I think the previous knowledge is incidental. Which the essay reflects in pointing it out in a single quick section. What's really relevant is all the other stu

I think the previous knowledge is incidental. Which the essay reflects in pointing it out in a single quick section. What's really relevant is all the other stuff. At the moment it's academically interesting, not a "critical" vulnerability as so many people are rating it. Exploiting it is riskier than it is being presented as and less likely to work than presented. If I were trying to slip something into a code base today, this would not be the top of my list. Personally I'd be sticking to the already-existing plausibly deniable issues of things like off-by-one or subtle misspellings of string constants or variable shadowing or any number of other things. Sure, by all means, take some steps to address this, but you can handle this as a medium or even a low priority vulnerability. It's not a panic to upgrade and panic to release half-assed, poorly-thought-out fixes. I'd rather see some carefully-thought out Unicode policies in a couple months than a hack fix now and people thinking the problem is solved. For instance, it's not hard to write code that looks at the category of characters and points out characters that don't match the category of the rest of the characters around them, highlighting homophone attacks. There's time to think this through. The priority is not "critical".