[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20161104114855.GA13029@hurricane.linuxnetz.de>
Date: Fri, 4 Nov 2016 12:48:55 +0100
From: Robert Scheck <robert@...oraproject.org>
To: Daniel Stenberg <daniel@...x.se>
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: [SECURITY ADVISORY] IDNA 2003 makes curl use wrong host
On Fri, 04 Nov 2016, Daniel Stenberg wrote:
> DENIC alledgedly has rules that should prevent separate registrations like
> in the straße.de case. Still it seems that this particular host name is
> registered by two different entities unless there's some background juggling
> that we can't easily see from the outside.
It is possible (and also allowed by the DENIC), that e.g. "straße.de" and
"strasse.de" have two different domain owners. I performed at least one
registration for a customer for a "ß"-domain after the "ß" sunrise period
was over, where the "ß"-domain owner is not the owner of the corresponding
"ss"-domain. Not sure which rules you refer to, but except the "ß"-sunrise
period in 2010, I'm able to register "ß"-domains on first come, first serve
basis at DENIC.
The DENIC FAQ (https://www.denic.de/en/faqs/faqs-about-idns-ss/) mentions
also that e.g. "mueller.de" and "müller.de" are two completely different
domain names (even "ue" is the German transcription of "ü") - and here the
argumentation is, that "bauer.de" is not the same like "baür.de" (which is
from the non-technical perspective of a German native speaker obviously
true). From my understanding, the argumentation here is non-IDNA mueller.de
vs. IDNA2003 müller.de, while now it is IDNA2003 strasse.de vs. IDNA2008
straße.de - which might be slightly different, because it's a switch of the
IDNA version rather the introduction.
For those who didn't notice, Florian also started a German thread on the
public DENIC mailing list (https://www.denic.de/en/service/mailing-lists/)
about exactly this topic (I'm not sure if there is a public archive).
Greetings,
Robert
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
