3 ms·

https://chromium-review.googlesource.com/c/chromium/src/+/6227546/3/components/lookalikes/core/lookalike_url_util.cc https://chromium-review.googlesource.com/c/

• em-bee 1y ago
  fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. in fact this could be a novel attack vector. replace fonts on victims devices to hide the true address of a website. the fix then would have to be to not display any ligatures at all in website addresses, which in my opinion would be a smart change.
  • toast0 1y ago
    > fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature. Fixing the code doesn't help users that downloaded code and don't get the new version either. Malicious code that can replace a font can replace a lot more too.
    • em-bee 1y ago
      right, but a replacing a font is much easier than replacing a browser.
  • arcfour 1y ago
    Disabling ligature rendering in the omnibox seems significantly more sane and safe than this (why wouldn't you do that already?! URLs need to be displayed clearly - not be "aesthetically pleasing").
• anal_reactor 1y ago
  I can imagine a group of excited guys coming up with that idea as something cool, and then the whole thing slowly evolving into a yet another branding tool.
• a2128 1y ago
  Guess I'll have to come up with a different domain name for my new business MakeLogoLigatures :(