<story><title>&apos;Text bomb&apos; is latest Apple bug</title><url>http://www.bbc.com/news/technology-42728336</url></story><parent_chain></parent_chain><comment><author>rspeer</author><text>Anyone got any information on how the text rendering bug actually works (not just hand-waving it away as &amp;quot;oh it&amp;#x27;s UTF-8&amp;quot;)?&lt;p&gt;I can see that the file alternates between segments of:&lt;p&gt;- Repetitions of the glyph &amp;quot;t̴́̍̒&amp;quot;, which is a lowercase t with a combining tilde overlay, an acute accent, a vertical line above, and a turned comma above&lt;p&gt;- Random-looking ASCII characters with lots of apostrophes (spelled as &amp;amp;#39; in the HTML)&lt;p&gt;- Short sequences of spaces, non-breaking spaces, and zero-width joiners&lt;p&gt;- Occasional emoji&lt;p&gt;The &amp;quot;t̴́̍̒&amp;quot;s manage to slow down my terminal and glitch its rendering a bit. Is it that they&amp;#x27;re unexpectedly tall? But we&amp;#x27;ve had zalgo-text for a while and it hasn&amp;#x27;t actually crashed devices.</text></comment>
<story><title>&apos;Text bomb&apos; is latest Apple bug</title><url>http://www.bbc.com/news/technology-42728336</url></story><parent_chain></parent_chain><comment><author>devit</author><text>Based on a web search, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bogdanz.me&amp;#x2F;work&amp;#x2F;diddu.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bogdanz.me&amp;#x2F;work&amp;#x2F;diddu.html&lt;/a&gt; might be a working mirror of the proof of concept.&lt;p&gt;It appears to contain a 10MB long UTF-8 mess in both the og:title meta content and in a mailto: link.&lt;p&gt;I&amp;#x27;d guess it&amp;#x27;s supposed to crash iOS apps by either posting that link if it displays links in a thumbnail element using og:title or otherwise by pasting the huge mailto link contained in the webpage, or perhaps only the e-mail address.</text></comment>