Re: [idn] IDN spoofing

From: George W Gerrity (g.gerrity@gwg-associates.com.au)
Date: Tue Feb 22 2005 - 08:41:15 CST

  • Next message: Peter Constable: "RE: Codepoint Differentiation"

    On 22 Feb 2005, at 19:25, Gregg Reynolds wrote:

    > George W Gerrity wrote:
    >> The two references below summarise much that has been said about the
    >> difficulty of dealing with the internationalisation of Domain Names.
    >> Let us agree once and for all:
    >>
    > ...snip
    >>
    >> These sort of common-sense rules can be easily implemented and the
    >> computational overhead is minimal. Of course, owners of ridiculous
    >> trade marks (such as <U+004B U+0049 U+039B>, $B!H(BKI$B&+!I(B, for the brand
    >> name of the automobile $B!H(BKIA$B!I(B) will disagree, but realism has to
    >> intrude somewhere into the free market economy.
    >
    > I can see it now: the official roster of "ridiculous trade marks" to
    > blacklist. This is supposed to protect us from the lawyers?

    Yes. In the example I gave, the trademark is ridiculous because it uses
    approximate homographs. Lawyers wouldn't have a handle for a court case
    if the rules were general and reasonable to prevent spoofing, and if
    the registering authority had legal protection for its decisions. We
    have plenty of examples in any country where naming authorities already
    have these protections, and where challenges aren't even likely to get
    before a court. Examples are the names you can give to children (you
    can't call him/her $B!H(Bshithead$B!I(B, for example), or even that you can give
    to yourself by deed poll, or what can appear on automobile licence
    plates. In the case of domain names, there is already a limitation to
    name lengths of 63 characters, and that is certainly arbitrary. There
    are a few Welsh place names exceeding that length, and they simply
    won't be registered.

    >> By using this approach, and starting off with a set of rules that
    >> disallow most forms of script mixes, then where appeals to common
    >> sense and the wishes of a reasonable number of potential clients
    >> suggest a loosening of the rules, this can be done with little
    >> disruption to the existing state of affairs.
    >
    > Sorry, but when I hear a phrase like "appeals to common sense" I reach
    > for my revolver, as the saying goes. That just doesn't work across
    > cultures. Doesn't work within cultures very well, for that matter.

    Some cultures adopt civilised ways to settle differences (discussion,
    consensus, suck-it-and-see): I am hoping the IDN culture will be one of
    these.

    My point about $B!H(Bappeals to common sense$B!I(B was in the context of
    initially adopting deliberately overly restrictive rules so as to keep
    the allowable subset small enough that a filter can be quickly and
    easily built, and we can be sure that nothing nasty gets through. This
    will obviously catch some names that no one would want to prohibit, but
    that we may not yet have an algorithm to let through. So, we have some
    experts look at it, and if they can't see any harm, then we let it
    through. In parallel, we try to find a sieve that lets these sort of
    names through, but still keeps the nasties out. My $B!H(Bappeals to common
    sense$B!I(B is the opposite of $B!H(Benforcing bureaucratic nonsense$B!I(B.

    > We'd all like to agree once and for all; the problem is, we don't.

    I think we do agree what the problem is. However, it is a difficult one
    to solve (especially algorithmically), probably is language and/or
    script and/or region particular, and is better solved by incremental
    safe steps, where there is an escape clause (looking at individual
    names by human experts) to put a human face to it, rather than either
    doing nothing, or being cynical about legitimate approaches.

    George



    This archive was generated by hypermail 2.1.5 : Tue Feb 22 2005 - 08:42:39 CST