Re: [I18nrp] Conservatism principle doesn't go far enough

["Asmus Freytag (c)" <[e-mail]>]

On 2/3/2019 3:48 PM, Nico Williams wrote:
> On Sat, Feb 02, 2019 at 11:52:45PM -0800, Asmus Freytag wrote:
>> On 2/2/2019 8:01 PM, Larry Masinter wrote:
>>> But I think this is counter-productive and wrong. If you're showing someone
>>> a URL which is not in normal form, normalization will lose this critical
>>> information. Better to just display the punicode for any unnormalized
>>> domains.
>> I'm missing something here. What "critical" information (other than the
>> normalization state) is it that gets lost?
> There's a confusable issue, isn't there?  If you show me a URI which if
> I were to type in would take me elsewhere...  That is an important bit
> of information.

I see this issue in case mapping, but can't come up with a normalization 
example.
Hence my question.


>   If DNS servers just had had to implement normalization-
> insensitive matching, that wouldn't be a problem a tall, but obviously
> we couldn't get DNS servers to do anything other than ASCII case
> insensitivity.


The user doesn't care what's on the server. The user cares what's 
displayed in the URL / address bar.

>
> Whether the punycoded name is displayed, or perhaps U-labels are
> displayed but in some fashion as to make the danger clear (in a loud red
> font, say, modulo accessibility), is another story.  I think I'd prefer
> to see the Unicode and some danger warning, or perhaps hide the URI and
> when I try to see it tell me it's dangerous and why.

Still like to see the specific scenario you guys are thinking about.
>
>> There are some scripts where ordinary text is most likely not normalized and
> Ordinary text, as in prose from some document, yes, but security-
> relevant identifiers generally need to be normalized.
Right, but that means they are not normalized when type as URL into HTML 
source or into an address field on a form.
>
>> where it's also not necessarily trivial for users to enter normalized text.
>> Should all of those URLs get displayed as punycode?
> Users cannot be expected to enter normalized text, naturally (how could
> they?).  Normalization has to be a software function, and a non-
> negotiable part of the interface; somewhere, security-relevant
> identifiers must be normalized.
No disagreement here. However, the question was, should all string that 
are entered by users as unnormalized be displayed as A-labels?
>
> Again, in some systems one could just normalization-insensitive
> matching, but DNS cannot be such a system, therefore for DNS we must
> normalize on create.

No disagreement here; we were talking about how to "display" something - 
that's not a function of the DNS.

A./

>
> Nico