Re: [pkix] [apps-discuss] character repertoire for fragment identifiers, was: Fwd: FW: New Version Notification for draft-kerwin-file-scheme-13.txt

["Martin J. Dürst" <[e-mail]>]

On 2015/01/12 07:10, Sean Leonard wrote:

> The security angle brings up another problem: the interoperable
> transcription of URIs across systems. The ASCII range is a limited
> repertoire, so it is easy to write it out unambiguously on paper,
> display it on a TV screen, say it over the radio or a public service
> announcement, or memorize it on your smartphone, in order to type it
> into your web browser, the command-line, or any other system of choice.

Many other writing systems are equally limited, and are easier to use 
for those using them natively. Some writing systems in East Asia aren't 
that limited, but have other mechanisms to just about allow the same 
things to happen.

> If you allow the enormous (and ever-expanding) range of Unicode
> characters in "URIs", all of those use cases become fundamentally
> ambiguous, inviting homograph attacks. Which smiley face out of nearly a
> hundred smiley emoji do you mean when you say "http://foo.com/😋" ??

Homograph attacks can happen, but only at points where different actors 
can add to the same namespace. There are exceptions, but usually, the 
path part isn't such an exception.

Also, people using smileys in their IRIs and hoping that these get 
easily copied are just shooting themselves in the foot. Just because it 
turns out that using some Unicode characters in IRIs isn't necessarily a 
good idea doesn't mean that we should exclude them all.

> How
> about an URI containing "ῗ" (U+1FD7 GREEK SMALL LETTER IOTA WITH
> DIALYTIKA AND PERISPOMENI)--what composition or decomposition mode? What
> if the combining accent mark code points are in a different order?
>
> ***
> I have empathy for what Sam/the W3C wants, since the HTML protocol slots
> basically beg to be filled with Unicode strings like <a
> href="http://zh.wikipedia.org/wiki/巴泰勒米·波岡達"> (instead of <a
> href="http://zh.wikipedia.org/wiki/%E5%B7%B4%E6%B3%B0%E5%8B%92%E7%B1%B3%C2%B7%E6%B3%A2%E5%B2%A1%E9%81%94">).

Very very much so. The former is readable (although there are better 
examples than foreign names such as Barthélemy Boganda) to a significant 
part of the world's population; the later is gibberish for everybody.


> But maybe the more interoperable approach is to define a format and
> mechanism (e.g., IRIs, or something like IRIs v2) to map /from ///the
> Unicode-capable protocol slots, /to/ the well-standardized RFC 3986 URI
> format.

With IRIs, that's essentially what we have. (of course I don't want to 
imply that the IRI spec cannot be improved upon)

Regards,   Martin.