4 ms·

One of the major vectors for fingerprinting in various ways is font rendering. It's extremely surprising how integrated with the OS font rendering is, consideri

One of the major vectors for fingerprinting in various ways is font rendering. It's extremely surprising how integrated with the OS font rendering is, considering it's something that can be done completely seamlessly in userspace for most applications. I spent a long time integrating libpango/cairo (http://www.pango.org/ http://www.pango.org/ and https://www.cairographics.org/ https://www.cairographics.org/) into a semi-toy opengl game engine I wrote which had a Windows target, and was baffled at the level of complexity/interdependency required to build it. Gecko (firefox's rendering engine) maintains a fork of cairo https://github.com/mozilla/gecko/blob/0ea4c5812c2adecbed1d84884e9695628a47502c/gfx/cairo/README https://github.com/mozilla/gecko/blob/0ea4c5812c2adecbed1d84... , which is as far as I can tell the only way to statically link it. Both these libraries require Glib. There isn't an alternate minimalist open-source font rendering library as far as I'm aware, simply because the task of handling all font-rendering edge cases in all languages is so gargantuan. So we're stuck with a huge intertwined set of poorly understood C libraries, tightly integrated into the system and every application and ever-exploitable.

eximius 9y ago
font-rs, pathfinder are both open source Rust libraries for font rendering (cpu, gpu, respectively).
- rspeer 9y ago
  I checked font-rs and it looks like it just solves the small problem of rasterizing glyphs, not the whole stack. I would love a replacement for Pango/Cairo, because they are utter dependency hell, but don't get my hopes up prematurely.
  - pcwalton 9y ago
    You might not need Pango: HarfBuzz might be enough, depending on your needs. HB has a relatively easy to use API. stb_truetype is even more minimal. As for Cairo, there are lighter-weight alternatives available: AGG, nanovg, etc.
atesti 9y ago
If you need a minimalist open-source font rendering library, look at stb_truetype: https://github.com/nothings/stb https://github.com/nothings/stb A single header file. Unfortunately it cannot do what harfbuzz or pango do, that is lay out complex scripts or do any layout
- sempron64 9y ago
  Thanks, this project is really cool! Layout is a major difficulty though -- no one wants to use all-monospace or forgo linebreaks, or to have to code that logic by hand.
sempron64 9y ago
Though information leaks via font rendering is very much a solvable problem, another major vector for fingerprinting is WebGL: https://browserleaks.com/webgl https://browserleaks.com/webgl Since graphics rendering is tied so tightly to the hardware, I can't really imagine a scenario where all fingerprinting leaks from WebGL can ever be plugged.
- deleted 9y ago
  [deleted]
- ris 9y ago
  It's simple - WebGL should never have been enabled without user action in the first place - it's a security minefield.
SubiculumCode 9y ago
Perhaps an entropy function could be added to Firefox to add noise to Firefox's rendering in the canvas; noise that would change on each render. This might make it more difficult to establish a reliable fingerprint, at least without acquiring multiple samples to average away the noise.
- SubiculumCode 9y ago
  I might add that the noise doesn't necessarily have to always come from the same distribution. The more the noise changes distributions, the harder it would be to use sample averaging to extract the signal, I think.
  - sillysaurus3 9y ago
    The noise would be noticeable.
    - SubiculumCode 9y ago
      You would just limit noise to the spectrum of existing differences between in the wild renderings.
    - deleted 9y ago
      [deleted]
  - rootw0rm 9y ago
    adding information is rarely the best approach.
kevin_thibedeau 9y ago
> There isn't an alternate minimalist open-source font rendering library as far as I'm aware... You can use Freetype in conjunction with libagg. It will lack the more sophisticated multi-lingual layout features Pango provides but is doable for portable font rendering. It would be interesting to make a fork of Pango that is independent of Glib or, more realistically, uses a stripped down Glib with minimal dependencies.
kccqzy 9y ago
I find it demeaning to call other people’s hard work “poorly understood” just because you don’t understand it. The open source world is large enough that you’re bound to encounter projects written in a language you might not be familiar with, or written in a style you consider old-school. Grow up and have some respect for the software we are using every single day.
- revmoo 9y ago
  Whoa, relax
- chris_wot 9y ago
  Poorly understood is not an insult. It’s just a fact!
rossy 9y ago
The real problem is that people get used to how their operating system renders fonts, and different operating systems render fonts very differently. The difference between how macOS and Windows render fonts is almost philosophical. macOS does not hint fonts at all in an attempt to preserve a font's character at small sizes, but Windows applies aggressive hinting (and no anti-aliasing) in the Y-direction to make fonts sharper and more readable, even if it totally changes the shape of the letters. On Windows, at least, fonts can also differ between monitors (even on the same computer.) The built-in ClearType tuner tool lets the user adjust the font rendering gamma for each monitor individually. It would be a shame if this didn't have an effect in the browser, where users probably do most of their reading these days. If you made your own simple from-scratch font rendering library that rasterized glyphs to the same array of pixels on every operating system, regardless of user settings, I guarantee your users would be upset. When you render a lowercase 'e' to a 6x6 pixel grid, any slight difference in rendering makes a huge difference to the character of the letter, and it's the sort of thing that contributes to the "uncanny-valley" feeling that non-native apps have. This is why Pango and Firefox go through so much effort to use the native renderers on each platform and why they may seem complicated to an outsider.
- jonnycomputer 9y ago
  I think most people don't really care that much how their fonts are rendered, or would even notice a change. (And no, I don't have data to back that up) edit: The emphasis here is on "most". In a world where an OS will have many millions of users, at least more than a few are going to care a lot about things like the differences between font renderers; programmers and graphic designers are no doubt among them. But the typical user? Without real data to back it up, count me as skeptical.
  - rossy 9y ago
    For an example of how much people care, look up all the outrage that happened when Chrome switched between two very similar Windows font renderers (GDI and DirectWrite.) Example: https://www.change.org/p/google-inc-bring-sharp-fonts-back-in-google-chrome-disable-directwrite https://www.change.org/p/google-inc-bring-sharp-fonts-back-i... If anecdotal evidence counts, I've heard lots complaints about font rendering, even from people in real life and non-technical people. (I like the fonts on X. Why does Y look so bad? Why can't it just look like it does in Word on Windows?) It turns out that if people spend most of their lives/jobs looking at text that appears a certain way, they will get accustomed to it. If these people are using LoDPI monitors where they can perceive each individual pixel, you'd better hope your custom font renderer replicates your users' favourite renderer down to the exact pixel layout of each glyph.
vetrom 9y ago
It's not perfectly minimalist, but freetype can be used on its own for rendering as well.

eximius 9y ago

font-rs, pathfinder are both open source Rust libraries for font rendering (cpu, gpu, respectively).

rspeer 9y ago
I checked font-rs and it looks like it just solves the small problem of rasterizing glyphs, not the whole stack. I would love a replacement for Pango/Cairo, because they are utter dependency hell, but don't get my hopes up prematurely.
- pcwalton 9y ago
  You might not need Pango: HarfBuzz might be enough, depending on your needs. HB has a relatively easy to use API. stb_truetype is even more minimal. As for Cairo, there are lighter-weight alternatives available: AGG, nanovg, etc.

atesti 9y ago

If you need a minimalist open-source font rendering library, look at stb_truetype: https://github.com/nothings/stb https://github.com/nothings/stb A single header file. Unfortunately it cannot do what harfbuzz or pango do, that is lay out complex scripts or do any layout

sempron64 9y ago
Thanks, this project is really cool! Layout is a major difficulty though -- no one wants to use all-monospace or forgo linebreaks, or to have to code that logic by hand.

sempron64 9y ago

Though information leaks via font rendering is very much a solvable problem, another major vector for fingerprinting is WebGL: https://browserleaks.com/webgl https://browserleaks.com/webgl Since graphics rendering is tied so tightly to the hardware, I can't really imagine a scenario where all fingerprinting leaks from WebGL can ever be plugged.

deleted 9y ago
[deleted]
ris 9y ago
It's simple - WebGL should never have been enabled without user action in the first place - it's a security minefield.

SubiculumCode 9y ago

Perhaps an entropy function could be added to Firefox to add noise to Firefox's rendering in the canvas; noise that would change on each render. This might make it more difficult to establish a reliable fingerprint, at least without acquiring multiple samples to average away the noise.

SubiculumCode 9y ago
I might add that the noise doesn't necessarily have to always come from the same distribution. The more the noise changes distributions, the harder it would be to use sample averaging to extract the signal, I think.
- sillysaurus3 9y ago
  The noise would be noticeable.
  - SubiculumCode 9y ago
    You would just limit noise to the spectrum of existing differences between in the wild renderings.
  - deleted 9y ago
    [deleted]
- rootw0rm 9y ago
  adding information is rarely the best approach.

kevin_thibedeau 9y ago

> There isn't an alternate minimalist open-source font rendering library as far as I'm aware... You can use Freetype in conjunction with libagg. It will lack the more sophisticated multi-lingual layout features Pango provides but is doable for portable font rendering. It would be interesting to make a fork of Pango that is independent of Glib or, more realistically, uses a stripped down Glib with minimal dependencies.

kccqzy 9y ago

I find it demeaning to call other people’s hard work “poorly understood” just because you don’t understand it. The open source world is large enough that you’re bound to encounter projects written in a language you might not be familiar with, or written in a style you consider old-school. Grow up and have some respect for the software we are using every single day.

revmoo 9y ago
Whoa, relax
chris_wot 9y ago
Poorly understood is not an insult. It’s just a fact!

rossy 9y ago

The real problem is that people get used to how their operating system renders fonts, and different operating systems render fonts very differently. The difference between how macOS and Windows render fonts is almost philosophical. macOS does not hint fonts at all in an attempt to preserve a font's character at small sizes, but Windows applies aggressive hinting (and no anti-aliasing) in the Y-direction to make fonts sharper and more readable, even if it totally changes the shape of the letters. On Windows, at least, fonts can also differ between monitors (even on the same computer.) The built-in ClearType tuner tool lets the user adjust the font rendering gamma for each monitor individually. It would be a shame if this didn't have an effect in the browser, where users probably do most of their reading these days. If you made your own simple from-scratch font rendering library that rasterized glyphs to the same array of pixels on every operating system, regardless of user settings, I guarantee your users would be upset. When you render a lowercase 'e' to a 6x6 pixel grid, any slight difference in rendering makes a huge difference to the character of the letter, and it's the sort of thing that contributes to the "uncanny-valley" feeling that non-native apps have. This is why Pango and Firefox go through so much effort to use the native renderers on each platform and why they may seem complicated to an outsider.

jonnycomputer 9y ago
I think most people don't really care that much how their fonts are rendered, or would even notice a change. (And no, I don't have data to back that up) edit: The emphasis here is on "most". In a world where an OS will have many millions of users, at least more than a few are going to care a lot about things like the differences between font renderers; programmers and graphic designers are no doubt among them. But the typical user? Without real data to back it up, count me as skeptical.
- rossy 9y ago
  For an example of how much people care, look up all the outrage that happened when Chrome switched between two very similar Windows font renderers (GDI and DirectWrite.) Example: https://www.change.org/p/google-inc-bring-sharp-fonts-back-in-google-chrome-disable-directwrite https://www.change.org/p/google-inc-bring-sharp-fonts-back-i... If anecdotal evidence counts, I've heard lots complaints about font rendering, even from people in real life and non-technical people. (I like the fonts on X. Why does Y look so bad? Why can't it just look like it does in Word on Windows?) It turns out that if people spend most of their lives/jobs looking at text that appears a certain way, they will get accustomed to it. If these people are using LoDPI monitors where they can perceive each individual pixel, you'd better hope your custom font renderer replicates your users' favourite renderer down to the exact pixel layout of each glyph.

vetrom 9y ago

It's not perfectly minimalist, but freetype can be used on its own for rendering as well.