Opened 2 years ago

Last modified 8 months ago

#20842 assigned defect

Proposal: Improve Tor Browser font whitelist / bundled fonts

Reported by: arthuredelstein Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-usability, ux-team
Cc: gk, yawning, brade, mcs, linda Actual Points:
Parent ID: #18097 Points:
Reviewer: Sponsor:

Description

Background:

In #13313 we introduced a new font whitelisting mechanism. Tor Browser only allows certain fonts to be used in the browser, in order to prevent bad people from trying to identify you by detecting what fonts are installed on your computer. Font whitelisting is also available in Firefox, off by default. (The whitelisting is controlled by a pref, "font.system.whitelist", which contains a comma-separated list of allowed font names. You can edit this pref by opening a tab and browsing to about:config.)

On Window and Mac, we mostly whitelist certain system fonts that are bundled with the operating system by default. We bundle a few Google Noto fonts as well for languages that don't have a built-in platform font.

On Linux, we bundle a large number of Google Noto fonts, plus Arimo, Cousine, and Tinos. We don't expose any system fonts, because these aren't consistent across Linux flavors.

My strategy for choosing fonts for the whitelist was to try to cover all possible languages with at least one font, and get the work done as efficiently as possible. I whitelisted Mac and Windows fonts that have been available for a long time and should be on essentially all systems. Bundling fonts from the Noto collection was a quick and dirty method for covering any missing fonts for different languages.

But there are probably more appealing fonts for some languages that we could use, especially on Linux. For example, in #20820 we are considering switching Linux from Noto Japanese to mona.ttf because the latter looks better (according to Yawning) and because mona.ttf can be used in the ancient Japanese art of ascii calligraphy. I also heard from someone who knows that the Tamil font on Windows is not too beautiful.

Proposed project:

So it would be a useful project to go through each of the fonts on each platform and see if there are better fonts that could be used instead. Important considerations would include:

  • Aesthetics
  • Character coverage
  • Printability
  • Font licensing
  • Font file size

This would require asking the opinions of native speakers of various languages.

Ideally, we could come up with a new font whitelist and bundling list for Mac, Windows and Linux, where the fonts are beautiful and users are happy.

Child Tickets

Change History (12)

comment:1 Changed 2 years ago by yawning

Cc: yawning added

comment:2 Changed 2 years ago by mcs

Cc: brade mcs added

comment:3 Changed 2 years ago by vegansalad

I'm interested in seeing some better unicode support for dingbats in Linux TBB.

Simple things like the pencil doesn't work on TBB on Linux: ​https://www.fileformat.info/info/unicode/char/270E/browsertest.htm

This is Unicode version 1.1.0 released in June, 1993. https://www.fileformat.info/info/unicode/char/270e/index.htm It probably should be supported in TBB.

In TBB on Windows, the pencil works via Micro$oft's copyrighted MS PGothic (which Linux can't use) but it doesn't look very pretty at all.

Also, black flag dingbats don't seem to work on TBB on either Windows or Linux: ​https://www.fileformat.info/info/unicode/char/2691/browsertest.htm This came out in Unicode 4, which was released 14 years ago.

The Up Down Arrow does work on Linux: ​https://www.fileformat.info/info/unicode/char/2195/browsertest.htm

Also, a regular multiplication sign works ​https://www.fileformat.info/info/unicode/char/00D7/browsertest.htm but a "MULTIPLICATION X" does not. ​https://www.fileformat.info/info/unicode/char/2715/browsertest.htm Multiplication X is also Unicode 1.1 which is 24 years old.

When surfing the web, it isn't unusual to come across some of these and it looks silly when they don't render.

I got these example errors while trying to figure out what was going on with fed.wiki.org and ended up writing a github issue about it, only to close it after I found out that it was a Tor Browser bug: https://github.com/fedwiki/wiki/issues/97

Some people also were talking in this issue about emojis not working: https://trac.torproject.org/projects/tor/ticket/18172

Is https://www.google.com/get/noto/#emoji-zsye a possible solution to this? I'm not seeing a debian package for it.

comment:4 Changed 2 years ago by vegansalad

Ok, I looked into noto emoji a bit more. I found that the "noto color emoji" font is being packaged here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849042

It was said that this should allow for color and black and white emojis once it is finished.

In the mean time, that link also said that https://packages.debian.org/jessie/ttf-ancient-fonts offers black and white emojis. I wonder if it would render the dingbats too. I don't know how to look through it to see if it has all of the Unicode 1 thru Unicode 4 dingbats though. If it does, perhaps we could whitelist it in the next TBB release.

I also looked at https://wiki.debian.org/Fonts/UnicodeCoverage to see if it might describe any packages that cover these old dingbats, but I wasn't able to figure it out.

Can anyone help me figure out what debian packaged font should be whitelisted to get all these old Unicode Characters to work in TBB?

Last edited 2 years ago by vegansalad (previous) (diff)

comment:5 Changed 2 years ago by vegansalad

I also posted an issue in Tails just in case they might have some fonts that they already use that might be good whitelisting candidates: https://labs.riseup.net/code/issues/12154

comment:6 Changed 2 years ago by vegansalad

Parent ID: #18097

comment:7 Changed 23 months ago by vegansalad

My native language is Dingbat and TBB on Linux only supports a few words in my language. I notice that some of my language's symbols are on this webpage and in uBlock Origin, but aren't supported on Linux TBB, so I can't read them. Can you please evaluate whether adding NotoSansSymbols-Regular.ttf to TBB Linux would help this situation as yawning suggested here: https://trac.torproject.org/projects/tor/ticket/18364?replyto=9#comment:9?

comment:8 Changed 20 months ago by linda

Cc: linda added

comment:9 Changed 20 months ago by linda

Component: WebpagesApplications/Tor Browser
Keywords: ux-team added

comment:10 Changed 17 months ago by antonela

I outlined below some font families who are running right now on products with a significant amount of users and which maybe we could add to our whitelist.

Android / Google Products
Source -> https://material.io/guidelines/style/typography.html

Roboto is the standard typeface on Android.
Noto is the standard typeface for all languages on Chrome and Android for all languages not covered by Roboto.

Script types

  • English and English-like (Latin, Greek, and Cyrillic)
  • Dense (Chinese, Japanese, and Korean)
  • Tall (South and Southeast Asian and Middle Eastern languages)

Ubuntu
Source -> http://font.ubuntu.com/

Ubuntu is the standar typeface on

  • 1,200 glyphs, 200-250 languages (native languages of 3 billion people!).
  • OpenType-based TTF (TrueType)
  • Alternative glyphs (e.g. proportional/non-proportional/superscript/subscript numerals)
  • Debugging glyphs (U+EFFD, U+EFFE, U+EFFF, U+F000) giving face, version, grayscale level and pixels-per-em digit display)

iOS
San Francisco is the current standard typeface on all iOS products.
https://github.com/AppleDesignResources/SanFranciscoFont
https://en.wikipedia.org/wiki/San_Francisco_(sans-serif_typeface)

I'm open to looking into other options for specific OS related problems.

comment:11 Changed 8 months ago by vegansalad

It'd be great to see this proposal move forward. I saw some similar chatter going on about this over here: https://github.com/pyllyukko/user.js/issues/286 Is there some way in which we could coordinate with them to try to get this stuff sorted?

Also, would it be bad to turn this propoal into a reality in the next few days by changing the name of this thread and just start asking people to start providing TBB font feedback like was provided in part in the above comment? https://trac.torproject.org/projects/tor/ticket/20842#comment:10 If not, who needs to say yes to this proposal? Is there a way in which proposals are officially reviewed and deemed appropriate that I'm not aware of? If so, is there a way to bump this proposal to the top of the list since it seems to have been ignored for so long?

Alternatively, would it be preferable to provide the TBB font feedback in the parent ticket? https://trac.torproject.org/projects/tor/ticket/18097

A third option would be to create seperate sub-tickets for font feedback that are OS specific and then solicit the opinions of native speakers of various languages and ask them to post in their respective operating system specific threads related to what fonts are good and bad?

I personally am a native speaker of dingbat/unicode/emoji and my personal request is to add fonts-noto-color-emoji to the list of Google Noto fonts shipped with the GNU+Linux version of TBB, now that it is an official Debian package https://packages.debian.org/buster/fonts-noto-color-emoji and the binary is available https://github.com/googlei18n/noto-emoji/releases I talk more about this suggestion in the specific issue page related to this bug here: https://trac.torproject.org/projects/tor/ticket/18364#comment:12

comment:12 Changed 8 months ago by gk

Owner: set to tbb-team
Status: newassigned
Note: See TracTickets for help on using tickets.