Message-Id: <6.1.2.0.2.20050222163109.02e51db0@mail.jefsey.com>
Date: Tue, 22 Feb 2005 16:58:37 +0100
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>,
	Erik van der Poel <erik@vanderpoel.org>
From: "JFC (Jefsey) Morfin" <jefsey@jefsey.com>
Subject: Re: [idn] Re: nameprep, IDN spoofing and the registries
Cc: idn@ops.ietf.org
In-Reply-To: <20050222132656.GA13173@nic.fr>
References: <BE3FE373.C6C%haberg@math.su.se>
 <421A3E9C.5020204@vanderpoel.org>
 <f3aaace6b9037e8383c412d9e24b18db@gwg-associates.com.au>
 <421AC08F.2030207@vanderpoel.org>
 <20050222132656.GA13173@nic.fr>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Sender: owner-idn@ops.ietf.org
Precedence: bulk

At 14:26 22/02/2005, Stephane Bortzmeyer wrote:
>On Mon, Feb 21, 2005 at 09:18:07PM -0800,
>  Erik van der Poel <erik@vanderpoel.org> wrote
>  a message of 218 lines which said:
>
> > As George points out, the registries are going to have to start
> > filtering IDN lookalikes, otherwise they will eventually face
> > lawsuits from the "big boys" (as George so delightfully puts it).
>
>Quite the opposite: according to our lawyer, if the process is
>completely automatic (no human eyes involved), you can disclaim any
>responsability. But if you do screen, you accept a liability if the
>screening fails (and it will fail, trying to catch homographs is an
>hopeless task).
>
>I seriously doubt that european registries, which all moved from a
>"screen every domain to check if it is legal" model to a "accept
>anything" model in the '90s will go back...

Full agreement. Now, only for the reasons explained below, I am ready to 
test and propose several ccTLDs a filtering experimentation.

1. I filter the registered names (against foul names, blocked names) at 
registration level, before accepting payment.
2. the filtering will therefore be on xn--entries strings.

This being accepted:

1. could someone point a "C" source code to carry what has to be carried to 
filter out the dangerous names? Please help: I have no resource on this.
2. could someone list all the Unicode codes to blacklist that way?
3. could someone point a Perl code to use to enter a IDN and to get it 
properly punycoded, which could use such a list.

My rationale is that I only want to protect my own operations from 
confusion. I will only extend the description of the non-authorized 
characters in the terms and conditions. If this works properly I will 
describe the solution and experience in a for information Draft and a 
request to the IANA to list a Unicode black list.

jfc


jfc