September 2017 - UA-discuss

Re: [UA-discuss] UASG010 - Quick Guide to Linkification
by Tex Texin Sept. 30, 2017

Sept. 30, 2017

Ajay, Is your reference to RFC 3896 in response to my comment on escapes? Yes we need to address #hh escapes used in URLs. However, if I cut and paste text from an html page that also uses Javascript, then the escapes for those languages might also be passed along. So software that is looking to linkify a url may need to deal with those as well. To compound the problem, the order of unescaping multiply escaped (in different languages) strings can make a difference. Agreed about the path allowing other scripts. Also the userinfo portion of the authority field. So the guide should be more specific about its application to domain labels (not just the TLD) rather than the entire URL string. tex From: AJAY DATA [mailto:ajay@data.in] Sent: Friday, September 29, 2017 10:44 PM To: textexin(a)xencraft.com; asmusf(a)ix.netcom.com; marksv(a)microsoft.com Cc: ua-discuss(a)icann.org Subject: Re: [UA-discuss] UASG010 - Quick Guide to Linkification I think we have not also considered this RFC 3896 for URL normalization. https://tools.ietf.org/html/rfc3986 P Let's also consider and make it part of recommendation. Now on mix script. :- When URL is containing absolute page and parameter http://www.example.com/page.html?parameter=1 Or http://www.example.com/ <http://www.example.com/???.html?parameter=1> पेज.html?parameter=1 Or http://www.example.com/ <http://www.example.com/???/page.html?parameter=1> पेज/page.html?parameter=1 Notice path and page.html is in Hindi and allowed . So, Tex may be we need to consider only till TLD , after that it can be mix script and may have to be allowed. Wish wishes Ajay On 30 September 2017 08:52:47 GMT+05:30, Tex Texin <textexin(a)xencraft.com> wrote: Asmus, I can understand why forum operators would apply those restrictions, but as you indicate, they don’t apply to new links in other contexts. However, coming back to linkification, the guidelines don’t address the query and fragment portions of a URL. As with the distinction to apply the script set rules to labels, it is worth pointing out in the guidelines that those rules do not apply to the portion after the “?” unless perhaps the query portion in turn is a URL. Example 1 http://domain.com/?refer= http://newdomain.com Example 2 http://domain.com/?title=script1 <http://domain.com/?title=script1&author=script2&quote=script1+script2+scrip…> &author=script2&quote=script1+script2+script3 The guidelines doesn’t address escapes. Should linkification attempt to unescape escaped characters? That might make the process much more complex. However, ignoring escapes might also lead to very inconsistent results. tex From: Asmus Freytag (c) [mailto:asmusf@ix.netcom.com] Sent: Friday, September 29, 2017 7:41 PM To: Tex Texin; 'Mark Svancarek' Cc: 'Universal Acceptance' Subject: Re: [UA-discuss] UASG010 - Quick Guide to Linkification On 9/29/2017 5:28 PM, Tex Texin wrote: Thanks Mark and Asmus. I agree about the distinction of script mixing within a label. The guide should clarify this. Also support Asmus clarification regarding ASCII vs all of Latin. For the attention to mixing digits within a label, I agree although I would need to review if I can easily know which digits are widely used vs of historical interest. I don’t believe that being a bit broad in linkification acceptance is a problem. The domain registry (and perhaps servers) should be more restrictive to not allow domains that could represent spoofing. (I know there are problems with reliance on registries). Being too restrictive in linkification could hurt users that need to enter a legitimate URL and can’t. Digits come in sets that are specified as such in the Unicode Standard (although implicitly: the members of such sets have a property "decimal digit" and Unicode follows the convention of encoding these in complete sets from 0-9). Therefore, not linkifying something that contains a mixture of these sets can be implemented deterministically (although regex syntax leads to particularly grim expressions for specifying this constraint, it can be done). Realistically, only the modern set of about 30 scripts is of practical importance, so a scheme that does not track the addition of future historic alphabets in Unicode would be adequate.... Where native digits are (largely) historic holdovers, we wouldn't need them at all, but linkification isn't a good place to filter those. Some reluctance on automatic conversions of "risky" URLs would be a benefit; it's along the same line as not linkifying something not under the author's control: the risk for mischief is just too great. Forum software that I have been a user of tended to implement three restrictions that are not related to new TLDs or IDN TLDs: 1) limit file names by extension (e.g. if the link entered was supposed to be for an image, do not allow it to link to something that doesn't have a common image file extension). 2) disallow any link with a "?" in it - rationale: it's not a static link and who knows what will be served later (including risky stuff) 3) require http://, etc., even in text spans that are marked as being URLs or in link attributes. In some cases these restrictions were deliberate decisions by forum operators - part of reigning in certain kinds of forum spam. I feel we need to be cognizant of the needs for limiting the risk profile of certain operations - in particular where the result then winds up online to an open audience (as opposed to just sharing something in a private message). The alternative for an operator is to simply blacklist specific TLDs and domains (and most of those will be any IDNs that are not local to the operator...). And it seems we need to clarify our implied intent for the guidance about the “implied intent of user’s entry”. J (I couldn’t resist any longer.) :) Tex From: ua-discuss-bounces(a)icann.org [mailto:ua-discuss-bounces@icann.org] On Behalf Of Mark Svancarek via UA-discuss Sent: Friday, September 29, 2017 5:04 PM To: Asmus Freytag; ua-discuss(a)icann.org Subject: Re: [UA-discuss] UASG010 - Quick Guide to Linkification Hmm, I don’t recall approving that principle (hopefully it was added while I was out on leave, and not just because I carelessly failed to notice it was being added). I mention that because it seems the opposite of what we could recommend i.e. we SHOULD allow use of Highly Restrictive and continue to discourage Moderately Restrictive. Do we need to revisit this? Sorry if I am just confused. Note that, as Asmus points out, our concern is about script-mixing within a label, not use of different scripts in different labels. Tex’s examples are all the latter, and should linkify cleanly by UA-ready SW. /marksv From: ua-discuss-bounces(a)icann.org [mailto:ua-discuss-bounces@icann.org] On Behalf Of Asmus Freytag Sent: Friday, September 29, 2017 2:40 PM To: ua-discuss(a)icann.org Subject: Re: [UA-discuss] UASG010 - Quick Guide to Linkification On 9/29/2017 2:26 PM, Tex Texin wrote: Hi, Some questions: 1. Do I understand correctly, that the recommendation to not linkify highly restrictive strings means that <mailto:tex@%E6%99%AE%E9%81%8D%E6%8E%A5%E5%8F%97-%E6%B5%8B%E8%AF%95.%E4%B8%96%E7%95%8C> tex(a)xn----f38am99bqvcd5liy1cxsg.xn--rhqv96g would not become a link? Or http:// 普遍接受-测试.世界.com? Highly restrictive means that latin cannot be mixed with Chinese or Japanese characters. Some script mixing *within* a label should be restricted as it is a security risk. Script mixing across a FQDN or between local part and host seem to be rather likely scenarios instead. For certain scripts, ASCII admixture (just ASCII, not all of Latin) would be common practice in the writing system and it may be common enough/benign enough to allow it. However, you might also want to address European digits for those scripts where native digits exist and are widely / predominantly used, vs. scripts where the native digits are more of historic/cultural interest. (In Arabic you have both, depending on the region). Mixing digit sets in the same label should be a no-no and indicated something's not well-formed. 2. I do not understand “Linkification should be determined by the implied intent of the user's entry” Is this intended to mean that the scheme (http, mailto, etc) should be added to form the link? Or some other determination of intent? If the former, it should be stated more clearly. My naive interpretation had to do with things like tables or data records where the purpose of a particular field would be a URL. tex From: ua-discuss-bounces(a)icann.org [mailto:ua-discuss-bounces@icann.org] On Behalf Of Don Hollander Sent: Thursday, September 28, 2017 11:19 AM To: Universal Acceptance Subject: [UA-discuss] UASG010 - Quick Guide to Linkification A quick update on Linkification We have published an updated Quick Guide to Linkification https://uasg.tech/wp-content/uploads/2017/06/UASG010-Quick-Guide-to-Linkifi… <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fuasg.tech%…> This builds on discussions we had post the UASG meeting in Seattle in April. We are also working on an evaluation of Linkification in major Social Media Communication applications. (Here’s the link to the Help Wanted advertisement - Help Wanted: Linkification Evaluation <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fuasg.tech%…> ) This evaluation is being built on a replicable testing platform so that we can readily repeat the process in the future. While early days, we expect to provide a preliminary report during the ICANN60 meeting. As we go through the testing it is raising some additional questions about our Good Practice guide and expectations. We fully expect that once the evaluation is completed we’ll again review UASG010 based on real world experiences. Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander -- Sent from my Android device with BharatSync Communicator.

1 0

UASG010 - Quick Guide to Linkification
by Don Hollander Sept. 30, 2017

Sept. 30, 2017

A quick update on Linkification We have published an updated Quick Guide to Linkification https://uasg.tech/wp-content/uploads/2017/06/UASG010-Quick-Guide-to-Linkifi… <https://uasg.tech/wp-content/uploads/2017/06/UASG010-Quick-Guide-to-Linkifi…> This builds on discussions we had post the UASG meeting in Seattle in April. We are also working on an evaluation of Linkification in major Social Media Communication applications. (Here’s the link to the Help Wanted advertisement - Help Wanted: Linkification Evaluation <https://uasg.tech/wp-content/uploads/2016/11/Help-Wanted%E2%80%A6-Linkifica…>) This evaluation is being built on a replicable testing platform so that we can readily repeat the process in the future. While early days, we expect to provide a preliminary report during the ICANN60 meeting. As we go through the testing it is raising some additional questions about our Good Practice guide and expectations. We fully expect that once the evaluation is completed we’ll again review UASG010 based on real world experiences. Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

7 9

UASG @ ICANN60
by Don Hollander Sept. 28, 2017

Sept. 28, 2017

Dear all: Confirming the schedule for the UASG during ICANN60 in Abu Dhabi Friday October 27 from 09:00 - 17:00 - UASG Workshop - https://docs.google.com/document/d/11Nwy50gMGPu14tGdrCJEzUXtBfMHgI6K7a1N6Ty… <https://docs.google.com/document/d/11Nwy50gMGPu14tGdrCJEzUXtBfMHgI6K7a1N6Ty…> Remote participation wil be available Monday October 30 10:30 - 12:00 - UASG Status update to the community. Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

1 0

Recent www.uasg.tech publications
by Don Hollander Sept. 28, 2017

Sept. 28, 2017

We’ve published a number of items on the UASG website: 1) UASG016 - Review of Popular Browsers for UA Readiness - English <https://uasg.tech/wp-content/uploads/2017/09/UASG-Report-UASG016.pdf> 2) UASG017 - Review of Popular Websites for UA Readiness - English <https://uasg.tech/wp-content/uploads/2017/09/UASG-Report-UASG017.pdf> 3) Blogpost covering these two https://uasg.tech/2017/09/universal-acceptance-ua-key-reaching-next-billion… <https://uasg.tech/2017/09/universal-acceptance-ua-key-reaching-next-billion…> 4) UASG018 - Evaluation Criteria for Programming Languages English <https://uasg.tech/wp-content/uploads/2017/09/UASG018-Programming-Languages-…> The Appendices for all three of these have rich and interesting material. Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

2 1

What’s in a (Domain) Name? - October 19, 2017 from 14:00 to 15:00 - EASTERN Standard Time
by Don Hollander Sept. 26, 2017

Sept. 26, 2017

Dear all… IDC, one of the largest IT media companies in the world, will be hosting a Webinar on Broccoli Issues (Universal Acceptance, IPv6 and DNSSEC) It’s set for October 19, 2017 from 14:00 to 15:00 - EASTERN Standard Time (USA) - Washington DC Time Zone. You can register at the link below Here’s the link to the public registration site. http://council.cio.com/webinars/domain-name-ua/ <http://council.cio.com/webinars/domain-name-ua/> It will be recorded and we’ll share the details once their published. Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

1 0

More UA Coverage - this time in the June 2017 Issue of CSI Communications (India)
by Don Hollander Sept. 21, 2017

Sept. 21, 2017

Thanks Satish for making this happen. Don

3 2

UA Voices @ ICANN60 - EAI
by Don Hollander Sept. 21, 2017

Sept. 21, 2017

The UASG has secured a video ‘taping’ slot on 31 October @ 13:00 at the ICANN meeting in Abu Dhabi. We’re looking for 3-6 people to talk about EAI in 60-90 second bursts. We’ll put it together something akin to https://youtu.be/0VAwYpe24ZA which we did in India last year. Topics to include: Why EAI is important for you, your business or your community What you’re doing about EAI Why you’re doing something about EAI If you want to speak in a language other than English, can you please provide a translation that we can use for captioning (you can see that in the above video too) Short, passionate, clear. If you’re interested, please let me know off list. Thanks. Don

1 0

Regular Expression
by Don Hollander Sept. 15, 2017

Sept. 15, 2017

Please note that this is a Geeky post - so carry on if that’s not you. Email validation is an area where many websites fall short as we found in our study on Website UA Readiness (nearing publication) The technologies behind these websites generally use a Regular Expression as their first line of defence against rubbish data. The issue is that most of these RegExs are overly restrictive. As an appendix to the Website review, we looked at some of the technologies behind the websites to see if there were common denominators for good and bad experiences. One RegEx has stood out as being simple and correct. I’d like the UASG to consider recommending this in our documentation. Toward that end, this thread is for discussion. /^.+@(?:[^.]+\.)+(?:[^.]{2,})$ Regular expression check in Javascript. This accepts any Unicode characters, only insisting that the domain must have more than one label and the TLD is 2 characters or longer. Your thoughts? Don Hollander Universal Acceptance Steering Group Skype: don_hollander

14 25

Re: [UA-discuss] Re : Re: Regular Expression
by Tex Sept. 14, 2017

Sept. 14, 2017

1 0

Re : Re: Regular Expression
by Dr. AJAY D A T A Sept. 14, 2017

Sept. 14, 2017

This is what Microsoft suggests for EAI Validation.https://blogs.msdn.microsoft.com/shawnste/2014/04/01/eai-email-a… Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com From: Don Hollander MailId : [73397993]To: Mark Svancarek Cc: Universal Acceptance Subject: Re: [UA-discuss] Regular ExpressionDate: 13 Sep 2017 10:37:07 PM Mark.What would such a RegEx look like?D> On 14/09/2017, at 4:26 AM, Mark Svancarek via UA-discuss wrote:> > Depending on your mail client, you may have experienced a linkification error in my response. Weird. > > -----Original Message-----> From: Mark Svancarek > Sent: Wednesday, September 13, 2017 9:21 AM> To: `Vittorio Bertola` Chaals McCathie Nevile ua-discuss(a)icann.org> Subject: RE: [UA-discuss] Regular Expression> > I believe that validation should be as light as possible. "Contains `@` " is about the extent of it unless you are willing to look at bidi and IFS. Just capture the string and send a test message.> > -----Original Message-----> From: ua-discuss-bounces(a)icann.org [mailto:ua-discuss-bounces@icann.org] On Behalf Of Vittorio Bertola> Sent: Wednesday, September 13, 2017 1:34 AM> To: Chaals McCathie Nevile ua-discuss(a)icann.org> Subject: Re: [UA-discuss] Regular Expression> >> Il 13 settembre 2017 alle 0.01 Chaals McCathie Nevile ha scritto:>> >> >> On Tue, 12 Sep 2017 22:43:09 +0200, Don Hollander >> wrote:>> >> I think there is value in validation - first, to determine whether an >> email address is real - if it isn`t, you are probably better off >> getting a warning than trying to send it.> > But this is nothing you can do just with a regexp. The regexp could allow you to intercept blatant mistakes - e.g., there are national keyboards where typing "@" requires pressing Alt or some uncommon combination of keys, so it`s easy to mistype it and you can easily warn the user that their entered string does not have a "@" - but anything beyond that is unnecessary, because, if a user mistypes an email address in any other way, it`s very likely that he will still end up entering a valid email address that no regexp will be able to tell as non-existing, or that could even exist but belong to someone else.> > On the other hand, if you try to implement a complex regexp, and especially if you try to figure it out on your own, it`s almost certain that you will mark as invalid several valid email addresses that are corner cases but should be accepted, as well as many future developments of the standards which are invalid now but will be valid in the future.> >> Second, I find it very helpful, including as a protection against >> phishing emails, to be told if an email is not recognised as a contact >> to whom I have *sent* an email, which is a stricter validation check.>> Applications that do that for me - especially for scripts I don`t read >> fluently like Chinese - are common, and I would be upset if they were to stop validating.> > But this, again, is a validation that cannot be done via a regexp (can you write a regexp representing your entire contact book?) and that, on the other hand, poses an additional stricter condition than just "the email address is valid". We are just discussing how to check that the email address is syntactically valid, any other checks could still be implemented however appropriate.> > The point here is that you should not try to determine whether an email address is valid by checking its syntax, other than checking that it has a "@" and possibly a "." on the right of it (but even this latter condition is already too strict, as the ideographic full stop "。" should be accepted in place of the ASCII dot, if you check strings in IDN form). Anything beyond that is going to exclude some valid addresses while not increasing in any significant way your chances of intercepting user input error at this stage - and you will still intercept any user error a few seconds later, when you send the validation/confirmation message.> > Regards,> -- > > Vittorio Bertola | Research &amp Innovation Engineer vittorio.bertola(a)open-xchange.com Open-Xchange Srl - Office @ Via Treviso 12, 10144 Torino, ItalyDon HollanderUniversal Acceptance Steering GroupSkype: don_hollanderDo not Remove:[HID]20170913223703930[-HID]

4 4