Glassworm is back: A new wave of invisible Unicode attacks hits repositories • Hacker News Board

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#51

Post by WalterBright » Sun, Mar 15, 2026, 6:34 PM UTC

nswango wrote: post #36

WalterBright wrote: post #27

Earlier quoted context omitted.

Another dum dum Unicode idea is having multiple code points with identical glyphs. Rule of thumb: two Unicode sequences that look identical when printed should consist of the same code points.

So you think that the letters in the Greek and Cyrillic alphabets which are printed identically to the Latin A should not exist? And, for example, Greek words containing this letter should be encoded with a mix of Latin and Greek characters?

> So you think that the letters in the Greek and Cyrillic alphabets which are printed identically to the Latin A should not exist?

Yes. Unicode should not be about semantic meaning, it should be about the visual. Like text in a book.

> And, for example, Greek words containing this letter should be encoded with a mix of Latin and Greek characters?

Yup. Consider a printed book. How can you tell if a letter is a Greek letter or a Latin letter?

Those Unicode homonyms are a solution looking for a problem.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#52

Post by WalterBright » Sun, Mar 15, 2026, 6:34 PM UTC

jeltz wrote: post #34

WalterBright wrote: post #27

Earlier quoted context omitted.

Another dum dum Unicode idea is having multiple code points with identical glyphs. Rule of thumb: two Unicode sequences that look identical when printed should consist of the same code points.

I don't think that would help much. There are also characters which are similar but not the same and I don't think humans can spot the differences unless they are actively looking for them which most of the time people are not. If only one of two glyphs which are similar appear in the text nobody would likely notice, expectation bias will fuck you over.

I wonder how anybody got by with printed books.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#53

Post by WalterBright » Sun, Mar 15, 2026, 6:35 PM UTC

uhoh-itsmaciek wrote: post #38

WalterBright wrote: post #21

Unicode should be for visible characters. Invisible characters are an abomination. So are ways to hide text by using Unicode so-called "characters" to cause the cursor to go backwards. Things that vanish on a printout should not be in Unicode. Remove them from Unicode.

>Remove them from Unicode. Do you honestly think this is a workable solution?

Yes, absolutely. See my other replies.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#54

Post by WalterBright » Sun, Mar 15, 2026, 6:35 PM UTC

abujazar wrote: post #22

WalterBright wrote: post #21

Unicode should be for visible characters. Invisible characters are an abomination. So are ways to hide text by using Unicode so-called "characters" to cause the cursor to go backwards. Things that vanish on a printout should not be in Unicode. Remove them from Unicode.

Invisible characters are there for visible characters to be printed correctly...

I'll grant that a space and a newline are necessary. The rest, nope.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#55

Post by bulbar » Sun, Mar 15, 2026, 6:42 PM UTC

_flux wrote: post #44

nswango wrote: post #37

Earlier quoted context omitted.

For a long time the standard way of loading JSON was using eval.

And why do we not anymore make use of it, but instead implemented separate JSON loading functionality in JavaScript? Can you think of any reasons beyond performance?

Why did you opt in for such a comment while a straight forward response without belittling tone would have achieved the same?

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#56

Post by _flux » Sun, Mar 15, 2026, 6:43 PM UTC

WalterBright wrote: post #47

_flux wrote: post #45

Earlier quoted context omitted.

Arguably them being in Unicode is an accessibility issue, unless we thought to standardize GIF names, and then that already sounds a lot like Unicode.

How is it an accessibility issue? HTML allows things like little gif files. I've done this myself when I wrote text that contained Egyptian hieroglyphs. It works just fine!

I mean if you don't have sight.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#57

Post by WalterBright » Sun, Mar 15, 2026, 6:44 PM UTC

WalterBright wrote: post #49

pvillano wrote: post #35

Earlier quoted context omitted.

Unicode is "designed to support the use of text in all of the world's writing systems that can be digitized" Unicode needs tab, space, form feed, and carriage return. Unicode needs U+200E LEFT-TO-RIGHT MARK and U+200F RIGHT-TO-LEFT MARK to switch between left-to-right and right-to-left languages. Unicode needs U+115F HANGUL CHOSEONG FILLER and U+1160 HANGUL JUNGSEONG FILLER to typeset Korean. Unicode needs U+200C ZER…

[flagged]

    Look Ma
    xt! N !
    e tee S
    T larip

(No Unicode needed.)

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#58

Post by WalterBright » Sun, Mar 15, 2026, 6:46 PM UTC

_flux wrote: post #56

WalterBright wrote: post #47

Earlier quoted context omitted.

How is it an accessibility issue? HTML allows things like little gif files. I've done this myself when I wrote text that contained Egyptian hieroglyphs. It works just fine!

I mean if you don't have sight.

Then use words. Or tooltips (HTML supports that). I use tooltips on my web pages to support accessibility for screen readers. Unicode should not be attempting to badly reinvent HTML.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#59

Post by _flux » Sun, Mar 15, 2026, 6:47 PM UTC

bulbar wrote: post #55

_flux wrote: post #44

Earlier quoted context omitted.

And why do we not anymore make use of it, but instead implemented separate JSON loading functionality in JavaScript? Can you think of any reasons beyond performance?

Why did you opt in for such a comment while a straight forward response without belittling tone would have achieved the same?

I actually gave it some thought. I had written the actual reason first, but I realized that the person I was responding to must know this, yet keeps arguing in that eval is just fine.

I would say they are arguing that in bad faith, so I wanted to enter a dialogue where they are either forced to agree, or more likely, not respond at all.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#60

Post by bulbar » Sun, Mar 15, 2026, 6:50 PM UTC

WalterBright wrote: post #49

pvillano wrote: post #35

Earlier quoted context omitted.

Unicode is "designed to support the use of text in all of the world's writing systems that can be digitized" Unicode needs tab, space, form feed, and carriage return. Unicode needs U+200E LEFT-TO-RIGHT MARK and U+200F RIGHT-TO-LEFT MARK to switch between left-to-right and right-to-left languages. Unicode needs U+115F HANGUL CHOSEONG FILLER and U+1160 HANGUL JUNGSEONG FILLER to typeset Korean. Unicode needs U+200C ZER…

[flagged]

That's a very narrow view of the world. One example: In the past I have handled bilingual english-arabic files with switches within the same line and Arabic is written from left to right.

There are also languages that are written from to to bottom.

Unicode is not exclusively for coding, to the contrary, pretty sure it's only a small fraction of how Unicode is used.

> Somehow people didn't need invisible characters when printing books.

They didn't need computers either so "was seemingly not needed in the past" is not a good argument.