any one working on full #Punycode support in their #fediverse apps?
@xn--c1h@xn--c1h.tk should really display as @▲@▲.tk and there is no reason that shouldn’t be a valid handle. of course we need security measures in place for homograph attacks but that should not stop us from supporting the worlds languages.
Hypolite Petovan
wakest ⁂
Hypolite Petovan
I'm curious about the email support of punycode. In username s well or in the domain part only?
My reason #1 is that it's relevant to DNS and domain names only. So I don't think we should use it for usernames for example.
My reason #2 is that it is a machine encoding while username are meant to be transmitted between humans. "xn--c1h" isn't a meaningful representation of "▲" for humans. For browsers and DNS software, yes.
My reason #3 is that there aren't any security measures related to punycode because punycode itself is the security measure to prevent homograph attacks on Unicode domain names, precisely because it destroys the "graph" of the considered name, which brings us back to my reason #2.
My reason #4 would be to just use straight up Unicode for usernames. The security risks are way lower than with domain names because there is less critical trust involved. Sure, someone could register a similar looking username as someone else, but it would only potentially affect this person's followers, not millions of people using a specific domain.
... show moreI'm curious about the email support of punycode. In username s well or in the domain part only?
My reason #1 is that it's relevant to DNS and domain names only. So I don't think we should use it for usernames for example.
My reason #2 is that it is a machine encoding while username are meant to be transmitted between humans. "xn--c1h" isn't a meaningful representation of "▲" for humans. For browsers and DNS software, yes.
My reason #3 is that there aren't any security measures related to punycode because punycode itself is the security measure to prevent homograph attacks on Unicode domain names, precisely because it destroys the "graph" of the considered name, which brings us back to my reason #2.
My reason #4 would be to just use straight up Unicode for usernames. The security risks are way lower than with domain names because there is less critical trust involved. Sure, someone could register a similar looking username as someone else, but it would only potentially affect this person's followers, not millions of people using a specific domain.
My reason #5 is that I believe there already are better Latin transliterations of non-Latin scripts than what punycode provides, and that people using non-Latin script probably don't expect their username to be visibly transformed the way punycode does. Usernames are much more personal than domain names in general, so the drastic machine-oriented transformation is more significant for usernames.
My reason #6 is that supporting punycode doesn't equals "supporting the world's languages". It still is a Latin representation of a machine representation of non-Latin scripts. Straight Unicode would be the way to go.
Most of these reasons tie in with each other but hopefully I was able to make a case against punycode without making a case against non-Latin scripts.
wakest ⁂
Hypolite Petovan
wakest ⁂
Hypolite Petovan
wakest ⁂
Hypolite Petovan
wakest ⁂
Hypolite Petovan
wakest ⁂
Hypolite Petovan
wakest ⁂
Hypolite Petovan
wakest ⁂
Hypolite Petovan
wakest ⁂
Hypolite Petovan