Live data from Hacker News

Show HN: QR code renderer in a TrueType font

qr.jim.sh

11–19 of 19 posts

Re: Show HN: QR code renderer in a TrueType font

#14
post #3

This is absolute black magic. I never realized OpenType rules were powerful enough to render something as complex as a QR matrix inline.

Font shaping rules are actually turing complete. An incredible amount of engineering effort has gone into this not being a total disaster everywhere at all times.

Coming late to this thread, but this is reminding me that many remote execution vulnerabilities have come from font rendering code paths.

If there is a turing complete VM inside the font renderer that makes perfect sense.

I'm not sure if it's the case but at one point on Windows, font rendering happened in the kernel.

Re: Show HN: QR code renderer in a TrueType font

#15

Earlier quoted context omitted.

Font shaping rules are actually turing complete. An incredible amount of engineering effort has gone into this not being a total disaster everywhere at all times.

Coming late to this thread, but this is reminding me that many remote execution vulnerabilities have come from font rendering code paths. If there is a turing complete VM inside the font renderer that makes perfect sense. I'm not sure if it's the case but at one point on Windows, font rendering happened in the kernel.

Microsoft began the push to move TTF rendering out of the kernel in Vista. I'm sure there are still bits here-and-there that are still kernel.

as an aside- I find the fact even microsoft's own modal dialogs don't all support DPI scaling- aka they are blurry.

Re: Show HN: QR code renderer in a TrueType font

#16
post #8

Side question: Why is nobody making QR codes on web pages clickable (regardless if it’s an image or text-based)? Not every QR code represents a URL, of course, but many do. Maybe there should be a qrcode URL scheme that lets browsers behave the same way as a camera scanning a QR code.

If they know it's a url, all they need to do is wrap it in an tag. Laziness probably wins out though.

Re: Show HN: QR code renderer in a TrueType font

#17

Earlier quoted context omitted.

Font shaping rules are actually turing complete. An incredible amount of engineering effort has gone into this not being a total disaster everywhere at all times.

Coming late to this thread, but this is reminding me that many remote execution vulnerabilities have come from font rendering code paths. If there is a turing complete VM inside the font renderer that makes perfect sense. I'm not sure if it's the case but at one point on Windows, font rendering happened in the kernel.

More than one Turing Complete VM inside the font renderer stack, at that. One of the biggest recurring CVE generators in both Windows and Macintosh was 1984's legacy of the Adobe Type 1 font format [1]. Everyone had to license it for backward compatibility with PostScript documents. It shared enough Turing completeness with PostScript despite being a subset.

Both Windows and Macintosh spent years trying to isolate type rendering from kernel operations specifically because of Adobe Type 1's legacy alone, including the fact that it was an ugly vendored 3rd party spaghetti. IIRC, both Apple and Microsoft ended up paying Adobe tons of money to rewrite their Type 1 Font Manager code from scratch rather than keep paying Adobe to write that code. (TTF and OpenType were also both somewhat direct responses to Type 1's legacy and mistakes.)

[1] https://en.wikipedia.org/wiki/PostScript_fonts

Re: Show HN: QR code renderer in a TrueType font

#18
This would be even better if it used reserved characters instead of brackets, so you could also use it as a normal font. You could even use different characters to start different QR code sizes. E.g. type 'ctrl+shift+u 11 enter' to start the QR code and 'ctrl+shift+u 14 enter' to end it, but for larger QR codes enter 12 or 13, instead of 11. (Or maybe you'd need to change the end character, to select the QR code size.)

Re: Show HN: QR code renderer in a TrueType font

#19
post #8

Side question: Why is nobody making QR codes on web pages clickable (regardless if it’s an image or text-based)? Not every QR code represents a URL, of course, but many do. Maybe there should be a qrcode URL scheme that lets browsers behave the same way as a camera scanning a QR code.

I am surprised no browser/OS that I've seen allows scanning them from the screen using an interface like the one used to take a screenshot.
Post reply on HN