Re: [Idna-update] emoji and security

[Andrew Sullivan <[e-mail]>]

On Tue, Mar 13, 2018 at 05:09:29PM -0700, Asmus Freytag wrote:

> It would have been easy to restrict IDNA 2008 to modern scripts only

Easy for _whom_?  The IETF just does not have that expertise, which
was something we had demonstrated pretty nicely using IDNA2003.  What
the IETF needed was a way of avoiding the problem of evaluating
particular code points, and so the Unicode properties were the path.

> However, many non-modern scripts are really not suitable for general
> identifiers: there's not a body of working expertise on where the problems
> are with them. It's arguable that they should (have been) kept out of second
> level domains altogether, because nobody who includes them in a registry can
> be said to have done so understanding the consequences, therefore implicitly
> violating the prescription in RFC 5891.

But the IETF does not have, and does not want, authority to "keep them
out".  That's a policy question, and one rather far from the IETF's
area of expertise.  Indeed, that division of labour is precisely why
the IANA root zone registry policy is set by someone other than the
IETF, which sets the policies for IANA protocol parameter registries.

> similar-looking code points), it's bordering on the absurd to stop all work
> on updating IDNA 2008 over the case of a single Arabic addition that isn't
> even an exact homoglyph

But that is not, as I think you know perfectly well, why in the past
the IAB asked for additional work and a pause.  The IAB made that
request because it was necessary to do a bunch of work to understand
the issues and attempt to get a grasp on what the overall implications
are.  I think that was a good idea, because proceeding as one ever did
without understanding how one was wrong in one's assumptions is pretty
foolish.  I think there has been considerable work done in the
meantime, and it might well be that conditions have changed (I am not
the IAB, so I can't speak about that).

Best regards,

A

-- 
Andrew Sullivan
[e-mail]