Browser IDN display policy: opinions sought

Kent Karlsson kent.karlsson14 at telia.com
Sat Dec 10 21:59:54 CET 2011


Den 2011-12-09 12:12, skrev "Gervase Markham" <gerv at mozilla.org>:

... 
> The policies fall into 3 approximate buckets:
> 
> A (IE, Chrome): Unicode if the (single) 'language' of the string is
> configured in the options, Punycode otherwise.
... 
> (Note that "no restrictions" is not an option, given what happened in
> 2005 with payp-cyrillic-a-l.com, and I would rather not derail this
> debate by rehearsing those arguments again.)

There must be better ways to indicate that a particular domain name is
"not altogether fine" (whatever criteria are used for determining that)
than to use punycode display, which is altogether user unfriendly.

I would suggest to never use punycode display (but display the decoded
form) in display places where the conversion takes place (like the
address bar of a browser, to/from fields of a GUI-based email client,
...). That would hold even if there is no font on the system that
can display the characters in the domain name. The punycode version
should be extractable somehow, even though never used for normal display.

That a displayed domain name is "not altogether fine" could instead be
indicated by, e.g., red background, overstriking, or explicit error
messages (in the UI language of the application/app/...) associated
somehow with the display of the IDN, or a combination of these. Error
(or warning, if you like) messages could include "This domain name is
not in the global/personal whitelist", "This domain name mixes scripts
in an inappropriate manner", "This domain name is in the global
blacklist/has been reported as fraudulent", "This domain name uses
characters in script not used for any of the languages you have in
your language preference list" or whatever else is considered
"suspicious". Such error/warning messages would make it clear why
a particular domain name is flagged, while using punycode dispay is
on the level of using "?" as the sole error message for any error...

    /Kent K




More information about the Idna-update mailing list