IDN processing-related security considerations for draft-ietf-websec-strict-transport-sec

[Frank Ellermann]

Update:

> Apparently <http://unicode.org/cldr/utility/idna.jsp?a=xn--cocacola>
> is down at the moment...

Somebody fixed this, thanks.  It confirms Jeff's Firefox result, the
"raw" Unicode result confirmed by <http://josefsson.org/idn.php> is:

<http://unicode.org/cldr/utility/idna.jsp?a=\u0c03\u0bfe\u0c05\u0c05\u0bff\u0bfe>

U+0BFE and U+0BFF are unassigned Unicode points in the Tamil block;
at the moment xn--cocacola is a "fake A-label".  Sadly XN-labels do
not tell me if mixing Tamil and Telugu will be always utter dubious.

Different ??-- introducers identifying selected subsets of relevant
scripts could be an idea.  In other words, meanwhile I found UTS 46
and its IDN FAQ.  This was a brave attempt to rescue IDNA2008, but
I'm not convinced that any "transitional" labels containing various
IDNA2008 DISALLOWED Unicode points "go away", why should they, ever?

-Frank