In “a so-called "HPACK Bomb" attack”, if "so-called" is not sarcasm then what is it?

Question

I was reading this CVE describing a vulnerability in the implementation of a compression algorithm used in HTTP/2. The summary says:

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack.

I was extremely disturbed by the word so-called because I know it's used for sarcasm. But it doesn't make sense here so it must have another meaning.

I looked here and found this question: Can we use the phrase "so-called" in its positive sense (or neutral) when refereeing to a widely adopted thing?

All answers agree it's used negatively to indicate something is misleading.

Considering the summary also says the following, it seems to be a pretty accurate name for the exploit:

This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.

Therefore what does so-called mean here?

• If it is to signify misleading, what would misleading about the term HPACK Bomb?
• or is it effectively used in a sarcastic manner?

Answer 1

so-called does not necessarily imply sarcasm. It often simply means "as people call it".

Is that heap of bolts your so-called "sports car"? ^sarcasm

That part of the sound system is a so-called "sub-woofer". ^{simply referring to a term}

Answer 2

In addition to what Tᴚoɯɐuo said, I would add that the use of "so-called" in this particular context helps indicate that exploit has just been nicknamed an "HPAC bomb attack" by computer folks who have expertise in that area, but that name doesn't literally describe what's happening. There's no real bombing going on, and it's probably not the official name given to the exploit by cybersecurity firms or whomever.

Subtle little descriptions like that inserted into an article with a lot of technical jargon can make the text more approachable to average people who don't have particularly advanced computer knowledge.

Answer 3

"So-called" is a construct which can be used when someone else would use a wording that the author or speaker would not. It's a way of using the term without implying that the author condones the choice of words.

In this case, it is likely that the attackers who first exploited this attack called it a "HPACK Bomb." However, that may be a very poor name for describing a type of exploit in the security community. The author doesn't want you reaching for your glossary of hacking terms to look up the meaning of "HPACK Bomb." That being said, it may be convenient to refer to the attack by name, and someone did give it a name.

The sarcastic use of "so-called" stems from this usage. Often people will use "so-called" as a way of insulting the person who coined the term. In a "charged" setting where people are reading into your choice of words to see a deeper meaning, use of a phrase like "so-called motion sensors" suggests that you don't think they deserve to be called "motion sensors" at all. However, in a less charged setting, where people aren't looking for a deeper meaning, it's just a way of making it clear that the word choice isn't yours, and you're not interested in making it yours.

Answer 4

The purpose of the phrase "so-called" is to suggest that the terminology is surprising because it is unusual or ill-fitting.

So, you can use "X is a so-called Y" for sarcasm. The implication is "You may call X a Y, but I find that terminology surprisingly unusual or ill-fitting".

Example: This is your so-called brilliant project?
Meaning: While you may call it a brilliant project, I find that terminology ill-fitting.

You can also use "X is a so-called Y" to instruct. The implication is "You may be familiar with X. I don't expect you to know that X is called Y --- that's a surprise that may be unusual to you based on your background knowledge."

Example: This denial-of-service attack is a so-called "HPACK Bomb".

Meaning: While experts refer to this denial-of-service attack as an "HPACK Bomb", you the reader may find this terminology surprising (and possibly ill-fitting?) because it is new to you.

Answer 5

“So-called” can be used to describe a newly introduced or very specific term.

We guide the steam through the so-called “foobazic”, which is a specially shaped glass tube.

In this case, the use of “so-called” tells readers that they need not worry if they don't know the word immediately following. It's some special term that may not be widely known yet, but that hopefully will get explained later on. Without “so-called”, people might be confused when they reach the comma, even though that confusion should be gone by the end of the sentence.

The glass tube to use has to have a pentagonal shape. Using this so-called “foobazic”, we can guide the steam as intended.

Same pattern as before, except this time the explanation comes first, and the name for it follows. So this is telling readers that all the things explained thus far will now get summarized using a single term. Without the “so-called” in there, readers might think that the pentagonal tube is some special kind of foobazic, and start looking up the general meaning of that word they don't know.

The example you quoted doesn't match either of these cases exactly. There isn't an explicit and clear definition of the term in your case. But I believe it still kind of resembles the first of these examples. There is a term which is probably only known to a very limited audience. So to the wider audience we make them aware of the fact that this technical term does exist, and that we don't expect readers to already know it up front. Lacking a definition, we either let them ignore it if they don't care, or look it up elsewhere if they do, or derive a rough idea of what it's probably about from similar uses of the term “bomb” combined with the term “HPACK” which is a name explained earlier.