Google Logo Ligature Bug

https://www.jefftk.com/p/google-logo-ligature-bug

104•cubefox•4h ago

Comments

adzm•3h ago

Wow it still works.

Kyro38•3h ago

The issue has been fixed on Chrome: https://issues.chromium.org/issues/391788835

But ligature is indeed still visible on Google search.

madeofpalk•3h ago

Neat to see how impressed the Google team was at how novel this issue was.

bsimpson•3h ago

I imagine the overlap between number of people who know about google_logo and that the Omnibar is set it Google Sans is quite small.

netsharc•2h ago

https://chromium-review.googlesource.com/c/chromium/src/+/62...

Gotta love that the patch isn't fixing the font, but adding a rule for domain names which contains a substring similar to the ligature name...

em-bee•1h ago

fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature.

in fact this could be a novel attack vector. replace fonts on victims devices to hide the true address of a website. the fix then would have to be to not display any ligatures at all in website addresses, which in my opinion would be a smart change.

toast0•1h ago

> fixing the font does not help those that downloaded the font and won't get the new version. it also does not prevent malicious code from replacing the font on your machine with a version that has the ligature.

Fixing the code doesn't help users that downloaded code and don't get the new version either.

Malicious code that can replace a font can replace a lot more too.

em-bee•26m ago

right, but a replacing a font is much easier than replacing a browser.

jasonthorsness•1h ago

And look, a working bug bounty program!

“$10,000 for report of high-quality && high-impact security UI issue + $5,000 bonus for unique, novel cool bug -- this was a very neat discovery!”

stefan_•2h ago

I thought there was something wrong with this blog post that kept writing "googlelogoligature" but no some absolute cretin really added that as a ligature to the font.

sublinear•2h ago

> Fonts can include "ligatures", which let font designers special-case specific combinations of letters ... but the feature has been (ab)used for many other things

Same reason to not use ligatures in your IDE, terminal, etc.

Did that trend finally die off?

nine_k•2h ago

Ligatures that give slightly stylized rendering to stuff like <!-- or even replace a >= with a ≥ in your source code view are much less prone to exploitation than a "ligature" that replaces a 18-letter sequence with the word "Google" in your browser's address bar. It's like comparing the hazardousness levels of a safety pin and of a chainsaw.

jasonthorsness•2h ago

My great fear is they will become so popular that the option to disable them will be forgotten. I can’t stand the ligatures that noticeably change and merge the glyphs.

wbl•1h ago

Have you ever read a book typeset without them? Imagine a dot in fig where the loop of the f conflicts.

jasonthorsness•1h ago

Those historical use cases are fine and important, the problem ones are the ones in monospace fonts that change <= to ≤ and that sort of thing, or even crazier abuses like shown here.

toast0•1h ago

I like the dotted i in fig, thank you. Not a big fan of underlines that don't cross descendeds either.

kstrauser•1h ago

Fortunately, no. They’re increasingly well supported for the user base who think they look nice… like me.

I love the way my code looks in Berkeley Mono on any modern editor version. Seeing `>=` render similar to `≥` makes me smile. It’s a tiny visual tweak that doesn’t even cause anything to move on the screen, because that font’s ligatures are the same width as the characters they replace. I see no downside to it for me.

layer8•22m ago

Personally, I find an extra-wide “≥” more ugly and jarring than “>=“. If anything, I would prefer programming languages to understand the actual Unicode “≥”, and people learning how type that (Compose key, dedicated IDE support, or whatever). It would be nice for more people to appreciate that the characters one can type aren’t limited to the symbols printed on the keyboard.

sjs382•2h ago

There are many others including "glogoligature".

jasonthorsness•2h ago

It’s difficult (impossible?) to force a font on the web in a way that can’t be overridden by some users. This must have been a font designed for device-specific applications picked up for other use-cases? Or maybe they just didn’t care that the long tail of users might see the string “googlelogoligature” instead of the logo.

em-bee•1h ago

any website that supplies its own fonts will work. the number of people that would override the fonts specified in a website is small.

void-pointer•1h ago

Why didn’t google just use a Unicode private use code point like apple does with U+F8FF? ()

layer8•32m ago

Because that wouldn’t degrade gracefully with a different font.

Speaking Up and Calling Out BS When You See It

Vibe coding: your roadmap to becoming an AI developer

The dial-up modem lives on, in office meeting rooms

Zeta: Shadcn/UI components registry built for private and premium projects

GitHub Copilot Wants to Become Your Peer Programmer

Rust a Decade Later

The Leprechauns of Software Engineering

Svalbard Global Seed Vault

Remote work study clear conclusion: "Working from home makes us happier."

FTX Dumped Cursor Stake for $200K – It's Now Worth $500M After $9B Valuation

We need new AI design schemas for better product

How to Grow as a Technical Writer

The Mechanics of Déjà Vu

The Three C's of Meaningful Work

Suspension bioprinted whole intervertebral disc analogues

Let's learn C: lesson 1 – by Salvatore Sanfilippo [video]

AI models can't tell time or read a calendar, study reveals

Show HN: Racketmeter – Measure Badminton String Tension Using Sound Frequency

M&S hackers believed to have gained access through third party

$30 Homebrew Automated Blinds Opener

I tried to learn Toki Pona in 48 hours using memes (2015)

What every coder should know about gamma (2016)

Understanding the Go Scheduler

The Origin of "Sweet Summer Child"

Show HN: Operating System for Tasks

Custom storybook for children in 5 minutes

The X220 ThinkPad Is the Best Laptop in the World

Show HN: I built a Next.js 15 and Notion waitlist template to help launch faster

'Robotability score' ranks NYC streets for future robot deployment

Python: The Documentary [Official trailer] [video]