Daily Tech News 11 November 2021

• Unicode considered harmful: Hiding backdoors in plain sight by, um, making them invisible. (Bleeping Computer)
  
  The script in question uses an invisible Unicode character as a JavaScript variable parsed from a URL parameter, and passes it, still invisible, to the command line, where it can do whatever the hell it wants.
  
  PyCharm flags this as a warning, and Rust quite properly won't compile. In Notepad++ though, it looks absolutely normal; the only sign of anything odd is a redundant trailing comma in a couple of places.
  
  Given how frequently Node.js packages are caught misbehaving in obvious ways, it's discomforting to consider that this invisible attack could already be in the wild.

  "It might therefore be a good idea to disallow any non-ASCII characters," advises the researcher.

  Quite.
  
  
  
• This researcher, if you want to go to the source. (Certitude)
  
  
  

• Testing the Framework Laptop under Linux. (Phoronix)
  
  This is the one where every component is replaceable with nothing more than a Phillips screwdriver needed to take it apart, and all the IO is in little adaptor pods, two on each side.
  
  It runs Linux quite well.
  
  
  
• Three out of four adults think Facebook is making society worse. (CNN)
  
  On the one hand, yes.
  
  On the other hand, it's a convenient scapegoat for far worse actors such as CNN.
  
  
  
• YouTube is removing the dislike count after discovering that no-one likes them. (Tech Crunch)
  
  "It's all the fault of the hoarders and wreckers," said a YouTube spokes.
  
  
  
• Google lost its appeal against a $2.7 billion EU antitrust ruling. (The Register)
  
  More of this, please, harder and faster.

posted by Pixy Misa at 03:12 AM

| Access Comments