Leaving out scripts (Re: Unicode versions (Re: Criteria for exceptional characters))

[Michael Everson]

At 17:32 -0800 2006-12-19, Kenneth Whistler wrote:
>  > If you allow
>  > script-mixing, then of course, someone might try
>  > to spoof Danish å by using a THAANA SUKUN.
>
>Or of course using a COMBINING LATIN SMALL LETTER O,
>which *doesn't* involve script mixing.
>
>Or with LATIN SMALL LETTER A WITH DOT ABOVE,
>which doesn't involve script mixing.
>
>Or with <LATIN SMALL LETTER ALPHA, COMBINING RING ABOVE>,
>which doesn't involve script mixing.
>
>>  So don't allow it.
>
>Trying to put disallowance of script mixing into the
>protocol doesn't really solve the problem you are trying
>to solve.

It solves *one* of our particular problems. Your 
exclusion list (within each script as it were) 
solves *another*.

>And it would make the protocol more complicated,
>which likely would cut down its acceptance and make it
>more likely to be implemented with mistakes, which has
>its own security risks attached.

I guess that is a matter for whoever it is who "owns" the root.

>If we can just focus on eliminating as much of the undesireable
>cruft and unnecessary stuff from the inclusions table as
>possible at *this* point, the implementation of
>StringPrep will be much cleaner, the implementations will
>be simpler and easier to understand, the output will have
>many fewer types of problems in it.

I agree, but I think a script-mixing ban is 
nevertheless of great potential benefit.

>I really think you are being overly optimistic, 
>even quixotic, in thinking "just say no to 
>script mixing" in the protocol is going to be 
>the magic bullet to solve these problems.

*One* of our bullets. I'm not so exclusivist.
-- 
Michael Everson * http://www.evertype.com