Hacker News Reader

Comment by graypegg | Hacker News Reader

How does this work? I thought ligatures were just different glyphs stored in the font that would replace some number of other individual characters. Does that mean there’s a ligature glyph for every combination of 7 characters?!

View on HN

There's a whole, let's say, scripting engine that lets the font decide which glyph is going to be used that goes way further than just simple ligature substitution. People have even implemented "games" as fonts this way: https://www.coderelay.io/fontemon.html

Great link, I'm impressed by the sort of animations that they were able to fit into a font.

Well, that's surprisingly addictive.

If anyone is interested I wrote a blog post about how I made fontemon and which type features I used: https://github.com/mmulet/code-relay/blob/main/markdown/HowI...

> Implementation for a seemingly simple logic is surprisingly powerful

hmm.

Have there been any high profile exploits of these font scripting engines?

I guess that must be where stuff like

https://arstechnica.com/information-technology/2015/05/bewar...

comes from.

It seems quite risky, I’m used to not downloading and executing shady programs, but downloading and executing… characters… is hard to avoid.

Windows had some security issues in the past. It has a font rendering engine in the kernel.

OpenType is basically turing-complete via glyph shaping. There's an explanation here: https://litherum.blogspot.com/2019/03/addition-font.html

Reply on news.ycombinator.com