----- Original Message -----
From: "Adam M. Costello"
To: "IETF idn working group"
Sent: Wednesday, January 30, 2002 4:33 PM
Subject: Re: [idn] stringprep comment 2
> Soobok Lee wrote:
>
> > In many cases, label strings are imported or transmitted from other
> > applicationss, not generated by the application itself. that makes it
> > difficult to classify them.
> >
> > ...comparing two "query strings" are inevitable and make troubles.
> >
> > It seems very subtle question.
>
> I'm starting to agree.
>
> Hmmm, is it even necessary to avoid comparing two query strings? Even
> if you compare two strings prepared with loose stringprep (unassigned
> code points allowed), the worst that can happen is still a false
> negative (where they don't match when they should), you still can't get
> a false positive (where they match when they shouldn't).
Right. but, The latter can be as catastrophic as the former.
>
> So maybe we could simply remove all this talk about stored strings
> and query strings. The Stringprep spec could make this yet another
> parameter: the profile would have to specify, along with the mapping
> tables etc, a single bit indicating whether unassigned code points are
> prohibited or not. The Stringprep spec would retain the discussion
> about what can happen when unassigned code points are not prohibited.
>
> The Nameprep document would define two profiles: strict Nameprep and
> loose Nameprep, which differ only in that bit. The IDNA spec would
> require registrars to use strict Nameprep, and would let applications
> decide for themselves when/if to allow loose Nameprep.
Using iDN doesn't necessarily mean the application should *generate* the
ACE label. As examplified in my previous posting, the IRC server may
get chatters' email addresses only from chatting clients,not making on its own,
therefore, the IRC servers can't know whether the iDN email addresses
are made using strong nameprep or weak one. the IRC server are left with
no clue to decide whether to compare them or not.
if each application vendor adopts its own different nameprep profile,
applications behaviors may be unpredictable across applications
for end users. then, IDN can't fulfill the essesntial conditions of successful
universal identifier system.
To shot down moving targets,we need moving guns and moving hands and moving eyes.
Soobok Lee
