[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [idn] Re: stability

Martin v. Löwis wrote:
Erik van der Poel wrote:
If we do not correct the specs, more and more implementations will be created and deployed, some implementing it one way, the others the other way. It is hard to change something when a lot of implementations have been deployed. This is why we have to act now (or soon). We have to nip it in the bud.

Not sure what aspect you are referring to,

I was referring to the RFC that has a pointer to UAX #15, i.e. RFC 3454 (Stringprep). The pointer should be updated to tracking number 24 or higher. Since this issue is hard to understand, it might also be a good idea to add an explanation in the new versions of Stringprep and the IDNA family.

http://www.unicode.org/reports/tr15/tr15-24.html

however, I doubt that the
majority of the implementations cares too much about what the RFC says.
So whether the RFC is changed or not in a minor aspect has little
impact on reality.

There may be some organizations that ignore some or all of the changes we make to the RFCs, but others are paying attention, and I'm pretty sure they will follow at least some parts of the new RFCs. Mozilla and Opera have already indicated that they believe the punctuation mark and symbol problem is a big problem, and that they would/will address this problem whether or not the RFCs do.

In the specific case of normalization, I think most IDNA implementations
will rely on a normalization implementation created elsewhere - few
IDNA implementations will come with their own normalization routines.
This is because normalization is difficult to implement, so you rather
reuse than reinvent. Then, when the underlying normalization routine
is changed, the IDNA implementation also changes - most likely without
the author of the IDNA implementation (let alone its user) even knowing.
In that scenario, the implementor of IDNA has little control over what
specific incarnation of normalization is used.

This specific issue is already mentioned in RFC 3490 (IDNA) in the Security Considerations section. Of course, it is up to the implementors whether they will adhere to the letter of the specs, but the IETF tries to achieve a "rough consensus" among the parties discussing the matter, and the authors try to write clear specs that foster interoperability.

Erik