<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Courier New;color: #000000;font-size: 10pt;">
Andrei,
<div><br>
</div>
<div>thanks. Exactly. No list of "forbidden strings" - just one good practice. A lot of mischief can be done in the remaining space but at least that one bad practice can be taken off the table.</div>
<div><br>
</div>
<div>Alejandro Pisanty<br>
<div><br>
<p> </p>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px"><span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New">- -
- - - - - - - - - - - - - - - - - - - - - - - - - <br>
Dr. Alejandro Pisanty<br>
Facultad de Química UNAM </font></span></span></div>
<div style="font-family:Tahoma; font-size:13px"><span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New">Av.
Universidad 3000, 04510 Mexico DF Mexico</font></span></span></div>
<span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New"></font></span></span></div>
<p><span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New"></font></span></span> </p>
<span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New">
<p><span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New">+52-1-5541444475
FROM ABROAD </font></span></span></p>
</font>
<p><font size="2" face="Courier New"><span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New">+525541444475
DESDE MÉXICO </font></span></span><span class="Apple-style-span" style="widows:2; text-transform:none; text-indent:0px; letter-spacing:normal; border-collapse:separate; font:medium 'Times New Roman'; white-space:normal; orphans:2; color:rgb(0,0,0); word-spacing:0px"><span class="Apple-style-span" style="font-family:arial; font-size:small"><font size="2" face="Courier New">SMS
+525541444475 </font></span></span><br>
Blog: http://pisanty.blogspot.com<br>
LinkedIn: http://www.linkedin.com/in/pisanty<br>
Unete al grupo UNAM en LinkedIn, http://www.linkedin.com/e/gis/22285/4A106C0C8614<br>
Twitter: http://twitter.com/apisanty<br>
---->> Unete a ISOC Mexico, http://www.isoc.org<br>
. . . . . . . . . . . . . . . . </font></p>
</span></span></div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF24027" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>Desde:</b> At-Large [at-large-bounces@atlarge-lists.icann.org] en nombre de Andrei Kolesnikov [andrei@rol.ru]<br>
<b>Enviado el:</b> lunes, 23 de julio de 2018 11:05<br>
<b>Hasta:</b> Alejandro Pisanty<br>
<b>CC:</b> At-Large Staff; At-Large Worldwide<br>
<b>Asunto:</b> Re: [At-Large] IDN Variants in the market place<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div>Mixing scripts on the left and right is a sin initially. Cool registries ban it at EPP level.
<br>
</div>
<div><br>
</div>
<div>--andrei<br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">2018-07-20 22:34 GMT+03:00 Alejandro Pisanty <span dir="ltr">
<<a href="mailto:apisanty@gmail.com" target="_blank">apisanty@gmail.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">Hi,
<div><br>
</div>
<div>"at least in ASCII space" still can't work. Innumerable strings contain characters that, in turn, have look-alikes in other character sets, many in more than one. To get a sense of scale, try "aardvark" first; EVERY character has a potential substitute.
Also please remember the row around ".bg" in Cyrillic. (Again, barring correction from someone more knowledgeable.)</div>
<span class="HOEnZb"><font color="#888888">
<div><br>
</div>
<div>Alejandro Pisanty</div>
</font></span></div>
<div class="HOEnZb">
<div class="h5">
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Jul 20, 2018 at 1:55 PM, Sivasubramanian M <span dir="ltr">
<<a href="mailto:6.Internet@gmail.com" target="_blank">6.Internet@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="auto">
<div><br>
<br>
<div class="gmail_quote">
<div dir="ltr">On Sat, Jul 21, 2018, 12:19 AM Alejandro Pisanty <<a href="mailto:apisanty@gmail.com" target="_blank">apisanty@gmail.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">Barry,
<div><br>
</div>
<div>spot on, plus the idea of a list of forbidden strings appears to be pure lunacy in this context.</div>
</div>
</blockquote>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto"></div>
<div dir="auto">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div>All strings are potentially an attack for any substitution of any character by any IDN look-alike character. The list would contain a couple zillion names and as you say, many could be legtimate. To complicate things further, an ASCII "A" could be used
in an homograph attack by substituting for a Greek or Cyrillic "A" as well.</div>
<div><br>
</div>
<div>I may be missing something and would study a correction though.</div>
</div>
</blockquote>
</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div dir="auto" style="font-family:sans-serif"><span style="font-size:12.8px">for the Registries, </span><span style="font-size:12.8px">at least in the ASCII space,</span><span style="font-size:12.8px"> to volunteer to feed their respective list of harmful
names</span><br>
</div>
<br>
</div>
<div dir="auto">You missed 'at least in ASCII space'. </div>
<div dir="auto"><br>
</div>
<div dir="auto">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div><br>
</div>
<div>Alejandro Pisanty</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Jul 20, 2018 at 1:37 PM, <span dir="ltr"><<a href="mailto:bzs@theworld.com" rel="noreferrer" target="_blank">bzs@theworld.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<br>
On July 19, 2018 at 15:48 <a href="mailto:6.Internet@gmail.com" rel="noreferrer" target="_blank">
6.Internet@gmail.com</a> (Sivasubramanian M) wrote:<br>
> Please take a look at the attached screenshot of a domainer's offer to sell<br>
> single character IDNs, for instance an IDN variant (lookalike) of the ASCII<br>
> character X, which sets a harmful trend. This is an issue if confusability.<br>
<br>
The general term for this is "homograph attack" or specifically "IDN<br>
homograph attack", where "attack" may be in the eye of the beholder:<br>
<br>
<a href="https://en.wikipedia.org/wiki/IDN_homograph_attack" rel="noreferrer noreferrer" target="_blank">
https://en.wikipedia.org/wiki/<wbr>IDN_homograph_attack</a><br>
<br>
and has been the subject of much discussion over recent years and<br>
little resolution.<br>
<br>
I believe one popular proposal is browser support which either<br>
visually flags such IDNs or displays the punycode alongside which is<br>
an ASCII represenation and should make obvious that this not what one<br>
might suspect.<br>
<br>
For example (from this wikipedia page): xn--bcher-kva.tld indicating<br>
an umlauted 'u' is in there but importantly that it's not just<br>
bucher.tld.<br>
<br>
<a href="https://en.wikipedia.org/wiki/Punycode" rel="noreferrer noreferrer" target="_blank">
https://en.wikipedia.org/wiki/<wbr>Punycode</a><br>
<br>
There's still the problem with intent. Could I legitimately offer for<br>
sale the strings with and without the umlaut? I think that's generally<br>
considered acceptable.<br>
<br>
Caveat emptor?<br>
<br>
> <br>
> I understand that the Registries (are required to?) maintain a list of harmful<br>
> names for their TLDs, but there is no common minimal list of harmful names. One<br>
> possible way to achieve this is for the Registries, at least in the ASCII<br>
> space, to volunteer to feed their respective list of harmful names into a<br>
> common Registry Stakeholder database, and then draw up a common minimum list of<br>
> harmful domain names that any Registry could avoid registering. <br>
> <br>
> If At-Large could shape this as a workable suggestion, it could formally go to<br>
> the Registry Stakeholders.<br>
> <br>
> Sivasubramanian M<br>
> x[DELETED ATTACHMENT Screenshot_20180719-152932~2.p<wbr>ng, PNG image]<br>
> ______________________________<wbr>_________________<br>
> At-Large mailing list<br>
> <a href="mailto:At-Large@atlarge-lists.icann.org" rel="noreferrer" target="_blank">
At-Large@atlarge-lists.icann.o<wbr>rg</a><br>
> <a href="https://atlarge-lists.icann.org/mailman/listinfo/at-large" rel="noreferrer noreferrer" target="_blank">
https://atlarge-lists.icann.or<wbr>g/mailman/listinfo/at-large</a><br>
> <br>
> At-Large Official Site: <a href="http://atlarge.icann.org" rel="noreferrer noreferrer" target="_blank">
http://atlarge.icann.org</a><br>
<span class="m_-1895905736083545532m_7991951261013456010m_-7037647268669022242HOEnZb"><font color="#888888"><br>
-- <br>
-Barry Shein<br>
<br>
Software Tool & Die | bzs@TheWorld.com | <a href="http://www.TheWorld.com" rel="noreferrer noreferrer" target="_blank">
http://www.TheWorld.com</a><br>
Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD<br>
The World: Since 1989 | A Public Information Utility | *oo*<br>
______________________________<wbr>_________________<br>
At-Large mailing list<br>
<a href="mailto:At-Large@atlarge-lists.icann.org" rel="noreferrer" target="_blank">At-Large@atlarge-lists.icann.o<wbr>rg</a><br>
<a href="https://atlarge-lists.icann.org/mailman/listinfo/at-large" rel="noreferrer noreferrer" target="_blank">https://atlarge-lists.icann.or<wbr>g/mailman/listinfo/at-large</a><br>
<br>
At-Large Official Site: <a href="http://atlarge.icann.org" rel="noreferrer noreferrer" target="_blank">
http://atlarge.icann.org</a><br>
</font></span></blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="m_-1895905736083545532m_7991951261013456010m_-7037647268669022242gmail_signature">
- - - - - - - - - - - - - - - - - - - - - - - - - - -<br>
Dr. Alejandro Pisanty<br>
Facultad de Química <a href="https://maps.google.com/?q=UNAM+Av.+Universidad+3000&entry=gmail&source=g" target="_blank">
UNAM</a><br>
<a href="https://maps.google.com/?q=UNAM+Av.+Universidad+3000&entry=gmail&source=g" target="_blank">Av. Universidad 3000</a>, 04510 Mexico DF Mexico<br>
+52-1-5541444475 FROM ABROAD<br>
+525541444475 DESDE MÉXICO SMS +525541444475<br>
Blog: <a href="http://pisanty.blogspot.com" rel="noreferrer" target="_blank">http://pisanty.blogspot.com</a><br>
LinkedIn: <a href="http://www.linkedin.com/in/pisanty" rel="noreferrer" target="_blank">
http://www.linkedin.com/in/pis<wbr>anty</a><br>
Unete al grupo UNAM en LinkedIn, <a href="http://www.linkedin.com/e/gis/22285/4A106C0C8614" rel="noreferrer" target="_blank">
http://www.linkedin.com/e/gis/<wbr>22285/4A106C0C8614</a><br>
Twitter: <a href="http://twitter.com/apisanty" rel="noreferrer" target="_blank">http://twitter.com/apisanty</a><br>
---->> Unete a ISOC Mexico, <a href="http://www.isoc.org" rel="noreferrer" target="_blank">
http://www.isoc.org</a><br>
. . . . . . . . . . . . . . . .</div>
</div>
______________________________<wbr>_________________<br>
At-Large mailing list<br>
<a href="mailto:At-Large@atlarge-lists.icann.org" rel="noreferrer" target="_blank">At-Large@atlarge-lists.icann.o<wbr>rg</a><br>
<a href="https://atlarge-lists.icann.org/mailman/listinfo/at-large" rel="noreferrer noreferrer" target="_blank">https://atlarge-lists.icann.or<wbr>g/mailman/listinfo/at-large</a><br>
<br>
At-Large Official Site: <a href="http://atlarge.icann.org" rel="noreferrer noreferrer" target="_blank">
http://atlarge.icann.org</a></blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="m_-1895905736083545532gmail_signature">- - - - - - - - - - - - - - - - - - - - - - - - - - -<br>
Dr. Alejandro Pisanty<br>
Facultad de Química UNAM<br>
Av. Universidad 3000, 04510 Mexico DF Mexico<br>
+52-1-5541444475 FROM ABROAD<br>
+525541444475 DESDE MÉXICO SMS +525541444475<br>
Blog: <a href="http://pisanty.blogspot.com" target="_blank">http://pisanty.blogspot.com</a><br>
LinkedIn: <a href="http://www.linkedin.com/in/pisanty" target="_blank">http://www.linkedin.com/in/<wbr>pisanty</a><br>
Unete al grupo UNAM en LinkedIn, <a href="http://www.linkedin.com/e/gis/22285/4A106C0C8614" target="_blank">
http://www.linkedin.com/e/gis/<wbr>22285/4A106C0C8614</a><br>
Twitter: <a href="http://twitter.com/apisanty" target="_blank">http://twitter.com/apisanty</a><br>
---->> Unete a ISOC Mexico, <a href="http://www.isoc.org" target="_blank">http://www.isoc.org</a><br>
. . . . . . . . . . . . . . . .</div>
</div>
</div>
</div>
<br>
______________________________<wbr>_________________<br>
At-Large mailing list<br>
<a href="mailto:At-Large@atlarge-lists.icann.org" target="_blank">At-Large@atlarge-lists.icann.<wbr>org</a><br>
<a href="https://atlarge-lists.icann.org/mailman/listinfo/at-large" rel="noreferrer" target="_blank">https://atlarge-lists.icann.<wbr>org/mailman/listinfo/at-large</a><br>
<br>
At-Large Official Site: <a href="http://atlarge.icann.org" rel="noreferrer" target="_blank">
http://atlarge.icann.org</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>Andrey Kolesnikov<br>
</div>
<div><a href="http://RIPN.NET" target="_blank">RIPN.NET</a><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>