Re: [cti-taxii] Restrictions on resource names

My only concern with this is the fact it makes it easier to do phishing attacks. IDIs make it easier to make fake DNS names look like real ones (eg make a fake oasis-open.org using an a from a different language).

But that is something that network intrusion detection systems need to learn to cope with, and the benefits for internationalisation are important, so it seems like a good idea to do.

On 15 Oct. 2016 21:18, "Dave Cridland" <dave.cridland@surevine.com> wrote:

On 14 Oct 2016 23:43, "John-Mark Gurney" <jmg@newcontext.com> wrote:
>
> Dave Cridland wrote this message on Tue, Oct 11, 2016 at 13:42 +0100:
> > And if you add in %-encoding, you can cover everyone's languages.
> > (Ignoring, for the moment, that we're talking about UTF-8 being percent
> > encoded into Latin-1).
>
> We should be using IRI[1][2] for TAXII, which address non-ASCII characters is
> URLs.
>
> [1] https://en.wikipedia.org/wiki/Internationalized_Resource_Identifier
> [2] https://tools.ietf.org/html/rfc3987
>

Judging by the discussion about I18n on the call last week, I think this is the right path - it shows channel names to be IRI path segments, I think, for which we should be able to pass the buck to an existing definition.

> > On 11 October 2016 at 13:40, Trey Darley <trey@kingfisherops.com> wrote:
> >
> > > On 11.10.2016 09:19:00, Jason Keirstead wrote:
> > > > I think it would be overly limiting to not allow people to create
> > > > collection names with non-latin1 characters. People will want to
> > > > create collection names in their own language.
> > > >
> > >
> > > I concur with Jason.
>
> --
> John-Mark

cti-taxii message