Date: Tue, 2 Nov 2021 23:25:54 +0000 From: Seth Arnold <seth.arnold@...onical.com> To: Stuart D Gathman <stuart@...hman.org> Cc: oss-security@...ts.openwall.com Subject: Re: Trojan Source Attacks On Tue, Nov 02, 2021 at 04:43:48PM -0400, Stuart D Gathman wrote: > Having some sample source files to test your code editor/viewer on would be > helpful. There's examples on https://github.com/nickboucher/trojan-source GitHub was kind enough to include a banner like this on many of the files: This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters eg: https://github.com/nickboucher/trojan-source/blob/main/Go/stretched-string.go But not all of them: https://github.com/nickboucher/trojan-source/blob/main/Go/homoglyph-function.go Looks completely normal to me, but mouse hovering over the sayHello function names shows the difference. https://github.com/nickboucher/trojan-source/blob/main/Rust/invisible-function.rs The isAdmin function name is rendered three different ways, but it's pretty subtle, and the colouring gives no indication which of the two definitions is actually going to be used (though I've got a guess). There's otherwise no warnings today from GitHub that these two are out of the ordinary. Thanks Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.