graemep 7 hours ago

Surely the fact that the change is in a domain name (and the diff shows this) is a red flag?

  • bombcar 6 hours ago

    That was an example- an attacker would slip it in an actual URL change to make it less noticeable- and a good attacker would have their domain work and redirect until the code was deployed in the wild.

fsflover 7 hours ago

Qubes OS protects from such attacks by running all software in isolated VMs and not passing the unicode symbols to the host by default, https://www.qubes-os.org/news/2024/07/13/qubes-os-4-2-2-has-...

  • poincaredisk 4 hours ago

    You link says the opposite - the change was very annoying for people that use non-english languages (like me), and:

    >By default, qvm-copy and similar tools will use this less restrictive service (qubes.Filecopy +allow-all-names) whenever they detect any files that would be have been blocked by the more restrictive service

    Also it looks like this is just for filenames? I can't imagine filtering text like this, that would render the system useless for me.

    • fsflover 3 hours ago

      The defense of the host (dom0) from the websites comes from not showing the UTF-8 window titles (https://www.qubes-os.org/doc/config-files/#gui-and-audio-con...). Since all you see inside VMs is isolated, you can show any text inside them safely for dom0.

      It gets a bit harder with transferring files between VMs as my original link shows, but you can be protected from that too at some cost.