Re: [I18nrp] Conservatism principle doesn't go far enough

[Nico Williams <[e-mail]>]

On Sat, Feb 02, 2019 at 11:52:45PM -0800, Asmus Freytag wrote:
> On 2/2/2019 8:01 PM, Larry Masinter wrote:
> > But I think this is counter-productive and wrong. If you're showing someone
> > a URL which is not in normal form, normalization will lose this critical
> > information. Better to just display the punicode for any unnormalized
> > domains.
> 
> I'm missing something here. What "critical" information (other than the
> normalization state) is it that gets lost?

There's a confusable issue, isn't there?  If you show me a URI which if
I were to type in would take me elsewhere...  That is an important bit
of information.  If DNS servers just had had to implement normalization-
insensitive matching, that wouldn't be a problem a tall, but obviously
we couldn't get DNS servers to do anything other than ASCII case
insensitivity.

Whether the punycoded name is displayed, or perhaps U-labels are
displayed but in some fashion as to make the danger clear (in a loud red
font, say, modulo accessibility), is another story.  I think I'd prefer
to see the Unicode and some danger warning, or perhaps hide the URI and
when I try to see it tell me it's dangerous and why.

> There are some scripts where ordinary text is most likely not normalized and

Ordinary text, as in prose from some document, yes, but security-
relevant identifiers generally need to be normalized.

> where it's also not necessarily trivial for users to enter normalized text.
> Should all of those URLs get displayed as punycode?

Users cannot be expected to enter normalized text, naturally (how could
they?).  Normalization has to be a software function, and a non-
negotiable part of the interface; somewhere, security-relevant
identifiers must be normalized.

Again, in some systems one could just normalization-insensitive
matching, but DNS cannot be such a system, therefore for DNS we must
normalize on create.

Nico
--