Re: Bidirectional text and URLs

[Eli Zaretskii]

> Date: Mon, 01 Dec 2014 05:18:07 -0500
> From: Richard Stallman <address@hidden>
> CC: address@hidden, address@hidden, address@hidden
> 
> 1. There are magic bidi characters inside the URL.

By "magic bidi characters" do you mean printable characters from RTL
scripts, or do you mean the directional controls?  (RTL characters are
also "magic" in some sense, because they might cause reordering of
surrounding text, e.g. if it contains numerical characters.)

> 2. The bidi context of the URL could cause the URL to appear strangely
> even though the URL itself does not contain any magic bidi characters.
> 
> Mixing up these two cases has caused a lot of confusion in this
> discussion.  Things said about one of them were mistakenly applied to
> the other, resulting in nonsense.
> 
> I proposed checking the URL for bidi magic, for case 1, and someone
> interpreted the suggestion based on case 2 and said it would be
> ineffective.

I, for one, don't understand how would such a check help us.  As I
wrote elsewhere, at least some parts of a legitimate URL can include
such characters, and we shouldn't treat those as suspicious.  Maybe
you are talking only about some parts of the URL, like the host and
the domain.

> For case 2 I proposed the user could insert newlines around the URL to
> see what it really says.  Someone replied that this would be
> ineffective because he interpreted it based on case 1.

I think it's impractical to insert newlines before and after each
URL.  It will make Web pages and HTML mail all but illegible, because
modern Web text includes URLs in the normal flow of text, which will
be interrupted by these newlines.

We might do that for URLs where we detect an attempt at
spoofing/phishing, but once those are detected, there are better
methods to undo the effects of phishing.  They were suggested earlier
in this thread, let me reiterate the alternatives:

 . modify the way the relevant directional controls are displayed to
   make them prominently apparent

 . allow the user to request a temporary display of the URL in its
   original logical order, before the reordering, or maybe do that
   automatically in a tooltip

 . replace the relevant directional controls with percent-hex encoded
   representation, which will as result disable the reordering

 . cover the relevant directional controls with a display property
   (e.g., with a display string " "), which will also disable
   reordering

Let's pick up one of these alternatives and use it, or maybe allow the
users choose any one of them.