One way in which the truncation shows up in that blogpost which I thought was curious is that the attack involved generating a *longer* truncated hash
The fix ended up resulting in codifying the hash length: 24 characters, and no longer https://github.com/did-method-plc/did-method-plc/pull/31