4 ms·
It was not originally meant to be fed malicious inputs from the web all day though. I think the majority of the responsibility rests on people plugging it into
by fulafel 6y ago
It was not originally meant to be fed malicious inputs from the web all day though. I think the majority of the responsibility rests on people plugging it into web browsers.
- jeffbee 6y agoI don't think that's really true. Downloading and installing fonts was one of the very first popular activities online. At the time FreeType was written it was easily seen that untrusted inputs would be the norm.
- fulafel 6y agoSure but you can hardly place the same onus of security rigor on the shoulders of a 90's OS/2 software hobbyist enabling people to explicitly download font files once in a blue moon from sources they explicitly choose, vs a big corporation in the 00's employing world class product security staff deciding to stick that in their source tree without even a shrug, where the downloading and applying the fonts happens behind the users back with 0 interaction.
- jeffbee 6y agoI believe WebKit integrated FreeType2 years before Chrome project even started.