Subject: Re: [idn] stringprep comment 2

From: "Soobok Lee" <[email-masked]>
Date: Sat, 2 Feb 2002 01:23:52 +0900

----- Original Message -----
From: "Adam M. Costello"
To: "IETF idn working group"
Sent: Friday, February 01, 2002 7:03 AM
Subject: Re: [idn] stringprep comment 2

> This message argues both sides of the issue. :)
>
> Soobok Lee wrote:
>
> > The latter can be as catastrophic as the former.
>
> I assume you meant that false negatives (where names don't match when
> they should) can be as catastrophic as false positives (where names
> match when they shouldn't). Can you back up that claim?

false postives result in "errors".
false negative result in "failures", like shutdown of authoritaive DNS servers.

end users of old clients would meet
"host not found", "email address is not found" failture notices.
They will be rejected to access the desired informations/resources/people in a timely manner,
even without any clues/explanations to such failures. They will be get lost and be frustrated.

Permanent/temporary shutdown of the 13 root servers are not errors, but catastrophic .

Soobok Lee

---

From: "Soobok Lee" <[email-masked]>
Date: Sat, 2 Feb 2002 01:53:44 +0900

----- Original Message -----
From: "Mark Davis"
To: "IETF idn working group"
Sent: Friday, February 01, 2002 7:17 AM
Subject: Re: [idn] stringprep comment 2

> The comparison of loose vs loose should never be done, for the reasons
> you outline. That leaves
>
> a) strict vs strict
> b) strict vs loose
>
> (a) is always safe.
>
> (b) works for situations like DNS, where there is a server on one side
> storing strict keys, and queries are made on the other and may be
> loose or strict. It would work for similar situations, such as email,
> if at one end there is a server that does validation (of, in this
> case, email names).

In VCARD , P3P , MSN Passport or addressbook entry form,
by what criteria can we decide which nameprep the input email addresses
should go through : strict nameprep or loose nameprep ?

The same question is valid for the senders' email addresses
in RFC822 "From:" header values and in SMTP "MAIL FROM:" header values ,
in instant web-based FORMMAIL submissions and
in job applications forms.

In there any possibility that any IDN labels which are intended as "queries" and ever injected into the internet
from one application , become permanent/persistant identifiers
at other applications? ACE labels carry no such context during their trip through out thier life time
in the interconnected applications. How can we prevent blind trusts or misuses of "queries"?

Soobok Lee