3 ms·
Why NoScript Blocks Web Fonts
- steve19 17y agohttp://en.wikipedia.org/wiki/Truetype#Hinting_language http://en.wikipedia.org/wiki/Truetype#Hinting_language
- cgranade 17y agoThanks! I was wondering why on earth a font engine needed a full VM, but that makes a lot more sense now.
- plesn 17y agoHopefully this will lead to enhancements in FreeType (or some competition). Anyway users will prefer shiny lolcat fonts to their own security...
- jrockway 17y agolibpng was also vulnerable to arbitrary code injection, but NoScript doesn't block images by default... If you write your software in C, it's not really safe to expose to the Internet.
- tedunangst 17y agoGood thing none of the modern browsers or web servers are written in anything like C.
- jrockway 17y agoThey are, and that's why they're not safe to expose to the Internet.
- prodigal_erik 17y agoThis is what we get for assuming every user wants native code to have all their privileges as it munges untrusted data. I keep hoping something like a capability-based system will come along and trump both Unix and Windows, but if a litany of security trainwrecks isn't enough motivation, I can't imagine how it could happen.