3 ms·

> so why bother with seatbelts. No, it is specifically not like that. It's like saying that, in any situation where you need a seatbelt, you also need airbags

• kazinator 6y ago
  That version just strikes out at a "seatbelts are all you need" strawman argument which nobody made, and adds nothing to the seatbelt topic. For instance, even if a browser validates all incoming UTF-8 from all sources and rejects bad inputs, users can still be duped with URLs that use funny Unicode characters to look legit. But that concern is simply not in the scope of UTF-8 validation and its requirements. Whereas I might want a low-level I/O library to reject overlong UTF-8 forms at the stream level, I probably would not want it deal with Unicode ambiguity issues at that level. A: "I have some code to to fast UTF-8 Validation" B: "That's nice, but you need to restrict more than just UTF-8 to canonical form in order to catch all attacks." B is just signaling that they know a lot about the larger issue from various angles.