Re: [Idna-update] [Ext] Re: emoji and security

[John C Klensin <[e-mail]>]

Kim,

Just to clarify one other part of your comments...

--On Wednesday, March 14, 2018 11:15 -0400 Kim Davies
<[e-mail]> wrote:

> However, given the IDNA tables are posted, some IDNA 2008
> implementations use them as a shortcut to greatly simplify
> their code. As a consequence, the landscape of implementations
> is likely variable because you have some implementations using
> the IANA-published tables limited to the Unicode 6.3
> repertoire, and others using more recent versions because they
> are deriving from Unicode properties directly.

yes.  But that is inevitable, whether there are tables stored at
IANA or not.   Unless every registry in the DNS (not just TLD or
SLD registries) is either calculating code point and label
validity using the IDNA rules in real time or making that
calculation every time a new version of Unicode is announced
(and exactly the same number of minutes after the announcement)
_and_ every instance of every lookup application does one of
those things as well, there will always be some practical risk
of unsynchronized implementations.  I don't know whether having
the tables posted by/at IANA makes that problem any worse, but
it seems obvious to me that it doesn't make it much worse.

Noting that the DNS itself uses a slow synchronization model,
those properties of IDNA2008 probably don't even change the
problem in a qualitative way.

best,
    john