HarfBuzz 8.0 Released - Introduces Shaper For WebAssembly Within Font Files

[phoronix]

Phoronix: HarfBuzz 8.0 Released - Introduces Shaper For WebAssembly Within Font Files

HarfBuzz 8.0 was released on Saturday as the newest feature release for this text shaping library used by many open-source software projects from GUI toolkits to desktop environments and other prominent applications...

https://www.phoronix.com/news/HarfBuzz-8.0

[Nuc!eoN]

Bitmap font support would be nice imo.

[tildearrow]

A virtual machine......
....in the font rendering engine.

What.

[tildearrow]

Also, typo:

HarfBuzz's new documentation around this WwebAssembly shaper explains:

[uid313]

So will there be malware embedded in fonts now?

[markg85]

What i'm curious about is... What the hell do WASM and font rendering (oke, shaping to be precise) have anything todo with each other?
In my, perhaps naive, thought the two are completely unrelated. Anything that renders fonts (including shaping) should run deep within internal browser libraries or be triggered from therein. In chrome that's is probably triggered inside the Skia library.

Now i can "get" it if WASM means that they optimize it with a set of assembly instructions comparable to wasm, but i don't get it if wasm actually means on the web.

[fitzie]

What i'm curious about is... What the hell do WASM and font rendering (oke, shaping to be precise) have anything todo with each other?
In my, perhaps naive, thought the two are completely unrelated. Anything that renders fonts (including shaping) should run deep within internal browser libraries or be triggered from therein. In chrome that's is probably triggered inside the Skia library.

Now i can "get" it if WASM means that they optimize it with a set of assembly instructions comparable to wasm, but i don't get it if wasm actually means on the web.

fonts are able to influence shaping by packing metadata into the font. the knobs are not as flexible as if the font creator can understand the exact situation the font is in when in use. therefore this experiment from harfbuzz.

I hope distros compile this feature out (or I will), until there is some usage of this by windows/macos. I can imagine this being used for cache timing attacks, or worse, exfil/watermarks.

[ssokolow]

A virtual machine......
....in the font rendering engine.

What.

Didn't TrueType font hinting already have something like that? Wasn't that why, for a long time, Fedora's font rendering sucked unless you compiled your own for patent-related reasons?

[domih]

So will there be malware embedded in fonts now?

Yes and there will be a new font called Fontanyl.

[creative]

So will there be malware embedded in fonts now?

It's possible, which is sort of hilarious because lots applications have dependencies for it. I have known about stuff like this since about 2018 but at the time it had more to do with imperceptible stuff in images rendered on the web. Most distributions have security patches already applied concerning this engine/library. There is so much stuff out there though, that if discovered lots of people would have meltdowns over. Getting on the web is almost like taking a risk of endangerment traveling via roads and highways, hazards are always there of various types.