Opened 3 years ago

Last modified 2 years ago

#22787 new defect

Fontconfig warning: remove 'blank' configuration

Reported by: cypherpunks Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-fingerprinting-fonts
Cc: dcf, traumschule Actual Points:
Parent ID: #18097 Points:
Reviewer: Sponsor:


In the log:

Fontconfig warning: line 145: blank doesn't take any effect anymore. please remove it from your fonts.conf

Quickly skimming fontconfig's changelog one finds:

commit 46b2c62faa64250eec3981ee816e91a9a3dee857
Author: Akira TAGOH <akira@…>
Date: Wed Jun 17 16:29:08 2015 +0900

Add a warning for blank in fonts.conf

and remove the unnecessary code for parsing blanks

src/fcxml.c | 7 +++++++
1 file changed, 7 insertions(+)

Child Tickets

Change History (5)

comment:1 Changed 3 years ago by gk

Cc: dcf added

I guess we can't remove that part of fonts.conf, though, until all distros we support have updated to a more recent fontconfig?

comment:2 Changed 3 years ago by dcf

Keywords: tbb-fingerprinting added

Here is the upstream commit (2015-06-17):

But before that (2015-02-17), they had removed <blank></blank> from the default fonts.conf and made the blanks be hardcoded in the library:

I am sure that when I set up fonts.conf for Tor Browser initially, I cargo-culted most of the config from somewhere, including the <blank> section. I don't really know what it does.

According to fonts.dtd, the <blank> section is optional, so I would guess that we can remove it without causing crashes on old versions of fontconfig.

But we may have to deal with this as a new fingerprinting vector (whether we remove the <blank> or not). If we are using the system fontconfig, and the system fontconfig has a built-in set of blanks that varies across systems (it looks like they update it with new Unicode versions), and it's possible for a web page to detect the difference, then it could be used for fingerprinting.

The set of built-in blanks isn't even under version control, because they have a makefile that fetches a list from at build time :( So it's likely to be whatever randomly happened to be there when someone built a release.

To test, we could repurpose the fontfp code and replace the list of code points with the list.

comment:3 Changed 3 years ago by gk

Keywords: tbb-fingerprinting-fonts added; tbb-fingerprinting removed
Severity: MinorNormal

Interesting. Seems to be worth investigating further.

comment:4 Changed 3 years ago by gk

Parent ID: #18097

comment:5 Changed 2 years ago by gk

Cc: traumschule added

Nowadays we have systems where we get line 85: unknown element "blank" messages. Resolved #28198 as a duplicate.

Note: See TracTickets for help on using tickets.