I was reading this CVE describing a vulnerability in the implementation of a compression algorithm used in HTTP/2. The summary says:

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack.

I was extremely disturbed by the word so-called because I know it's used for sarcasm. But it doesn't make sense here so it must have another meaning.

I looked here and found this question: Can we use the phrase "so-called" in its positive sense (or neutral) when refereeing to a widely adopted thing?

All answers agree it's used negatively to indicate something is misleading.

Considering the summary also says the following, it seems to be a pretty accurate name for the exploit:

This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.

Therefore what does so-called mean here?

  • If it is to signify misleading, what would misleading about the term HPACK Bomb?
  • or is it effectively used in a sarcastic manner?
  • 4
    I suspect that the author here merely intended to say that the name "HPACK Bomb" is colloquial rather than a part of the Python spec. I can see no sarcasm in the paragraph you cite. Commented Jun 13, 2017 at 18:35
  • 2
    How is it a pretty accurate name, given the actual definition and general usage of the word "bomb"? Only IT experts dumbing it down for a general audience would call this a "bomb", reasoning that it has one particular feature that makes it somewhat like a "bomb".
    – Pranab
    Commented Jun 13, 2017 at 21:48
  • 6
    @Pranab See: Zip Bomb, Fork Bomb.
    – wizzwizz4
    Commented Jun 14, 2017 at 6:14
  • 4
    See also this answer to a similar question; basically this is using so-called to give a "jargon name" for a thing.with a less catchy proper name.
    – Hellion
    Commented Jun 14, 2017 at 16:03
  • 1
    I'm used to the language of security advisories, there is no sarcasm to be assumed here. The vulnerability exists and is called as described. Commented Jun 16, 2017 at 6:29

5 Answers 5


so-called does not necessarily imply sarcasm. It often simply means "as people call it".

Is that heap of bolts your so-called "sports car"? sarcasm

That part of the sound system is a so-called "sub-woofer". simply referring to a term

  • 13
    I don't think I would say the latter sentence unless I meant to subtly disavow the term "sub-woofer". i.e. "if you don't like the term sub-woofer, your quarrel isn't with me"
    – Colin
    Commented Jun 13, 2017 at 22:24
  • 9
    @Colin Zwanziger: If we extend the meaning of "disavowal" to include "that's what it's called, don't blame me", then yes. But there's no sarcasm. It's merely an acknowledgement that the term is what it is: the speaker didn't coin it.
    – TimR
    Commented Jun 13, 2017 at 22:31
  • 6
    In main stream usage, disavowal absolutely is a part of it. If you're not pointing out something odd about the name, you can just use the name without adding extra words that complicate the phrasing. However, I have seen it used many times in a completely neutral manner in math and science papers from non-native speakers.
    – wnoise
    Commented Jun 13, 2017 at 22:44
  • 12
    @wnoise: I use so-called when wielding jargon.
    – TimR
    Commented Jun 13, 2017 at 22:48
  • 21
    @Tᴚoɯɐuo, agree it can be used for jargon, but I also thought your second example was a little weird merely because I think "sub-woofer" is a fairly common term. I think a more appropriate use would be something more like "That particular model is the Super Awesome Sub-Woofer-o-Matic 9000, the so-called Ceiling Shaker."
    – cjl750
    Commented Jun 13, 2017 at 23:06

In addition to what Tᴚoɯɐuo said, I would add that the use of "so-called" in this particular context helps indicate that exploit has just been nicknamed an "HPAC bomb attack" by computer folks who have expertise in that area, but that name doesn't literally describe what's happening. There's no real bombing going on, and it's probably not the official name given to the exploit by cybersecurity firms or whomever.

Subtle little descriptions like that inserted into an article with a lot of technical jargon can make the text more approachable to average people who don't have particularly advanced computer knowledge.


"So-called" is a construct which can be used when someone else would use a wording that the author or speaker would not. It's a way of using the term without implying that the author condones the choice of words.

In this case, it is likely that the attackers who first exploited this attack called it a "HPACK Bomb." However, that may be a very poor name for describing a type of exploit in the security community. The author doesn't want you reaching for your glossary of hacking terms to look up the meaning of "HPACK Bomb." That being said, it may be convenient to refer to the attack by name, and someone did give it a name.

The sarcastic use of "so-called" stems from this usage. Often people will use "so-called" as a way of insulting the person who coined the term. In a "charged" setting where people are reading into your choice of words to see a deeper meaning, use of a phrase like "so-called motion sensors" suggests that you don't think they deserve to be called "motion sensors" at all. However, in a less charged setting, where people aren't looking for a deeper meaning, it's just a way of making it clear that the word choice isn't yours, and you're not interested in making it yours.


The purpose of the phrase "so-called" is to suggest that the terminology is surprising because it is unusual or ill-fitting.

So, you can use "X is a so-called Y" for sarcasm. The implication is "You may call X a Y, but I find that terminology surprisingly unusual or ill-fitting".

Example: This is your so-called brilliant project?
Meaning: While you may call it a brilliant project, I find that terminology ill-fitting.

You can also use "X is a so-called Y" to instruct. The implication is "You may be familiar with X. I don't expect you to know that X is called Y --- that's a surprise that may be unusual to you based on your background knowledge."

Example: This denial-of-service attack is a so-called "HPACK Bomb".

Meaning: While experts refer to this denial-of-service attack as an "HPACK Bomb", you the reader may find this terminology surprising (and possibly ill-fitting?) because it is new to you.


“So-called” can be used to describe a newly introduced or very specific term.

We guide the steam through the so-called “foobazic”, which is a specially shaped glass tube.

In this case, the use of “so-called” tells readers that they need not worry if they don't know the word immediately following. It's some special term that may not be widely known yet, but that hopefully will get explained later on. Without “so-called”, people might be confused when they reach the comma, even though that confusion should be gone by the end of the sentence.

The glass tube to use has to have a pentagonal shape. Using this so-called “foobazic”, we can guide the steam as intended.

Same pattern as before, except this time the explanation comes first, and the name for it follows. So this is telling readers that all the things explained thus far will now get summarized using a single term. Without the “so-called” in there, readers might think that the pentagonal tube is some special kind of foobazic, and start looking up the general meaning of that word they don't know.

The example you quoted doesn't match either of these cases exactly. There isn't an explicit and clear definition of the term in your case. But I believe it still kind of resembles the first of these examples. There is a term which is probably only known to a very limited audience. So to the wider audience we make them aware of the fact that this technical term does exist, and that we don't expect readers to already know it up front. Lacking a definition, we either let them ignore it if they don't care, or look it up elsewhere if they do, or derive a rough idea of what it's probably about from similar uses of the term “bomb” combined with the term “HPACK” which is a name explained earlier.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .