Re: [EAI] Add requirement for punycode conversions in downgrade

[John C Klensin <klensin at jck.com>]

--On Tuesday, 18 March, 2008 02:34 +0100 Harald Tveit Alvestrand
<harald at alvestrand.no> wrote:

>> 3. Downgrade should do a punycode conversion instead of
>> failing because  of no Alternate Address.
>> 
>> Since attempting delivery is almost always better than
>> failing a  delivery, I would support adding a requirement to
>> do the punycode  conversion for these cases in the Downgrade
>> specification.
> For the case of non-ASCII localparts, this has been discussed 
> extensively, and version 3 has been consistently rejected by
> the WG.
> 
> I haven't seen a discussion that focused on the
> ASCII at non-ASCII situation.

It seems to me that we have a tradeoff.  As Yao points out, no
presentation of punycode to a user is user-friendly.  Punycode
encoding can also be used to disguise various types of attacks
that would be obvious if the string were presented in "native"
form -- an analogy to the use of IP addresses, rather than
domain names, in URLs might apply here.     One can say "Since
attempting delivery is almost always better than failing...",
but perhaps this is one of the exceptions in which it is better
to get the failure message back to the sender and sending MUA in
the hope of getting the punycode change made there (or some
other decision being made).

In any event, it seems to me that the case for _requiring_
punycode conversion as a downgrade method is weaker than some of
this discussion would indicate.

    john



_______________________________________________
IMA mailing list
IMA at ietf.org
https://www.ietf.org/mailman/listinfo/ima