Dovecot v2.3.17 released

[lists]

The unicode hack is in the comments. Google "Trojan Source". Having never dealt with Hebrew and Arabic, it was news to me there is a right to left feature in Unicode.

TWIT Security Now (MP3): SN 843: Trojan Source - Chrome 0-days, Windows 11 confusion, VoIP DDos attacks, Dune https://pdst.fm/e/chtbl.com/track/E91833/cdn.twit.tv/audio/sn/sn0843/sn0843.mp3#t=4768 [01:19:28]

Or look for the paper. Hopefully this isn't too off topic. 




  Original Message  


From: reinob at bbmk.org
Sent: November 4, 2021 2:16 AM
To: dovecot at dovecot.org
Reply-to: dovecot at dovecot.org
Subject: Re: Dovecot v2.3.17 released


On Thu, 4 Nov 2021, Rupert Gallagher wrote:

> Please convert all source code to ASCII. If it fails to compile, then it may
> have a trojan hiding in Unicode clothing.

Did you check yourself?

The only source code files which contain non-7-bit-ASCII characters are
1. src/lib-storage/list/mailbox-list-index-status.c
  * Opportunistic function to see ïf we can extract guid from mailbox path */

i.e. in a /* comment */, and it's 8-bit ASCII not even UTF-anything.

2. src/lib-mail/test-qp-encoder.c
which defines binary data.

I don't think any C compiler allows Unicode in the code itself (instructions,
variables names, etc.)

Cheers.