Live data from Hacker News

Glassworm is back: A new wave of invisible Unicode attacks hits repositories

aikido.dev

111–120 of 201 posts

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#111
post #74

Earlier quoted context omitted.

[flagged]

The fact is that there were so many character sets in use before Unicode because all these things were needed or at least wanted by a lot of people. Here's a great blog post by Nikita Prokopov about it: https://tonsky.me/blog/unicode/

Sometimes you gotta say no. Trying to please every hare brained idea leads to madness.

Normalized code point sequences are another WTF feature.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#112

Earlier quoted context omitted.

How does invisible Unicode text fit into that?

It's not text, it's control characters, which have always been in character sets going back to ASCII.

ASCII having a few obsolete control characters does not justify opening the floodgates.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#114

Earlier quoted context omitted.

Regardless of the thorny question of whether it's Github's responsibility , it sure would be a good thing for them to do ASAP.

Here's the big reason GitHub should do it: It makes the product better I know people love to talk money and costs and "value", but HN is a space for developers, not the business people. Our primary concern, as developers, is to make the product better . The business people need us to make the product better, keep the company growing, and beat out the competition. We need them to keep us from fixating on things that a…

At the end of the day it boils down to putting your users first.

Making the product better generally stems from acting in their interest, honing the tool you offer to provide the best possible experience, and making business decisions that respect their dignity.

Your comment talks a lot about product and I agree with it, I just mentioned this so we don't lose sight of the fact this is ultimately about people.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#117
post #74

Earlier quoted context omitted.

The fact is that there were so many character sets in use before Unicode because all these things were needed or at least wanted by a lot of people. Here's a great blog post by Nikita Prokopov about it: https://tonsky.me/blog/unicode/

Sometimes you gotta say no. Trying to please every hare brained idea leads to madness. Normalized code point sequences are another WTF feature.

Of course! I bet there are tons of ideas that didn't make it into Unicode, for better of worse. Where you draw the line is kind of arbitrary. You, personally, can of course opt out of all of that by restricting yourself to ASCII only, for example. But the rest of the world will continue to use Unicode.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#118

I use non-Unicode mode in the terminal emulator (and text editors, etc), I use a non-Unicode locale, and will always use ASCII for most kind of source code files (mainly C) (in some cases, other character sets will be used such as PC character set, but usually it will be ASCII). Doing this will mitigate many of this when maintaining your own software. I am apparently not the only one; I have seen others suggest simil…

CP437 forever!

The biggest use of Unicode in source repos now might be LLM slop, so I certainly don't miss its absence at all.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#119

Earlier quoted context omitted.

Unicode is about semantics not appearance. If you don't need semantics then use something different.

> Unicode is about semantics not appearance. And that's where it went off the rails into lala land. 'a' can have all kinds of distinct meanings. How are you going to make that work? It's hopeless.

It already works.

Tell me what the problem is and what your proposed solution would be.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#120

Earlier quoted context omitted.

What about numbers? Would they be assigned to arabic only? I guess someone will be offended by that. While at it we could also unify I, | and l. It's too confusing sometimes.

> While at it we could also unify I, | and l. It's too confusing sometimes. They render differently, so it's not a problem.

totally not true :D
Post reply on HN