Submitted by Microsoft’s latest release of Internet Explorer will drive demand for internationalized domain names, according to industry experts who are predicting a sharp increase in sales of foreign language domain names. That’s because IE 7 has built-in support for IDNs, as does Firefox 2.0, also released in October.
Firefox has it since version 1.0 IIRC. Also, interesting whether IE7 will be vulnerable to IDN-based spoofing.
Oh, IE (and others) will be. Except now they have patented anti-phishing technology, so if it doesn’t warn you about the site, go ahead and trust it
The posts at this link cover IDN support, URI handling, and spoofing mitigations in IE 7 (more IE and general IDN info is available in the MSDN Library and IE Dev Center):
http://blogs.msdn.com/ie/search.aspx?q=idn&p=1
A few excerpts:
Internet Explorer 7 includes a new URL handling architecture known internally as CURI. The new optimized URI functions provide more secure and consistent parsing of URIs to reduce attack surface and mitigate the threat of malicious URIs.
CURI is a lightweight object which holds a single URI in normal form. If the CURI is constructed from a string URI, that string URI is cracked just once when the object is first constructed. After construction, callers may access any of the URI components using members provided by the object. This ensures that URIs are evaluated consistently throughout both security and feature code paths. We’ve re-plumbed Internet Explorer to accept and use CURI objects internally… The CURI object is available for consumption by external callers like ActiveX controls and Browser Helper Objects… It’s worth noting that even external code that does not directly consume CURI objects will benefit from the change, because Unicode string serialized out of CURI objects will be consistently normalized, decreasing the likelihood of incorrect parsing even outside of IE.
—–
IE7 imposes restrictions on the scripts allowed to be displayed inside the address bar. These restrictions are based on the user’s configured browser language settings. Using APIs from the aforementioned idndl.dll, IE will detect what scripts (character sets) are used by the current domain name. If the domain name contains characters outside of the user’s chosen languages, it is displayed in Punycode form to help prevent spoofing.
—
Users who allow Greek in their language-settings are as susceptible to Greek-only spoofs as the population using English is susceptible to pure-ASCII based spoofs. That’s where IE7’s Phishing Filter kicks in for both Unicode and ASCII urls. If the user has opted into the Phishing Filter, a real-time check is performed during navigation to see if the target domain name is a reported phishing site. If so, navigation is blocked. For additional defense-in-depth, the Phishing Filter’s web service can apply additional heuristics to determine if the domain name is visually ambiguous. If so, the Phishing Filter will warn the user via the indicator in the IE address bar.
—
Whenever viewing a site addressed by an International Domain Name, an indicator will appear in the IE address bar to notify the user that IDN is in use. The user can click on the IDN indicator to view more information about the current domain name.
So, erm, the title needs a rewrite?
‘Latest Web Browsers to drive foreign language domain names’
Even so:
People were using IDN before all this anti-phishing crap, and I doubt it’ll accelerate the market either. A lot of phishers now wont have the playground they previously had, so that’ll reduce purchases. ( http://www.xn--pypal-4ve.com/ anyone ? )
IE 7 and Firefox 2.0 uptake seems to be in Firefox’s favour, earlier Firefox’s already had it, as had Opera. So IE isn’t exactly *the* new thing.
Everyone who cares about IDN already has access to it. Well done MS, you’re last to the party again.
“So, erm, the title needs a rewrite?”
No, it doesn’t. Wether we like it or not, IE *IS* the most commonly used web browser and having it support IDN will naturally increase the use of IDN. Exactly how drastic that increase will be is of course an entirely different matter.
“So IE isn’t exactly *the* new thing.”
No-one is saying it’s a new thing.
“Everyone who cares about IDN already has access to it.”
Right. I’m sure no-one is interested in using their own language and characters.
No, it doesn’t. Wether we like it or not, IE *IS* the most commonly used web browser and having it support IDN will naturally increase the use of IDN.
Yet IE 7 is nearly the least common web browser on the Internet. And if you didn’t notice, only the English version of it has been released so far.
Right. I’m sure no-one is interested in using their own language and characters.
My point was: many DNS servers had IDN support already, and for users that knew they needed Firefox/Opera for access, would have used them for it. Simple As.
“And if you didn’t notice, only the English version of it has been released so far.”
Just released earlier today:
http://blogs.msdn.com/ie/archive/2006/11/02/first-wave-of-localized…
“many DNS servers had IDN support already”
No they havent because what we are talking about is IDNA and IDNA does not affect the DNS infrastructure at all. IDNA resides in applicatons, translating IDN names to ASCII names. DNS servers aren’t involved at all.
Who wants to use accent, or umlaut in a URL ?
In French most people don’t put them because you never know if it will be recognized or not, and if both systems are coexisting, it will not be easy to know which one is the good one and lots of websites will have to be bought instead of only one without accent.
German replaces ü with ue too.
I guess this may be different depending of the languages anyway.
Edited 2006-11-02 11:05
And the problem is characters like ü, ö, etc are hard to type for people with non-european keyboards. Imagine trying to type in a kanji URL….
Kanji is a lot easier to type on a standard English keyboard that any of the extended European characters are. You simply install an IME and then type out the language phonetically.
Simple.
I couldn’t agree more… most non-native german speakers i know have a hard time realizing the difference between u and ü. And if you think that might be troublesome, wait untill you try to enter an Japanese or Chinese URL.
I can’t even imagine how to enter Chinese URL and for Japanese URLs you would at least have to know Hiragana and still would often get it wrong, because it is reduced to the wrong kanji without you recognizing.
I have the feeling that IDNs will rather hurt the international spirit of the internet.
edit: darn, i should take less time to write posts
Edited 2006-11-02 12:02
“And if you think that might be troublesome, wait untill you try to enter an Japanese or Chinese URL.”
IDN is intended for the native users of the language, not for people who don’t speak it. Amazingly enough English isn’t the worlds most widely natively spoken language and quite a few people don’t speak it at all.
“I have the feeling that IDNs will rather hurt the international spirit of the internet.”
I guess the Internet should actually use Esperanto, eh?
Except that nobody understands Esperanto
In Denmark we use the same approach as in Germany and other countries. We fit our names within pure ascii. So æ and ä becomes ae , ø and ö becomes oe, å becomes aa, ü become ue and so on.
This solution works better than any other solution.
EDIT: True, other languages are more widely spoken than English, but English is #1 language in the economic sector, and the no. 1 foreign language for the bigger part of the world. Add to that the fact that English is the most widely spoken language (either as first or second language) in the industrial world.
It doesn’t matter what people speak amongst themselves – what matters are what they speak when communicating with persons from other language groups. And then English is #1.
Edited 2006-11-02 14:54
“what matters are what they speak when communicating with persons from other language groups.”
But the majority of people don’t do that, most communicate mostly with people in their own language.
Why should Kim Chen in China have to use an english/ascii address when comunicating with his chinese friend Gong Li, whos also in China?
IDNA (which is what we are actually talking about) isn’t a big problem because the IDNA names are only mapping/translations to actual ascii names which means that for every IDNA name there is a corresponding ascii name. IDNA resides solely in the application and does not affect the DNS infrastructure itself.
IDN is intended for the native users of the language, not for people who don’t speak it. Amazingly enough English isn’t the worlds most widely natively spoken language and quite a few people don’t speak it at all.
Yeah, well, those native users of the language will be really out of luck when they try to use IDNs without access to keyboards with the proper keyboard layout. Want to check your web mail at HügaBüga.de from an internet cafe in New York or London? Tough luck. And this is just one example, there are many more.
The Internet, and especially the World Wide Web, is all about easy access. We’ve spent decades to get the complexity out of it in order to make it both available and usable to the world. IDNs add a layer of complexity to both implementation and usability, exposing developers and users alike to a many problems ranging from security nightmares to accessibility disasters, and I’ve yet to hear a single convincing argument for them. I know am I not alone in thinking that the only ones that benefit from IDNs are the Registrars that sell them.
But most people use links, google, bookmarks, or autocomplete from the browser’s history. It should be easy.
And, as someone said, if you are using a german domain it ( not from a search engine, bookmark, link o history) is quite probable that you know german or how to type it.
Anyway. My prediction is that some companies will have dual domains. The ASCII friendly and the i18n’ed version. Some names can sound bad in ASCII.
“Some names can sound bad in ASCII.”
Yeah
http://blog.dreamhosters.com/2006/07/26/top-10-worst-domain-names/
OF course, you can use the Compose key to combine charakters to get many possible things like Ä (Compose : A), ß (Compuse S S) and so on. THis works on non-european systems as well – as long as the corresponting charset is present.
In French, you have grave and acute on vocals. There are so many character combinations in varous languages with a letter and a sign on top of or below them…
Browsers should not honor this. One of the goals of the entire Internet was internationalisation by a standard character set (ASCII subset). You would need a converter to transform Ö to OE for example. So on the TPC data, you’d have OE and not Ö, so why don’t use OE at the first time?
IDNs make things more complicated as it needs to be. Especially regarding japanese URIs and URLs (hiragana – kanji).
In some languages with e.g. an umlauted o or u, they may not be equivalent to “oe” or “ue”. Finnish, for example.
Hmm.. What are the equivalent to ü in Finnish then? (Just out of curiosity.)
Finnish doesn’t use umlauted u in particular – it uses y instead. But it does use umlauted a and o. I’m not aware of any alternatives.
Not me, but I would like to be able to use Æ, Ø and Å.
A lot of Danish companies have some of these characters in their names, and they should be able to communicate with their customers using their real name as domain.
Too many people tend to forget that once again, Opera was pioneer to implement IDN standard into its browser.
Opera innovates, others copy.
Opera this, Opera that.
Opera has _never_ innovated. They have merely copied from others and made some evolutionary steps on that.
The same is true for Mozilla and Microsoft. The first browser was an innovation, but updates to that are merely evolutionary.
I get sick and tired of this and that claiming to be innovative. What’s next? Web 2.0 SP1? *sigh*
That simply isn’t true. Opera was one of the first, if not the first, browser to have tabs. It was the first browser I know of to have gesture support. It is smaller, faster, and more standards compliant that either Firefox or IE.
It seems to me if anything, Firefox is playing catch up with Opera and IE is the younger brother trailing off in the distance who still eats sand sandwiches and poops his pants.
Edited 2006-11-02 15:18
Actually the Gecko browsers are more standard compliant than Opera. Opera is however far ahead of IE7, which is slightly better than IE6. Opera passes the Acid2 test but that means very little in regard to standard compliance.
Having tabs in a browser isn’t innovative. It’s merely an evolutionary step, considering that other applications had tabs before Opera had. And tabs is merely an evolutionary step from MDI (or towards, depending on what you prefer).
You may consider FF to be playing catch up. Since I don’t have FF at home (using K-Meleon and IE7 instead), I can’t say for sure, but as I see it Opera and IE is playing catch-up.
To me the browser’s external functionality means less than the rendering engine. I don’t care about mouse gestures. They are nothing but a slightly different way to perform actions and as such irrelevant. Keyboard shortcuts still beats mouse clicks and mouse movements (incl. mouse gestures)
But there must be many innovative things in life, if mouse gestures are innovative in your mind. SVG icons must be innovative, too
Actually they are about even for standards support.
And Opera *has* innovated. You’re restricting your definition of innovation too much. You can innovate pieces of software.
Also, IE *has* innovated in the past. AJAX anyone?
Edited 2006-11-02 17:48
I wouldn’t call it even. Opera 9.02 is somewhat behind the Mozilla 1.8.x branch when looking at overall compliance. But one thing is the overall compliance, another thing is complying with the most used standards.
“Innovating pieces” of software is the same as “evolutionary step”.
AJAX isn’t an innovation, but merely an evolutionary step. The personal computer was an innovation, and the wheel was an innovation, the car was an innovation. But the rubber wheel was an evolutionary step and not an example of innovation.
“Innovating pieces” of software is the same as “evolutionary step”.
AJAX isn’t an innovation, but merely an evolutionary step.
Make up your mind please.
wouldn’t call it even. Opera 9.02 is somewhat behind the Mozilla 1.8.x branch when looking at overall compliance. But one thing is the overall compliance, another thing is complying with the most used standards.
Mozilla 1.8.x is used in…? I’ve seen actual charts comparing individual things of the spec and they were even.
The Mozilla 1.8.x branch is used in Firefox 1.5.0.x and 2.x as well as in K-Meleon. newt and other Mozilla ActiveX Control-based browsers use the 1.7.x branch.
I’ve seen actual charts comparing individual things of the specifications for the many standards and Opera 9.02 is clearly behind though it handles things pretty well – and much better than IE7.
One must remember that many standards are quite new or rather old, and both groups have little support and are used little. For the standards that matters for the end user, Opera is no doubt side by side.
EDIT: When I talk about innovations, I think of large steps without a similar solution existing already. Like the wheel or the PC (not the IBM one, but the personal computer, including Apple II and many others). Small “innovative” steps are not innovative in reality, but mere evolutionary. Calling them innovative is pure hype. That’s why I’m asking “What’s next? Web 2.0 SP1?”
(And for the mod-down’ers.. please feel free, it doesn’t change the facts
Edited 2006-11-03 00:12
Calling them innovative is pure hype.
Calling them innovations is fact. You’re trying to down-play that fact, but that’s not the point. They are innovations nonetheless.
I’ve seen actual charts comparing individual things of the specifications for the many standards and Opera 9.02 is clearly behind
Well it’s quite possible that FF pulled a little bit ahead with 2.0, but I know 1.5 was even. They’ve been like that for a while.
Actually the Gecko browsers are more standard compliant than Opera.
Yes, they are, but they aren’t used nearly as much as Firefox, IE, and Opera. I didn’t feel the need to mention every browser ever invented because doing so didn’t add anything to my point, which was your point was wrong.
Opera is however far ahead of IE7
Most things are.
Opera passes the Acid2 test but that means very little in regard to standard compliance.
What it means, which may be “very little” to you, is that I can use HTML/CSS standards and rest assured that my page is going to load as I expect it to. IE doesn’t.
Having tabs in a browser isn’t innovative.
The definition of “innovating” is to create a new thing or a new method. When Opera started using tabbed browsing back in the 90s, it was innovative from a browser point of view because it was new. You can whine about it if you’d like, but it doesn’t change anything.
It’s merely an evolutionary step
By your definition (which isn’t correct) nothing in innovative. Cars are just an evolution from horses and wagons. Planes are just an evolution of birds. And meatloaf is just poop devolved.
You may consider FF to be playing catch up.
I do in some regards.
I can’t say for sure, but as I see it Opera and IE is playing catch-up.
I’m pretty confident in saying that Opera is a leader in the browser market. Firefox is too. IE is junk. Popular, but junk none the less.
To me the browser’s external functionality means less than the rendering engine.
The why not use Opera. It has an extremely fast rendering engine that is very standards compliant.
I don’t care about mouse gestures.
Mouse gesters are as important to browsing as a scroll wheel is to a mouse. Why limit yourself to a small 32X32 picture in the top left corner of your browser when you can accomplish the same thing from anywhere. It is, I don’t know, convenient.
They are nothing but a slightly different way to perform actions and as such irrelevant.
Email is just another way to send a letter to somebody, but I wouldn’t call it irrelevant.
Keyboard shortcuts still beats mouse clicks and mouse movements (incl. mouse gestures)
No they don’t. Since modern computers pretty much demand the use of a mous, it is silly to reposition your hand to perform a keyboard shortcut when you can do the same thing without moving your hand from the mouse. Doing so can cause repetitive stress injuries.
But there must be many innovative things in life, if mouse gestures are innovative in your mind. SVG icons must be innovative, too
By definition, they are. They are a new thing or method. That’s the cool thing about English words. They mean things.
Eehh.. Firefox is a Gecko browser
The rest of it is too long for me to answer now. It’s already two hours over bed time
(and tabs still won’t work in newt – It’ll have to wait).
Hope that when they come in they make it clear that Linux is not Windows to the average Joe.
I still know of a few local OEMs who bought into the hype from Lindows years ago and of people who fell ripped off knowing that there was no Windows on those computers.
The best solution I can think off is to ship the Desktops with relatively decent hardware at a mid-range price($900 to $1200). You know, something that an Average Linux user would like but that won’t lure too many Linux illiterate people looking for just a “cheap” PC.
If that happens, then my next desktop(Q3 2007) is going to be a Dell.