<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">9 jan. 2023 kl. 09:22 skrev Marius Spix <<a href="mailto:marius.spix@web.de" class="">marius.spix@web.de</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class=""><div style="font-family: Verdana;font-size: 12.0px;" class=""><div class="">We should also be aware that plain text styling has many potential security risks. For example, if we had the characters <START_ITALICS> and <RESET_STYLE> someone could create two different strings which look exactly the same like "Hallo World" and "H<START_ITALICS><RESET_STYLE>llo World". This may allow identity spoofing, bypassing regex filters, phishing or even hash collision attacks.</div></div></div></div></blockquote><div><br class=""></div>((Not sure where the ”a” went…))<br class=""><div><br class=""></div><div>This is true for any kind of ”edit” (automatic, semi-automatic, manual) that may be done between such a security check and any kind of ”execution”; including but not limited to:</div><div><ul class="MailOutline"><li class="">Unicode normalisation</li><li class="">Replace malformed UTF-8 or UTF-16 with some kind of replacement, like ?, SUB, REPLACEMENT CHARACTER, or deleting them</li><li class="">Case mapping</li><li class="">Encoding mapping (like mapping to ASCII), which may ”loose”/replace non-convertible characters</li><li class="">”Drop accents” mapping</li><li class="">Adding or removing HTML tags</li><li class="">Expanding (or inserting) any kind of character or string references (like \uNNNN, &xNNNN;, <, \xNN, …)</li><li class="">Replacing quote marks by other quote marks</li><li class="">Removing/replacing any ”undesirable” control character or default ignorable character</li><li class="">Spell corrections</li><li class="">Correcting syntax errors (if it is some kind of command or query)</li><li class="">Do bidi reordering to get a ”visual order” string; or use bidi controls to confuse the character order; or any kind of inverse bidi reordering</li><li class="">and lots more</li></ul><div class=""><br class=""></div><div class="">So there is nothing new or unique with using ECMA-48 text styling in this regard.</div><div class=""><br class=""></div></div><blockquote type="cite" class=""><div class=""><div class=""><div style="font-family: Verdana;font-size: 12.0px;" class=""><div class=""> Styling is supposed to be done at application layer.</div></div></div></div></blockquote><div><br class=""></div></div><div><div class="">Yes… (Not sure what you are aiming at here.)</div><div class=""><br class=""></div><div class="">Kind regards</div><div class="">/Kent K</div><blockquote type="cite" class=""><div class=""><div class=""><div style="font-family: Verdana;font-size: 12.0px;" class=""><div class=""><div class=""><div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="margin:0 0 10px 0;" class=""><b class="">Gesendet:</b> Sonntag, 08. Januar 2023 um 23:08 Uhr<br class="">
<b class="">Von:</b> "Kent Karlsson via Unicode" <<a href="mailto:unicode@corp.unicode.org" class="">unicode@corp.unicode.org</a>><br class="">
<b class="">An:</b> "Sławomir Osipiuk" <<a href="mailto:sosipiuk@gmail.com" class="">sosipiuk@gmail.com</a>><br class="">
<b class="">Cc:</b> <a href="mailto:unicode@corp.unicode.org" class="">unicode@corp.unicode.org</a><br class="">
<b class="">Betreff:</b> Re: “plain text styling”…</div>
<div name="quoted-content" class="">
<div class="">
<div class="">
<blockquote class="">
<div class="">8 jan. 2023 kl. 18:34 skrev Sławomir Osipiuk via Unicode <<a href="mailto:unicode@corp.unicode.org" target="_blank" class="">unicode@corp.unicode.org</a>>:</div>
<div class="">
<div class="">On Sunday, 08 January 2023, 09:15:21 (-05:00), Kent Karlsson via Unicode wrote:
<blockquote class=""><br class="">
The point is that the ”protocol” is at plain text level. That is why ECMA-48 styling can work for applications like terminal emulators, where higher-level protocols, like HTML, are out of the question.</blockquote>
<br class="">
This does not make sense. Both are formats that need to be interpreted by the display software or they just look like junk within the visible text.</div>
</div>
</blockquote>
<div class=""> </div>
Yes…</div>
<div class="">
<blockquote class="">
<div class="">
<div class="">HTML and ECMA-48 are no different in principle.</div>
</div>
</blockquote>
<div class=""> </div>
On this point they are wildly different. One is possible to use in contexts such as terminal emulators, indeed intended for such use. The other one cannot be used in such contexts.</div>
<div class="">And the precise reason is that one is a plain text protocol, and the other a higher level protocol. One cannot make a HTML(like) based terminal emulator, since the controls in HTML are purely printable characters (which in turn requires that certain characters *must* be represented via character escapes, like <, otherwise risk being part of a control).</div>
<div class=""> </div>
<div class="">Now, using ECMA-48 styling controls for styling text (that may be stored in a file) is not vitally dependent on that. It is, <b class="">for that use, just a question of reuse of an already existing mechanism for specifying styling</b>. That mechanism need not be locked in to be used only for terminal emulators. (Though some of the proposed addition may be useful also for terminal emulators, and indeed some already are; I ”grabbed” some suggestions from already implemented (in some terminal emulators) additions, with the intent of not compromising those implementations.)</div>
<div class="">
<blockquote class="">
<div class="">
<div class="">You can write a terminal emulator that respects basic HTML styling.</div>
</div>
</blockquote>
<div class=""> </div>
Nope. Violates the plain text principle of terminal emulators. (Besides, HTML has a nesting structure, but that is a <i class="">different</i> obstacle for your suggestion here.)</div>
<div class="">
<blockquote class="">
<div class="">
<div class="">The only reason it hasn't been done is because there is no demand, and that is because of historical reasons (including that many terminal scripting languages have syntax that would conflict with HTML).<br class="">
<blockquote class="">
<blockquote class="">From a simple (basic) text editor perspective that knows nothing about styling, what is the difference between displaying these two examples related to same intended result ?<br class="">
<b>bold</b><br class="">
versus<br class="">
\x1b[1mbold\x1b[2m</blockquote>
<br class="">
The first one is a higher level protocol (interpreting substrings consisting purely of ”printable characters” as controls; counting SP,HT and LF as ”printable"), the second is a text level protocol.</blockquote>
<br class="">
No. Whether "<" or \x1b is a special syntax introducer makes no real difference.</div>
</div>
</blockquote>
<div class=""> </div>
Except that it does. See above.</div>
<div class="">
<blockquote class="">
<div class="">
<div class="">You need something to recognize it and interpret it.</div>
</div>
</blockquote>
<div class=""> </div>
Yes, but that is not ”it”.</div>
<div class="">
<blockquote class="">
<div class="">
<div class="">Both standards are about interpreting substrings, with opening and closing characters and formatting information between them. There is nothing inherently special about having the characters be below \x20, certainly not any more than, for example, using the tag characters.</div>
</div>
</blockquote>
</div>
<div class="">There very much is a difference between control characters and printable characters (including SP,LF,CR,HT), in that the latter are ”normal text” to be printed, while control characters are, well control characters not to be printed. True, the distinction is somewhat ”muddled” by that SP/CR/LF/HT/VT/NEL aren’t all that ”pure control”, but characters like SHY actually are control characters but not formally counted as such. Plus the various control characters introduced by Unicode (like bidi controls; note that HTML has it’s separate way of doing bidi controls, using printable characters, not the Unicode bidi controls). So I agree that it is not straight-forward, but there really is a difference.</div>
<div class=""> </div>
<div class="">Kind regards</div>
<div class="">/Kent K</div>
<div class=""> </div>
<div class=""> </div>
</div>
</div>
</div>
</div>
</div></div></div>
</div></blockquote></div><br class=""></body></html>