Subject: RE: [idn] homograph attacks

From: "Michel Suignard" <[email-masked]>
Date: Wed, 16 Feb 2005 16:29:04 -0800

> -----Original Message-----
> From: "Martin v. Löwis" [mailto:[email-masked]] 
> 
> Michel Suignard wrote:
> > I have seen European standard bodies spending forests of 
> > paper to try 
> > to establish these language tables, but there have never been an 
> > authoritative version because simply you can't.
> 
> Why do you say that? DENIC is using an authorative list for .DE, see
> 
> http://www.denic.de/de/domains/idns/liste.html
>

This is not a language table, it is basically all IDN allowable Latin characters from Unicode block 0000-007F and 0100-017F. This covers many European languages. As long as you don't call it a language table we may be in agreement. Note btw that by doing this they are excluding Welsh and Irish Gaelic which needs Latin characters in the 1Exx range. And obviously all Latin letters from the Extended-B are not included, which is excluding de facto many European minorities. 
  
> > It is not a bad idea to have language tables to filter, but 
> you have 
> > to allow exception for the reasons exposed above.
> 
> No, you don't. The exception you mention (Häagen-Dazs) is 
> already covered in the list of characters. It might be that 
> some company cannot use its logo as a domain name - tough 
> luck. There might not even be a Unicode character for the 
> logo. They will find a solution, using some sort of 
> transliteration. If enough users complain that they want a 
> certain, say, Greek character to be available in the .de 
> zone, DENIC might reconsider. However, I very much doubt this 
> will ever happen. For the .de zone, the DENIC list of 
> characters covers all actual needs. It may be that artificial 
> needs are not covered, but I could not care less.
> 

See above, there are quite a few European languages that need IDN allowed Latin characters above 017F. It is my belief that registry policies should be based on scripts, not subset because you are likely to miss some characters. I am not advocating for script mix as you may hint.
I am not saying either that the the DENIC list is bad. It is in fact reasonable (with the minor caveat expressed above), but it is by no mean a German language table or even an European language table.

> It is a very good idea to be more restrictive at the 
> beginning, and the gradually become less restrictive. This is 
> how the DNS started out - allowing only ASCII letters. With 
> IDNA, it is possible to widen this, but that does not mean 
> you cannot have a policy more restrictive than "full Unicode".

I never said that. I am just saying that subsetting Unicode script per language won't work. You are typically better off allowing all characters from a given script (within the IDN repertoire constraint and rules of course). By script I mean the script property as defined by Unicode. 
> Regards,
> Martin

Regards,
Michel

---

From: Erik van der Poel <[email-masked]>
Date: Wed, 16 Feb 2005 16:52:35 -0800

Michel,

You make a good point about Latin language tables and that maybe script 
tables should be used instead, but my real point was that a registry 
should not allow the registration of a domain name if it is not being 
filtered by some sort of character inclusion table.

You also point out that it may be inappropriate to try to get ccTLDs to 
follow rules from external organizations (outside that country). My 
email was not really directed at these ccTLDs either. Many of them seem 
to be using character inclusion tables rigorously.

My main concern, I guess, is COM. Wouldn't it be a good idea for them to 
reject or restrict registrations in those cases where the applicable 
table is not there yet?

Note also that the ICANN guidelines say:

"top-level domain registries will (a) associate each registered 
internationalized domain name with one language or set of languages"

http://www.icann.org/general/idn-guidelines-20jun03.htm

This "set of languages" could be a Unicode "script"?

Erik

---

From: "Martin v. Löwis" <[email-masked]>
Date: Thu, 17 Feb 2005 02:08:27 +0100

Michel Suignard wrote:
>>> I have seen European standard bodies spending forests of paper to
>>> try to establish these language tables, but there have never been
>>> an authoritative version because simply you can't.

> This is not a language table, it is basically all IDN allowable Latin
> characters from Unicode block 0000-007F and 0100-017F. This covers
> many European languages. As long as you don't call it a language
> table we may be in agreement. Note btw that by doing this they are
> excluding Welsh and Irish Gaelic which needs Latin characters in the
> 1Exx range. And obviously all Latin letters from the Extended-B are
> not included, which is excluding de facto many European minorities.

All true - but "so what?". This is an official policy what characters
can be used in a "German" domain name, in the .de zone. Whether that
makes it a "language table", I don't care. This kind of table is what
we have been talking about all along.

> I am not advocating for script mix as
> you may hint. I am not saying either that the the DENIC list is bad.
> It is in fact reasonable (with the minor caveat expressed above), but
> it is by no mean a German language table or even an European language
> table.

This is not the point. The point was your claim: "there cannot be an
official table", and I'm merely trying to say "but there is". Now,
I see that you make a difference between a character table for a
language, and a "language table"; I was unaware that "language table"
is a reserved term.

> I never said that. I am just saying that subsetting Unicode script
> per language won't work.

But we are not talking about typesetting here: this is about DNS.

Regards,
Martin