Gonna Grab a Bunch!
March 19, 2021 11:54 PM Subscribe
This feels wrong and dirty.
posted by Joe in Australia at 3:23 AM on March 20, 2021
posted by Joe in Australia at 3:23 AM on March 20, 2021
Branching-tree interactive fiction, with graphics, in a font.
There need to be a yearly award for "Most Creative Screwing Around on the Internet" just to recognise this type of shenanigans.
posted by Eleven at 5:08 AM on March 20, 2021 [11 favorites]
There need to be a yearly award for "Most Creative Screwing Around on the Internet" just to recognise this type of shenanigans.
posted by Eleven at 5:08 AM on March 20, 2021 [11 favorites]
That, and I can't believe how much time and brainpower I spent choosing between the starter types.
posted by Eleven at 5:22 AM on March 20, 2021 [2 favorites]
posted by Eleven at 5:22 AM on March 20, 2021 [2 favorites]
I enjoyed this list of things that are surprisingly turing complete.
posted by jenkinsEar at 6:54 AM on March 20, 2021 [7 favorites]
posted by jenkinsEar at 6:54 AM on March 20, 2021 [7 favorites]
Security people, somewhere, right now:
"The fonts do what now?"
posted by mmcg at 7:18 AM on March 20, 2021 [10 favorites]
"The fonts do what now?"
posted by mmcg at 7:18 AM on March 20, 2021 [10 favorites]
Yeah, the security implications are pretty terrifying.
If you can somehow gain control of what font is used to view a document - which is not something usually considered security critical! - then you can, for instance, make that document appear to the viewer to contain completely different text. Or indeed, different things depending what edits are made. Like, say, what name is filled in somewhere in an otherwise standard text.
Imagine the scenario: Eve sends a contract to Alice to approve. Unbeknown to Alice, Eve has tricked Alice's computer to display the text of the contract using a font that Eve controls. That font detects parts of the text of the contract, containing terms favourable to Eve, and replaces it with terms that appear favourable to Alice.
Alice sends a message back approving the text. Both messages are recorded somewhere trusted, but in plain text form - after all, why would the font matter?
The attack can even be targeted by the font. Maybe Eve has no access to Alice's computer, but she can control what font it will use because the document references a font from http://www.example.com/fonts/totallynormalfont.otf. Many documents on the web, including the page you're reading right now, include fonts referenced by URL. Often those are from third party servers. Who knows if they're secure and trustworthy? Let's say Eve controls the font file at that URL.
Eve can now send the same unfavourable contract text to a bunch of customers, with different names filled in.
The font detects Alice's name in the text and changes the terms to look favourable to her. Meanwhile Bob, who is not the target, sees the same document with his name in it and the unfavourable terms. Bob rejects the contract. Alice approves it. The plain-text paper trail shows that Eve sent the same terms to everyone and Alice was the only one to accept.
And by the time there's a dispute later, the malicious font is long gone.
posted by automatronic at 8:34 AM on March 20, 2021 [14 favorites]
If you can somehow gain control of what font is used to view a document - which is not something usually considered security critical! - then you can, for instance, make that document appear to the viewer to contain completely different text. Or indeed, different things depending what edits are made. Like, say, what name is filled in somewhere in an otherwise standard text.
Imagine the scenario: Eve sends a contract to Alice to approve. Unbeknown to Alice, Eve has tricked Alice's computer to display the text of the contract using a font that Eve controls. That font detects parts of the text of the contract, containing terms favourable to Eve, and replaces it with terms that appear favourable to Alice.
Alice sends a message back approving the text. Both messages are recorded somewhere trusted, but in plain text form - after all, why would the font matter?
The attack can even be targeted by the font. Maybe Eve has no access to Alice's computer, but she can control what font it will use because the document references a font from http://www.example.com/fonts/totallynormalfont.otf. Many documents on the web, including the page you're reading right now, include fonts referenced by URL. Often those are from third party servers. Who knows if they're secure and trustworthy? Let's say Eve controls the font file at that URL.
Eve can now send the same unfavourable contract text to a bunch of customers, with different names filled in.
The font detects Alice's name in the text and changes the terms to look favourable to her. Meanwhile Bob, who is not the target, sees the same document with his name in it and the unfavourable terms. Bob rejects the contract. Alice approves it. The plain-text paper trail shows that Eve sent the same terms to everyone and Alice was the only one to accept.
And by the time there's a dispute later, the malicious font is long gone.
posted by automatronic at 8:34 AM on March 20, 2021 [14 favorites]
Because this will drive me slightly up the wall otherwise: can anybody explain, in a somewhat less cryptic manner than the "secrets revealed" link, exactly where we're supposed to enter the first secret code for the better ending?
posted by eponym at 9:04 AM on March 20, 2021
posted by eponym at 9:04 AM on March 20, 2021
exactly where we're supposed to enter the first secret code for the better ending?
As you're typing through the dialog after you win the flying badge.
"TAKE THE FLYING BADGE. IT'S MEAT:"
Start right there after the colon appears.
posted by Avelwood at 4:01 PM on March 20, 2021 [1 favorite]
As you're typing through the dialog after you win the flying badge.
"TAKE THE FLYING BADGE. IT'S MEAT:"
Start right there after the colon appears.
posted by Avelwood at 4:01 PM on March 20, 2021 [1 favorite]
If OpenFont has been around since ~1996 does that mean this Pokemon parody could have been playable alongside actual Pokemon?
posted by Mr.Encyclopedia at 4:16 PM on March 20, 2021
posted by Mr.Encyclopedia at 4:16 PM on March 20, 2021
I think the Turing-complete scripting capability may have been added to the OpenFont spec a bit later.
posted by acb at 4:25 PM on March 20, 2021 [1 favorite]
posted by acb at 4:25 PM on March 20, 2021 [1 favorite]
Thank you, Avelwood! I was trying to do it during the glitched battle that follows if you don't backspace, with frustrating results.
posted by eponym at 4:51 PM on March 20, 2021 [1 favorite]
posted by eponym at 4:51 PM on March 20, 2021 [1 favorite]
Pedantic graphic artist here...It’s OpenType, not OpenFont. The file extension is .otf.
posted by Thorzdad at 8:58 PM on March 20, 2021 [2 favorites]
posted by Thorzdad at 8:58 PM on March 20, 2021 [2 favorites]
The clue is in what happened immediately before the glitched battle. Pret-ty clever. Though I can see how the hint instructions can be confusing for someone who hasn't reached that part of the game.
posted by BiggerJ at 9:40 PM on March 20, 2021
posted by BiggerJ at 9:40 PM on March 20, 2021
This is very clever, but as the explanation is upfront about, it's not a turing-complete game, but rather a finite state machine (like a choose your own adventure). It relies on the fact that ligatures can chain (a ligature can match another ligature) to set up a state machine using ligatures as the transitions:
[State][input] -> [NewState]
So for example the intro movie is a series of ligature replacement rules like:
[string start][any char] -> [Intro0000]
[Intro0000][any char] -> [Intro0001]
[Intro0001][any char] -> [Intro0002]
[Intro0002][any char] -> [Intro0003]
...
where each IntroXXXX glyph in the font embeds one frame of the intro movie. User input works like:
[BranchPoint][a] -> [BranchOutcomeA]
[BranchPoint][b] -> [BranchOutcomeB]
posted by Pyry at 7:06 AM on March 21, 2021 [5 favorites]
[State][input] -> [NewState]
So for example the intro movie is a series of ligature replacement rules like:
[string start][any char] -> [Intro0000]
[Intro0000][any char] -> [Intro0001]
[Intro0001][any char] -> [Intro0002]
[Intro0002][any char] -> [Intro0003]
...
where each IntroXXXX glyph in the font embeds one frame of the intro movie. User input works like:
[BranchPoint][a] -> [BranchOutcomeA]
[BranchPoint][b] -> [BranchOutcomeB]
posted by Pyry at 7:06 AM on March 21, 2021 [5 favorites]
Pedantic graphic artist here...It’s OpenType, not OpenFont. The file extension is .otf.I accept full blame for this particular brain fart
sorry everyone
posted by DoctorFedora at 6:04 PM on March 21, 2021 [1 favorite]
« Older An $80,000,000 Glass Mansion with Everything Left... | The Iraq war turns 18 Newer »
This thread has been archived and is closed to new comments
posted by Avelwood at 12:30 AM on March 20, 2021 [1 favorite]