[jdev] SASL debugging

[Norman Rasmussen]

On 12/10/05, Matthias Wimmer <m at tthias.net> wrote:
> Hi Norman,
>
> Norman Rasmussen schrieb:
>
> >Cool, thanks for sorting out that example!
> >
> >I'm a 'latin' only charset kinda guy, so the notion of stringprep is
> >pretty foreign to me, but I understand why it's necessary.

correction: I'm an 7-bit ascii kinda guy, the only reason I've ever
used the eight bit for anything was line-and-box-drawing, or typing
second language essay's at school.

> Well I even had an example in Latin-1, that demonstrated the nodeprep
> profile. The mapping from ² to 2 … both are within the Latin-1 charset.
> Another example in Latin-1 is the mapping from "ß" to "ss" ("ß" is a
> character used in Germany).
>
> >I'd expect that stringprep is more used to map 'е' 0x0435 to 'e'
> >0x0065, and 'ё' 0x0451 to 'ë' 0x00EB?
> >
> >
> Sorry, but these two are invalid examples. Both е and ё are kept and not
> mapped to another character.

I thought that was the whole point of stringprep? (make similar chars
the same), but it seems not: RFC, section 9.1: ""stringprep does
nothing to map similar-looking characters together nor to prohibit
some characters because they look like others""

The point of stringprep seems to be: (RFC, section 1): ""these
[stringprep] profiles will allow users to enter internationalized text
strings in applications and have the highest chance of getting the
content of the strings correct.  In this case, "correct" means that if
two different people enter what they think is the same string into two
different input mechanisms, the strings should match on a
character-by-character basis. [...] In addition to helping string
matching, profiles of stringprep can also exclude characters that
should not normally appear in text that is used in the protocol.""

Having only ever lived and worked in a english centric world, I have
troubles understanding the issues that stringprep address, but I'm
trying!

I have this great concern that a lot of xmpp developers might think
the same thoughts that I thought the first time I looked at
stringprep, mainly:  ""It's too hard, and I don't understand it, and
my application works at the moment, so why should I care?""   Then two
months after the release of your code, you get some
spanish/polish/russian guy using non-english characters telling you
that 'your program doesn't work', because you were too lazy to figure
out stringprep.

--
- Norman Rasmussen
 - Email: norman at rasmussen.co.za
 - Home page: http://norman.rasmussen.co.za/