WordSafety – Check a name for unwanted meanings in foreign languages - <AUTHOR> http://wordsafety.com/?hn=1 <comment><USER4> Hey guys, I made this last week as a two-evening side project. Happy to see it posted here, thanks randall!

I know the word lists aren't complete. This was the best I could do given the time constraint, the fact that I don't actually speak 19 languages... And also, after two evenings of googling dirty words, I started feeling like I'm about to acquire Tourette's in some unknown language ;)

I'll update the database with the words submitted here and through the form on the site. Thanks!

\--

Edit -- here's Google Analytics for this site after 1 hour on the HN frontpage:

[http://wordsafety.com/img/analytics_2015-08-25_1736.jpg](http://wordsafety.com/img/analytics_2015-08-25_1736.jpg)

This is a site that had essentially zero traffic before HN, so I figured this would be a potentially interesting glimpse into HN's audience.

<comment><USER5> You may want to look at slang as well. I tried both "knob" and "bell end". It said both were safe. Maybe they may be safe-ish in the US, but in Britain they are definitely slang words that could result in quite a chuckle if you named your app that.

<comment><USER6> Or "root" in Australia.

<comment><USER7> Quick, somebody point me in the direction of some witty australian UNIX jokes.

<comment><USER4> What did the sysadmin buy her wife for Valentine's Day? A rootkit.

(Just made that one up... Not genuine Australian. Also, I can't tell jokes.)

<comment><USER8> well your jokes certainly fit.

</comment></comment></comment></comment></comment></comment><comment><USER9> Dutch: [http://www.taalkabaal.nl/scheldwoorden/indexa.php](http://www.taalkabaal.nl/scheldwoorden/indexa.php)

Have fun. Some of these are spelled incorrectly, so run them through a spell- checker.

While I'm at it, let me translate some personal favourites. I realize they are quite long and unlikely candidates for the next hot SF start-up, but why keep knowledge away from the masses:

adderengebroedsels - offspring of vipers

argeologisch kontfossiel - archaeological ass fossil

bosuil - Strix aluco

duinbewoner - dune dweller

ebverzuiper - person who drowns during ebb (burnnn)

greppelheks - ditch witch

ingeblikte atlas - canned atlas (??)

janksnor - literally "crying mustache"

kamelenzuurvleesoog - literally "camels-Sauerbraten-eye" (???)

mountendeldarmbeklimmer -- literally "climber of Mt. rectum"

paashaasschaamhaarverzamelaar -- literally "collector of Easter Bunny pubes"

rioolpinguin -- sewer pinguin

tepelbaviaan -- nipple baboon

I have submitted several short and useful Dutch words to grant myself license for this comment.

<comment><USER10> I want to start a razor startup now just so I can call it Janksnor.

<comment><USER11> Dollar Shave Club... but for Scandinavia.

Or a brutally fast Handlebars implementation.

</comment></comment></comment><comment><USER12> "He had a computer that knew all the names of all the companies, and another one that checked if the made-up word meant "dickhead" or something in Chinese or Swedish."

\-- William Gibson, "Mona Lisa Overdrive"

[https://books.google.se/books?id=QojrNYyGMyEC&pg=PA118#v=one...](https://books.google.se/books?id=QojrNYyGMyEC&pg=PA118#v=onepage&q&f=false)

</comment><comment><USER13> "bite" is safe according to this tool. Any french speaker does a double take when they see that word though, especially in certain sentences.

For reference: [https://askafrenchguy.wordpress.com/2012/02/07/petite- bites-...](https://askafrenchguy.wordpress.com/2012/02/07/petite-bites-pauvre- nancy/)

Edit: Yes, I have submitted it to the database, it should get vetted eventually. A crowdsourced process for the vetting could be fun too!

<comment><USER14> "pipi" as well [http://i.imgur.com/VcSKnTb.png](http://i.imgur.com/VcSKnTb.png)

<comment><USER15> In Dutch pipi is dialect for urination, often used when talking/referring to children.

<comment><USER16> In Spanish it's exactly the same.

I wonder were the roots of that is?

<comment><USER17> In polish it's "psipsi" which is clearly an onomatopoeia.

</comment></comment></comment></comment></comment><comment><USER18> So this seems to work for a very small subset of the words I typed. Also, it seems to only check against dictionary meaning and not cultural usage.

"Tatsu" means "to stand" in Japanese, but is culturally used for erection. This is just an example, I tried a bunch which I know and none were flagged.

<comment><USER19> I think this is a case of 'the product is YOU!'

notice the little box 'enter word here'? :P

<comment><USER20> That box doesn't seem to permit adding cultural referents / context. If we added all normal words that _can_ have another meaning, it'd flag almost everything.

</comment></comment></comment><comment><USER21> I saw this and immediately thought of an old story where General Motors tried to sell the Chevy Nova in South America. It hardly sold at all in South America even though it was a hugely popular car in North America. The reason turned out to be that "No va" in Spanish translates to "won't go" so GM was basically trying to sell a sporty car with a misleading name.

Unfortunately this website wouldn't have helped GM sell the Nova since it's only looking for profanity, but I think that the concept is great and clearly needed. I hope you develop it further and get to make some money off of it. Great job!

<comment><USER22> For what it's worth, the "Nova" story is a myth: [http://www.snopes.com/business/misxlate/nova.asp](http://www.snopes.com/business/misxlate/nova.asp)

<comment><USER23> Here is a whole list of cultural misunderstandings of car manufacturers [http://www.oddee.com/item_93544.aspx](http://www.oddee.com/item_93544.aspx)

</comment></comment></comment><comment><USER24> One of the most recent corporate mishaps I've learned of is Microsoft Nokia calling their phone "Lumia", when in Spain "lumi" or "lumia" is an informal word to mean "prostitute".

Your app doesn't reflect that. I was going to say that you need to source slang dictionaries, but this one is in the Diccionario de la Real Academia:

[http://buscon.rae.es/drae/srv/search?val=lumia](http://buscon.rae.es/drae/srv/search?val=lumia)

And even in the first random online bilingual dictionary Google threw up:

[http://diccionario.sensagent.com/lumi/es- en/](http://diccionario.sensagent.com/lumi/es-en/)

So maybe do a bit of scraping/spidering of multilingual dictionaries, starting with your collected list of bad words?

<comment><USER25> I think Wiktionary is a great and underutilized resource. Fairly good coverage, free, and easily amendable. There is in fact an entry for _lumia_ : [https://en.wiktionary.org/wiki/lumia#Spanish](https://en.wiktionary.org/wiki/lumia#Spanish)

It's actually the basis for a site called The Alternative Dictionaries which features "colorful extracts": [http://www.alternative- dictionaries.net/](http://www.alternative-dictionaries.net/)

</comment></comment><comment><USER26> I'd be really interested in knowing how do they do the phonetic matching. Things like, the nonexistent English word "bocket" sounding like Brazilian slang for blowjob ("boquete"), but only when spoken the way a Brazilian would.

I think this cross-pronouncing thing would actually be harder to tackle: It's more important to try to match the way users on their home locale would say the foreign term, than the way the foreign people would say it.

To illustrate what I mean, consider the word Skype, said in Portuguese, is pronounced as if it were spelt in English as "Shkuipy" (I mean [ʃkaj'pi]).

<comment><USER27> The lack of phonetic matching is a problem - the most (in?)famous example of this was the Chevy Nova, which phonetically sounds like 'doesn't go' in spanish.

<comment><USER26> Regarding the Chevy Nova, I always found that story very hard to believe. While it may seem plausible for someone who does not speak Spanish, someone who does would quickly note the fact that "no va" is pronounced /no'βa/ (stress on the second syllable) while Nova would be pronounced /'no.βa/ (stress on the first syllable).

These two sounds would not be perceived by a Spanish speaker as being the same.

<comment><USER28> Yes, I've heard that saying "Nova" is read as _no va_ is like saying "notable" is read as "no table".

(of course, the classic Spanish screw-up is the Mitsubishi Pajero, which has no excuse whatsoever: that's unambiguously the Mitsubishi Wanker)

<comment><USER29> I always thought that someone in Mitsubishi named the Pajero knowing exactly what it meant in Spanish as a joke.

</comment></comment></comment></comment></comment><comment><USER30> Obligatory Arabic story of the last few years: the Pakistani ambassador who was rejected for service in the Gulf, because his name is Akbar Zib.

This is Arabic for biggest cock.

[https://encrypted.google.com/search?hl=en&q=%D8%B3%D9%81%D9%...](https://encrypted.google.com/search?hl=en&q=%D8%B3%D9%81%D9%8A%D8%B1%20%D8%A8%D8%A7%D9%83%D8%B3%D8%AA%D8%A7%D9%86%D9%8A%20%D8%A7%D9%83%D8%A8%D8%B1%20%D8%B2%D8%A8)

No reputable source mentions this; only crap newspapers in different countries mention this. But every person I know in the Arab world knows this internet meme.

Almost as bad as naming your son after a deceased Libyan dictator, before he was dead of course. Perhaps I know one of those too. Talking about parenting jokes.

<comment><USER31> There's a guy on Israeli TV named גיא פינס--pronounced "Guy Penis." How's that for a name?

<comment><USER32> The classic example of this is the Ford Pinto. That was a naming mistake. (Try it)

</comment></comment></comment><comment><USER33> "expertsexchange" only matches the Chinese "cha", and not "sex" or "sexchange".

<comment><USER34> Coincidentally cha1 ("1" here means the first tone in pinyin) is a sexual innuendo alluding to sexual intercourse. The character itself, which means "to insert", has nothing to do with sex in normal usage though. And most importantly, there is virtually zero resemblance between the pronunciation of "change" and that of "cha1".

> to have sex (lit. insert).

> Source: a long list of Chinese profanity on Wikipedia.[0]

[0] [https://en.wikipedia.org/wiki/Mandarin_Chinese_profanity](https://en.wikipedia.org/wiki/Mandarin_Chinese_profanity)

</comment></comment><comment><USER35> Tried the Spanish word "pajero" (usually translated to "wanker" or "tosser"). Mitsubishi named a car "Pajero" and they had to change the name to "Montero" in Spanish speaking countries.

Another unfortunate car name is Suzuki Moco. This word neither appears in this app. "Moco" means "snot" or "booger" in Spanish.

<comment><USER36> I have found it's important when emailing/texting in Spanish to put the tilde in 'año', when I normally wouldn't bother with an American keyboard.

<comment><USER37> US-Based native Spanish speaker here. Very important indeed, specially when asking someone their age :) Whenever the ñ is not available (foreign keyboards, mobile, etc...), a decent substitute is "anyo", which is phonetically equivalent and also happens to be the Ladino variant of the word.

<comment><USER38> Agno is safer (same idea as in 'gnu'). "Anyo" is close phonetically to "anillo", that is a ring, but also a common source of jokes about little Frodo's sexuallity.

<comment><USER39> I think Catalan people don't have the "ñ" letter in their alphabet and they use instead this combination "ny" for that particular sound.

<comment><USER38> Well, catalan people have the ñ letter in their alphabet because they are spaniards, is just that some of them prefer to ignore this for political reasons, and they choose instead to do simple things complicated.

Both systems are a question of convenience, so no one is perfect. You can choose between the useful (and trendy in two or three spanish communities) "ny" or the older "gn" charged of historical context and showing lots of connections with other latin languages like french. Be aware also that "ny" leads easily to a "nll" sound that can be annoying, specially when is placed next to an 'i'.

This is just a personal opinion. Is perfecty ok if you think different, but if you are interested in mastering the second language with more native speakers in the world, I'll suggest to avoid the political experiments of the modern catalan and save yourself a lot of future headaches with grammar and orthography. To replace the 'ñ' by '~n' will work in most of the cases also.

<comment><USER40> And this, kids, is how a Spanish hater looks like.

If anyone is interested, Catalan[1] is a Latin language spoken in Catalonia and other areas of the North East of Spain, South of France and a city in Italy. It is also the official language of a country: Andorra.

It has about 10 million speakers[2], a bit more that Swedish, that is an official working language in the EU.

Its use has been forbidden in Spain during 300 years[3] -until the death of the Spanish fascist dictator Francisco Franco- but, even though it has managed to survive until today.

And there's a top level domain, .cat[4], that is intended for websites that use Catalan language.

Also, and we don't use Catalan because we are doing political experiments, or to annoy Spanish people. We use it because, for some of us, is our native language!

[1]: [https://en.wikipedia.org/wiki/Catalan_language](https://en.wikipedia.org/wiki/Catalan_language) [2]: [https://en.wikipedia.org/wiki/Languages_of_Europe#Number_of_...](https://en.wikipedia.org/wiki/Languages_of_Europe#Number_of_speakers) [3]: [https://en.wikipedia.org/wiki/Catalan_language#Spanish_state...](https://en.wikipedia.org/wiki/Catalan_language#Spanish_state:_18th_to_20th_centuries) [4]: [https://en.wikipedia.org/wiki/.cat](https://en.wikipedia.org/wiki/.cat)

<comment><USER38> And this, kids, is one of the many problems with some Catalonian people. Persecutory delusion. "Spain hates us".

<comment><USER40> I was answering to you, not to all Spain.

And I did because I think that your comment stating that Catalan language and culture are a "political experiment" is not only offensive to Catalans -and anybody a little common sense- but also shows that you have a huge lack of understanding about Spanish culture and history.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> Pretty cool. And the example I chose, funny.

I searched "foda" (f--- in Brazil) just to try it out, here's the result, which actually mentions the Amazon. [http://i.imgur.com/CUpSgN6.png](http://i.imgur.com/CUpSgN6.png)

<comment><USER42> You don't have to go very deep into the Amazon at all for that to be an insult. :-) What an amusing example.

</comment></comment><comment><USER43> There needs to be a "No results found" type result. Currently it's impossible to tell the difference between no result and an empty result.

</comment><comment><USER44> Interesting, I recently found out that one of my usernames on a popular game means "shitman" in finnish or swedish, not through this site though (and it doesn't appear to bring anything up). Great idea though!

Also the word search field has an XSS, try entering "<script>alert(1)</script>". Not sure if it's a big deal but it's good to be safe.

</comment><comment><USER45> I believe you can make a good use of [http://www.urbandictionary.com/](http://www.urbandictionary.com/) to update your database, because there are also lot of foreign words, which you miss at the moment. (pula - Romanian for dick, fasz - Hungarian for dick, piča - Czech/Slovak for cunt, etc.)

<comment><USER46> They have an unofficial API[1] that could be used.

[1] [http://api.urbandictionary.com/v0/define?term=culo](http://api.urbandictionary.com/v0/define?term=culo)

</comment></comment><comment><USER47> Suggestion for improvement: numbers.

I was about to name a project "Plate88", and a couple of people independently pointed out a reference to the nazi salute [1].

We then renamed it to Plate28, hopefully safer.

Anyway, maybe worth considering these use cases.

[1] [https://en.wikipedia.org/wiki/88_(number)](https://en.wikipedia.org/wiki/88_\(number\))

<comment><USER48> Which brings us to the second part of naming things. I wouldn't tell someone in NASCAR country that 88 means a nazi salute unless you really want to offend.

<comment><USER47> Exactly -- we want to do a healthy/educational thing, imagine our surprise knowing that...

<comment><USER48> I guess I would say the bad meaning of 88 is not very relevant and certainly shouldn't stop a company operating in Asia from using it. Heck, a golf company using 88 would mean double snowmen rather than any dark meaning beyond a bad score.

</comment></comment></comment></comment><comment><USER49> It's great :-)

However, could I Suggest there are two markets for this and you might be falling between two stools.

Firstly there is the market we have here - looking for dirty words in different languages. I _love_ the petites bites ad - and it would be great to have a crowd sourced "daily WTF" site of amusing failures

But the usage of your site looks ... Serious, with half an eye maybe on charging marketing departments for access. Which is almost impossible because no sane database can catch MR2.

But if the entertainment site catches on, you have a ready made list of reliable dirty-minded experts whose private opinions and double entendres you can charge marketing depts to put their ideas in front of them - confidentially ensuring they don't screw up. And given that the number of language to language potential screwups is n^^2 and the experts are n you should be ok.

Anyway - it's a lovely idea and reminds me of Douglas Adams' "Go stick your head in a pig".

</comment><comment><USER50> _" Results for "Hello"

"hell"

English: heck

Direct match at start or end, potentially serious issue! 335 million native speakers, about 1.5 billion speakers in total."_

Isn't that overdoing it a little?

<comment><USER51> False positives are far more useful than false negatives.

</comment></comment><comment><USER52> Excellent idea.

Given the number of people here who missed the "add a word" function, you might want to mention it up top with a negative result.

> No results found for this search. It looks likely that it's safe...

say this in hopes to get fuller coverage because it looks like a useful tool.

<comment><USER4> I updated the "no results" text, thanks!

</comment></comment><comment><USER53> Yeah, also, a classic one we had here in Sweden:

Honda released this new small car model named "Honda Fitta", and one of the slogans were something like "small on the outside, large on inside".

In Swedish, "Fitta" is a crude word for female genitalia.

The car was quickly renamed "Honda Jazz".

A link to a Swedish article, translated by Google:

[https://translate.google.com/translate?sl=auto&tl=en&js=y&pr...](https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.automotorsport.se%2Fartiklar%2Fnyheter%2F20020403%2Ffitta- blev-dyr-affar-for-honda&edit-text=)

<comment><USER54> I was going to post something about this myself, but decided it was still unverified. The Auto Motor & Sport article was as far as the trail took me. It quotes the Dagens Nyheter, which in turn quotes an anonymous Japanese car magazine, whose article may or may not be true (if it exists at all).

This has the hallmarks of an urban legend: Japanese car manufacturers do have previous form with the Toyota MR2 and Mitsubishi Pajero, so the story is plausible; there's a moral here; and the story has not been followed all the way to its original source.

</comment></comment><comment><USER55> There's a company here in New Zealand called RaboDirect. Rabo means "tail" in Portuguese (and in Spanish maybe?). But it can also mean arse or ass. In most cases I'd think people were talking about arses than about tails. This was not caught by wordsafety :/

Not sure if you are breaking up words. I remember a friend told me about some algorithm that works for that, and is used by German linguists... not exactly stemmers, but there was another thing that could be useful too.

Anyway, thanks for sharing! Looking great.

</comment><comment><USER56> I've submitted it but it brought up nothing for "wog". Did this due to the "wogrammer"/"wog" issue pointed out on Twitter yesterday. I haven't heard it in recent years but "wog" was used much like the n-word when I was a kid in the UK and appears to still carry some of that meaning: [https://en.wikipedia.org/wiki/Wog](https://en.wikipedia.org/wiki/Wog)

"slope" is another, but I don't know if I'll submit it since no-one seemed to have heard of it at the time. Jeremy Clarkson got in trouble over it though - [http://www.telegraph.co.uk/motoring/top- gear/10995483/Jeremy...](http://www.telegraph.co.uk/motoring/top- gear/10995483/Jeremy-Clarksons-slope-joke-on-Top-Gear-was-deliberate-use-of- racist-term-Ofcom-rules.html)

I absolutely love the idea of having a newsletter on the backend full of awful words submitted though - a rather "cute" idea.

</comment><comment><USER57> I looked up "Bora". No results. The Volkswagen Bora was somewhat famous in Iceland because "Bora" means "Anus". You could drive the Volkswagen Anus! The vendor went out of its way to mispronounce the name in their TV ads as "Bóra", which would be like pronouncing "Anus" as "Aneece" or something like that.

</comment><comment><USER58> As we are in the subject, does the brand names "Dickies" "Dick's Sporting Goods" or even the character "Dick Tracy" seems awkward name choices for US people/native english speakers?

As a ESL, the first time I heard of them it was kind of funny. I guess when one grows up in the context of those names is not that appalling...

<comment><USER59> You're exactly right. Growing up with the words removes them from being recognizable as dirty. Note also, Dick is a name (or nickname for Richard). Language is weird sometimes...

</comment></comment><comment><USER60> This is great! There are certain puns/combos that would be really hard to catch though.

For example - the Ford Nova. In Spanish, it literally translates to "no va" "doesn't go". Terrible name for a car.

I'm unsure how to make this understand the context of the product, but that would be the next step

<comment><USER61> I've always been pretty skeptical about Nova in particular. It's like an English speaker going to a restaurant named "Notable": we wouldn't expect to have to eat on the floor.

</comment></comment><comment><USER62> This is really a shame, I would hate to see unintentionally awful things in corporate media go away!

</comment><comment><USER63> How do you account for spelling?

In Fijian, "caita" means "fuck" or "fuck it", but the word is pronounced "thaita". From a fijian perspective, seeing both "caita" and "thaita" would bring the swear-word to mind.

</comment><comment><USER64> It fails on the classic Nova check: [https://en.wikipedia.org/wiki/Chevrolet_Chevy_II_/_Nova#Urba...](https://en.wikipedia.org/wiki/Chevrolet_Chevy_II_/_Nova#Urban_legend)

<comment><USER4> It would be really hard to capture this kind of double meaning that only applies to a certain product category... "Doesn't go" is certainly an unwanted association for a car, but it wouldn't matter for most products.

To make it more complicated, "nova" actually has the same astronomical meaning in Spanish as in English:

[https://es.wikipedia.org/wiki/Nova](https://es.wikipedia.org/wiki/Nova)

So it's fine in some contexts, bad in some very specific context. Someone smarter than me will probably crack problems like this with AI...

</comment></comment><comment><USER65> It would be nice this detected double meaning phrases, although it might be hard to implement. In spanish many combinations of 'safe' words will generate very 'unsafe' meanings, probably many other languages too.

</comment><comment><USER66> Italian one needs work. It did not have 'minchia' in it, which is no longer even all that regional, AFAIK. Didn't have 'mona' either, although that could be foregiven as it's dialect in the Veneto.

<comment><USER67> italian is definitely lacking. it doesn't recognize STOCATSO nor ESTIGRANQATSI nor euphemisms such as patata, passera..

</comment></comment><comment><USER68> If only Miyazaki would have had this when he named _Laputa: Castle in the sky_

<comment><USER69> FWIW, he got the name from Jonathan Swift:

[https://en.wikipedia.org/wiki/Laputa](https://en.wikipedia.org/wiki/Laputa)

<comment><USER68> Who... apparently didn't speak Spanish.

<comment><USER70> >As "la puta" means "the whore" (see Spanish profanity), some Spanish editions of "Gulliver's Travels" use "Lapuntu", "Laput", "Lapuda" and "Lupata" as bowdlerisations. It is likely, given Swift's brand of satire, that he was aware of the Spanish meaning. (Gulliver, himself, claimed Spanish among the many languages in which he was fluent.)

[https://en.wikipedia.org/wiki/Laputa](https://en.wikipedia.org/wiki/Laputa)

</comment></comment></comment></comment><comment><USER71> Do not trust yet - list is not complete. Some known Polish bad words are not there.

<comment><USER72> Phonetic does not work also. Tried qrwa, qurwa, kuhrwa,. Nothing. They also find hui (russian) but not huj or chuj.

<comment><USER17> Yeah, I've had some fine time trying to remember most of polish swear words. But it will probably never properly take into account the variety of word "pierdolić".

</comment></comment></comment><comment><USER73> Just tried the word "crotte" which means "dung" in french. It returned "No results found for this search. It looks likely that it's safe." Phew, it's a good thing I speak french :)

</comment><comment><USER74> Maybe it should include English words as well?

Beaver returns nothing

'caca' and 'pede' do return, so props for that

'bosta' matches but maybe Josta should?

'sharmuta' also matches (with a different spelling, but it's probably a variation)

<comment><USER75> Yes, it seems to be missing a fair bit of English slang, like "fanny", "root", "gigolo"...

</comment></comment><comment><USER76> False positive: "hat" was flagged for "idiot" in English. I can't find a dictionary with that definition, and it's not one that I'm familiar with as a native speaker.

</comment><comment><USER20> Is a start. How about death and failure type words? Muerta doesn't elicit any warning. And 'Nova' is famous for its Spanish meaning (apocryphal?) - <USER2> like that might be hard to catch.

</comment><comment> V-2 It's reasonably good - I tested it for Polish swearwords, it misses some no- nos, such as "alfons" (which stands for "pimp"), I actually submitted this :)

It reminded me of this major company [https://en.wikipedia.org/wiki/Osram](https://en.wikipedia.org/wiki/Osram) whose name happens to be "future tense conjugation of verb >to shit<" (a spot- on match, and the website correctly detects it) :)

It was founded in 1919 when the website didn't exist yet

</comment><comment><USER77> Found a hole on my first try. 'Foda' in Portuguese is 'fuck', yet the app deemed it to be safe. 'Foda-se' (fuck you) wasn't there either - <USER3> both.

</comment><comment><USER78> I've been blessed to name my new startup "Phucker."

<comment><USER79> "phuck" works as well

</comment></comment><comment><USER80> > _We respect your privacy — input is never logged or monitored._

Except it _is_ logged and monitored by the US Government because this site uses unencrypted HTTP.

Otherwise, a commendable sentiment…

</comment><comment><USER81> Anyone find any real-world matches? I was able to get positives by typing in foreign curses directly, but couldn't find any startups with foreign curses in their name.

<comment><USER26> Not a startup, but yesterday I was impressed with the font Skolar, which name I mistakenly remembered as Skola, and apparently it's considered close enough to "Chola", which is Hindi for clitoris.

The "level of worriness" does go down (pun intended) when I type the font's correct name.

</comment></comment><comment><USER82> Similar app for iOS: [https://itunes.apple.com/us/app/profanity- check/id923020053](https://itunes.apple.com/us/app/profanity- check/id923020053)

Blog post: [http://blog.lexiconbranding.com/2015/05/12/our-first- iphone-...](http://blog.lexiconbranding.com/2015/05/12/our-first-iphone-app- profanity-check/)

</comment><comment><USER83> Doesn't catch "tineh", which is apparently a derogatory term for Indians [http://www.urbandictionary.com/define.php?term=tineh](http://www.urbandictionary.com/define.php?term=tineh), so probably wise to also check UD and Google.

I was going to have that as part of my company name until I discovered that (tineh is a transliteration of the word for "fire" in Irish).

</comment><comment><USER84> 'Results for "nova": Spanish: did you know that the popular anecdote about the Chevrolet Nova is an urban legend? Google for "snopes nova".'

I liked that.

</comment><comment><USER85> It doesn't list the word "Belgium". Even though according to Douglas Adams that's the most offensive word in the galaxy. :)

</comment><comment><USER86> This would sell much better as baby name checker.

</comment><comment><USER87> Where was this when these guys were picking their name?

[http://pidora.ca/](http://pidora.ca/)

<comment><USER88> 155 million native speakers.

</comment></comment><comment><USER89> Aren't you the creator of Pixel Conduit? I used your tool for some VFX works and recently saw that you are creating software for web animations, but it ia a surprise to see you come up with such a tool. By the way, I am planning to create a slang database for Turkish and Turkic languages. I would like to share the database with you as I develop.

</comment><comment><USER90> It seems that "fuk" is not recognised as sounding like "fuck". Might want to look at that phonetic matcher :)

<comment><USER91> While it could help some people around to know about it: [http://www.tripadvisor.fr/Restaurant_Review-g298113-d4906941...](http://www.tripadvisor.fr/Restaurant_Review-g298113-d4906941-Reviews- Fukyu_an-Takayama_Gifu_Prefecture_Chubu.html)

</comment></comment><comment><USER33> I think this should also do a phoneme based comparison, for example the photo sharing website Flickr is pronounced like this word (as a slang word it is well known) [https://en.wiktionary.org/wiki/flikker](https://en.wiktionary.org/wiki/flikker)

<comment><USER92> Do you know of any high-quality phonemic dictionaries?

<comment><USER42> There is such a thing for English, the CMU Pronouncing Dictionary.

Very, very useful, although specific to American English.

[https://en.wikipedia.org/wiki/CMU_Pronouncing_Dictionary](https://en.wikipedia.org/wiki/CMU_Pronouncing_Dictionary)

I've succeeding in using it to solve puzzles that had to do with how words were pronounced, as opposed to how they were spelled.

</comment></comment></comment><comment><USER93> Excellent idea, but the lists need to be expanded. Didn't catch any of the Slavic words I threw its way.

</comment><comment><USER94> Is Russian really supported? I tried both Cyrillic and Latin transliteration of some words and it reports it's all safe. For example, try any of the Russian synonyms for "shit". "говно" transliterates to "govno" and both check out as safe.

</comment><comment><USER95> Submitted bunch of Nepali swear words. People in Nepal will laugh out a loud when English speaking people talk about renting a Condo or generating a Rand number. Here are few /swear/ words in Nepali (Spoken by ~30M people)

Chick

Goo

Moose

Turi

Condo

Moot

Rand

Chalk

Lado

PuT

Fuse

If you are wondering what these words mean check this:

[http://www.youswear.com/index.asp?language=Nepali](http://www.youswear.com/index.asp?language=Nepali)

<comment><USER96> Turi and Lado are not words in English? (Unless I'm very much mistaken). All the other's are, bar Rand, but that is a variable name beloved of coders!

<comment><USER95> Turi prefixes Turing (which means the act of pissing in Nepali) and Lado is popular in Spanish i guess.

</comment></comment></comment><comment><USER38> One of the funniest in Spain: facultad (faculty). An innocent word, with a very common and poisoned abbreviature. "Nos vamos a la fac" (We go to the university). English speakers always hear another thing. Totally homophone with the called "f-word"

</comment><comment><USER97> I added "cu" (Portuguese for "ass"), but I'm not able to get it to match. Guessing there's a size limit?

I wonder if it makes sense to add "ku" as well? When I was a kid, I'd always giggle at the American candy bar "Kudos."

This is really cool....

Kudos.

</comment><comment><USER98> No results found for this search. There's a reasonable chance that it's safe...

But you can never be quite sure. There are over 6,000 languages spoken in the world. Somewhere deep in the Amazonian jungle, "anal" could be an insult that gets you killed.

<comment><USER99> not only that (incomplete coverage of languages) - words can also have phonetic similarities to vulgarities without the same spelling.

</comment></comment><comment><USER100> It wouldn't have saved Mitsubishi: [https://en.wikipedia.org/wiki/Mitsubishi_Pajero](https://en.wikipedia.org/wiki/Mitsubishi_Pajero)

But I like the idea and will submit a few words

</comment><comment><USER101> Missed a few of the ones I tried:

"zina" "eir" "khuee" "popa"

</comment><comment><USER102> I use a similar method to find brandable names and domain names. I'll input a word or synonym of into Google Lang Tools and translate it into all the available languages. I've had really good success in doing so.

</comment><comment><USER7> So there's a restaurant near me called "Pho King". It's pho king delicious. Anyway, this tool doesn't know how 'pho' is pronounced in Vietnamese because it didn't catch it.

</comment><comment><USER103> It literally fails on the first word I tried, the/a Dutch word for 'penis': [http://imgur.com/Mw6Efx0](http://imgur.com/Mw6Efx0)

</comment><comment><USER104> If you are still here, it would be useful if we could link to a word, e.g.: [http://wordsafety.com?word=dimwit](http://wordsafety.com?word=dimwit)

</comment><comment><USER42> This seems like a nice idea, but many of the comments here are pointing to omissions that the people commenting feel could be serious.

I guess I see six kinds of potential difficulties:

① There are so many languages out there, including languages will millions of speakers who might eventually come across your thing. Maybe that's not an issue for tangible products that will be marketed to specific territories.

② There are so many slang terms out there; each individual language might well have thousands of terms that have a rude, sexual, or excretory meaning, or that are used as a slur against some group. Also, some languages have expletives that don't correspond to expletives in other languages. [https://en.wikipedia.org/wiki/Quebec_French_profanity](https://en.wikipedia.org/wiki/Quebec_French_profanity)

③ People have pointed out that phonetic matching is hard when you're dealing with different languages' orthographies and phonologies, and you can have the problem of "the source language's intended pronunciation sounds like an offensive word in the other language", "the other language's likely pronunciation of the written term sounds like an offensive word in the other language", or even other combinations among highly multilingual populations. "Sounds like" is sometimes challenging to automate in software, for example because epenthesis of a vowel may not be enough to remove the association. (But I think Levenshtein edit distance between phonemic transcriptions can kind of sort of work.)

Also, the "MR2" example someone gave shows that understanding how people will pronounce something in different languages is complicated: you have to know that the number two in French is "deux" /dø/.

④ People might also perceive something as an offensive reference that isn't even familiar to people elsewhere, like a reference to an upsetting person, place, or event. Reportedly some people in India have named people and businesses after Adolf Hitler just because he was famous, for example. I bet it's easy to do this cross-culturally in general.

⑤ As people point out with the Chevy Nova story, there might be a reason why a product name would become the target of ridicule in a particular language even if it's not offensive. That's true even if it didn't literally happen to the Chevy Nova.

⑥ It might even turn out that the space of offensive references is so dense that there is nothing that isn't a near-homophone of something pretty offensive in _some_ language.

Anyway, I think this project is really neat; I'm just reminded from people's comments that natural language is hard! There's scope to keep expanding this site, and I think there are also existing "cultural consultant" businesses that try to deal with these problems through human review (I wonder how many of them have consultants on contract from many widely varying cultures, which seems especially useful in the Internet era).

<comment><USER42> A funny page that might be support for point ⑥ is

[https://web.archive.org/web/20071112172929/http://members.ao...](https://web.archive.org/web/20071112172929/http://members.aol.com/yahyam/coincidence.html)

If you can take an arbitrary word and find a coincidental homophonous synonym (or antonym) in some other language, you can probably find a coincidental homophonous expletive or sexual reference in some other language too!

(These coincidences are _not_ cognates -- that's part of what "coincidence" means here.)

</comment></comment><comment><USER105> I'd have expected a small easteregg for the word "bro" ;)

</comment><comment><USER106> Searched for Tina but it found nothing, in North Africa it means pu$$y,

<comment><USER63> What are we, five year olds?

Pussy.

</comment></comment><comment><USER107> You seem to have a good grip on Hindi words :) This is a good idea. Last I heard, Accenture spent good amount of $$$ to verify the name in several languages before fixing on that name!

</comment><comment><USER108> "cu" gets a pass. [https://translate.google.com/#pt/en/cu](https://translate.google.com/#pt/en/cu)

</comment><comment><USER109> It will be great if the program checks for phonetically similar words as well, currently, looks like it doesn't. Bhat (India), pronounced like 'butt' is not flagged.

</comment><comment><USER110> It doesn't match some balkanic or eastern european words.

Some of us don't appreciate tracking links, please get rid of tracking so we don't have to manually edit the urls.

</comment><comment><USER111> I tried Tessa and it means "to pee." How come it is not on the list? I know it's not a swear word, but it's still a name with negative connotations.

<comment><USER112> There is a form to submit words that are missing.

</comment></comment><comment><USER113> Funny, it gets Siri, which has to be katakana-ized specially, but it misses both ketu and ketsu. What kind of database are you using? This is a great idea, by the way.

</comment><comment><USER114> Results for "home" "ho" English: woman Direct match at start or end, potentially serious issue! 335 million native speakers, about 1.5 billion speakers in total.

</comment><comment><USER115> Misses "matasano" -> "quack doctor".

</comment><comment><USER116> The phonetic matching doesn't catch "Phuck"

</comment><comment><USER117> It's missing rather a big one. "Mist" means something very different in german.

My point: Is this connected to dictionaries or is it all crowdsourced data?

<comment><USER41> Isn't 'mist' like 'darn' in English?

<comment><USER118> "Darn" is a minced oath. Mist, simply means "crap" or "manure". A pile of manure is called "Misthaufen" (crap heap), a pitchfork for handling manure is called "Mistforke" or "Mistgabel" (crap fork). It's a bit vulgar but so is the subject matter.

But you can also use it as a general expression of discontent: "Mist!" is something you might exclaim if you just dropped something expensive and fragile. It's still vulgar but it's something you'd find far more appropriate around the young ones than the harsher "Scheiße!" (shit).

It's basically the little brother of "shit" in the same way as "dumb" is the little brother of "retarded".

You might legitimately hear someone curse at the "Mistkatze" (Katze = cat) that just peed on the bed, or the "Mistauto" (Auto = car) that refuses to start or simply shout "So ein Mist!" when they find out they've spent the past hour aligning the wallpaper upside down.

The equivalent of "damn" would be "verdammt" and there are minced oaths for that in German as well (although nowadays they're generally considered cute and not something you'd use only because you're mild-mannered or religious).

<comment><USER117> Man, don't put "dumb" anywhere near "retarded". I don't want another literal user for a word (retarded=delayed, dumb=mute) to disappear in the name of political correctness.

To quote from TGOTG: "This dumb tree, he is my friend." Groot is dumb because his is effectively a mute. Drax was not commenting in any way on his intelligence.

</comment></comment></comment></comment><comment><USER119> Ah good, it matches 'perse', which was a slight amusement when seeing the expensive clothing brand 'James Perse' while visiting the US :)

</comment><comment><USER120> While you have this on the front page, why not start a repo where people can send pull requests, rather than submit one word at a time?

</comment><comment><USER121> This doesn't work for Esperanto. Fiku vin!

</comment><comment><USER122> I would have expected "Coq" to fail.

<comment><USER123> I would have expected Cox Communications to fail.

</comment></comment><comment><USER124> FYI this doesn't check for words that sound like swear words. For example, it'll detect Fuck but not Fack.

<comment><USER43> With the input box I suspect they want the database to be crowdsourced. I wonder if they vet the input, if we all try hard enough might we get hackernews into the swear list?

</comment></comment><comment><USER125> I searched "gift" expecting "poison" from German, and was disappointed when nothing came up.

</comment><comment><USER126> Missing Zune which means Penis in Quebec.

</comment><comment><USER127> It didn't catch anything on "phuck," despite claiming that it checks phonetically.

Still a nice idea, though.

</comment><comment><USER128> Doesnt detect any greek curse words

</comment><comment><USER129> You'll have a real hard time with Slavic languages. ;)

Trying to add all the things you missed meanwhile.

</comment><comment><USER130> Interesting. You even have support for converting ß to ss. e.g. scheissekopf -> scheiße

</comment><comment><USER131> It doesn't have "pinche" which is about the most common Mexican curse word.

</comment><comment><USER132> Doesn't support even the most dirty Dutch words! Could use more languages :)

</comment><comment><USER133> The guys at Wix should have had that before they entered the german market.

</comment><comment><USER134> It says "pute" is fine, but google translate says otherwise…

edit: I submitted it

</comment><comment><USER135> Missing danish ! There are some really good curse words in danish :)

</comment><comment><USER136> "Bite"... means "dick" in french...

</comment><comment><USER137> > Results for "boomerang"

> "bum"

> English: butt

> Direct match at start or end, potentially serious issue!

lol.

</comment><comment><USER138> Very nice ! could save the day in foreign country

</comment><comment><USER139> There might be a good service in this as an API.

</comment><comment><USER140> wix.com should have had a look at that site...

</comment><comment><USER141> Wang. No results found! Kimmy. No results found!

Interesting.

</comment><comment><USER142> tried a few words from Indian languages and got matches for other languages..

Interesting to see how you have implemented this...

</comment><comment><USER143> Doesn't work in French : caca, bite

</comment><comment><USER144> "GIT" is safe. hehehehe

</comment><comment><USER145> Solid.

[http://i.imgur.com/tnjNMs1.png](http://i.imgur.com/tnjNMs1.png)

<comment><USER146> For those who don't get the reference, there is an urban legend that the Chevy Nova sold poorly in Spanish-speaking countries because "no va" translates to "no go".

</comment></comment><comment><USER147> tried a few common insults in my native tongue (french) and it detected none...

</comment><comment><USER148> mensa means stupid in spanish.

</comment><comment><USER9> submitted a bunch in Dutch.

</comment><comment><USER149> pajero is not safe

<comment><USER150> Was the first thing I tried being from Argentina. Big fail.

</comment></comment><comment><USER151> poo is all good.

</comment><comment><USER152> Searched for Imen, nothing.

Lousy program

<comment><AUTHOR> Fix it then! Contribute. This is a 2 day program. Help him out!</comment></comment>


It's Time to Encrypt the Entire Internet - <AUTHOR> http://www.wired.com/2014/04/https/ <comment><USER2> It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control).

The current situation is akin to having to travel to some centralized letter- reading facility in order to read letter mail. Your grandma sends you a letter in the mail and you have to go to a central facility downtown, then prove your identity, and then they hand over the (opened) letter.

We put a man on the moon more than 40 years ago. We must be able to sort this out.

<comment><USER3> > It's time to decentralize the internet. There is no good reason why we can't > have email, webpages, photos, even facebook-like social stuff housed on our > own machines in our own homes (or some other place under our control).

This is how the internet is designed, and you can already do this today. In my case, I host my own dns, email, and my own webpages, locally on my home connection. You just have to be willing to learn, and willing to do. Once you've learned, the actual "do" is rather trivial.

[edit: forgot to list dns in the first version]

<comment><USER4> Why would you need your own DNS?

<comment><USER5> To avoid DNS censorship, my ISP filters pirate bay, plenty of other sites.

<comment><USER6> You could just use Google's 18.104.22.168 and 126.96.36.199 though.

<comment><USER7> Google's DNS resolvers are 100% truthful?

<comment><USER6> I've never heard of them changing or blocking entries. They're on Wikileaks' list of censorship-avoiding DNS servers [http://www.wikileaks.org/wiki/Alternative_DNS](http://www.wikileaks.org/wiki/Alternative_DNS) And Google claims: _Google Public DNS does not perform blocking or filtering of any kind._ [https://developers.google.com/speed/public- dns/docs/intro?cs...](https://developers.google.com/speed/public- dns/docs/intro?csw=1)

<comment><USER7> Not what I had in mind. Ignoring the NXDOMAIN results, what makes you trust the VALUE of the NS/A/AAAA/MX/whatever records you get from Google (or any other resolver)?

Because I _have_ frequently seen provably-wrong results from other resolvers, and some highly-suspicious results from 126.96.36.199 on occasion (though I haven't checked particularly often).

The point being, unless you're proving the results with DNSSEC (or similar), you can't trust _any_ source.

<comment><USER6> Is that the sort of thing that could be fixed by running your own DNS resolver? I mean it all comes down to DNSSEC eventually.

<comment><USER7> You can limit some of the simple abuses by resolving DNS yourself, but DNSSEC (or other crypo-auth system) is best, of course.

I use and recommend doing both, as there's very little downside to running your own resolver.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> The only problem I see with https everywhere is the current CA system. I don't trust CAs, and I don't want to pay them. If we can get rid of them somehow there is nothing in the way of https everywhere anymore. I really like the [http://convergence.io/](http://convergence.io/) approach, but anything else that gets rid of a central authority I have to trust will do for me.

<comment><USER9> Is convergence still running? I last tried it a couple years ago and the number of authorities dropped to three.

<comment><USER8> Some say it's not dead¹. But it doesn't seem to have any traction, which is a shame.

Perspectives is a similar project and seems more alive with a release in February: [http://perspectives- project.org/2014/02/15/perspectives-4-4-...](http://perspectives- project.org/2014/02/15/perspectives-4-4-released/)

¹[https://twitter.com/ivanristic/status/400624593515192320](https://twitter.com/ivanristic/status/400624593515192320)

</comment></comment></comment><comment><USER10> So perhaps this should start with a reduction in the cost of valid, "don't throw a security warning" certificates down to zero.

At the moment the SSL certificate industry is one big ripoff fest...

<comment><USER11> You mean like [https://www.startssl.com/](https://www.startssl.com/)? Their standard certificates are accepted by all major browsers released since 2010 (see [http://en.wikipedia.org/wiki/Startssl#Trustedness](http://en.wikipedia.org/wiki/Startssl#Trustedness)) and are free for non-commercial use (I've heard claim of trouble with Windows Phone 7 devices but I've not had opportunity to check that myself).

[http://www.cacert.org/](http://www.cacert.org/) is another option, but their CA cert is generally trusted by default so it is no good for publicly targeted services.

<comment><USER12> You mean the one with a terrible user interface who charge 25$ to regenerate a cert?

PKI is a scam and a racket.

<comment><USER11> _> PKI is a scam and a racket._

The current implementation is far from perfect, but that is more than a tad strong.

And it need not be as bad as it is, we just need to find the right changes to the process and get everyone to agree on them...

Don't tar all PKI based solutions with the same overly large brush.

 _> You mean the one with a terrible user interface_

I'll not disagree with you there. Though for free are you expecting perfection? It at least does the job.

 _> who charge 25$ to regenerate a cert?_

Pro tip: backups.

If you properly protect your keys and certificates you only need to pay if you need the old cert revoked (this is annoying if something beyond your control makes you need a full resign rather than a reissue, but things like heartbleed that necessitate this are hardly common).

<comment><USER12> Trust me, that is not an accusation I bandy about lightly.

         <rant intensity="120%">

It's a scam in that SSL purports to verify identity, when really you're trusting the CA to handle that; some do more, some do less, there's no standard, no _real_ accountability beyond major cockups when the community decides to disown you out of necessity for bad behavior (see Diginotar from not that long ago). Having a CA signed cert proves nothing beyond that you gave some person who is trusted some amount of money who ostensibly verified something.

It's a racket in its implementation. The PKI model used nowadays is rotten and exploitative. Renewals which exist as a pure profit vehicle for CAs (upwards of $100 to run some code and generate a hash? Fkn seriously?), the implementation in every browser which treats a self-signed certificate as coming from a known bad guy, or the slightest misconfiguration as same.

But every single user out there has it drilled into their head to look for the little lock (or nowadays, the much more expensive by a factor of ten or so green bar) before shopping, and every browser out there throws really scary looking errors (Chrome's red screen of doom) for something so much as an expiration date. The CA's can effectively say "Gee, that's a nice commerce website you have there, would be a shame if something were to happen to it and all your customers got scared off since you didn't pay your protec^H^H^H^H renewal fee" \- Some basically do, especially around renewal time.

Charging to regenerate or revoke a certificate (again, completely automated processes with zero human interaction required) is just rent-seeking dick behavior of the highest order.

Why do I have to pay upwards of $100 for a wildcard certificate? They don't cost the CA anymore to issue or handle, it's identical to any other certificate except the CN field is written slightly differently. No, the fuckers expect me to either pay for a massively overpriced bit of hashed code or pay lots of times for slightly different overpriced bits of hashed code. Either way, i'm getting screwed. All so people who visit my website don't get scary and misleading warnings.

<comment><USER11>
      the implementation in every browser which treats a self-signed certificate as coming from a known bad guy

Ah, you are a "self signed certificates should be accepted" guy. I very much don't agree there.

A self-signed certificate effectively gives none of the protection of a cert signed by a trusted CA so the warnigs areperfectly valid. Of course self- signed certificates are perfectly valid in specific communities: a company might sign the certificates for all its internal apps themselves and make sure their standard employee desktops & laptops trust their internal CA, or you could sign your own and have your friends and other contacts install your CA as a trusted one. But for public use they are simply not valid.

The commonly given comparison here is the way SSH works, but that is _not_ comparing oranges to oranges. With SSH you also have some authentication credentials that have been given to you via another channel, with a self-sign certificate you do not. You can emulate SSH's "remember this servers ket fingerprint and only tell me if it has changed" in most browsers by adding a permanent exception, so it'll only moan again if the self-signed certificate changes. Firefox does this.

      Having a CA signed cert proves nothing beyond that you gave some person who is trusted some amount of money who ostensibly verified something.

That is true, but having a self-signed cert proves _nothing at all_. There _is_ some process (a process that has been shown to have exploitable flaws I'll grant you, but a process exists and is far from completely broken) to try make sure that the CAs that are generally trusted are generally trustworthy.

      Renewals which exist as a pure profit vehicle for CAs

Renewals exist because certificates expire. Certificates expire because an infinitely valid certificate is potentially dangerous because the revokation process can not be relied upon in many cases.

      ... for something so much as an expiration date ...
      Gee, that's a nice commerce website you have there, would be a shame if something were to happen ...

If your e-commerce site finds $7/year or the hassle of using StartSSL's interface for free (or $120/y or $70/y respectively for EV certs) a problem, then it isn't much of a profit making e-commerce site...

      Charging to regenerate or revoke a certificate is just rent-seeking dick behavior

I'll say again: keep secure copies of the relevant keys and you won't need to use the regeneration or revocation procedures.

      again, completely automated processes with zero human interaction required

Automated processes _that rely on infrastructure that someone needs to create, monitor, and maintain_. If you ignore the infrastructure creation and maintainance costs then yes the process is zero effort and near zero cost (just a little electricity for the CPU time) but ignoring those factors is simply fallacious reasoning.

If you so strongly believe that this is a complete and utter rip-off and that you could do it so much cheaper, why not do so? If you _can_ do it as well while charging less (or nothing) then people will flock to your service. One man's margin is another's opportunity.

      Why do I have to pay upwards of $100 for a wildcard certificate? They don't cost the CA anymore to issue or handle

That I'll grant you, but artificial market segmentation exists _everywhere_ for better or worse (usually for worse from the consumer's PoV) rather than being a property of this particular area.

      All so people who visit my website don't get scary and misleading warnings.

The scary warnings are not misleading in the worse cases. If a DNS hijack passes your bank's traffic through a server that has a self-signed certificate would you want your browser to warn you or just carry on because self-signed certificates are fine usually? Unfortunately there is no way to differentiate the bad and fine situations so we give the scary warning for both to make sure we give it when it is really needed.

If you can think of a better way then do let people know, everyone in the know knows the current arrangement way isn't perfect so a good idea well presented should get listened too if addequately explored and explained.

If what you are looking for when you refer to "people visitin my website" is simple anti-snooping protection (so random people on the same WAN can't see everything for instance) rather than identity assurance, then there are already moves in that direction. HTTP2, due to be submitted for approval in final form later this year, will use encrypted traffic in _all_ cases in a way the ensures this level of protection (though I've not yet read into the details of these proposals myself, I'll reserve judgement on how effective that will be until I have) meaning that is soon to become a sorted problem if things work out as expected. For e-commerce or anywhere else where greater trust is required though, a CA-signed certificate will still be required because for those uses identity assurance is essential.

<comment><USER12> >You can emulate SSH's "remember this servers ket fingerprint and only tell me if it has changed" in most browsers by adding a permanent exception, so it'll only moan again if the self-signed certificate changes. Firefox does this.

Doing this en-masse would be a much better system than we have right now. Example: Have a random internet user visit a site and note down the details of the certificate they get (automatically). Repeat a few thousand times. Compare notes. Wait a sec, why do I have a different certificate than 99% of the other visitors? Hmm. Throw alerts.

The chances of the average user being the target of a MITM is utterly minuscule, so this system ensures that you as the bad guy either have to own the service provider directly by installing a certificate you have keys for, or _every single user that hits the site_ simultaneously to prevent the others from being alerted.

Pinning on steroids, basically. No CA's required.

> _but having a self-signed cert proves nothing at all._

..other than the connection being encrypted, the CN on the cert matching the domain name, and it not being expired. This is the same data that the lowest level certificates from every CA provides.

I believe that the past decade or so has shown that CAs do not deserve the level of trust they're implicitly given. I certainly don't trust them. We know they can be coerced by the bad guys with guns to generate certs anyways. QED, they are not trustworthy.

>Renewals exist because certificates expire. Certificates expire because an infinitely valid certificate is potentially dangerous because the revokation process can not be relied upon in many cases.

Then re-generate the bloody certificate and don't charge me money for the privilege of giving me exactly what I had before with a different date on it!

> _f your e-commerce site finds $7 /year or the hassle of using StartSSL's > interface for free (or $120/y or $70/y respectively for EV certs) a problem, > then it isn't much of a profit making e-commerce site..._

Ah yes, the old "It's not _that_ expensive, so why are you complaining?" canard. A dime here, a nickel there. It's nothing.

Why just a little of a bad thing remains bad is left as an exercise to the reader.

> _Automated processes that rely on infrastructure that someone needs to > create, monitor, and maintain. If you so strongly believe that this is a > complete and utter rip-off and that you could do it so much cheaper, why not > do so? If you can do it as well while charging less (or nothing) then people > will flock to your service. One man 's margin is another's opportunity._

Why are there no serious community CAs? Why is every single one of them a large corporation? Larger infrastructure projects exist that are community, free/donationware efforts, after all. Is it really that hard, or is there some other reason?

I'll wager that one of the reasons is that entrenched players (the VeriSigns and Comodos and Thawtes of the world) get to set the standard for the market. For audits (e.g. Webtrust) that cost tens-to-hundreds of thousands of dollars to complete.

De-facto regulatory capture, except the regulations are more of a consensus than top-down legislating.

>The scary warnings are not misleading in the worse cases. If a DNS hijack passes your bank's traffic through a server that has a self-signed certificate would you want your browser to warn you or just carry on because self-signed certificates are fine usually?

I have no way to prove this, but I would be willing to bet large and ridiculous amounts of money that 99 out of 100 SSL warnings an average computer user sees is going to be the result of either misconfiguration (a badly set CN is common) or expiration. The connection is still encrypted and the certificate was still generated by a "trusted" CA so we know that the identity is valid (what are the chances that the owner of bar.com doesn't know of the existence of foo.bar.com?) - yet we still cry wolf like something is very definitely wrong.

And I say "cry wolf" for a reason. With the majority of SSL warnings being bogus (bogus as in they fail part of some validation test, instead of bogus as in the user was in some actual danger), we're training users to override the annoying warning every time.

And you can't override parts of the validation - it's all or nothing. If I know a certain website has an expired cert, and everything else is still valid, why can't I just override the expiration check? Being N+1 days out of date doesn't reduce the security of anyone concerned. - Instead I have to completely except the cert from all checks and then I _won 't_ get warned if say, the issuer changes or the CN doesn't match or some other data point, which when taken together, might add up to a different whole.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> There's the obvious security/privacy point, but I think on a technical basis it would also be useful: the internet is full of pesky middleboxes which meddle with content, and this breaks things. For example, sometimes WebSockets can't connect unless run securely because somewhere a middlebox is looking at the content and changing it, expecting it to be HTTP traffic when really it's a websocket. Encryption removes the possibility for infrastructure-breaking middleboxes.

</comment><comment><USER5> HTTP/2.0 is working on encrypting everything though NSA shills have managed to derail the working group by proposing "trusted proxies" that are allowed to decrypt traffic for nonsense optimization reasons.

<comment><USER14> Will encryption be mandatory in HTTP2?

<comment><USER15> It's central to the protocol, if I recall.

</comment></comment></comment><comment><USER16> Yet when I go to this link it's plain HTTP.

<comment><USER17> Wired just got it wrong postfixing https instead of prefix :) [http://www.wired.com/2014/04/https/](http://www.wired.com/2014/04/https/)

But to stay on topic: encouraging this kind of major shift to SSL spreads a problem that is still there but is very little acknowledged or worked on -- revocations.

Certificate revocation check is using either CRL or OCSP. CRL is a list of all the revoked certificates - browser needs to download the whole file and then check if the cert is revoked. OCSP is an optimized protocol to perform a more efficient certificate validation.

CRL is slowly being phased out as it grows too fast and there are jokes around that thanks to heartbleed the size becomes comparable to a blockchain.

But now the real issue: almost NONE of the mobile browsers check for revocation! Add to this that by default Chrome is not checking for cert revocation either. So isn't this rendering the whole revocation mechanism almost useless against a real attack?

There is a reason why it's not done in mobile (and Chrome) -- it makes the requests slower, especially in mobile. There is a timeout fallback in browser so that whenever OCSP responder times out then browser assumes the cert is valid. Which is not helping when the real attack is executed.

To sum up, until there is a 99% browser-market covering revocation mechanism that is not slowing down the browser CA-based SSL certificates are too fragile to get us to the safe and encrypted future.

<comment><USER18> However, it seems possible to explicitly use a _secure_ browser (i.e. one that checks certificate revocations) if the need arises. You don't need 99% browser-market coverage to allow people to securely connect to your site, nor do you need 99% browser-market coverage to securely connect to a given site. You _only_ need that site to implement HTTPS, either with a self-signed cert and e.g. Certificate Patrol on your side or a CA-signed cert and a revocation- checking browser. In the latter case, you should also configure your browser to consider an OCSP failure an invalid certificate, not a valid one.

<comment><USER17> This all sounds good but at the same time only Firefox has OCSP Hard Fail feature (OCSP failure==invalid cert). Please correct me if it's still possible with others.

Also user must become a rather paranoid person in order to start using a browser in mobile that supports hard fail OCSP. Getting HTTPS everywhere shouldn't mean promoting false sense of security.

Considering that most HTTPS attacks require MITM it seems to me that OCSP without Hard Fail leaves attack vector wide open.

</comment></comment></comment></comment><comment><USER19> For as long as the general population remains as computer illiterate as they are today no amount of encryption or decentrialising will save the internet.

Despite its growing importance, the topic of computing is completely ignored at school.

They teach the kids how to click on a few icons on Microsoft Word and Excel and PowerPoint, they graduate and become adults and think they know about computing.

We have trained people to not learn anything of substance about computers, just click on this button, and push that button ... easy. There's only so far that stuff goes.

When they teach you calculus, you don't turn around and tell the mathematicians "oh well ... just go make it easier for me this is not user- friendly".

But with software no one is willing to take a single step towards learning some basic principles.

So we end up making sacrifices because people can't be bothered with anything more complex than pushing this big green button right here.

A better internet requires a population that understands some basic principles and is therefore willing to put some effort in protecting themselves.

</comment><comment><USER20> > You have to purchase TLS certificates from one of several certificate > authorities

I'd like to stop this misconception. You don't buy certificates. You make your own certificate, which is unknown to the world, and _then_ you buy a stamp from a trusted third-party on your own certificate, so everyone can trust it.

The crux of the matter is whether you can actually trust these third-parties.

<comment><USER21> That's not accurate. You send them a 'Certificate Signing Request', which is a request for them to issue you with a certificate. It's not a complete certificate template just lacking a signature. In any case... semantically a certificate isn't a certificate until it's been _certified_ , it's just meaningless paper.

In some ways this reminds me of the misconception about birth (and marriage) certificates from people new to genealogy. In the UK a birth certificate is just a piece of paper that contains markers of authentication to ensure people who read it can trust that it's true likeness of _a record_ held at Her Majesty's GRO. It doesn't provide any guarantees about the honesty of data itself, or even if the person was ever born, in the same way me reading an x509 doesn't guarantee the data it contains is factual or was issued to the right person. Even if a CA does these checks, there's no way to insert a proof of such in to a certificate, therefore the certificate isn't such a proof...

</comment></comment><comment><USER22> "Everything on the Internet should be strongly encrypted all the time." \-- Bob Metcalfe (Infoworld 24 June 1996)

</comment><comment><USER23> The question is better posed as "Can encryption put the morals of 'you know who' back in place?"

As I see it encryption works against your average trouble maker. But the current wave essays that the data needs to be protected from even more people. Definitions like GOVERNMENT, CORPORATE, etc. Traditionally the GOVT needs that info to make macro-level decisions, so it was trusted by most people. CORPS on other hand could get that info, and the GOVT was supposed to regulate that process.

Now it seems that the GOVT has gone beyond its neutral stance, but wait! it is actually not the GOVT, but the individuals at fault here. If you see this problem as something induced by corporate greed, than its possible to see this situation from a tech-security-guy-point-of-view as:

The GOVT needs to keep all the windows safe from such greed, and the CORPS just need few windows to get inside, just like in Computer Security. Now join reality with this hypothesis, and ask yourself this:

How many politicians fail to draw a line between: (1) cooperation (with CORPS) for "selfish" reasons (2) cooperation (with CORPS) for "democratic" reasons

Now yes, historically many politicians have fallen prey to this type of thing, but up to what extent? You take succumb to it sometimes or regularly on a personal level? And yes, many corporate individuals/entities feel that they are at disadvantage if they don't cheat slightly, but does it stays within the self drawn line called "slightly/just a bit" or goes beyond it?

At the end it becomes a chicken and egg problem. But is that really impossible to solve? Is the encryption alone or together with other things answer to this dilemma? And is it okay to sit at home, knowing you have the antidote to all the problems in the world, and let everyone outside "go to hell?"

PS: Seemingly, the traditional 4th party: Elite evil hackers seems to be in line, thanks to a lot of people in US security structure working against them.

</comment><comment><USER17> Here's my quick write-up on why encryption won't get us anywhere without a proper revocation mechanism (yes, it's 100% broken in the mobile). [https://news.ycombinator.com/item?id=7604641](https://news.ycombinator.com/item?id=7604641)

</comment><comment><USER24> "That means secure connections to everything from your bank site to Wired.com to the online menu at your local pizza parlor."

Oh, the irony that the article itself isn't served over HTTPS.

<comment><USER25> That's not really irony since it is proposing a possible "future".

</comment></comment><comment><USER26> [https://encrypt.today](https://encrypt.today) \- who said the new TLDs were useless?

</comment><comment><USER27> Encrypting the internet is not enough if a few companies have unlimited resources and the freedom to figure out how to break the encryption (legally).

*Edited for clarity

<comment><USER10> False. What you say _reduces_ the usefulness of encrypting everything but certainly doesn't make it "useless".

<comment><USER27> That's true, I misspoke. It does make it hard for the average joe hacker to get steal information, which is very valuable.</comment></comment></comment>


How Much Is Second Life Worth? - <AUTHOR> http://www.techcrunch.com/2007/11/05/how-much-is-second-life-worth/

<comment><USER2> i think second life defines the problem domain a bit too large. no i don't care to explain.</comment>