5 ms·
Buries the lede. The interesting part is the abuse of invisible characters to sneak malicious code into pull requests. The language is just a cute transliterat
by Null-Set 10y ago
Buries the lede. The interesting part is the abuse of invisible characters to sneak malicious code into pull requests.
The language is just a cute transliteration of brainfuck to use invisible zero width characters.
- gwern 10y agoYeah, I was like 'well, that's kinda amusing' and then I saw the screenshot of the diff and went 'AHHHHH!!!' The worst part is, it's totally plausible. 'What's with the whitespace changes in your patch?' 'You had some trailing whitespace in there so my text editor automatically cleaned it up.'
- detaro 10y agoDiff views probably should replace invisible characters with visible place-holder glyphs. Is that something that can be done on a font level, or does it require extra code? As in, can I assign a glyph to an RTL mark and have it automatically show up?
- dang 10y agoSince the article's title doesn't have that weakness and should have been used anyhow, we'll use it. (Submitted title was "Anguish: A language written in zero-width characters".) Anyone who uses 'lede' correctly gets express treatment here...
- labster 10y agoI chose that title because "invisible" has a lot of meanings and "zero-width" is more precise here. Brainfuck is an invisible language -- and so is COBOL because so few people think about its widespread use today.
- function_seven 10y agoTrue, but your title leaves out the important part, the data theft POC.
- danharaj 10y ago> Anyone who uses 'lede' correctly gets express treatment here... is that a hint of weariness? :3
- deleted 10y ago[deleted]