Hacker News Reader

To be clear (because the snippet is non-explanatory).

For encode("idna") what they did is use lower() except where it would produce a result different to 3.2.0 and then instead use the result from 3.2.0 instead.

Essentially they've frozen the IDNA encoding to be based on 3.2.0 by overriding any changes.

View on HN

Yeah. I can understand the confusion, though. The title claims the issue was in lower(). Though the problem was actually in encode('idna')'s usage of lower().

The article would probably get far fewer clicks if it were named "when encode('idna') is a security vulnerability"

Yeah, that's what I figured, but my worry upon seeing this is "what happens if lower() changes again and people forget to update the list of exceptions?".

Unless they have unit testing on the entire Unicode code space to ensure what they're doing is always identical to 3.2.0.

Reply on news.ycombinator.com