[Uri-review] Re: draft-grimminck-safe-ioc-sharing

[Stefan Grimminck <[e-mail]>]

Hi Martin,

Thank you for the TR58 reference. Initially, I set out to codify existing behaviors, but it became clear that a lot of legacy mechanisms do not scale (e.g., character substitution). This led to documenting a path forward with the scheme bracketing seen in the current text.

I agree that this should include IPv6 to ensure consistency. It was initially omitted due to the currently low frequency of IPv6 occurrences and the existing use of brackets within IPv6 syntax. I am creating a test setup to validate a solution for IPv6 and will share results.

Best regards,

Stefan Grimminck


On Tuesday, April 14th, 2026 at 11:00, Martin J. Dürst <[e-mail]> wrote:

> Hello Stefan,
> 
> First, please also have a look at https://www.unicode.org/reports/tr58/,
> which may be relevant for your work.
> 
> On 2026-04-13 18:33, Stefan Grimminck wrote:
> 
> > Based on the review feedback, I'm planning the following changes for -09:
> 
> > - Reframing the IPv6 rationale in Step 3. The text currently states that IPv6 "does not trigger auto-linking in typical software," which I agree should not be presented as a permanent justification. I plan to replace this with a technical rationale.
> 
> Sorry to disagree, but this is NOT about justification. Why do you
> obfuscase domain names and IPv4 literals, but not IPv6 literals? If
> attacks with the former are possible, I'm sure attacks with the later
> also should be possible, and obfuscation has to address this.
> 
> Regards,    Martin.
> 
> 
>