Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The only reason why this makes any sense as a threat vector is because Java code highlighting parsers and javac work differently. Sure, someone can still try it, but if they knew that every code highlighter would render it correctly they wouldn't bother.


I'd assume that there are plenty of editors that just do general C-style comment highlighting without diving into java-specific Unicode escapes. As long as you can't be sure that no bad actor could ever consider this obfuscation a net positive for their goals, the lint approach remains worthwhile. Worthwhile because its cost is so low.


True. I'm not saying the lint is a bad idea, just that fixing the parser is a better one.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: