Re: secdir review of draft-ietf-jsonbis-rfc7159bis-03

[Julian Reschke <[e-mail]>]

On 2017-03-08 02:48, Benjamin Kaduk wrote:
> I'm also concerned about the freewheeling use of Unicode.  While
> this document does discuss the potential encodings and lists UTF-8
> as the default (and most interoperable), I think it would benefit
> from a stricter warning that parties using JSON for communication
> must have some out-of-band way to agree on what encoding is to be
> used.  I would expect that this is usually going to be done by the
> protocol using JSON, but could see a place for the actual
> communicating peers to have out-of-band knowledge.  (An application
> having to guess what encoding is being used based on heuristics is a
> recipe for disaster.)
> ...

AFAIU, there is no need for out-of-band knowledge (which would be very 
bad). Recipients are supposed to inspect the payload and detect which of 
the three encoding was used.

That said, we probably should make that clearer.

 > ...
> I'm also rather curious about the claim that no "charset" parameter
> is needed as it "really has no effect on compliant recipients".  Why
> is this not a good way to communicate whether UTF-8, UTF-16, or
> UTF-32 is in use for a given text?
> ...

It might have been, but that's now how it is implemented.

Best regards, Julian