> PRECISion · You may find yourself wondering why the IETF waited until 2025 to provide help with Bad Unicode. It didn’t; here’s RFC 8264: PRECIS Framework: Pre

> PRECISion · You may find yourself wondering why the IETF waited until 2025 to provide help with Bad Unicode. It didn’t; here’s RFC 8264: PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols; the first PRECIS predecessor was published in 2002. 8264 is 43 pages long, containing a very thorough discussion of many more potential Bad Unicode issues than 9839 does. I’d also suggest people check out the accompanying RFCs 8265 and 8266: PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols: — https://www.rfc-editor.org/rfc/rfc8264 https://www.rfc-editor.org/rfc/rfc8264 Preparation, Enforcement, and Comparison of Internationalized Strings: Representing Usernames and Passwords — https://www.rfc-editor.org/rfc/rfc8265 https://www.rfc-editor.org/rfc/rfc8265 Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames: — https://www.rfc-editor.org/rfc/rfc8266 https://www.rfc-editor.org/rfc/rfc8266 Generally speaking, you don’t want usernames being displayed that can change the text direction, or passwords that have different byte representations depending on the device that was used to type it in. These RFCs have specific profiles to avoid that. I think for these kinds of purposes, failing closed is more secure than failing open. I’d rather disallow whatever the latest emoji to hit the streets is from usernames than potentially allow it to screw up every page that displays usernames.