zlacker

>>fugled+(OP)
While cool, technically… From a security perspective today I learned that TrueType fonts have arbitrary code execution as a ‘feature’ which seems mostly horrific.

>>electr+4e
Not really, no more so than a random webpage running js/WASM in a sandbox.

The only output from the WASM is to draw to screen. There is no chance of a RCE, or data exfiltration.

>>samwil+xe
The risk is that you could have the text content say one thing while the visual display says another. There are social engineering and phishing risks.

>>turnso+lh
If you control the font, you control the content as well, I don't see the attack vector.