Hacker News Reader

Comment by js2 | Hacker News Reader

...in web apps (i.e. during presentation). Don’t do it at the storage layer:

https://github.com/git/git/commit/76759c7dff53e8c84e975b88cb...

Edit: see comments below. My generalization is over broad. Maybe a fairer statement is that some forms of normalization lead to aliasing and sometimes you want that but sometimes not. So be aware of whether you want different strings to be treated the “same” or not.

My thought was that you can always test for sameness after the fact, but once you’ve normalized into storage, you can’t undo it.

View on HN

Eh, in general I think it makes a lot of sense to do it at the storage layer.

That particular commit mentions _filenames_. I agree you should _never_ touch the bytes that are meant to be a filepath. file systems still do idiosyncratic things with non-ascii file paths, and most of us aren't filesystem experts. Leave the bytes of a filepath alone.

Since git is all about filepaths, it makes sense that git would want to generally avoid this.

But in general, "during presentation" is not enough to deal with the sorts of problems the OP talks about. If you're comparing strings somewhere, it's probably before "presentation".

In general, I think it's quite reasonable to normalize your input, on the way in, to NFC. I think it's reasonable enough in most cases that normalizing input to NFC on the way in is a reasonable "default" to get started with, unless you know a reason you shouldn't.

(For searching, you MIGHT want to normalize to NFKC, but that is "lossy" so I would never do that as a rule. I'd normally do it in some other field, and keep the original lossless copy too).

Sorry if this sounds a little clueless, but it sounds like the problem is because there's multiple Unicode standards (UTF-8, UTF-16, UTF-32). So it seems like if you just re-encode everything into one of these before committing to the storage layer, that you'd avoid this problem altogether, and you'd be able to do operations in the storage layer correctly too.

Yeah, no. That is actually a different issue. Curious if you read the OP?

But, no, you do not avoid issues with unicode normalization by ensuring everything is in (eg) UTF-8. Unicode normalization is a thing within UTF-8.

A Unicode string is an array of Unicode's building blocks: Code points. Normalization/composition refers to how we use code points to represent characters. Encoding refers to how we use bytes to represent code points. The two concepts exist at two independent levels of abstraction.

Accurate but so arrogant. HN purity achieved.

Sorry, I didn't intend that. I honestly considered it a reasonable question.

No worries, your reply was a concise clarification of the issue and terminology, and a reasonable answer; I didn't perceive it as arrogant in the least.

OP here; I didn't perceive it as arrogant either. I think the "arrogant" accuser might have a point about some stuff I see on HN, but this reply to my post just isn't it.

Even then, it's not just filepaths. Internal representations can range from "bytes that are sometimes string-ish" to "bytes which are valid strings", while in no way covering the domain where the string-like properties that normalization brings are desireable.

I doubt there are hard-and-fast rules where normalization is appropriate, but if you start applying it to all input, you're going to break things. Email addresses immediately spring to mind, for example.

Can you even have unicode/non-ascii in email addresses?

If you can, and your email address is josé@gmail.com, but whether it arrives to you depends on whether the address was entered as unicode codepoint 'LATIN SMALL LETTER E WITH ACUTE' or 'LATIN SMALL LETTER E'+'COMBINING ACUTE ACCENT'... you're going to have a lot of trouble getting email. Becauase people entering your address have no idea which they are entering. I know I can type an "é" on MacOS US keyboard layout by typing `option-e,e`, but I have _no idea_ what actual bytes (corresponding to which of these codepoints) are sent to HN when I enter that in an HN comment text box. And most people sending email, of course, don't even know any of this is a thing.

If it works at all, it's actually gonna be because the software on either or both ends (sending and receiving) is already doing NFC normalization!

So, yes, this illustrates that normalization _is a thing_ you have to pay attention to, and can get weird.

But in general, for "text" input (rather than addresses or filepaths), normalizing to NFC is _usually_ a good call. If it's addresses or filepaths or what have you... it's gonna get confusing no matter what.

If you know what you're doing, maybe NFC isn't right. If you don't know what you're doing, NFC is a lot better start-out-with call than not normalizing at all. Not normalizing at all will bite you more often than NFC will.

Is running normalization algorithms against UCS-2 -- i.e., where it's possible to have invalid surrogate pairs -- well-defined?

I'm not certain, I'm not familiar with that situation. (I think "UCS-2" is basically "legacy" and not actually a unicode standard at this point? I'm not familiar with it).

If the issue is invalid bytes for a given unicode encoding (I am familiar with those!), I'm not certain what the official unicode normalization algorithms would do to them. They might just leave invalid bytes alone. The discussion of normalization seems to be in terms of codepoints though; a bytestream with invalid bytes (that can't be turned into unicode codepoints)... I would guess most actually existing normalization implementations are gonna complain about that. One could certainly write an algorithm that would just leave those bytes alone, I'm not sure if it would be considered compliant with the standard or not, just can't say.

Why does this come up?

UCS-2 refers to the UTF-16 encoding of the first plane, defined when there was only one plane's worth of assignable space. UTF-16 extends UCS-2, and defines the reserved surrogates, thereby introducing the possibility of invalid surrogate usage. The parent post is referring to that (so it would be more accurate for the parent post to have said "UTF-16").

OK, thanks.

You can certainly have invalid bytes for UTF-8 too. I think in any unicode encoding, not every possible byte sequence is a valid representation of unicode codepoints. It doesn't require UCS-2/UTF-16.

Here's an invalid byte sequence in UTF-8: "\xc3\x28"

True, though the GP's example was somewhat unique in that UTF-16 created the possibility of invalid combinations at the code point level, rather than only the byte level.

> I'm not certain, I'm not familiar with that situation.

See RFC 6531.

This comes up because many implementations of "UTF-16" are in fact naive, and just operate within the mentality of UCS-2, where everything is just a 16-bit number.

This is relevant within this discussion because we were talking about filesystems, and Windows stores file names as an arbitrary array of 16-bit numbers, but UTF-16 has additional requirements that Windows file names do not satisfy.

When I say UCS-2, I just mean pretending that UTF-16 is short for `[]uint16`, and not worrying about surrogate pairs.

I think we can all agree that you should never be applying any normalization to bytes representing a file system path, unless you are doing it according to specifications for that particular file system+OS combo.

file system paths are tricky with non-ascii, that is for sure! Especially if you are trying to be agnostic to OS/filesystem. They are an edge case.

Normalization has nothing to say about what happens if you have a string containing invalid surrogates - you have an invalid string at that point and normalization won't get you into or out of that situation - it only affects how valid characters are composed of code points.

> Can you even have unicode/non-ascii in email addresses?

Yes, per RFC 6531:

* https://en.wikipedia.org/wiki/Unicode_and_email * https://en.wikipedia.org/wiki/International_email

Strangely, RFC 6531 gives the impression of being written by people who didn't realize unicode normalization was a concern. I'm reading it for the first time, but it basically just says "an SMTP server can advertise it supports UTF8, and then it should accept UTF8 in all the places that were ascii before." I mean, a little bit more complicated than that, but with regard to _mailboxes_ (the part before the `@`), not much.

It doens't seem to say anything about normalization, or the fact that a mailbox `josé@` could be using 'LATIN SMALL LETTER E WITH ACUTE' or 'LATIN SMALL LETTER E'+'COMBINING ACUTE ACCENT'.

I suspect any SMTP servers supporting UTF8 are actualy doing NFC normalization to match mailboxes to requests.

Servers are free to do any transformation on the account names they accept, and shouldn't apply any on the ones they relay.

It's expected that they would do many kinds of transformations, like case normalization. Unicode normalization should be one of those but none of the email RFCs intend to enumerate them all.

> That particular commit mentions _filenames_.

This basically just comes down to the (sometime unpleasant) reality that on most Unix systems, file paths are not text; they are byte strings that don't have 00 or 2F bytes.

Depends on the context such as filenames on Mac which you link. There are many cases where doing it at the storage layer makes sense. Are you indexing text for search? Normalize. Do you want to de-duplicate textual data and store it in a database? Normalize. Are you going to run some sort of NLP analysis? Normalize.

Reply on news.ycombinator.com