Re: [I18nrp] Mappings for IDNA2008 ?

["Patrik Fältström " <[e-mail]>]

On 8 Feb 2019, at 20:54, Andrew Sullivan wrote:

> Yes.  And the way to mess with you is to (e.g.) send you something that has various foldings or mappings in _your_ locale that are not the same as the various foldings and mappings in the locale with which the string was generated.  These are blessedly rare, but they're not "never", which is John's point upthread about working irregularly vs working.  This gets even worse when the mappings vary according to application or whatever, which is _also_ a potential feature of IDNA.

Correct.

> UTS#46 doesn't do anything to help this _either_ because it is no more able to know the locale-at-identifier-generation time than anything else is, because that information is simply not carried around with the identifier.
>
> This problem is, I should note, well understood among network protocol people, who spent a lot of time talking about it during PRECIS.  But it keeps coming back up because people keep forgetting that these protocols are locale-free even if you think you know the locale at lookup time.

And this is why I am stronger and stronger a believer that we should in protocols and what not only allow strings of characters which really are allowed in the protocols.

It is the mix between "displayed string" and "allowed in protocol string" which is problematic, specifically as we seems to allow a larger set of characters (and combination of characters) in the "displayed string", EVEN IF we are really and intentionally exposing the protocol element (like a domain name) to the end user.

That is when things breaks down I claim.

And this is why the mapping, if any, must be done as close to when the string enters "the system" as possible, and after that stays as only the allowed characters in the allowed combinations in the protocol and because of that as display.

Real protocols (whatever that is -- but lets take email as an example) should separate display strings from protocol elements, and this is why I thing the deal with local part of email addresses is a so called Big Mistake. The protocol element is ascii only. The display part is different. But this is easy for me to say that uses latin characters. I do understand people using other scripts (specifically different directionality).

I.e. my email address is:

  "Patrik H:son Fältström" <[e-mail]>

The whole thing! First the display string, and then the protocol element.

A security issue of course, like HTML:

<A HREF="security-error">display</A>

But that is at the same time the best we can get...

/me thinks

   Patrik