4 ms·

Actually, I'll come up with a better option... don't render any fonts locally... instead, get them when/as you need them as precisely sized bitmaps, from a font

Actually, I'll come up with a better option... don't render any fonts locally... instead, get them when/as you need them as precisely sized bitmaps, from a font server, somewhere else on the Internet... Now the security for the font server becomes the problem of the server its running on, not your local PC... and while the font server runs the risk of compromise, you, by only using pre-rendered bitmaps, should ideally not... Of course, the drawback to this approach is, what if you want to work offline and have not downloaded the necessary fonts?

core-questions 7y ago
> Actually, I'll come up with a better option... don't render any fonts locally... instead, get them when/as you need them as precisely sized bitmaps, from a font server, somewhere else on the Internet... This sounds like: - a latency nightmare - a performance nightmare - a privacy nightmare > Of course, the drawback to this approach is, what if you want to work offline and have not downloaded the necessary fonts? I'm calling Poe's Law on you, friend
- peter_d_sherman 7y ago
  A latency and performance nightmare... yes, quite possibly. A privacy nightmare? I don't see how (unless you had to register on the font-serving machine and it tracked fonts downloaded -- but is that really privacy invading?) Yes, there would be trade-offs (didn't I say that a couple of times?), but such is the price potentially paid for font renderer security... That is -- get rid of the font renderer software component... Hey, one other idea, while I'm at it... run the font renderer in a virtual machine... that could possibly work too... although given that virtual machines have the same issues with complexity and security bugs, I'm sort of 50/50 about that... Another idea: You could have a completely sandboxed language VM -- (e.g., JVM), and if that language VM is provably secure -- run the font renderer code on it... But again, we've seen JVM security bugs so... I'm going to have to go with either "shrink a big bitmap" or "put the font renderer on an entirely different server and serve exact-sized bitmaps" ideas... Or... use a 64K computer from the 1980's where the glyphs are in ROM... <g>
  - GauntletWizard 7y ago
    Yes, font downloading is privacy invading - You can make a "totally unique" font like "timesoldroman-adfssdg" and then track everyone who's downloaded it, for each webpage you want to track. It's just like any other tracking cookie, except a font.
    - peter_d_sherman 7y ago
      Didn't think about that, but yes, that makes sense...
rurban 7y ago
Even better idea: Make the font server a new local CPU with write access to the graphics buffer. But no read access at all. Very expensive idea though.

core-questions 7y ago

> Actually, I'll come up with a better option... don't render any fonts locally... instead, get them when/as you need them as precisely sized bitmaps, from a font server, somewhere else on the Internet... This sounds like: - a latency nightmare - a performance nightmare - a privacy nightmare > Of course, the drawback to this approach is, what if you want to work offline and have not downloaded the necessary fonts? I'm calling Poe's Law on you, friend

peter_d_sherman 7y ago
A latency and performance nightmare... yes, quite possibly. A privacy nightmare? I don't see how (unless you had to register on the font-serving machine and it tracked fonts downloaded -- but is that really privacy invading?) Yes, there would be trade-offs (didn't I say that a couple of times?), but such is the price potentially paid for font renderer security... That is -- get rid of the font renderer software component... Hey, one other idea, while I'm at it... run the font renderer in a virtual machine... that could possibly work too... although given that virtual machines have the same issues with complexity and security bugs, I'm sort of 50/50 about that... Another idea: You could have a completely sandboxed language VM -- (e.g., JVM), and if that language VM is provably secure -- run the font renderer code on it... But again, we've seen JVM security bugs so... I'm going to have to go with either "shrink a big bitmap" or "put the font renderer on an entirely different server and serve exact-sized bitmaps" ideas... Or... use a 64K computer from the 1980's where the glyphs are in ROM... <g>
- GauntletWizard 7y ago
  Yes, font downloading is privacy invading - You can make a "totally unique" font like "timesoldroman-adfssdg" and then track everyone who's downloaded it, for each webpage you want to track. It's just like any other tracking cookie, except a font.
  - peter_d_sherman 7y ago
    Didn't think about that, but yes, that makes sense...

rurban 7y ago

Even better idea: Make the font server a new local CPU with write access to the graphics buffer. But no read access at all. Very expensive idea though.