On: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

[moffkalast]

Makes you wonder why unicode has invisible characters in the first place and why a compiler would interpret them at all.

[h4ck_th3_pl4n3t → moffkalast]

It's not the compiler.

It's JavaScript and its fucked up UTF-16 strings.

UTF-16 should have been UTF-8 for a variety of reasons, and I thought we have learned from the Effective power لُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ 冗 incident.

[amingilani → h4ck_th3_pl4n3t]

The what incident? Can you elaborate?

Edit: Here’s the incident-https://www.theregister.com/2015/05/27/text_message_unicode_...

[h4ck_th3_pl4n3t → amingilani]

Not only iOS was affected. MacOS, too. Firefox, too. Chromium, too.

Essentially everything that used libicu as a unicode parser.

Was quite fun posting this in IRC and other chats and seeing clients go offline at the time :)

[AnimalMuppet → moffkalast]

The compiler doesn't. They get passed to decode, and then to eval.