Subject: [NNTP] New NNTP AUTHINFO text

From: Russ Allbery <[email-masked]>
Date: Sat, 06 Aug 2005 13:21:18 -0700

Hello folks,

We're working, in the NNTP group, to find a good resolution to the
handling of stringprep issues for the legacy AUTHINFO command, which is
documented just for backward compatibility.

We've changed the character set from UTF-8 to an octet string for that
command to avoid part of the problem, and have currently tentatively added
the following text:

+     Also note that historically the username is not canonicalized in
+     any way.  Clients and servers MAY use the [SASLprep] profile of the
+     [StringPrep] algorithm to prepare usernames for transmission or
+     comparison, but doing so may cause interoperability problems with
+     legacy implementations.  If canonicalization is desired, the SASL
+     PLAIN [PLAIN] mechanism is recommended as an alternative.

Does this seem okay and address the concerns that you had?  Or do we need
more work in this area?

Thank you for your advice!

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Sam Hartman <[email-masked]>
Date: Mon, 08 Aug 2005 09:40:44 -0400

I would strongly recommend against asking clients to canonicalize.
Servers may actually be in a position to know the character set in use
and may even know if normalization will help.  Clients never do.

Besides that looks good.

---

From: Ken Murchison <[email-masked]>
Date: Mon, 08 Aug 2005 12:57:41 -0400

> and may even know if normalization will help.  Clients never do.

OK, so you're thinking something like this?

"Servers MAY use the [SASLprep] profile of the [StringPrep] algorithm to 
prepare usernames for comparison, ..."

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     2495 Main St. - Suite 401
716-604-0088 x26      Buffalo, NY 14214
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: Sam Hartman <[email-masked]>
Date: Mon, 08 Aug 2005 13:01:24 -0400

>>>>> "Ken" == Ken Murchison <[email-masked]> writes:

    Ken> OK, so you're thinking something like this?

    Ken> "Servers MAY use the [SASLprep] profile of the [StringPrep]
    Ken> algorithm to prepare usernames for comparison, ..."

Works for me.