Fonts are still a Helvetica of a Problem

https://www.canva.dev/blog/engineering/fonts-are-still-a-helvetica-of-a-problem/

by ghuntley • 2 years ago

206 126 2 years ago

canva.dev

LightFog• 2 years ago

Ah XML external Entity resolution, the gift that keeps on giving.

ByQuyzzy• 2 years ago

I just turn off downloadable fonts, too risky these days.

fddrdplktrew• 2 years ago

it's also pretty useless... I like my local fonts.

I see it more as a tracking tool from spying companies like Google.

troupo2• 2 years ago

System fonts don't have to be ugly: https://iainbean.com/posts/2021/system-fonts-dont-have-to-be...

atoav4• 2 years ago

No, but for designers designing with an unknown/potentially changing font is more work and produces less good looking results. So unless there is a set of reliable cross-platform system fonts there is zero incentive for designers to use system fonts for commercial projects.

If you have ever worked in design the absolute horror is if you designed something well and then the boss of the org tou did it for opens it on their IE6 and it looks like shit. This is a similar problem.

cantSpellSober• 2 years ago

This article doesn't describe any vulnerabilities in the browser, is that correct? Mostly processing XML, Python and C. The conclusion is

Implement sandboxing for anything that processes fonts

I don't believe the author is referring "your web browser"

kragen12• 2 years ago

commonly the web browser passes the font data it downloads to the operating system for rendering, and there have definitely been exploitable holes in downloadable font handling in the past, in large part because the font rendering engines were not written with malicious data in mind (because you were buying your fonts from bitstream or apple or mergenthaler or whatever)

ibotty• 2 years ago

Looks a little like a redesign of fontforge to not use all these external commands but call libraries would solve a class of problems. Who knows how many there are still lurking. I am lucky I only use(d) fontforge on my local system with fonts I trust.

charcircuit• 2 years ago

These vulnerabilities don't seem to be related to Helvitica. I was expecting a critique related to fonts themselves and not bugs with general font rendering.

ngrilly• 2 years ago

The title is a play on words: the author used “Helvetica” for “hell” :)

nilsherzig• 2 years ago

A rial problem

RyeCombinator• 2 years ago

Did they mean Arial

notachatbot123• 2 years ago

Arial Problem?

MonkeyClub• 2 years ago

I think the play is on "Helvetica" sounding a bit like "helluva".

v3ss0n• 2 years ago

Arial = A Real

AlecSchueler• 2 years ago

Helluva of a problem.

nathancahill• 2 years ago

I still don't get what you see in him.

orliesaurus• 2 years ago

The only reason that they can't keep it as simple as font-family: system-ui

is probably because Canva is a tool for the larger crowd of designers. (I mean, I am not gonna start digging into what type of designer, that's a diff story)

and designers LOVE goofin' around with fonts, right?

walteweiss• 2 years ago

A real designer can use just one font his entire career and produce amazing results. See Massimo Vignelli.

eesmith• 2 years ago

For the uninformed like me, https://en.wikipedia.org/wiki/Massimo_Vignelli says "Vignelli's designs were famous for following a minimal aesthetic and a narrow range of typefaces that Vignelli considered to be perfect in their genre, including Akzidenz-Grotesk, Bodoni, Helvetica, Garamond No. 3 and Century Expanded. ... "Out of thousands of typefaces, all we need are a few basic ones, and trash the rest.""

rob74• 2 years ago

Vignelli designed the iconic signage for the New York City Subway system during this period, and the 1970s–80s map of the system.

If you're Vignelli, you can tell the MTA which font to pick. If you're not him (or someone of equally high standing), you will most likely have to work with a style guide someone else thought out, and use whatever font(s) the style guide says you should use...

Plus, that was back in the seventies. Nowadays, every self-respecting company wants to have their own font (even if it's indistinguishable from Hel(l)vetica/Arial/whatever for >99% of people) - https://www.hvdfonts.com/custom-cases

al_borland3• 2 years ago

If not just one, a small handful of maybe 3-5 fonts. The idea that someone needs to scroll through a list of hundreds of fonts every time they have a new project, and pick multiple fonts for every project, seems to mostly be a form of procrastination… or leaning on a font to cover up a weak design.

atoav4• 2 years ago

Why can't programmers keep it as simple as dependencies: use system libraries?

The reason is control. If you want your stuff to align neatly and look good in the details you need to define a font. And there is no single system font you can truly rely on, so you just bring your own.

I'd be very happy if OS creators could agree on one set of universally supported system fonts, preferably open source, that work on all systems — until then your two options are:

- not caring about good design, giving up control and using whatever (sometimes this is a feasible option)

- caring about design and using your own font

MaxMatti• 2 years ago

Even if they did, some designer would just decide that they need a specific font that is not in the set and then it's just the same thing again.

4hg4ufxhy• 2 years ago

I used to think fonts didn't matter. This changed when I had a takehome with a simple UI, some rows of text with alignment and some borders. The entire thing looked off until I setup the font that was in the spec. The difference with the "correct" font was so big it was hard to believe.

I still think most of the time sticking to system is good enough. But I can see the custom font point of view if you strive for something more.

pavlov• 2 years ago

I’m a big fan of typography, but I also strongly feel that applications (both native and web) should use system fonts and obey any user preferences for weight and size.

It’s a question of both accessibility and UX productivity. Switching to a different application shouldn’t be a jarring context switch. The user should be in control of their desktop environment, not the branding department at company X who insists that everything they release should be using font Y this year and then font Z the next. These changes bring no user benefits.

It’s different for software and content that actually tells a story. Games and web sites have a lot more freedom for custom design, and typeface choices are an elemental part of that.

I just wish more designers understood the distinction between telling a story and enabling people to be productive.

ggm• 2 years ago

Font downloading and things which have semi executable properties are a problem, yes. Otherwise we'd share postscript bezier curve fonts

planede• 2 years ago

Turing-completeness has nothing to do with safety. XML parsing isn't Turing complete, AFAIK, yet external entity resolution is a problem. Postscript is Turing complete, but I think it can be properly sandboxed, it's a VM with no IO other than "pages" that it can draw on.

gwern3• 2 years ago

Langsec https://langsec.org/ would like to have a word with you about your view that only Turing-completeness is a problem and you can solve all security issues with overpowered config formats by just chucking them in a sandbox.

anthk• 2 years ago

PostScript it's turing complete. You can play Zork with a Z-machine emulator written in PS.

gpjanik3• 2 years ago

It's so funny this article features a timeline graphic that's a PNG with a lot of text on it. On Firefox + M1 Macbook, the first image is not up to scale for high resolution screens and each pixel is blurry, rendering the font hardly readable. Then the article continues with some SVG code... oops?

evrimoztamur2• 2 years ago

With SVG support at a near-full coverage (and 99.99% for Canva's user base, https://caniuse.com/svg) you do wonder why we see less SVG for graphics like this. It's literally easier to export, and no harder to import than PNGs.

lifthrasiir• 2 years ago

Kinda because it's harder to make a good SVG editor, and also a clean SVG is substantially harder to export and thus SVG is only seen as an authoring format.

Etheryte• 2 years ago

From personal experience and having been burned by odd SVG bugs too many times over the years, a dumb image is simple, it works and you know that it works. I only reach for SVG when I need to do something that other formats cannot.

chiefalchemist2• 2 years ago

On Canva free plan, afaik, there is no export to SVG. If there is, I can't find it. Maybe the paid tiers have it? IDK.

The point is, they likely used their own tool and that tool's support for SVG is lacking.

chrisweekly• 2 years ago

See also https://slides.com/sdrasner/svg-can-do-that which despite its age (over 6y!) is still impressive.

oefrha• 2 years ago

You need to export all the text as curves to get predictable font and rendering (the fonts used in the image obviously aren’t your regular web-safe fonts), and that’s not gonna be small with a lot of text.

chiefalchemist2• 2 years ago

Or find a markup-based way to display that info. Text-based images can also often have accessiblity issues. It's best, when possible, to sidestep such images and use markup. Even a SVG afaik, might run into accessibility issue if not marked up correctly.

panzi• 2 years ago

I made myself a bookmarklet for that situation that sets image-rendering: pixelated. Beats blurry low res images, IMO:

    javascript:void(document.body.style.imageRendering='pixelated')

acornall• 2 years ago

Good catch, we've updated the graphic to use an SVG :)

~ Cheers

dudefeliciano• 2 years ago

As the article mentions fonts as an attack surface, here the "recently" released video of operation triangulation: https://media.ccc.de/v/37c3-11859-operation_triangulation_wh...

a truetype vulnerability that's been around for decades was part of the exploit

dusted• 2 years ago

One of the reasons I use xterm is it's beautiful default bitmap fonts, every character distinct and easy to understand, no matter if it's 1 i l | or I, no matter if it's 0 O o or Ø.

The extra flexibility of is not worth the compromise of clarity to me.

I use the different sizes too:

"unreadable" when I need to copy-paste huge amounts of text

"default" for most stuff

and "huge" when I need a bit more focus.

This is also the reason I prefer 1920x1200 px display rather than higher resolutions at the same size. Higher DPIs makes the characters too small for my old eyes, and switching to a vector font only to try and reproduce the shapes I already know seem idiotic.

bitwize• 2 years ago

There's a program called bdfscale that lets you blow up X fonts:

https://github.com/philj56/bdfscale/

tored• 2 years ago

Retvrn to New Roman Times.

mikhailfranco2• 2 years ago

Yeah, but the resolution is VIIIxXVI

HPsquared• 2 years ago

Maybe we need some kind of "Helvetica Confederation" so sort out these issues. A neutral body that can set standards and act as a safe repository for fonts.

mikhailfranco2• 2 years ago

Neutral Swiss - CH, sic

Perhaps CH is short for Cheese with Holes.

mnw21cam• 2 years ago

The font history is missing Intellifont (1987) which nobody seems to use any more.

empyrrhicist• 2 years ago

Beware the Helvetica Scenario

https://www.youtube.com/watch?v=-Y-yKmzP-4U

herodotus• 2 years ago

Many years ago (2011?) when I was working on PDF at Apple, and when Jailbreaking iPhones was a thing, someone posted a PDF on a Website. Just by reading the PDF on your device, it was Jailbroken.

Apparently the attack was done this way: someone modified an open source font library by removing bounds checking from one of its functions. They then waited 12 months to see if anyone had noticed or fixed the change. They then created a PDF with the font in question, including the embedded jailbreak code. The PDF was then released.

GrumpySloth2• 2 years ago

Was this attack genuinely dangerous? Or was it just a social experiment?

dijit• 2 years ago

That attack has the possibility of being incredibly dangerous.

The fact that they released the updated font to the public means everyone using that font became vulnerable if they had a similar lack of bounds checking inside the pdf reader (which is incredibly likely).

sergiomattei2• 2 years ago

Is there a CVE out for this somewhere? This is interesting

deadlydose• 2 years ago

Sounds like the FreeType vulnerability that comex exploited for JailbreakMe. I think it was called 'Star.' Try CVE-2010-1797.

kragen12• 2 years ago

in addition to the omission of intellifont which mnw21cam's comment points out, this is missing most of the historical development of computerized fonts

it's also missing hershey fonts, which are public-domain vector stroke fonts from 01967, and knuth's computer modern fonts, which are bézier outline fonts from 01979 with the final version published in i think 01983. one origin of the concept of outline fonts seems to be from p. j. m. coueignoux's 01973 master's thesis at mit, which he elaborated on in his doctoral dissertation in 01975 (including many examples of fonts he'd represented with bézier splines). even earlier, urw founder karow's outline font design system 'ikarus' was in use starting in 01972, and a very substantial fraction of the fonts people use every day were originally outlined in it. from 01974 the fred system on the alto at xerox parc was also being actively used to design outline fonts, though knuth doesn't seem to have known about the parc work or karow's work. a couple of people who worked on the parc project went on to found adobe

coueignoux's dissertation cited out mergler and vargo's 01968 program for making parametric outline fonts, called 'itsylf', but it was not able to produce a complete font (just 24 letters), and its objective was just plotting out the characters on a plotter for later use with more traditional typefounding approaches, not computerized typesetting. even coueignoux doesn't seem to have attempted computerized typesetting; the letters in the specimen sheets in his dissertation are not even aligned on a common baseline. hershey did write a full typesetting system, although unlike his fonts it has fallen entirely out of use, and of course the typesetting system knuth wrote at the time remains in wide use to this day, often using the outline fonts he designed at the time

so 'adobe introduces the concept of outline fonts' in 01984 is a bald-faced lie, and the authors should be ashamed of themselves for publishing such ignorant tripe, which is contradicted by the very page they link to on the history of computerized typography

debo_• 2 years ago

I upvoted this just because of the title.

tkone• 2 years ago

Arg this article is wrong.

TrueType was FREELY licensed. You could use TrueType fonts in Windows 3.1. (I know, I was there.)

What Apple didn't license was their Advanced Type Tech (Quickdraw GX?) which allowed for further refinements to glyph positioning.

CharlesW• 2 years ago

As a postscript (see what I did there?), Apple did eventually donate a bunch of QuickDraw GX tech/innovations to OpenType.

mrgoldenbrown• 2 years ago

Thank you for this clarification, I was scratching my head at this, wondering if I had misremembered my entire childhood desktop publishing experience. IIRC the relative openness of TrueType encouraged/forced Adobe to open up their previously proprietary Type 1 fonts.

transfire• 2 years ago

Good Lord! If we can’t even get fonts right… we got problems.

thayne2• 2 years ago

Fonts are actually really complicated. To a degree that is hard to understand unless you have had to deal with the intricacies of font files, or rendering text yourself, not using a library that abstracts away all the gritty details.

It doesn't help that TTF and OTF are decades old formats that predate Unicode code points having more than 16 bits, or needing color for emoji glyphs.

thayne2• 2 years ago

One big takeaway from this: don't use the system function, especially if you are processing user data that could include a shell injection.

Fonts are still a Helvetica of a Problem

Related Stories