Subject: RE: [idn] Debunking the ACE myth

From: "Colosi, John" <[email-masked]>
Date: Wed, 18 Jul 2001 22:17:27 -0400

Dan,

	I don't think you addressed Adam's specific assertion that ACE is
not involved in the problem.  I believe his point is that your operating
system will probably use utf-8 on the clipboard to transport the Unicode
data from the browser to the e-mail client.  ACE doesn't seem involved in
the client's failure to send the e-mail.  Can you address his point
specifically?

	In fact, I think ACE is at least responsible for giving the illusion
that the e-mail might succeed.  The behavior of the browser might also be at
fault.  By using only Unicode characters in the mailto address, the browser
has displayed these characters in an unusable form.  Maybe the browser
should elect to display the ACE characters along with the Unicode,
indicating to users that the strings are identical in some context.  This
would allow you to easily cut & paste the address.

	I think you could make an interesting argument here and I'd like to
see it.  The "ACE Myth" conspiracy theory stuff is not very constructive.

-- John

-----Original Message-----
From: D. J. Bernstein [mailto:[email-masked]]
Sent: Wednesday, July 18, 2001 9:17 PM
To: [email-masked]
Subject: Re: [idn] Debunking the ACE myth

Adam has been telling us that UTF-8 IDNs are bad because using them may
cause failures in the short term, i.e., before the software upgrade is
complete. He's been claiming that ACE is better in the short term:

   Suppose I am considering getting an IDN for my domain. With ACE, this
   will make [some displays better, some displays worse] but nothing
   will actually break (mail will get through, web pages will load, etc)

This example shows that he's wrong. Some mail _won't_ get through if he
switches to an ACE IDN before all the software supports ACE.

Adam M. Costello writes:
> I don't see how this is an ACE failure.

You don't see that it's a failure? Or you don't see that the procedure
succeeds if the ACE IDN is replaced by a normal domain name?

Pasting an address from a browser into a mail client is a very common
operation. I do it all the time. I'll be extremely unhappy if it breaks.

> you have no chance of dissuading the ACE supporters

We'll see. I think that the ACE myth has been a big part of the ACE
advertising campaign on this mailing list. I find it interesting that
you're trying to abort the discussion of this example.

---Dan

---

From: [email-masked]
Date: Thu, 19 Jul 2001 11:26:33 -0700 (PDT)

> I think that was my point.  The people that want "it" will
> upgrade, if they can.   The ISPs who run the servers may not see
> "want" the same way. So, once again, if you want rapid
> deployment, pick a solution that leaves the upgrading in the
> hands of those who need the functionality --the users in this
> case-- rather than entertaining fantasies about what ISPs and
> other server operators will do.

I don't work for an ISP, but I do work on email software that a fair
number of
large ISPs buy. And I believe that John is right on target here.

Here's a specific example. Some time back we released a new version of
our
email software. The primary goal of this particular release was to
improve our
internationalization and localization capabilities. A large number of
enhancements were made and a large number of internationalization bugs
were
fixed. In particular, any number of issues relating to the ability to
handle
non-ASCII user information properly were addressed.

But uptake of this new release has been very slow, even with customers
who said
they urgently needed the new internationalization and localization
support and
bug fixes in this release. And this continues to be the case despite
many
reports from the field saying the new release is actually more stable,
more
reliable, faster, and generally easier to deal with than the old
version.

And even in cases where the new release has been deployed the new
functionality
hasn't always been exposed to end users. This is because having the
support in
the product is only the first step. Provisioning issues have to be dealt
with.
And large ISPs often have their own provisioning tools, some of which
are quite
convoluted, and these tools have to be updated before they can usefully
offer
new functionality.

The bottom line is that large ISPs are conservative. No, make that
*extremely*
conservative. Marketing may be crying for new features, but operations
isn't
willing to sacrifice stability to get those new features. When it comes
to
software deployment they proceed slowly, they test everything six ways
from
Sunday, and even if it all looks good they still wait for an opportune
time to
upgrade cautiously. And at the first sign of trouble they call the whole
thing
off. And then you wait for another windoe in, say, 6 months or so.

And guess what? Even with all the care they take, they still have
problems all
the time. Our industry doesn't exactly have a stellar track record when
it
comes to quality and reliability. So I don't expect any of this to
change any
time soon.

But what if there was a security hole? As it happens I have experience
with
this as well. Happily, we haven't found holes in our code, but we depend
on
lots of other libraries and components from other sources, and several
vulnerabilities have been found in a couple of these. When such things
are
found and found to matter our customers get a patch for the software
they are
running. They don't upgrade to fix security holes. They demand patches.
And
they get them.

Now, you may argue that my experience isn't typical, that experience
with email
deployment says nothing about DNS deployment, that IDN deployment is
somehow
different or whatever. But you now have two people with real world
deployment
experience saying that John's experience in this area matches our own.
Make of
that what you will.

Ned

---

From: Dan Oscarsson <[email-masked]>
Date: Mon, 23 Jul 2001 13:02:05 +0200 (MEST)

Adam M. Costello wrote:

>It's undeniable that ACE is more backward-compatible, and fails in fewer
>instances, than any 8-bit encoding.  

Especially if ACE is never decoded into the non-ASCII characters it represent.
The moment ACE is decoded, ACE will have the same failures that using UTF-8
would result in.

  Dan

---

From: Dan Oscarsson <[email-masked]>
Date: Tue, 24 Jul 2001 08:44:52 +0200 (MEST)

David Hopwood wrote:

>Dan Oscarsson wrote:
>> 1) [names on the wire are always canonicalised]
>>    is the IDNA case and also in Microsofts draft-skwan-utf8-dns.
>>    This results in that for example upper case characters cannot be
>>    used in responses from DNS. Probably very irritating some people
>>    who have spent a lot of mony on their nice company name which uses
>>    mixed case and will break some programs expecting mixed case
>>    in PTR responses.
>
>What programs will break in this case? That doesn't sound remotely
>plausible to me. If it turns out to be difficult to support case
>preservation then that would be the first thing I'd discard: other
>properties are far more important.

Many programs still do case exact matching on host names despite
that DNS have had case insensitive matching from the start. I have seen
Unixprograms fail due to people prefering host names with the first
letter in upper case and have had to use exactely the same case in
my configuration files as in the DNS answers.

But yes, if we want we could require all results to be in the
nameprepped state (including ASCII only names) and add a new RR in
answers to supply the "true" from of the name where needed (for example
in PTR answers).

   Dan

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 24 Jul 2001 10:48:36 +0200

--On 01-07-24 15.43 +0900 Martin Duerst <[email-masked]> wrote:

> If anybody is so stupid to buy an IDN to put its ACE on paper,
> s/he can of course do that, but I doubt that's what many
> people would want to do.

I would ABSOLUTELY do it on my buissness card as an alternative form of my
email as I know that people in many countries don't know how to enter 'ä'
(adiaeresis) on their keyboard, and I want people to be able to create an
email and send it to me.

And, I would appreciate getting an ACE version of a japanese domainname
because even though I can enter japanese characters on my Mac, I don't know
the input system well enough (or japanese characters enough to say whether
I have entered the correct name or not).

Now kill me on this list if you want to...

   paf