The Invisible JavaScript Backdoor – Certitude BlogA few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code. This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even from thorough code reviews? Just as we were finishing up this blog post, a team at
http://www.unicode.org/Public/security/latest/confusables.txt
