Chromium PDF output turned a CFF OpenType font into Type 3 glyphs at every fsType setting tested

·6 views

A developer tested how Chromium 149 embeds fonts when printing to PDF, using one CFF-outline OpenType font and two TrueType fonts, each modified to six different fsType values. The TrueType fonts embedded normally or as Type 3 depending on the flag, with value 256 forcing full embedding. The CFF-based Noto Serif SC was written as Type 3 outlines at every fsType value tested, so the flag was not the cause in this case. The author suggests Chromium may lack an embedding path for CFF outlines, but notes this is an untested guess limited to one font, one Chromium version and one Mac. The author also ran the PDFs through a browser-based PDF-to-HTML converter, which turned the TrueType subsets into web fonts and the Noto Serif SC text into vector paths with a transparent text layer.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

PDF encryption keys in MuPDF and Foxit had weak randomness, making them recoverable

Security researcher Rick de Jager at V12 disclosed that some PDF implementations generate file encryption keys with insufficient randomness. MuPDF produced AES-256 file keys with only about 9 bits of effective entropy, while Foxit derived its keys from the current timestamp. In both cases the keys can be recovered without the password, in milliseconds on an ordinary laptop. The flaw lies not in the AES-256 cipher or the key derivation math, but in the randomness used to generate the file key. Because the file key protects all document content, the password and slow hashing offer no real protection when it is guessable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A Practical Plan for Building a Website from Scratch

The article argues that a website should be approached as a product project, starting with a clear goal and an understanding of who the site serves before any design or theme choices. It recommends defining one or two meaningful conversions and mapping pages to distinct user needs rather than creating many near-duplicate keyword pages. Essential pages such as home, services, company details, contact, and FAQs form the core, with each page given a defined purpose and next action. The piece also weighs hosted builders against content management systems and custom development, and advises careful domain selection and secure handling of account credentials. Finally, it stresses drafting real content early, since actual material shapes the final structure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Largest Census of MCP Tool Parameter Schemas Released: 229,827 Records

A new dataset has been published cataloging 229,827 tool records from the Model Context Protocol (MCP) ecosystem, each including a machine-readable input schema describing its parameters. The records draw from 13,120 servers that expose tool-level schemas, out of 42,163 servers surveyed, with most deployed servers lacking such machine-readable parameter definitions. The publisher reports byte-verified counts, no malformed records, and SHA-256 anchoring so the bundle can be independently checked. The dataset is intended to support security research, conformance test generation, and analysis of parameter-level risks such as injection and exfiltration, and is released under a CC-BY-SA-4.0 license. Its authors note that sampling is weighted toward English-language servers and that schema quality varies, with about 29,000 servers without tool-level schemas recorded but not expanded.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

commercetools Replaces Magento and Redis Pricing Cache With Native Price Rows

A developer rebuilt B2B company pricing for the open-source Forgeline storefront, moving from a Magento and Redis setup to commercetools. The earlier system depended on a nightly ERP sync, cached per-company JSON blobs, and AJAX-loaded prices to keep full-page caching working. In the new model, ERP changes are imported as native price rows keyed by store, channel, currency, and customer group, so nothing needs runtime caching. The author recommends a distribution channel per company rather than customer groups, since buyers can switch between business units. A test script confirmed how price selection resolves for company, fallback, and group-specific rows.

0 comments Read more at DEV Community