>> Provably false: well-coded applications know the limitations of domain >> names, and do not even attempt to make requests for non-ASCII names. > >First of all, I disagree with the "well-coded" part because I believe a >well-coded application will do the dns request as is and allow the dns >response to determine the validity of a domain name. Nope. You can almost certainly give your user a better error message if you validate the input yourself. For that matter, a well-designed application will not even make it possible to enter anything but ASCII in an input field (whatever) for a domain name. Basic rule of usability: making user mistakes impossible is better than catching them after the fact. >Secondly, if this is >the case, then the plugin should be intercepting the input to the app and >not the output. It is still a possibility. No, because that input is highly application-specific. /========================================================\ |John Stracke |Principal Engineer | |jstracke@incentivesystems.com |Incentive Systems, Inc.| |http://www.incentivesystems.com |My opinions are my own.| |========================================================| |Diplomacy: The art of letting someone else have your way| \========================================================/