Re: [idn] Re: stability

[Erik van der Poel <[e-mail]>]

Martin v. Löwis wrote:
> Erik van der Poel wrote:
>> If we do not correct the specs, more and more implementations will be 
>> created and deployed, some implementing it one way, the others the 
>> other way. It is hard to change something when a lot of 
>> implementations have been deployed. This is why we have to act now (or 
>> soon). We have to nip it in the bud.
> 
> Not sure what aspect you are referring to,

I was referring to the RFC that has a pointer to UAX #15, i.e. RFC 3454 
(Stringprep). The pointer should be updated to tracking number 24 or 
higher. Since this issue is hard to understand, it might also be a good 
idea to add an explanation in the new versions of Stringprep and the 
IDNA family.

http://www.unicode.org/reports/tr15/tr15-24.html

> however, I doubt that the
> majority of the implementations cares too much about what the RFC says.
> So whether the RFC is changed or not in a minor aspect has little
> impact on reality.

There may be some organizations that ignore some or all of the changes 
we make to the RFCs, but others are paying attention, and I'm pretty 
sure they will follow at least some parts of the new RFCs. Mozilla and 
Opera have already indicated that they believe the punctuation mark and 
symbol problem is a big problem, and that they would/will address this 
problem whether or not the RFCs do.

> In the specific case of normalization, I think most IDNA implementations
> will rely on a normalization implementation created elsewhere - few
> IDNA implementations will come with their own normalization routines.
> This is because normalization is difficult to implement, so you rather
> reuse than reinvent. Then, when the underlying normalization routine
> is changed, the IDNA implementation also changes - most likely without
> the author of the IDNA implementation (let alone its user) even knowing.
> In that scenario, the implementor of IDNA has little control over what
> specific incarnation of normalization is used.

This specific issue is already mentioned in RFC 3490 (IDNA) in the 
Security Considerations section. Of course, it is up to the implementors 
whether they will adhere to the letter of the specs, but the IETF tries 
to achieve a "rough consensus" among the parties discussing the matter, 
and the authors try to write clear specs that foster interoperability.

Erik