Re: [idn] IDN spoofing

[Erik van der Poel <erik@vanderpoel.org>]

> > Perhaps the .com operator could specify that 2nd 
> > level domain labels must stick to one writing system, and that that 
> > writing system must be indicated in the RRP (Registry Registrar 
> > Protocol) in order to validate the 2nd level name against the table of 
> > characters allowed in that writing system.
>
> This is already the case in Verisign's SRS where registrars are required 
> to submit an ISO-639 language tag via RRP.

I feel that it may be worth exploring whether we can come up with a 
distinct (from 639) set of names that more accurately matches the model 
I'm thinking of. See below.

> > This would probably require a (new?) set of names for writing systems, 
> > somewhat similar to the language tags of ISO 639.
> What nifty features would this bring, if the registry does not attach 
> any rules to the writing systems, as is the case with language tags now.

Well, perhaps the tag passed in RRP would not simply identify a table of 
characters that are used in a writing system. Perhaps the tag would name 
a set of rules for a domain label, that includes having to use a table 
of characters.

This set of rules could, for example, include a rule that states whether 
and how Latin characters are allowed in a Cyrillic label such as the 
XML-ccccccc.com example mentioned earlier on the Unicode mailing list. 
(Here, the "ccccccc" are all Cyrillic characters.)

As was mentioned on the Unicode mailing list, the hyphen '-' could be 
used to separate the Latin from the Cyrillic. The Russian TLD .ru might 
want to have such a set of rules. (They probably already have some 
rules; I certainly am not trying to force them to adopt this proposal; 
it is merely an example.)

To continue this example, the .com registry might then wish to reduce 
confusion by adopting the same set of rules for Russian registrations 
under .com. This way, a registrant is confronted with a unified model 
and set of rules, whether they wish to register only under .ru or also 
under .com.

Of course, under this proposal, the guideline would no longer be called 
"one label, one writing system" because my proposed sets of rules would 
not really be exactly the same as "writing systems" as defined in the 
Unicode book.

So we might have to come up with a different term for these sets of 
rules. How about "label rules"?

Erik