W3C home > Mailing lists > Public > public-i18n-core@w3.org > July to September 2014

I18N-ISSUE-381 (BUG25339): [survey needed] Make hz-gb-2312 a label of the replacement encoding [encoding]

From: Internationalization Working Group Issue Tracker <sysbot+tracker@w3.org>
Date: Thu, 10 Jul 2014 04:18:33 +0000
Message-Id: <E1X55oX-0001Dw-Kl@stuart.w3.org>
To: public-i18n-core@w3.org
I18N-ISSUE-381 (BUG25339): [survey needed] Make hz-gb-2312 a label of the replacement encoding [encoding]

http://www.w3.org/International/track/issues/381

Raised by: Addison Phillips
On product: encoding

https://www.w3.org/Bugs/Public/show_bug.cgi?id=25339

This issue tracks the bug listed above and was created as part of the WG LC process. The bug was created prior to the WG LC.

---

HZ is an exceptionally dangerous encoding, because its escape sequence consists of printable ASCII characters. See https://www.w3.org/Bugs/Public/show_bug.cgi?id=20886#c3 .

In Firefox 28, I constrained the inheritance of HZ, removed it from the UI so that it can't be chosen manually and added telemetry for counting sessions in which the HZ decoder has been instantiated.

Sessions in which the HZ decoder has been instantiated are very rare: such a session occurs less often than once in a million sessions. http://telemetry.mozilla.org/#release/28/DECODER_INSTANTIATED_HZ/saved_session/Firefox

This suggests that the utility of HZ is so small that it should be regarded mainly as an XSS attack vector and be mapped the replacement encoding.

I'd be interested in hearing the perspective of developers of other browsers, Chrome especially, since Chrome has resisted the addition of useless or merely marginally useful encodings.
Received on Thursday, 10 July 2014 04:18:34 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 21:23:09 UTC