‘Trojan Source’ Bug Threatens the Security of All Code

Re:‘Trojan Source’ Bug Threatens the Security of All Code by smashed on Monday November 01, 2021 @10:41AM (#29067163)

I was intrigued by your meta example and I took a look. It took me 3-4 minutes to find the warning, and I was looking for it!

I was expecting a big fat warning on the merge request itself, or maybe on the lines containing the dangerous chars.

In the end, it is a small ? character inserted were the unicode control chars are, and a mouseover tooltip warning about a potential issue.

The warning is good, but why so subtle? Sorry for the criticism. The feature is still a huge positive.

[ Parent | on HN ]

Re:‘Trojan Source’ Bug Threatens the Security of All Code by robotmay on Monday November 01, 2021 @10:54AM (#29067363)

Thanks for the feedback! Our primary use-case when deciding on it was to flag these up in a code-review situation, to prevent malicious content being submitted in merge requests to unsuspecting projects. We found this made it stand out enough to the reviewer when performing code reviews. I also try to not be too quick to add new alerts or sections to the GUI as we sometimes get criticised for having too much clutter D:

GitHub by comparison went down the alert banner route, from what I can see. I'm not opposed to adding something to that effect as well though - especially for inexperienced reviewers, it would be nice to include some more information about the potential exploit. That could be something we revisit when we add the homoglyph highlighting.

[ Parent | on HN ]

Re:‘Trojan Source’ Bug Threatens the Security of All Code by stolsvik on Tuesday November 02, 2021 @02:59AM (#29077917)

Thus, one sloppy review by that known tired-in-the-mornings dev, "sure thing, looks like Java..", and your little marking is missed?

[ Parent | on HN ]