Re: [idn] IDN spoofing

On 22 Feb 2005, at 19:25, Gregg Reynolds wrote:

> George W Gerrity wrote:
>> The two references below summarise much that has been said about the 
>> difficulty of dealing with the internationalisation of Domain Names. 
>> Let us agree once and for all:
>>
> ...snip
>>
>> These sort of common-sense rules can be easily implemented and the 
>> computational overhead is minimal. Of course, owners of ridiculous 
>> trade marks (such as <U+004B U+0049 U+039B>, “KIΛ”, for the brand 
>> name of the automobile “KIA”) will disagree, but realism has to 
>> intrude somewhere into the free market economy.
>
> I can see it now:  the official roster of "ridiculous trade marks" to 
> blacklist. This is supposed to protect us from the lawyers?

Yes. In the example I gave, the trademark is ridiculous because it uses 
approximate homographs. Lawyers wouldn't have a handle for a court case 
if the rules were general and reasonable to prevent spoofing, and if 
the registering authority had legal protection for its decisions. We 
have plenty of examples in any country where naming authorities already 
have these protections, and where challenges aren't even likely to get 
before a court. Examples are the names you can give to children (you 
can't call him/her “shithead”, for  example), or even that you can give 
to yourself by deed poll, or what can appear on automobile licence 
plates. In the case of domain names, there is already a limitation to 
name lengths of 63 characters, and that is certainly arbitrary. There 
are a few Welsh place names exceeding that length, and they simply 
won't be registered.

>> By using this approach, and starting off with a set of rules that 
>> disallow most forms of script mixes, then where appeals to common 
>> sense and the wishes of a reasonable number of potential clients 
>> suggest a loosening of the rules, this can be done with little 
>> disruption to the existing state of affairs.
>
> Sorry, but when I hear a phrase like "appeals to common sense" I reach 
> for my revolver, as the saying goes. That just doesn't work across 
> cultures. Doesn't work within cultures very well, for that matter.

Some cultures adopt civilised ways to settle differences (discussion, 
consensus, suck-it-and-see): I am hoping the IDN culture will be one of 
these.

My point about “appeals to common sense” was in the context of 
initially adopting deliberately overly restrictive rules so as to keep 
the allowable subset small enough that a filter can be quickly and 
easily built, and we can be sure that nothing nasty gets through. This 
will obviously catch some names that no one would want to prohibit, but 
that we may not yet have an algorithm to let through. So, we have some 
experts look at it, and if they can't see any harm, then we let it 
through. In parallel, we try to find a sieve that lets these sort of 
names through, but still keeps the nasties out. My “appeals to common 
sense” is the opposite of “enforcing bureaucratic nonsense”.

> We'd all like to agree once and for all; the problem is, we don't.

I think we do agree what the problem is. However, it is a difficult one 
to solve (especially algorithmically), probably is language and/or 
script and/or region particular, and is better solved by incremental 
safe steps, where there is an escape clause (looking at individual 
names by human experts) to put a human face to it, rather than either 
doing nothing, or being cynical about legitimate approaches.

George