Re: [SECURITY ADVISORY] IDNA 2003 makes curl use wrong host

[Florian Weimer <fw () deneb enyo de>]

* Daniel Stenberg:

> When curl is built with libidn to handle International Domain Names
> (IDNA), it translates them to puny code for DNS resolving using the
> IDNA 2003 standard, while IDNA 2008 is the modern and up-to-date
> IDNA standard.

I think everyone in the software space assumes that all DNS registries
block registrations which would allocate names colliding under the
IDNA 2003 and 2008 standards to different owners.  There were even
attempts at the registry level to automatically alias different
encodings (something which is difficult because it interferes with the
goal to make the whole thing application-centric).

> For example, `straße.de` is translated into `strasse.de` using IDNA
> 2003 but is translated into `xn--strae-oqa.de` using IDNA
> 2008. Needless to say, those host names could very well resolve to
> different addresses and be two completely independent servers. IDNA
> 2008 is mandatory for .de domains.

What does DENIC say about this matter?  It looks like their
implementation of IDNA is just very broken.