> A utf8 decoder should reject portions of utf8 > streams that don't use the shortest possible encoding so you would say that there should be no file

> A utf8 decoder should reject portions of utf8 > streams that don't use the shortest possible encoding so you would say that there should be no file names using the cyrillic o? I'm sorry, I was unclear. I should have said "don't use the shortest possible encoding for a code point". Cyrillic 'o' is code point U+043E while roman 'o' is code point U+006F. The canonicalization attack relies on overly liberal utf8 decoders that would allow multiple binary streams to be interpreted as, say, code point U+006F. This looks like the canonicalization attack, but is a different problem, one that is not solved by fixing decoders.