Hacker News Reader

So are there any mitigations for curl users? Anyone know if it's possible to disable IDN by default, and only enable it when (if ever) its needed?

Daniel needs to explain why it's enabled by default if it's so "crazy"

Because people who write come up with defaults are only human, so they sometimes make bad decisions, and this is one of those times.