191–200 of 201 posts
Earlier quoted context omitted.
In this instance the PR that was merged was from 6 years ago and was clear https://github.com/pedronauck/reworm/pull/28 . Looks to me like a force push overwrote the commit that now exists in history since it was done 6y later.
So who force pushed and why?
Looks like it's pilfering Solana wallets that don't belong to Russians.
[dead]
Though also seems relatively straightforward to code up in your scripting language of choice to call from pre-commit.
GitHub advertises itself as warning about those Unicode characters: https://github.blog/changelog/2025-05-01-github-now-provides... Of course, it doesn't work though. I reported this to their bug bounty, they paid me a bounty, and told me "we won't be fixing it": https://joshua.hu/2025-bug-bounty-stories-fail#githubs-utf-f... The exact quote is "Thanks for the submission! We have reviewed your report and validated yo…
I use non-Unicode mode in the terminal emulator (and text editors, etc), I use a non-Unicode locale, and will always use ASCII for most kind of source code files (mainly C) (in some cases, other character sets will be used such as PC character set, but usually it will be ASCII). Doing this will mitigate many of this when maintaining your own software. I am apparently not the only one; I have seen others suggest simil…
That’s great for you. Isn’t feasible for software development by teams that are native in a language with a non-Latin script.
Earlier quoted context omitted.
That’s great for you. Isn’t feasible for software development by teams that are native in a language with a non-Latin script.
Do you write the code itself in a language other than English? Localizations typically are in different files.
I feel like the threat of this type of thing is really overstated. Sure the payload is invisible (although tbh im surprised it is. PUA characters usually show up as boxes with hexcodes for me), but the part where you put an "empty" string through eval isn't. If you are not reviewing your code enough to notice something as non sensical as eval() an empty string, would you really notice the non obfuscated payload eithe…
Honestly I was expecting more. There are many languages that support Unicode in variable or function names and I expected it to be used there. It sounds like Python only allows approved Unicode characters to start a variable name but if it allowed any you could do something like `nonprintable = lambda x: insert exploit code here`. If that was hidden in what looked like a blank line between other additions would you c…
This isn't about formating characters, this is about private use characters.
Earlier quoted context omitted.
if you write كلب which is an arabic word written right to left in the middle of an english sentence, you want to preserve the order of the characters in the stream for computer processing purposes. meaning the chararacter ك must come before the ل and after the e and the space with respect to the memory layout. whereas when displayed, it must be inverted to be legible. the solution is to have an invisible character th…
Look I'm writing sdrawkcab (amazingly, I did it without using Unicode!). Layout is the job of your text formatting program. It's easy to fix a text editor to support right-to-left text entry. The switch in text direction has resulted in malicious code injection attacks, as the reversed text becomes invisible. I had to change my compiler to reject those Unicode characters for that reason. It can be used in other cases…
Earlier quoted context omitted.
> Look I'm writing sdrawkcab How would that work with Text-To-Speech output?
Good question! Two possibilities: 1. Tell the TTS program that the text is RTOL. 2. If the TTS program can speak Arabic, it can detect RTOL Arabic text. The only purpose for RTOL English I can think of is to insert hidden text for malicious purposes.