Doesn't Not Compute

My log of experiences with GNU/Linux and computers in general.

Tag Archives: NoScript

Funky Fonts Flocking, Free From … Foundry Fog? Eh, I Give Up

Or: So, You Installed NoScript, and Now You’re Getting Boxes with Numbers In Them

Or: I’m Not Even Using NoScript! These Kids’ Unicode Emojis Just Have Garbage Characters In Them!

Yeah, kinda hard to find a good Alliterative Appeal-ing title for this one. 😛 Do note that this post is GNU/Linux-specific. Maybe you’ll find something that gives you an insight into doing the same on Mac OS X or Windows, maybe you won’t.

Today, I reinstalled Arch Linux.  Judging from the date on a Deus Ex savefile, I had been successfully upgrading the same installation since February, 2013!  Really, I could’ve just rsync’d the existing data straight to my shiny new 1TB/32MB-cache drive and continued using it, but I was bored. >:D

What Are Those Boxes With Letters and Numbers In Them, Anyway?

This gives me the opportunity to hunt down and document what font packages I need if I want to avoid seeing boxes with numbers in them everywhere — ones like this:

U+F105


That’s U+F105, and it’s not in the more commonly-installed fonts of my systems.

That’s a code point from one of Unicode’s Private Use Areas (PUA), and as such, doesn’t have a standard glyph like ‘A’ or ┳ do.  Anybody can just slobber whatever characters they want all over the place, and no font can cover every variation, meaning that whatever character from the range you use isn’t necessarily — or even likely — what some random person viewing the file on their own computer is going to see.

So, How Come These Worked Without NoScript?

Enter @font-face and font libraries like TypeKit, Font Squirrel, and Google Web Fonts. These allow web developers to make webpages even more heavyweight by needing to contact and then load more data from a third-party server and not worry so much about whether the end-user has the perfect font for their perfectly elegant site installed on their system already. Great, huh? Yes, as long as you’re using a CSS3-compatible browser — and more specifically, on such as

  • Firefox 3.6+
  • Chrome/Chromium 4+
  • Safari 3+
  • Opera 10
  • Internet Explorer 9+

So, to support the obsolete browsers that took forever to get their act together (*cough*Internet Explorer*cough*), developers use Javascript and Adobe Flash(!) to make sure the external font gets loaded and used. This works well enough…as long as the browser is capable or allowed to run it.

NoScript to the Antirescue

Problem with these methods is that Firefox’s NoScript addon blocks @font-face embedding by default — for some pretty good reasons, assuming the concerns discussed in that link are still valid 5 years later — and thus prevents the fonts from being used. The result: sites that use fonts covering these Unicode Private Use Area datapoints, such as to have display resolution-independent symbols, become a sea of boxes with letters and numbers in them.

A Probably Bad Idea™ Solution

If you don’t want to shuffle through NoScript’s list, trying to figure out which linked site’s Javascripting is supposed to load a missing @font-face, you can simply determine what font family is being called for by the page’s style sheet.

In Firefox, for example, simply right-click the offending numberbox and choose “Inspect Element”. Then use the Inspector to view the page’s rules, and search for “font-family”. An example is below:

Inspector mode, then on the right side scrolling area under "Rules".
Screenshot taken of https://prism-break.org/en/projects/ixquick/

Now, you cant search your distro’s software repositories for the font. If you’re lucky, you’ll find it already packaged. In this case, I found it in Arch Linux’s User Repositories under the name aur/ttf-font-awesome
. Install it as usual, and enjoy having your browser load actual characters instead of numberboxes!

Whoa, Wait a Minute, What Do You Mean By “Bad Idea”?

Let’s re-read the last part of Why NoScript Blocks Web Fonts, specifically the excerpt quoting from Mike Perry of Torbutton fame, shall we? Go on, I’ll wait — I’d just print it here, but I can’t find a copyright license anywhere.

Think about it for a moment. Now, instead of loading an untrusted font from whatever remote server, you have it locally, on your own machine. It’s still being interpreted by the font libraries, and can still be crafted to trigger some known/unknown bug for malicious purposes.  The differences are only that:

  • Hopefully, the package maintainer reviewed it first and is familiar with the current security status of the font and font library,  Not exactly guaranteed in the Arch User Repository (AUR). There’s a reason you get a flashing message saying, “( Unsupported package: Potentially dangerous ! )”.
  • You can analyze it before installing and using it, assuming you know what you’re doing.

Security always involves tradeoffs, and is a much more complex topic than I am qualified to discuss in any detail.  Do your own research!

What About Those Unicode-Character Emojis?

Ah yes, those. (May not all be SFW). I doubt I’ve seen every one on the Internet, but that link has a wide enough variety for testing purposes. 🙂

What Fonts Do I Need Installed?

I currently have the following font packages installed, and don’t have any missing characters appearing yet. Some are just my desktop usage fonts (such as ttf-dejavu) or terminal font (like ttf-anonymous-pro), but they are included for completeness.

ttf-anonymous-pro
ttf-code2000
ttf-dejavu
ttf-font-awesome
ttf-gentium
ttf-jomolhari
ttf-kannada-font
ttf-liberation
ttf-opensans
ttf-symbola
ttf-urdufonts

I’ll try to update this list as I find more site with missing characters.