[precis] Adam Roach's Discuss on draft-ietf-precis-7564bis-08: (with DISCUSS)

[Adam Roach <[e-mail]>]

Adam Roach has entered the following ballot position for
draft-ietf-precis-7564bis-08: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-precis-7564bis/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Section 12.5 contains the following normative statement:

>  Furthermore, because most languages are typically
>  represented by a single script or a small set of scripts, and
>  because most scripts are typically contained in one or more
>  blocks of code points, the software SHOULD warn the user when
>  presenting a string that mixes code points from more than one
>  script or block, or that uses code points outside the normal
>  range of the user's preferred language(s).

This guidance seems broadly unimplementable for any users whose native language
uses a non-Latin script. Due in large part to the Internet's ASCII heritage,
and combined with the somewhat ubiquitous use of Latin characters for other
worldwide purposes (e.g., a quick perusal of Russian- and Chinese-language web
sites shows numerous examples of Latin representations for things like stock
ticker symbols and metric abbreviations), it seems that the normative
requirement to warn when "presenting a string that... uses code points outside
the normal range of the user's preferred language(s)" will *either* warn
non-Latin-character users almost constantly (if Latin is considered outside the
range), or be broadly useless in preventing spoofing (if it is).

I'm not clever enough to come up with a generalized solution for users of all
alphabets, so don't have a generic proposal here; but I think that the guidance
does at least need to be properly scoped so that it bears only on warning Latin
alphabet users of the presence of non-Latin characters, while acknowledging
that it is probably rather useless when used in the opposite direction. I
imagine that it still makes sense to warn non-Latin users of non-Latin
characters outside the codepoints used by their language (e.g., warning Greek
speakers of the presence of Cyrillic characters).