ASashitlerferad·Aug 29, 2016Submission
3 points · Open discussionkhaledhosny
ots
C++2015–2016
khaledhosny / ots
ots
Sanitizer for OpenType
4Distinct people
5Mentions
0Explicit recommenders
314GitHub stars
What to know before exploring
What it is
Sanitizer for OpenType
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month5 dated mentions
Observed mentions: 2015-06-24 07:27:04 UTC to 2016-08-29 05:17:53 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Jun 2015 | 2015-06-01 00:00:00 UTC | 2015-07-01 00:00:00 UTC | 1 | 0 | 1 |
| Jul 2015 | 2015-07-01 00:00:00 UTC | 2015-08-01 00:00:00 UTC | 1 | 0 | 1 |
| Aug 2015 | 2015-08-01 00:00:00 UTC | 2015-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2015 | 2015-09-01 00:00:00 UTC | 2015-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2015 | 2015-10-01 00:00:00 UTC | 2015-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2015 | 2015-11-01 00:00:00 UTC | 2015-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2015 | 2015-12-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2016 | 2016-01-01 00:00:00 UTC | 2016-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2016 | 2016-02-01 00:00:00 UTC | 2016-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2016 | 2016-03-01 00:00:00 UTC | 2016-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2016 | 2016-04-01 00:00:00 UTC | 2016-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2016 | 2016-05-01 00:00:00 UTC | 2016-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2016 | 2016-06-01 00:00:00 UTC | 2016-07-01 00:00:00 UTC | 2 | 0 | 2 |
| Jul 2016 | 2016-07-01 00:00:00 UTC | 2016-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2016 | 2016-08-01 00:00:00 UTC | 2016-09-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
5 sourcesIt's marked fixed because Microsoft released a patch for it. However at the very least Chrome and Firefox have been doing font sanitization for quite some time now (several years+ I believe). I'm not sure for other browsers. Opera might since it's just a Chromium fork and OTS[1] is a part of the WTF (webkit tools framework).
[1] https://github.com/khaledhosny/ots
In A year of Windows kernel font fuzzing #1: the resultsBoth Firefox and Chrome use font sanitizers[1]. I'm not sure about others, Opera probably does since it's just a Chromium fork and OTS is part of the WTF (webkit tools framework). AFAIK its been used for quite some time now, several years+.
The license for OTS is permissive so I don't see why it couldn't also be used in Edge/IE although I've no idea if they do (or if they rolled their own even).
[1] https://github.com/khaledhosny/ots
In A year of Windows kernel font fuzzing #1: the resultsBoth Chrome and Firefox pass web fonts through OTS [1] before rendering them, so hopefully that mitigates the threat.
[1] https://github.com/khaledhosny/ots
In Vulnerability in Microsoft Font Driver Could Allow Remote Code ExecutionChrome and Firefox require all web fonts to pass the OpenType Sanitiser https://github.com/khaledhosny/ots
In Results of recent PostScript CharString security research