoricUnicorn: No. There are not. There
are punycode first-level domains, because

there are languages that simply do not use
the same letters as english does, so

punycode first-level domains are existent
but no emoji first-level domains at this

point. Maybe there will be, but I kind of
doubt it because the people in charge of

this emoji domains are kind of an eye sore
to them from what I could read, so...

Herald: Talking about eye sores: I always
have the impression, that at least to the

old coders, diacritical signs in
themselves were considered an eye sore.

You know, that funny little dots those
German speaking people have up there.

Don't talk about the Czech and the Poles.
Now, my name contains such a diacritical

sign, my first name is André and I've been
fighting with all kinds of inputs that say

7 Bit ASCII and nothing else. Do
diacritical signs still break domains?

dysphoricUnicorn: They should not, because
are actually reason why IDN's exist. So it

was actually proposed by someone who has
one of those sign in his name and probably

just wanted the domain with his name. This
was the actual reason why we have punycode

in the first place and supporting emoji
was kind of an unwanted side effect. So in

theory, it should work without issues but
still many people don't think about it

enough when implementing their own thing,
so you can never be too certain that it

will. But it should.
Herald: seventy posted here, seventy

obviously runs a Windows, and in Windows
10, the emoji menu with the combination of

the Windows and the full stop. Is that
common already or is that new? I think

it's common by now, it's been implemented
and ever since then everybody's been using

emojis. And there is also a remark that
says "MS Outlook has actually pretty good

unicode-punycode support but still don't
try emojis". I remember a story about when

the Bosnian wars broke, when the Yugoslav
war broke, especially the ones in Bosnia

broke out, there were about a hundred
thousand Bosnians that fled to

Switzerland, and about fifteen thousand
were granted citizenship, but they

couldn't be registered in the citizenship
register, because that only supported

7-bit or 8-bit ASCII but no diacritical
sign of [unintelligible]. I think they

fixed it by now but that was quite a thing
some years back. I see no further

question, - oh, there is one ... coughs
... one... coughs excuse me that came in

right now... coughs... is there a
uniform way to generate punycode over

multiple platforms? Mobiles do not work
well with entering unicode numbers as we

all know.
dysphoricUnicorn: I'm not sure I

understood this correctly. The easiest
way that I used during my testing was a

simple online converters that would work
on every page. And actually my system

doesn't have a shortcut for emoji so I
would always copy and paste from

emojipedia into an online punycode converter
and just use it from there. Because I

don't actually use emoji that much.
Herald: Okay, we've come to the end of our

time. We still would have another minute
or two, but we have no more questions.

Thank you in the meantime for coming and
holding this talk. You have another talk.

I think it's tomorrow?

Outro

Subtitles created by c3subtitles.de
in the year 2021. Join, and help us!