446285 - Do not display non-ascii characters as punycode, *IF* they are not problematic

Status: RESOLVED WONTFIX

(Core :: Networking, defect)

Description

[Lucas Malor (mail: c6kfnkn2uc AT snkmail DOT c0m)]

Currently Mozilla products display non-ASCII characters as Unicode only if their top-level domains are in Mozilla whitelist:
http://www.mozilla.org/projects/security/tld-idn-policy-list.html

I suggest to display *non-problematic* characters as Unicode also if their domains are not whitelisted, as Safari does: http://www.w3.org/International/tests/results/results-idn-display

Comment 1

[Gervase Markham [:gerv]]

Define "non-problematic".

Gerv

Comment 2

[Lucas Malor (mail: c6kfnkn2uc AT snkmail DOT c0m)]

Characters that are not similar (or identical) to other Unicode characters.

See the example. http://www.tilbehör.nu/ is displayed by Firefox as punycode, but not by Safari. Indeed ö is not a "problematic" character. See the link to w3.org I posted:

    «Safari displays any IDN containing only characters from one or more scripts 
    in the whitelist as Unicode, and any other IDN as punycode»

I think a mixed method will be the best solution: a TLD whitelist and a Unicode script whitelist, for non-whitelisted TLDs.

Comment 3

[Gervase Markham [:gerv]]

(In reply to comment #2)
> Characters that are not similar (or identical) to other Unicode characters.

Where do you suggest we find a list of such characters?

> See the example. http://www.tilbehör.nu/ is displayed by Firefox as punycode,
> but not by Safari. Indeed ö is not a "problematic" character. 

Have you checked all the thousands of characters in Unicode to make sure?

Gerv

Comment 4

[Lucas Malor (mail: c6kfnkn2uc AT snkmail DOT c0m)]

Obviously no. I think Safari has a public policy for this behaviour.

Comment 5

[Gervase Markham [:gerv]]

A pointer to this policy would be a good step forward.

Why not ask the .nu registry to apply for whitelisting?

Gerv

Comment 6

[Simon Montagu :smontagu]

There are tables of confusable characters on the Unicode site: see the references at http://unicode.org/reports/tr39/#Confusable_Detection. The tables are not exactly small ;-)

Comment 7

[Gervase Markham [:gerv]]

Right. And they aren't guaranteed to be complete either. Who do we blame if they aren't?

If a registry shows us their policies and makes a promise to stick to them, we know exactly who to blame if there's a problem, and can say so publicly. We also have a possible sanction against them - removing their TLD from the list. The current system seems to be working very well; we have no plans to change it.

Gerv