3 ms·

The issue has been fixed on Chrome: https://issues.chromium.org/issues/391788835 https://issues.chromium.org/issues/391788835 But ligature is indeed still visi

The issue has been fixed on Chrome: https://issues.chromium.org/issues/391788835 https://issues.chromium.org/issues/391788835 But ligature is indeed still visible on Google search.

madeofpalk 1y ago
Neat to see how impressed the Google team was at how novel this issue was.
- bsimpson 1y ago
  I imagine the overlap between number of people who know about google_logo and that the Omnibar is set it Google Sans is quite small.
netsharc 1y ago
https://chromium-review.googlesource.com/c/chromium/src/+/6227546/3/components/lookalikes/core/lookalike_url_util.cc https://chromium-review.googlesource.com/c/chromium/src/+/62... Gotta love that the patch isn't fixing the font, but adding a rule for domain names which contains a substring similar to the ligature name...
- em-bee 1y ago
  fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. in fact this could be a novel attack vector. replace fonts on victims devices to hide the true address of a website. the fix then would have to be to not display any ligatures at all in website addresses, which in my opinion would be a smart change.
  - toast0 1y ago
    > fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. Fixing the code doesn't help users that downloaded code and don't get the new version either. Malicious code that can replace a font can replace a lot more too.
    - em-bee 1y ago
      right, but a replacing a font is much easier than replacing a browser.
  - arcfour 1y ago
    Disabling ligature rendering in the omnibox seems significantly more sane and safe than this (why wouldn't you do that already?! URLs need to be displayed clearly - not be "aesthetically pleasing").
- anal_reactor 1y ago
  I can imagine a group of excited guys coming up with that idea as something cool, and then the whole thing slowly evolving into a yet another branding tool.
- a2128 1y ago
  Guess I'll have to come up with a different domain name for my new business MakeLogoLigatures :(
jasonthorsness 1y ago
And look, a working bug bounty program! “$10,000 for report of high-quality && high-impact security UI issue + $5,000 bonus for unique, novel cool bug -- this was a very neat discovery!”
moralestapia 1y ago
OS-dependent? I don't see it on OS X.

The issue has been fixed on Chrome: https://issues.chromium.org/issues/391788835 https://issues.chromium.org/issues/391788835 But ligature is indeed still visible on Google search.

madeofpalk 1y ago

Neat to see how impressed the Google team was at how novel this issue was.

bsimpson 1y ago
I imagine the overlap between number of people who know about google_logo and that the Omnibar is set it Google Sans is quite small.

netsharc 1y ago

https://chromium-review.googlesource.com/c/chromium/src/+/6227546/3/components/lookalikes/core/lookalike_url_util.cc https://chromium-review.googlesource.com/c/chromium/src/+/62... Gotta love that the patch isn't fixing the font, but adding a rule for domain names which contains a substring similar to the ligature name...

em-bee 1y ago
fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. in fact this could be a novel attack vector. replace fonts on victims devices to hide the true address of a website. the fix then would have to be to not display any ligatures at all in website addresses, which in my opinion would be a smart change.
- toast0 1y ago
  > fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. Fixing the code doesn't help users that downloaded code and don't get the new version either. Malicious code that can replace a font can replace a lot more too.
  - em-bee 1y ago
    right, but a replacing a font is much easier than replacing a browser.
- arcfour 1y ago
  Disabling ligature rendering in the omnibox seems significantly more sane and safe than this (why wouldn't you do that already?! URLs need to be displayed clearly - not be "aesthetically pleasing").
anal_reactor 1y ago
I can imagine a group of excited guys coming up with that idea as something cool, and then the whole thing slowly evolving into a yet another branding tool.
a2128 1y ago
Guess I'll have to come up with a different domain name for my new business MakeLogoLigatures :(

jasonthorsness 1y ago

And look, a working bug bounty program! “$10,000 for report of high-quality && high-impact security UI issue + $5,000 bonus for unique, novel cool bug -- this was a very neat discovery!”

moralestapia 1y ago

OS-dependent? I don't see it on OS X.