Re: draft-klensin-emailaddr-i18n-00

John Cowan <[email protected]> wrote:

> > In any case, I think it would be good if receivers do not assume
> > that text is already normalized; they should perform normalization
> > whenever they want text to be normalized.  Then it will not be
> > necessary for senders to perform normalization.  The implementation
> > cost is the same whether the code is inside the senders or inside
> > the receivers.
>
> This is true for person-to-person email, but not for mailing list
> postings, which are formally equivalent.  There, the efficiency is
> much superior if senders MUST normalize and receivers SHOULD check
> normalization, checking being much less costly than normalizing in
> most cases.

When I say "implementation cost", I'm not talking about machine cycles.
Cycles are cheap and getting cheaper all the time.  I'm talking about
the cost of writing the code.  Sender and receiver implementations are
generally one-to-one.  Even if there are many receive events for every
send event (as in one-to-many communication), each side gets written
once.  The implementation cost of normalization is the same whether the
normalization code is written into the sender or the receiver.

If you want to conserve machine cycles, try this model:  Senders SHOULD
normalize, and receivers MUST accept unnormalized text.  Receivers can
check whether the text is already normalized (which is cheap, as you
say) and avoid doing the normalization in most cases.

> But if it is signed, you will destroy the digital signature.

Only if I destroy the original unnormalized text, which I'm under no
obligation to do.  I can construct a normalized copy of the text to make
it easier for me to interpret the text, and leave the signature attached
to the original unnormalized text.  Depending on the situation, I might
soon discard the copy and keep the original & signature, or I might keep
the copy and discard the original & signature, or keep both, or discard
both.

> What is worse, a sender of unnormalized text may be able to spoof a
> receiver.

The receiver will be fooled only if it blindly assumes that the text
is normalized.  I don't think receivers should make that assumption.
They can't be fooled if they force the text to be normalized whenever it
matters.

AMC