<font size="2">I think some of the statements on this thread are based on misinformation.<br>
<br></font><font size="2">There are a number of different useful techniques for reducing spoofing. </font><font size="2">According to Michel, what IE7 actually does is to look at the languages set
in the browser, and deduce from that a set of scripts. Any name that contains characters outside of those scripts (or fails in certain
other ways) is shown in the raw punycode form. Here are some
illustrative cases, that I just gathered:<br><br>
</font><table style="border-collapse: collapse;" id="AutoNumber1" border="1" cellpadding="2" cellspacing="0">
<tbody><tr>
<th align="left" bgcolor="#dddddd"><font size="2">User Entry</font></th>
<th bgcolor="#dddddd"><font size="2">Firefox</font></th>
<th bgcolor="#dddddd"><font size="2">IE7</font></th>
<th bgcolor="#dddddd"><font size="2">Comments</font></th>
</tr>
<tr>
<th align="left" bgcolor="#dddddd"><font size="2"><a href="http://www.þorn.is">www.þorn.is</a></font></th>
<td colspan="2" align="center"><font size="2"><a href="http://www.%C3%BEorn.is/">http://www.þorn.is/</a></font></td>
<td><font size="2">þ is Latin</font></td>
</tr>
<tr>
<th align="left" bgcolor="#dddddd"><font size="2"><a href="http://bäcker.com">bäcker.com</a></font></th>
<td bgcolor="#ffff00"><font size="2"><a href="http://xn--bcker-gra.com/">http://xn--bcker-gra.com/</a></font></td>
<td><font size="2"><a href="http://xn--bcker-gra.com/">http://bäcker.com/</a></font></td>
<td><font size="2"> </font></td>
</tr>
<tr>
<th align="left" bgcolor="#dddddd"><font size="2"><a href="http://путин.museum">путин.museum</a></font></th>
<td><font size="2"><a href="http://%D0%BF%D1%83%D1%82%D0%B8%D0%BD.museum/">http://путин.museum/</a></font></td>
<td bgcolor="#ffff00"><font size="2"><a href="http://%D0%BF%D1%83%D1%82%D0%B8%D0%BD.museum/">http://xn--h1akeme.museum/</a></font></td>
<td><font size="2"> </font></td>
</tr>
<tr>
<th align="left" bgcolor="#dddddd"><font size="2">I♥NY.museum</font></th>
<td><font size="2"><a href="http://i%E2%99%A5ny.museum/">http://i♥ny.museum/</a></font></td>
<td bgcolor="#ffff00"><font size="2"><a href="http://i%E2%99%A5ny.museum/">http://xn--iny-zx5a.museum/</a></font></td>
<td><font size="2"> </font></td>
</tr>
<tr>
<th align="left" bgcolor="#dddddd"><font size="2"><a href="http://pаypal.museum">pаypal.museum</a></font></th>
<td><font size="2"><a href="http://p%D0%B0ypal.museum/">http://pаypal.museum/</a></font></td>
<td bgcolor="#ffff00"><font size="2"><a href="http://p%D0%B0ypal.museum/">http://xn--pypal-4ve.museum/</a></font></td>
<td><font size="2">'a' is Cyrillic</font></td>
</tr>
<tr>
<th align="left" bgcolor="#dddddd"><font size="2">ibm.com⁄foo.museum</font></th>
<td colspan="2" align="center" bgcolor="#ffff00"><font size="2"><a href="http://amazon.xn--comfoo-rq0c.museum/">http://amazon.xn--comfoo-rq0c.museum/</a></font></td>
<td><font size="2">fraction-slash</font></td>
</tr>
</tbody></table>
<font size="2"><br>
</font><font size="2">That's in my browsers, where I don't include
Russian, but do include at least one European language. If I add Russian to my browser's languages in IE7, then </font><font size="2"><a href="http://путин.museum">путин.museum</a> </font><font size="2">is allowed, </font>
<font size="2">but not </font><font size="2"><a href="http://pаypal.museum">pаypal.museum</a> (mixed scripts). </font><font size="2">This is just
what the browser does with the URL, <span style="font-style: italic;">not </span>whether the name is permitted by the registry.<br>
<br>Thus it doesn't look at particular languages, nor does it have to see whether "a combination of letters is a valid word in a given language". One could have achieved the same end by having a check-off list of scripts, although I think the choice of using the language list (which the browsers already have) nicely avoids having an extra UI.
<br><br>We'll see over time which type of interface users prefer. (As for myself, although I use Firefox generally as my browser, I prefer the IE7 approach in this case since regardless of the registry it catches bad URLs like
</font><font size="2"><a href="http://pаypal.museum">pаypal.museum</a>, but </font><font size="2">lets me use reasonable URLs like </font><font size="2"><a href="http://bäcker.com">bäcker.com</a>.</font><font size="2">)<br>
<br>Mark<br>
<br>
</font><div><font size="2"><span class="gmail_quote">On 12/16/06, <b class="gmail_sendername">Erik van der Poel</b> <<a href="mailto:erikv@google.com">erikv@google.com</a>> wrote:</span></font><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<font size="2">On 12/16/06, Gervase Markham <<a href="mailto:gerv@mozilla.org">gerv@mozilla.org</a>> wrote:<br>
> If the side of the bus says one thing, but I type another thing<br>
> that looks the same, then I end up in the wrong place. This is a<br>
> security risk, depending on the ownership of the "wrong place".<br>
> Therefore, registries should not allow this situation.<br>
<br>
I agree that, ideally, registries would not allow this situation.<br>
<br>
> So if I speak four languages, I will get security warnings for the three<br>
> I speak perfectly that aren't the user interface language?<br>
<br>
I wasn't really talking about "security warnings". I mentioned one<br>
idea for displaying domain names to the user. If the name contains<br>
unfamiliar characters, it is not shown as is. Instead, say, a shaded<br>
rectangle, about the same size as the original name, is shown. This is<br>
just one example of a possible UI.<br>
<br>
If the four languages you speak are "close" to each other and use<br>
mostly the same characters, perhaps such groups of languages would be<br>
treated as, well, groups. English, French and German are sufficiently<br>
"close" that showing an e-acute to an English speaker is probably OK.<br>
<br>
> You seem to have this idea that language communities exist in their own<br>
> isolated islands, all reading their own separate advertising and<br>
> content. If things worked this way, why do we not have a Japanese<br>
> Internet, a separate English Internet, and a separate Chinese Internet?<br>
<br>
No, we have a single Internet, and a lot of people speak English as a<br>
2nd language, so email that crosses international boundaries is often<br>
in English (like this one).<br>
<br>
This does not prevent companies from setting up Web sites in multiple languages.<br>
<br>
> I suspect that having them not work in between 15 and 40% of users<br>
> browsers (depending on which country you are in) would be a significant<br>
> disincentive to deploying a registered IDN domain name.<br>
<br>
Ideally, all registries would adopt and enforce sensible policies like<br>
the ones you mention. In the meantime, some software such as<br>
Microsoft's will probably continue to display some of the .com IDNs. I<br>
guess time will tell.<br>
<br>
Erik<br>
______________________________</font><font size="2">_________________<br>
Idna-update mailing list<br>
<a href="mailto:Idna-update@alvestrand.no">Idna-update@alvestrand.no</a><br>
<a href="http://www.alvestrand.no">http://www.alvestrand.no</a></font><font size="2">/mailman/listinfo/idna-update<br>
</font></blockquote></div><font size="2"><br>
</font>