At 07:57 AM 9/4/2002 +0200, Simon Josefsson wrote: >+ The entire world doesn't use Unicode, which is where IDNA starts.
Protocol standards rarely cover 100% of all possible situations. The result is a limitation, not a failure. The difference is key. >+ The choice of Unicode normalization KC has been questioned. Are you claiming that a) the behavior is not well understood, or that b) the working group did not reach rough consensus on this matter? If you are claiming anything else, then it is not a "failure". >+ Any modifications to the Unicode code charts or normalizations > tables destroy stability of IDN. Even I remember this issue being resolved. Efforts like these always have an issue with outside work being incorporated, and that outside work getting revised. The IETF approach is the usual one: The specification refers to a specific version of Unicode. If Unicode gets revised, the IETF may consider adopting it. Just because there is a new version of Unicode, the old one does not stop working. >+ Unicode normalization and bidi rules interact problematically. Please refer to the "are you claiming" response, above. It applies here, too. >These are things I've discovered by participating here for a month or >two and I don't pretend to understand these issues. As nearly as I can tell, you have raised issues that are not failures in the specification, but rather issues about which some people are dissatisfied. There are always people dissatisfied with a specification. That does not mean it has technical failings. > My point of view of IDN is not to enable fancy glyphs with it; it > is to integrate IDN securely in protocols like TLS, Kerberos, > OpenPGP and S/MIME which uses domain names for security critical > things. What may be sufficient for the web browsing herd may not be > adequate for the security conscious club. This focus seems to have > been neglected. How do IDN strings involve security issues that are different from classic ASCII domain names? In other words, rather than "neglected" I believe the issue does not exist. d/ ---------- Dave Crocker <mailto:[EMAIL PROTECTED]> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850
