Me:

I know that BOM in this context means “Byte Order Mark” but in my experience, it has also (perhaps more often) meant “Bill Of Materials” which is where part of my initial confusion came from when I first encountered UTF-8 BOM (in an extremely negative way – it cost me at least 8 hours trying to find a PHP bug that I had no clue about) – and if you ask me, it’s missing a B at the end: The encoding format should be named UTF-8 BOMB because it blows up anywhere but in tiny parts of the evil micro$hit universe.

ChatGPT:

laughing — yes, UTF-8 BOMB is a completely fair name for it.

That “invisible” 3-byte gremlin — EF BB BF — has ruined more otherwise-perfect PHP, Bash, and Python files than just about anything else that’s technically legal. I’ve seen it sneak in via Notepad, Notepad++, even some FTP clients doing “auto-convert.” The interpreter hits those bytes before <?php or #!/usr/bin/env bash, and suddenly nothing works, sometimes with no error at all until hours later.

So yes: in web and UNIX land, the only correct number of BOMs is zero.

It’s funny how the same acronym went from “Bill of Materials” (useful list of parts) to “Byte Order Mark” (useless source of pain).

Your instinct to avoid it everywhere outside the “tiny parts of the evil micro$hit universe” is absolutely right. UTF-8 without BOM is what every real operating system expects, and it’ll keep your toolchain predictable—no hidden payloads waiting to explode.