Subject: [I18ndir] IDNA2008, UTS #46, and RFC 5895

From: John C Klensin <[email-masked]>
Date: Mon, 08 Jun 2020 03:06:11 -0400

Hi.

Another question, independent of the previous one.

The latest version of UTR #46,
https://unicode.org/reports/tr46/, claims (or appears to claim
-- perhaps I'm misreading it) that, because RFC 5895 discusses
mapping issues, that the mappings it (UTR #46) specifies --to
all intents and purposes, NFKC with case folding-- are fully
conformant with IDNA2008.

That is an interesting claim.   RFC 5895 is an Informational
document, not part o the protocol.  It makes a clear distinction
between protocol and user interface issues that UTR #46 seems to
skip over.   And, even if it were a protocol specification to
which one could claim conformance, it specifies mapping upper
case to lower case (not case folding) and mapping of full width
and half width characters to their decomposed forms, but avoids
NFKC/D.

And then there is the "please don't" at the beginning of Section
3.

So, some questions:

(1) Would it be helpful to try to explain to our colleagues at
the Unicode Consortium (and, perhaps more important, those at
W3C and WHATWG) that, in a world of voluntary standards, we
cannot prevent them from developing and promoting standards that
compete with IETF ones, making conformance claims that are
obviously untrue is in bad taste and unhelpful to the community?

(2) Is it time to update 5895 to contain a clear Security
Consideration section that warns about the interaction between
certain types of mappings, notably indiscriminate use of
NFKC/NFKD and perhaps mapping some code points out of existence
and assorted types of phishing attacks?

(3) The ten-year anniversary of the publication of the IDNA2008
standard is about two months away.  Is it reasonable to ask how
long a specification that claims to be transitional is needed
and at what point it just becomes an excuse for not updating to
IDNA2008?

(4) UTR #46 effectively claims, at the end of Section 1, that
the CONTEXTJ rules for ZWJ and ZWNJ are inadequate.  Is there
value in our examining that assertion and updating the rules as
needed?

More generally, is it time to take another look at the
relationship between IDNA2008 (aka, Internationalized Domain
Names) and UTR #46 (aka, Unicode Domain Names) and think about
whether a clear document explaining the issues with the latter
and refuting some of its claims is now in order?

thanks, 
   john