Re: [idn] Debunking the ACE myth

[Martin Duerst <duerst@w3.org>]

At 11:30 01/07/21 +0200, Patrik F$BgM(Btstr$B‹N(B wrote:
>--On 01-07-20 14.46 +0900 Martin Duerst <duerst@w3.org> wrote:
>
> >> I.e. the problem with using non-ascii in the labels in DNS, is that it is
> >> really easy to get what I would call leakage into the application layer
> >> protocols which can not handle other characters than ASCII.
> >
> > As Dan and others have shown, that's really easy also for ACE.
> > Even if we get all software doing it as planned, users will leak.
>
>But if ACE leak to a non-IDN aware application the user will be able to use
>the domainname.

Sorry Patrick, I was most probably too short. What I meant is:

Even with ACE, it's possible that real IDNs (i.e. non-ACEd) leak
to non-IDN-aware applications, via the user, some billboard or
napkin,... I.e. we cannot guarantee that all non-IDN-aware
applications only get ACE input.

Regards,   Martin.