5 ms·
Google Logo Ligature Bug
- deleted 1y ago[deleted]
- adzm 1y agoWow it still works.
- JeanMeche 1y agoThe issue has been fixed on Chrome: https://issues.chromium.org/issues/391788835 https://issues.chromium.org/issues/391788835 But ligature is indeed still visible on Google search.
- madeofpalk 1y agoNeat to see how impressed the Google team was at how novel this issue was.
- bsimpson 1y agoI imagine the overlap between number of people who know about google_logo and that the Omnibar is set it Google Sans is quite small.
- netsharc 1y agohttps://chromium-review.googlesource.com/c/chromium/src/+/6227546/3/components/lookalikes/core/lookalike_url_util.cc https://chromium-review.googlesource.com/c/chromium/src/+/62... Gotta love that the patch isn't fixing the font, but adding a rule for domain names which contains a substring similar to the ligature name...
- em-bee 1y agofixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. in fact this could be a novel attack vector. replace fonts on victims devices to hide the true address of a website. the fix then would have to be to not display any ligatures at all in website addresses, which in my opinion would be a smart change.
- toast0 1y ago> fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. Fixing the code doesn't help users that downloaded code and don't get the new version either. Malicious code that can replace a font can replace a lot more too.
- em-bee 1y agoright, but a replacing a font is much easier than replacing a browser.
- arcfour 1y agoDisabling ligature rendering in the omnibox seems significantly more sane and safe than this (why wouldn't you do that already?! URLs need to be displayed clearly - not be "aesthetically pleasing").
- anal_reactor 1y agoI can imagine a group of excited guys coming up with that idea as something cool, and then the whole thing slowly evolving into a yet another branding tool.
- a2128 1y agoGuess I'll have to come up with a different domain name for my new business MakeLogoLigatures :(
- jasonthorsness 1y agoAnd look, a working bug bounty program! “$10,000 for report of high-quality && high-impact security UI issue + $5,000 bonus for unique, novel cool bug -- this was a very neat discovery!”
- moralestapia 1y agoOS-dependent? I don't see it on OS X.
- stefan_ 1y agoI thought there was something wrong with this blog post that kept writing "googlelogoligature" but no some absolute cretin really added that as a ligature to the font.
- sublinear 1y ago> Fonts can include "ligatures", which let font designers special-case specific combinations of letters ... but the feature has been (ab)used for many other things Same reason to not use ligatures in your IDE, terminal, etc. Did that trend finally die off?
- deleted 1y ago[deleted]
- nine_k 1y agoLigatures that give slightly stylized rendering to stuff like <!-- or even replace a >= with a ≥ in your source code view are much less prone to exploitation than a "ligature" that replaces a 18-letter sequence with the word "Google" in your browser's address bar. It's like comparing the hazardousness levels of a safety pin and of a chainsaw.
- jasonthorsness 1y agoMy great fear is they will become so popular that the option to disable them will be forgotten. I can’t stand the ligatures that noticeably change and merge the glyphs.
- wbl 1y agoHave you ever read a book typeset without them? Imagine a dot in fig where the loop of the f conflicts.
- jasonthorsness 1y agoThose historical use cases are fine and important, the problem ones are the ones in monospace fonts that change <= to ≤ and that sort of thing, or even crazier abuses like shown here.
- toast0 1y agoI like the dotted i in fig, thank you. Not a big fan of underlines that don't cross descendeds either.
- sjs382 1y agoThere are many others including "glogoligature".
- jasonthorsness 1y agoIt’s difficult (impossible?) to force a font on the web in a way that can’t be overridden by some users. This must have been a font designed for device-specific applications picked up for other use-cases? Or maybe they just didn’t care that the long tail of users might see the string “googlelogoligature” instead of the logo.
- em-bee 1y agoany website that supplies its own fonts will work. the number of people that would override the fonts specified in a website is small.
- void-pointer 1y agoWhy didn’t google just use a Unicode private use code point like apple does with U+F8FF? ()
- layer8 1y agoBecause that wouldn’t degrade gracefully with a different font.
- odo1242 1y agoI mean, “googlelogoligature” degrades just as gracefully as “undefined”, I would say (Which is to say that it doesn’t)
- layer8 1y agoI guess we have to disagree on that. When the Apple private-use code point shows as a box, you have no idea what it is supposed to represent. With the ligature you have the equivalent of an alt text.
- anal_reactor 1y agoThe linked article on Unicode is far more interesting actually. I never really cared to think before how Unicode works, but reading the submission letter of beet emoji was the most interesting thing I've read this month so far.