People laugh at this, but remember, someone caught a malicious PR to CURL during optimization 'cus the malicious code made a function take longer than it should.
Oh you right, it was XZ. The curl one was a hypothetical, someone pointed out there was a way you could do some unicode wizardry to make a specific line vulnerable without it being really noticeable, but it was just a concept, no one tried to push it to the actual repo.
The spotter dude is a postgres contributor. For DB level a 100ms difference constantly is horrenduously big.
The curl one aint it the apex of the ai slop PRs in repo that made the only maintainer to force a "no ai PR" policy? He was being bombarded with convincing PRs, except they evoke code from heavens that never existed and assumes there were flaws
For a DB sure, but afaik what he measured was that establishing his ssh connection took 100ms longer or something. I would have just assumed my network was weird or something.
// Safe-looking code, but with homoglyph trickery
int safe_flag = 0; // uses normal Latin 'a' in "safe"
int sаfe_flag = 1; // the 'a' in "sаfe" is Cyrillic U+0430
if (safe_flag) {
// Reviewer thinks this block runs only when safe_flag == 1
do_safe_thing();
} else {
do_other_thing();
}
// Somewhere else in the patch:
log_status(sаfe_flag); // Looks like "safe_flag", but it's the Cyrillic one
Basically, but the specific implementation apparently had some very clever trick that made the change basically invisible, so there was no need for do_other_thing();
109
u/evilwizzardofcoding 1d ago
People laugh at this, but remember, someone caught a malicious PR to CURL during optimization 'cus the malicious code made a function take longer than it should.