Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Nov 2021 07:53:45 +0530
From: Siddhesh Poyarekar <>
Cc: Jan Engelhardt <>
Subject: Re: Trojan Source Attacks

On Tue, 2 Nov 2021 at 05:21, Perry E. Metzger <> wrote:
> On 11/1/21 16:51, Jan Engelhardt wrote:
> >> We have identified an issue affecting all compilers and interpreters that support Unicode.
> >> [...]
> >> The attached paper describes an attack paradigm -- which we believe to be novel -- discovered by security researchers at the
> >> University of Cambridge.
> > Not so novel. At one time, this picture made the rounds
> > ( - the pic is likely
> > older than this 2018 tweet), and anyone who knew that Unicode had zero-width
> > characters already made the connection.
> If it was known to everyone, then why are so many language interpreters
> and compilers impacted? Surely if this was truly something that was well

That's because unicode rendering is a UI element and calling compilers
"impacted" is misunderstanding the issue.  There's scope for adding
new diagnostics to square with UI representation of unicode, but
that's at best an optional warning and it may not even be feasible in
all cases.  A comprehensive language aware CI lint check is perhaps
more suitable but if such a check devolves into "7-bit ascii only
allowed" for all cases then we've regressed.

Also, this is not just about compilers, the idea of such obfuscation
is central to any content that a human and a computer program are
required to see consistently.  A rootkit could obfuscate configuration
files in a way that's invisible to a human and evades visual or basic
syntax based audit, or example configuration files of daemon programs
could be similarly compromised at source, resulting in the compromised
files landing on various systems.  Likewise for build configuration,
makefiles, etc.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.