Re: Trojan Source Attacks

[Seth Arnold <seth.arnold () canonical com>]

On Tue, Nov 02, 2021 at 04:43:48PM -0400, Stuart D Gathman wrote:
> Having some sample source files to test your code editor/viewer on would be
> helpful.

There's examples on https://github.com/nickboucher/trojan-source

GitHub was kind enough to include a banner like this on many of the files:

     This file contains bidirectional Unicode text that may be interpreted
     or compiled differently than what appears below. To review, open
     the file in an editor that reveals hidden Unicode characters. Learn
     more about bidirectional Unicode characters

eg: https://github.com/nickboucher/trojan-source/blob/main/Go/stretched-string.go


But not all of them:

https://github.com/nickboucher/trojan-source/blob/main/Go/homoglyph-function.go
Looks completely normal to me, but mouse hovering over the sayHello
function names shows the difference.

https://github.com/nickboucher/trojan-source/blob/main/Rust/invisible-function.rs
The isAdmin function name is rendered three different ways, but it's
pretty subtle, and the colouring gives no indication which of the two
definitions is actually going to be used (though I've got a guess).

There's otherwise no warnings today from GitHub that these two are out
of the ordinary.

Thanks

Attachment: signature.asc
Description: