32

If you exposing randomly generated strings or strings with data encoded in them (Product keys). Is it irrational to sanitize them for curse words to avoid the client possibly getting offended in the rare case an offensive word is generated.

Anybody ever have a customer get offended by a randomly generated curse word? Anybody out there ever code logic to filter them out?

Thanks

Edit

One time after developing a product key generation system which had customer data encoded into it. As a joke we wrote a program to see what customer input would generate funny words.

7
  • 5
    At first blush, this sure sounds silly. What about a customer offended by the name of a country? Some folks don't think Israel should exist, and go through great pains to say "The Zionist Entity" and things like that. How far down this road should you go? Do you have any additional information on where or how the line gets drawn? Is this the seven words you can't say on television list?
    – S.Lott
    Jun 5, 2009 at 15:39
  • 2
    I'd be curious if there is a consistent procedure for checking for "obscene" letter combinations on license plates. It seems like you could use a similar algorithm.
    – Jeff Moser
    Jun 5, 2009 at 15:42
  • THe odds of randomly generating any particular 4 letter word are like 1 in half a million. Jun 5, 2009 at 16:58
  • 2
    "Anybody ever have a customer get offended by a randomly generated curse word?" Yes: clickondetroit.com/news/4050844/detail.html Jun 19, 2009 at 23:43
  • School, user would have had to type C*NT: papercut.com/blog/chris/2008/05/12/…
    – Tom Clift
    Sep 9, 2015 at 6:41

14 Answers 14

46

Don't generate random strings with vowels and then you don't have to worry about curse words.

12
  • 3
    Great idea. Should work in most languages as well.
    – Laserallan
    Jun 5, 2009 at 15:41
  • 17
    While I generally agree, you might still end up with strings like "fck" or "fvck". This probably still falls under "don't optimize for the insane."
    – luke
    Jun 5, 2009 at 15:46
  • 4
    @luke: Yeah, I think that this method will get rid of the "real" curse words. Imagined or "kinda looks like a curse word if you squint really hard" words are still the user's problem :) Jun 5, 2009 at 15:47
  • 2
    Using guids likely will prevent any of these issues.
    – Nate
    Jun 5, 2009 at 15:54
  • 8
    Oh and for the love of Mike, please don't put in characters that render similarly (ie, O and 0, I and 1, p and q, d and b, l and 1, l and I). Use only 1 from each pair.
    – plinth
    Jun 5, 2009 at 15:58
32

Yes, on the grounds that anyone who would be offended by something they saw in a randomly generated string can think of more things they find offensive than you can sanitize.

Don't optimize for the insane.

0
17

Microsoft omits the following from their product keys:

0 1 2 5 A E I O U L N S Z

I omit those from [0-9A-Z], and once the key is generated, I match against a list I found of two-letter combinations most common in English, and regenerate the key if there is a match. For speed, I edit the list of letter pairs by first culling from that list the pairs that are already prevented due to their inclusion of a character in the stripped list ('HE' can't exist if the key is generated from a character set that does not include 'E'), then convert some from 'E' to '3', as in 'H3' instead of 'HE', etc. I have also added a few of my own, like 'KK' and 'CK' for edge cases. One could also omit '3' for speed as necessary, although the more characters you omit the fewer unique keys can be generated.

Probably not a perfect solution, but it's fast enough for my needs and prevents almost all English words from being generated, offensive or not.

3
  • 1
    Hi... just wondering if there is any reference to this omission of characters in a public document that Microsoft might have published? Would be handy to validate my use of this list. Apr 25, 2019 at 22:54
  • 7
    For copy-pasting reference: bcdfghjkmpqrtvwxyBCDFGHJKMPQRTVWXY346789
    – sebtheiler
    Sep 23, 2020 at 0:34
  • I don't think that some of these characters are omitted because of profanities. Lowercase L looks like uppercase i, zero looks like O, Z like 2, S like 5. These are just to avoid confusion. Dec 3, 2021 at 15:52
6

Simplest solution is to generate from a 'sanitized' alphabet; use a set of characters that cannot possibly form words. One suggestion in one of the answers is hexadecimal which is an excellent choice, or otherwise drop some critical letters from the alphabet.

Note that just dropping vowels is not going to do the job... it is all too easy to infer them from the remaining consonants.

5

That makes sense to me. I mean, it would be a pretty bad PR disaster if someone posts a picture of your product, with this stamped on the back of the CD case:

12345-67890-F**KU-ABCDE-FGHIJ

It sounds funny but you never know what kind of sense of humor the person will have who happens to pick up that package.

2
2

See those items tagged with clbuttic

1
2

I think it's better to plainly avoid vowels. A product key like JKL-YOUAREMYFRIEND-0001-KK may not be offensive but it doesn't sound like serious business either.

1

Limit your randomly generated "words" to hex characters and I don't believe you'll have any English-language curses. This also pushes you down a path of not spending too much time on your random word generator.

Of course, there may be some language where you can curse with hex digits, but then you're not likely to know/filter those curses anyway.

5
  • 1
    0xdeadbeef, 0xaffe (german for "monkey"). Jun 5, 2009 at 15:44
  • 6
    dead beef?!?! As a vegetarian I'm HIGHLY offended.
    – Aardvark
    Jun 5, 2009 at 15:46
  • 3
    A bad dad bedded a dead babe. Jan 4, 2011 at 17:20
  • @wilberforce - I like it, but I don't think any of those would be considered "curse" words :-)
    – kdgregory
    Jan 9, 2011 at 13:03
  • 1
    Some people find necrophilia offensive! Prudes. (: Jan 11, 2011 at 13:43
1

If you are just worried about product keys, I would stick to hexadecimal digits, maybe even a guid would work for you. Probably no chance of a "naughty" word being generated with these constraints. You could also just stick to numbers as well. If you must have random strings with all letters of the alphabet, it is probably better safe than sorry so I would do the filtering.

1
  • Oh hell, the 4s don't render like it needs to be.
    – EvilTeach
    Nov 5, 2010 at 16:44
1

We are using a random string generator for a security key that will be sent to customers, and did not omit vowels from the allowable characters, etc. No word of a lie, one of the strings it generated was "7D9WAF*CKS" ...! Luckily, this was discovered during development, and we are now going to restrict the allowable characters. Whew!! That was a close one - happy to have found this posting !

1

A very fun tale of woe to read with a similar situation to you.

0

It's certain conceivable, but I wouldn't devote much time to it, especially if you've got letters and numbers.

0

I'm using randomly generated, phonetic-sounding passwords for one webapp I wrote. I did end up hard-coding a list of "dirty" words that aren't acceptable, but the list that matched my pattern ended up being pretty short.

0

No. You have no chance to collect all curse words in all world languages. Those words usually don't appear in dictionaries.

1
  • 1
    A GOOD dictionary will include colloquialisms and slang. The OED certainly includes swears in it, and all other sorts of filth my ancestors would be ashamed to admit they did on a weekly basis.
    – Chris K
    Jun 5, 2009 at 18:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.