Live data from Hacker News

Memory safety for web fonts

developer.chrome.com

161–170 of 230 posts

Re: Memory safety for web fonts

#161

This is the true power of Rust that many are missing (like Microsoft with its TypeScript rewrite in Go): a gradual migration towards safety and the capability of being embedded in existing project. You don't have to do the Big Rewrite™, you can simply migrate components one by one instead.

"If you build it they will come."

Re: Memory safety for web fonts

#162

Earlier quoted context omitted.

I'm pretty sure windows dropped subpixel anti-aliasing a few years ago. When it did exist there was a wizard to determine and set the subpixel layout. Personally I don't bother anymore anyway since I have a HiDPI display (about 200dpi, 4K@24"). I think that's a better solution, simply have enough pixels to look smooth. It's what phones do too of course.

macOS dropped it a few years ago, primarily because there are no Macs with non-HiDPI displays any more (reducing benefit of subpixel AA) and to improve uniformity with iOS apps running on macOS via Catalyst (iOS has never supported subpixel AA, since it doesn’t play nice with frequently adjusted orientations). Windows I believe still uses RGB subpixel AA, because OLED monitor users still need to tweak ClearType setti…

ohh maybe it was macOS I am confused with here. Sorry. I use every OS under the sun together.

Or it could have been the DirectWrite thing. I just don't remember where I read it.

I always thought cleartype was ugly by the way.

Re: Memory safety for web fonts

#163

Earlier quoted context omitted.

> like Microsoft with its TypeScript rewrite in Go Go is also memory safe.

Since you've mentioned that you never see the annoying strike force threads that others complain about, you're in one.

I said that I do not see them happening at the rate that people say they happen. I never said they don't happen.

Re: Memory safety for web fonts

#164

Earlier quoted context omitted.

It is true that they are different, but also, given the significant overlap between the two, people will reasonably talk about them together.

From a safety perspective they aren't very close, there is a reason that all these CVE bugs are C code.

I haven't seen conclusive evidence that this is the case, do you happen to have an analysis of this somewhere?

Of course, C++ offers you tools that C doesn't, but some of those tools have their own sharp edges as well. Plus, many C++ codebases are "C with classes" style or similar hybrids, those are still ultimately C++ programs, not C ones.

Re: Memory safety for web fonts

#165
So, there's Skia. Skia is a high-level library that converts texts to glyph indices, does high-level text layout, and caches glyphs (and it also makes GPU calls). But the actual parsing of the font file and converting glyphs to bitmaps happens below in FreeType.

Skia is made in C++. It's made by Google.

There's FreeType. It actually measures and renders glyphs, simultaneously supporting various antialiasing modes, hinting, kerning, interpreting TrueType bytecode and other things.

FreeType is made in C. It's not made by Google.

Question: why was it FreeType that got a Rust rewrite first?

Re: Memory safety for web fonts

#166
I wonder what this means, if anything, for the future of WUFFS. TTF support is on their roadmap. If they can get acceptable performance and safety from Rust, will they still drive on with WUFFS?

Re: Memory safety for web fonts

#167
post #154
post #83

Earlier quoted context omitted.

Note that this can lead to horrid economics for the user. An example being Google unilaterally flipping on VP8/VP9 decode, which at that time purely decoded on the CPU or experimentally on the GPU. It saved Google a few CPU cycles and some bandwidth but it nuked every user's CPU and battery. And the amount of energy YouTube consumed wholesale (so servers + clients) skyrocketed. Tragedy of the Commons.

How is that related to the tradeoff calculation at hand? Implementing VP9, enabling it, transcoding videos and testing it COST SWE hours, it didn't save them. It also cost resources. In what way did you envision the VP9 issue being related to SWE/resource hour computations here?

I think what they're suggesting is that yes, Google spent some SWE hours to implement it, but they have (or will, over time) saved more than that in equivalent compute (by pushing it onto users). So, from Google's point of view, they saved SWE hours on the company balance sheet, so it's a win.

But from the larger point of view of "everyone," this actually made the total cost worse. The cost/benefit analysis from Google's point-of-view was worth it, even though it made things overall worse in the larger perspective. Hence "tragedy of the commons," where the short-sighted behavior of some actors makes things worse overall.

Re: Memory safety for web fonts

#168
post #117
post #77

Earlier quoted context omitted.

C and modern C++ are so different that lumping them together in a blanket assertion doesn't really carry much meaning.

If only didn't exist so many folks that insist in using C types, and C headers, in modern C++ code.

Indeed.

Re: Memory safety for web fonts

#169
post #83

Earlier quoted context omitted.

Note that this can lead to horrid economics for the user. An example being Google unilaterally flipping on VP8/VP9 decode, which at that time purely decoded on the CPU or experimentally on the GPU. It saved Google a few CPU cycles and some bandwidth but it nuked every user's CPU and battery. And the amount of energy YouTube consumed wholesale (so servers + clients) skyrocketed. Tragedy of the Commons.

Do you have an article about this? What is the state now?

They did this during the period where Chrome was eating into Firefox usage, after telling Mozilla that they would drop H.264 in favor of open codecs but never keeping that promise. Here’s some period discussion:

https://www.osnews.com/story/24263/google-h264-stifles-innov...

What this meant in practice was that Firefox would play YouTube videos at close to 100% CPU and Chrome would use H.264 and play at like 5% CPU, and since it was VP8 the quality was noticeably worse than H.264 as well. Regular people talked about that a lot, and it helped establish Chrome’s reputation for being faster.

Re: Memory safety for web fonts

#170

So, there's Skia. Skia is a high-level library that converts texts to glyph indices, does high-level text layout, and caches glyphs (and it also makes GPU calls). But the actual parsing of the font file and converting glyphs to bitmaps happens below in FreeType. Skia is made in C++. It's made by Google. There's FreeType. It actually measures and renders glyphs, simultaneously supporting various antialiasing modes, hi…

Perhaps since FreeType is the one handling the more untrusted inputs (the font files themselves, downloaded from who-knows-where), it is more at-risk and thus stood to benefit from the conversion more?

But I don't really know anything about how all the parts fit together; just speculating.

Post reply on HN