4 ms·

Given that fonts are attack vectors, why style text at all?

• snuxoll 11y ago
  The consideration of fonts as attack vectors is highly overplayed - the bytecode allowed in TTF in OTF fonts is pretty limited, while mistakes have certainly been made in FreeType and other implementations it's no worse than the JavaScript sandbox most people are already relying on in their browsers.
  • DonHopkins 11y ago
    There are some fonts you should never install, even if they look innocuous: http://fontmeme.com/freefonts/134412/the_trojan_horse.font http://fontmeme.com/freefonts/134412/the_trojan_horse.font And other fonts are so beautiful that merely looking at them can cause harm: http://re-type.com/notaweblog/2013/03/06/new-font-from-retype-medusa/ http://re-type.com/notaweblog/2013/03/06/new-font-from-retyp...
• stock_toaster 11y ago
  They aren't actually embedding the font, they are just setting a style in the css to use a particular system font, if present.