9 ms·
Fonts are still a Helvetica of a Problem
- LightFog 3y agoAh XML external Entity resolution, the gift that keeps on giving.
- ByQuyzzy 3y agoI just turn off downloadable fonts, too risky these days.
- fddrdplktrew 3y agoit's also pretty useless... I like my local fonts. I see it more as a tracking tool from spying companies like Google.
- troupo 3y agoSystem fonts don't have to be ugly: https://iainbean.com/posts/2021/system-fonts-dont-have-to-be-ugly/ https://iainbean.com/posts/2021/system-fonts-dont-have-to-be...
- atoav 3y agoNo, but for designers designing with an unknown/potentially changing font is more work and produces less good looking results. So unless there is a set of reliable cross-platform system fonts there is zero incentive for designers to use system fonts for commercial projects. If you have ever worked in design the absolute horror is if you designed something well and then the boss of the org tou did it for opens it on their IE6 and it looks like shit. This is a similar problem.
- codingdave 3y agoIs it truly designed well if you didn't find out the target audience and the tools they would be using to view that design? I love good design. I really do. And it truly is a critical piece of good software. Yet the most painful experiences I've had in my careers are from working with designers who who push their idealized design philosophies onto a reality where they aren't the right answer. Designers need to be as focused as anyone else on understanding the customers and solving the customer's problems.
- atoav 3y agoI agree with you. There is a lot of bad design and there are a lot of bad designers. Privately I tend to call design that doesn't conaider function styling and people who make these decisions are stylists. That being said designing for screens is already hard because the sizes and proportions of the screens and windows can vary wildly and even change during use. Adding potentially different fonts with wildly different widths and readability into the mix is certainly something that doesn't make things easier. Again, that doesn't mean using a system font is something I'd never do, it just means that whether that is a smart or a bad choice depends on all kind of factors.
- troupo 3y ago> Privately I tend to call design that doesn't conaider function styling and people who make these decisions are stylists. Oh, this is a perfect characterization. I've been calling such people "dribbble-raised designers" :)
- cantSpellSober 3y agoThis article doesn't describe any vulnerabilities in the browser, is that correct? Mostly processing XML, Python and C. The conclusion is > Implement sandboxing for anything that processes fonts I don't believe the author is referring "your web browser"
- kragen 3y agocommonly the web browser passes the font data it downloads to the operating system for rendering, and there have definitely been exploitable holes in downloadable font handling in the past, in large part because the font rendering engines were not written with malicious data in mind (because you were buying your fonts from bitstream or apple or mergenthaler or whatever)
- deleted 3y ago[deleted]
- ibotty 3y agoLooks a little like a redesign of fontforge to not use all these external commands but call libraries would solve a class of problems. Who knows how many there are still lurking. I am lucky I only use(d) fontforge on my local system with fonts I trust.
- charcircuit 3y agoThese vulnerabilities don't seem to be related to Helvitica. I was expecting a critique related to fonts themselves and not bugs with general font rendering.
- ngrilly 3y agoThe title is a play on words: the author used “Helvetica” for “hell” :)
- nilsherzig 3y agoA rial problem
- Mordisquitos 3y agoImpact-ful indeed.
- RyeCombinator 3y agoDid they mean Arial
- notachatbot123 3y agoArial Problem?
- MonkeyClub 3y agoI think the play is on "Helvetica" sounding a bit like "helluva".
- v3ss0n 3y agoArial = A Real
- daveslash 3y agoI think we can all agree... it's Arial Helvetica problem! I think it may be Terminal. I need someone to Consolas me.
- AlecSchueler 3y agoHelluva of a problem.
- nathancahill 3y agoI still don't get what you see in him.
- orliesaurus 3y agoThe only reason that they can't keep it as simple as font-family: system-ui is probably because Canva is a tool for the larger crowd of designers. (I mean, I am not gonna start digging into what type of designer, that's a diff story) and designers LOVE goofin' around with fonts, right?
- walteweiss 3y agoA real designer can use just one font his entire career and produce amazing results. See Massimo Vignelli.
- eesmith 3y agoFor the uninformed like me, https://en.wikipedia.org/wiki/Massimo_Vignelli https://en.wikipedia.org/wiki/Massimo_Vignelli says "Vignelli's designs were famous for following a minimal aesthetic and a narrow range of typefaces that Vignelli considered to be perfect in their genre, including Akzidenz-Grotesk, Bodoni, Helvetica, Garamond No. 3 and Century Expanded. ... "Out of thousands of typefaces, all we need are a few basic ones, and trash the rest.""
- daveslash 3y agoI'm not a font expert, but I do appreciate good typeface. I view typefaces like shoes - different types for different uses. I have my running shoes, my hiking boots, my beach shoes, my dress shoes, etc... I have my mono-spaced typefaces, my variable-width typefaces, my serif, and my sans serif.
- rob74 3y ago> Vignelli designed the iconic signage for the New York City Subway system during this period, and the 1970s–80s map of the system. If you're Vignelli, you can tell the MTA which font to pick. If you're not him (or someone of equally high standing), you will most likely have to work with a style guide someone else thought out, and use whatever font(s) the style guide says you should use... Plus, that was back in the seventies. Nowadays, every self-respecting company wants to have their own font (even if it's indistinguishable from Hel(l)vetica/Arial/whatever for >99% of people) - https://www.hvdfonts.com/custom-cases https://www.hvdfonts.com/custom-cases
- ggm 3y agoFont downloading and things which have semi executable properties are a problem, yes. Otherwise we'd share postscript bezier curve fonts
- planede 3y agoTuring-completeness has nothing to do with safety. XML parsing isn't Turing complete, AFAIK, yet external entity resolution is a problem. Postscript is Turing complete, but I think it can be properly sandboxed, it's a VM with no IO other than "pages" that it can draw on.
- gwern 3y agoLangsec https://langsec.org/ https://langsec.org/ would like to have a word with you about your view that only Turing-completeness is a problem and you can solve all security issues with overpowered config formats by just chucking them in a sandbox.
- LegionMammal978 3y agoThat's not what GP is saying? The point, as I understand it, is that pretty much all formats that can't be processed in a single trivial pass have to at least be sandboxed w.r.t. their time and memory usage. So just because a format has more surface-level power doesn't necessarily have to do with how prone a processor is to security issues. Indeed, my takeaway from your LangSec link is that formats shouldn't have complex grammars that leave holes open in parsers, not that formats can't represent powerful semantics. If you reach an exploitable hole in the parser, then you've likely already lost, short of the parser itself being sandboxed. Meanwhile, a TM bounded in time and space is just a finite state machine, not unlike all the other state machines in a typical processor.
- simpaticoder 3y agoPerhaps it would be useful to describe a program type that only does one pass through its source. No loops or function calls. It may be useful to describe a single block of reusable sections, which cannot refer to itself in whole or part, to reduce program redundancy. Or rely on compression algorithms to remove the need for even that. The one pass part would be something like a shader language.
- gpjanik 3y agoIt's so funny this article features a timeline graphic that's a PNG with a lot of text on it. On Firefox + M1 Macbook, the first image is not up to scale for high resolution screens and each pixel is blurry, rendering the font hardly readable. Then the article continues with some SVG code... oops?
- acornall 3y agoGood catch, we've updated the graphic to use an SVG :) ~ Cheers
- evrimoztamur 3y agoWith SVG support at a near-full coverage (and 99.99% for Canva's user base, https://caniuse.com/svg https://caniuse.com/svg) you do wonder why we see less SVG for graphics like this. It's literally easier to export, and no harder to import than PNGs.
- lifthrasiir 3y agoKinda because it's harder to make a good SVG editor, and also a clean SVG is substantially harder to export and thus SVG is only seen as an authoring format.
- xcdzvyn 3y agoThis was downvoted but I think it's true. I find it way easier to throw something together in a raster editor than e.g. Inkscape. I want to draw. With pixels. Not huge bezier curves.
- al_borland 3y agoI took the time many years ago to learn how to effectively draw with bezier curves. It was not time well spent. A good tool in my tool belt for the moment, but it was very much a use it or lose it skill. I tried to do something recently and it was like starting from square one, so I just used raster. Unless someone is doing this stuff professionally everyday, or they are really into it as a hobby, it’s not worth it. I assume this is simply a software problem that could be solved with a better UI, but who knows if that will ever be solved.
- dudefeliciano 3y agoAs the article mentions fonts as an attack surface, here the "recently" released video of operation triangulation: https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers https://media.ccc.de/v/37c3-11859-operation_triangulation_wh... a truetype vulnerability that's been around for decades was part of the exploit
- dusted 3y agoOne of the reasons I use xterm is it's beautiful default bitmap fonts, every character distinct and easy to understand, no matter if it's 1 i l | or I, no matter if it's 0 O o or Ø. The extra flexibility of is not worth the compromise of clarity to me. I use the different sizes too: "unreadable" when I need to copy-paste huge amounts of text "default" for most stuff and "huge" when I need a bit more focus. This is also the reason I prefer 1920x1200 px display rather than higher resolutions at the same size. Higher DPIs makes the characters too small for my old eyes, and switching to a vector font only to try and reproduce the shapes I already know seem idiotic.
- bitwize 3y agoThere's a program called bdfscale that lets you blow up X fonts: https://github.com/philj56/bdfscale/ https://github.com/philj56/bdfscale/
- tored 3y agoRetvrn to New Roman Times.
- mikhailfranco 3y agoYeah, but the resolution is VIIIxXVI
- HPsquared 3y agoMaybe we need some kind of "Helvetica Confederation" so sort out these issues. A neutral body that can set standards and act as a safe repository for fonts.
- mikhailfranco 3y agoNeutral Swiss - CH, sic Perhaps CH is short for Cheese with Holes.
- mnw21cam 3y agoThe font history is missing Intellifont (1987) which nobody seems to use any more.
- empyrrhicist 3y agoBeware the Helvetica Scenario https://www.youtube.com/watch?v=-Y-yKmzP-4U https://www.youtube.com/watch?v=-Y-yKmzP-4U
- herodotus 3y agoMany years ago (2011?) when I was working on PDF at Apple, and when Jailbreaking iPhones was a thing, someone posted a PDF on a Website. Just by reading the PDF on your device, it was Jailbroken. Apparently the attack was done this way: someone modified an open source font library by removing bounds checking from one of its functions. They then waited 12 months to see if anyone had noticed or fixed the change. They then created a PDF with the font in question, including the embedded jailbreak code. The PDF was then released.
- GrumpySloth 3y agoWas this attack genuinely dangerous? Or was it just a social experiment?
- dijit 3y agoThat attack has the possibility of being incredibly dangerous. The fact that they released the updated font to the public means everyone using that font became vulnerable if they had a similar lack of bounds checking inside the pdf reader (which is incredibly likely).
- GrumpySloth 3y agoSure. I’m just wondering about the attacker’s intentions. Whether they were malicious or merely misguided.
- bagels 3y agoSomeone else could make a different pdf with a different payload, so even if that specific person just wanted to jailbreak their own phone, others could do bad things with it.
- deleted 3y ago[deleted]
- sergiomattei 3y agoIs there a CVE out for this somewhere? This is interesting
- kragen 3y agoin addition to the omission of intellifont which mnw21cam's comment points out, this is missing most of the historical development of computerized fonts it's also missing hershey fonts, which are public-domain vector stroke fonts from 01967, and knuth's computer modern fonts, which are bézier outline fonts from 01979 with the final version published in i think 01983. one origin of the concept of outline fonts seems to be from p. j. m. coueignoux's 01973 master's thesis at mit, which he elaborated on in his doctoral dissertation in 01975 (including many examples of fonts he'd represented with bézier splines). even earlier, urw founder karow's outline font design system 'ikarus' was in use starting in 01972, and a very substantial fraction of the fonts people use every day were originally outlined in it. from 01974 the fred system on the alto at xerox parc was also being actively used to design outline fonts, though knuth doesn't seem to have known about the parc work or karow's work. a couple of people who worked on the parc project went on to found adobe coueignoux's dissertation cited out mergler and vargo's 01968 program for making parametric outline fonts, called 'itsylf', but it was not able to produce a complete font (just 24 letters), and its objective was just plotting out the characters on a plotter for later use with more traditional typefounding approaches, not computerized typesetting. even coueignoux doesn't seem to have attempted computerized typesetting; the letters in the specimen sheets in his dissertation are not even aligned on a common baseline. hershey did write a full typesetting system, although unlike his fonts it has fallen entirely out of use, and of course the typesetting system knuth wrote at the time remains in wide use to this day, often using the outline fonts he designed at the time so 'adobe introduces the concept of outline fonts' in 01984 is a bald-faced lie, and the authors should be ashamed of themselves for publishing such ignorant tripe, which is contradicted by the very page they link to on the history of computerized typography
- debo_ 3y agoI upvoted this just because of the title.
- tkone 3y agoArg this article is wrong. TrueType was FREELY licensed. You could use TrueType fonts in Windows 3.1. (I know, I was there.) What Apple didn't license was their Advanced Type Tech (Quickdraw GX?) which allowed for further refinements to glyph positioning.
- CharlesW 3y agoAs a postscript (see what I did there?), Apple did eventually donate a bunch of QuickDraw GX tech/innovations to OpenType.
- mrgoldenbrown 3y agoThank you for this clarification, I was scratching my head at this, wondering if I had misremembered my entire childhood desktop publishing experience. IIRC the relative openness of TrueType encouraged/forced Adobe to open up their previously proprietary Type 1 fonts.
- transfire 3y agoGood Lord! If we can’t even get fonts right… we got problems.
- thayne 3y agoFonts are actually really complicated. To a degree that is hard to understand unless you have had to deal with the intricacies of font files, or rendering text yourself, not using a library that abstracts away all the gritty details. It doesn't help that TTF and OTF are decades old formats that predate Unicode code points having more than 16 bits, or needing color for emoji glyphs.
- thayne 3y agoOne big takeaway from this: don't use the system function, especially if you are processing user data that could include a shell injection.