News for hackers. Stuff that matters.
Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by nine_k on Sunday March 15, 2026 @12:05PM (#47388735)
The rule must be very simple: any occurrence of `eval()` should be a BIG RED FLAG. It should be handled like a live bomb, which it is.

Then, any appearance of unprintable characters should also be flagged. There are rather few legitimate uses of some zero-width characters, like ZWJ in emoji composition. Ideally all such characters should be inserted as \xNNNN escape sequences, and not literal characters.

Simple lint rules would suffice for that, with zero AI involvement.

Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by trollbridge on Sunday March 15, 2026 @12:25PM (#47388927)
In our repos, we have some basic stuff like ruff that runs, and that includes a hard error on any Unicode characters. We mostly did this after some un-fun times when byte order marks somehow ended up in a file and it made something fail.

I have considered allowing a short list that does not include emojis, joining characters, and so on - basically just currency symbols, accent marks, and everything else you'd find in CP-1521 but never got around to it.

Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by WalterBright on Sunday March 15, 2026 @01:14PM (#47389470)
> There are rather few legitimate uses of some zero-width characters, like ZWJ in emoji composition.

Emojis are another abomination that should be removed from Unicode. If you want pictures, use a gif.

Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by _flux on Sunday March 15, 2026 @02:09PM (#47390068)
Arguably them being in Unicode is an accessibility issue, unless we thought to standardize GIF names, and then that already sounds a lot like Unicode.
Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by WalterBright on Sunday March 15, 2026 @02:20PM (#47390206)
How is it an accessibility issue? HTML allows things like little gif files. I've done this myself when I wrote text that contained Egyptian hieroglyphs. It works just fine!
Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by _flux on Sunday March 15, 2026 @02:43PM (#47390461)
I mean if you don't have sight.
Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by WalterBright on Sunday March 15, 2026 @02:46PM (#47390501)
Then use words. Or tooltips (HTML supports that). I use tooltips on my web pages to support accessibility for screen readers. Unicode should not be attempting to badly reinvent HTML.
Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by sghitbyabazooka on Sunday March 15, 2026 @02:03PM (#47390002)
( ꏿ ﹏ ꏿ ; )
Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by hamburglar on Sunday March 15, 2026 @01:30PM (#47389623)
I think there’s debate (which I don’t want to participate in) over whether or not invisible characters have their uses in Unicode. But I hope we can all agree that invisible characters have no business in code, and banishing them is reasonable.
Re:Glassworm Is Back: A New Wave of Invisible Unicode Attack... by hrmtst93837 on Monday March 16, 2026 @08:03AM (#47397845)
Automatic escaping sounds nice until you need to grep or diff across repos and get buried in opaque escapes that turn ordinary review into unreadable junk. Once that lands in a repo, even routine deps updates can turn into edge-case mismatch roulette.

Lint zero-width chars, sure. But if the actual sink is runtime string injection, banning eval is only half a fix because Function and friends still get you to the same bad place while the linter congratulates itself.