On Thu, Jul 30, 2015 at 08:55:36PM -0700, Arthur D. Edelstein wrote:

As Mike suggested, I've posted David's web app here: http://qfgbmpw3obwb3ix3.onion

David -- is this measuring system font glyphs or only web fonts that download at the beginning? And can you suggest how to interpret the submissions file?

The web app is doing many researchy things, some of which are no longer important. In particular, you probably want http://qfgbmpw3obwb3ix3.onion/fastfp, not the default /fontfp. That one runs in under a second and is a much faster way to test whether the defense is working. You only need to use /fontfp (which tests against all of Unicode) if you want to try and find new potentially problematic code points.

The fastfp page gives you three fingerprints. Only the first one matters. The other two are simulations of providing a standard-font defense; i.e., what you've already implemented. :2d5db8b8 using system fonts (no defense). st:502fc3e6 simulating a defense that allows only standard fonts. un:48ac0cd4 simulating a defense with just one standard font. The only one you need to pay attention to is the ":" one, not the "st:" one or the "un:" one.

You probably don't want to be collecting submission files. They are set up to be highly anonymized and to be for a general browser population, not Tor Browser. You're going to be getting a mix of people visiting the site, with and without 5.0a4, all their results mixed together with no way to differentiate them. There is code that partially documents the submission files in fp/submission.go. An example of what you can do with submission files is get summary statistics for individual code points, $ ./summary/summary submissions/* point minw maxw meanw minh maxh meanh var U+0000 0 249 16.06 368 1200 400.74 18.5226 U+0001 0 0 0.00 368 1200 400.74 16.5118 Or diff two submissions: $ ./diff/diff --styles default submissions/1 submissions/2 U+0000 default 0×369 0×380 (+0,+11) U+0001 default 0×369 0×380 (+0,+11)

I think it would be better if we set up a static HTML page that would print out a complete list of glyph sizes with a checksum. tor-qa people could self-report their checksum. If we find any that don't match, we can then try and investigate why (gk and I did a lot of this during the fontfp research). There's a code point viewer at e.g. http://qfgbmpw3obwb3ix3.onion/u/03b1. It gives the dimensions of the glyph in all font styles and shows the glyph on the screen. We resorted to this to find out why rendering was different across some systems (i.e., opened a couple of screenshots in Gimp and subtracted them to find out what pixels were different); that was some of our evidence that antialiasing settings are a cause of distinguishability.

This is brilliant, David! It's extremely useful. Thank you.

On Wed, Aug 5, 2015 at 11:38 PM, david@bamsoftware.com david@bamsoftware.com wrote:

On Fri, Jul 31, 2015 at 06:11:16PM -0700, david@bamsoftware.com wrote:

...

On Thu, Jul 30, 2015 at 08:55:36PM -0700, Arthur D. Edelstein wrote:

...

As Mike suggested, I've posted David's web app here: http://qfgbmpw3obwb3ix3.onion

David -- is this measuring system font glyphs or only web fonts that download at the beginning? And can you suggest how to interpret the submissions file?

I think it would be better if we set up a static HTML page that would print out a complete list of glyph sizes with a checksum. tor-qa people could self-report their checksum. If we find any that don't match, we can then try and investigate why (gk and I did a lot of this during the fontfp research).

I set up a test page to help with debugging font differences.

https://people.torproject.org/~dcf/fonttest.html

The page tests a few dozen code points (quickly, in less than a second). Then it saves all the dimensions to a text box that you can download to a file. I hope that it will make it easy to diff two result sets and investigate any differences. It doesn't have any of the "st:" and "un:" checksum stuff that is no longer relevant. The source code is pretty hackable.

The page has a viewer so you can screenshot and diff glyphs that differ.

https://people.torproject.org/~dcf/fonttest.html#viewer

Good news, the checksums on two of my Debian computers is the same under 5.0a4, when they were different under 5.0a3. At the end of this message I've included full results files downloaded from the fonttest page.

            5.0a3           5.0a4

Debian 8 1-2d5db8b8 1-83e97f7d Debian 8 1-ee150545 1-83e97f7d Windows 8 1-e77cd884 1-0fe1d60b

Checksum: 1-2d5db8b8 Date: 2015-08-06T05:31:14.400Z User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0 Browser version: Tor Browser 5.0a3 OS: Linux 3.16 Debian 8 x86_64 Notes:

U+20B9 636,1200 636,1200 636,1200 602,1200 636,1200 636,1200 U+2581 769,1200 769,1200 769,1200 602,1200 769,1200 769,1200 U+20BA 636,1200 636,1200 636,1200 636,1200 636,1200 636,1200 U+A73D 824,1200 818,1200 824,1200 818,1200 818,1200 818,1200 U+FFFD 1025,1200 1025,1200 1025,1200 602,1200 1025,1200 1025,1200 U+20B8 636,1200 636,1200 636,1200 602,1200 636,1200 636,1200 U+05C6 350,1240 442,1200 350,1240 442,1200 442,1200 442,1200 U+1E9E 829,1200 769,1200 829,1200 769,1200 769,1200 769,1200 U+097F 524,1598 524,1598 524,1598 524,1598 524,1598 524,1598 U+F003 1000,1200 978,1200 1000,1200 978,1200 978,1200 978,1200 U+1CDA 0,1215 0,1215 0,1215 0,1200 0,1215 0,1215 U+17DD 0,1215 0,1215 0,1215 0,1200 0,1215 0,1215 U+23AE 521,1200 521,1200 521,1200 602,1200 521,1200 521,1200 U+0D02 1449,1455 1449,1455 1449,1455 1449,1539 1449,1455 1449,1455 U+0B82 763,2000 763,2000 763,2000 763,2000 763,2000 763,2000 U+115A 1000,1215 1000,1215 1000,1215 1000,1200 1000,1215 1000,1215 U+2425 800,1240 800,1240 800,1240 600,1200 800,1240 800,1240 U+302E 500,1215 500,1215 500,1215 500,1200 500,1215 500,1215 U+A830 1000,1215 1000,1215 1000,1215 1000,1200 1000,1215 1000,1215 U+2B06 838,1200 838,1200 838,1200 602,1200 838,1200 838,1200 U+21E4 838,1200 838,1200 838,1200 602,1200 838,1200 838,1200 U+20BD 636,1200 636,1200 636,1200 636,1200 636,1200 636,1200 U+2C7B 553,1200 491,1200 553,1200 491,1200 491,1200 491,1200 U+20B0 489,1240 636,1200 489,1240 602,1200 636,1200 636,1200 U+FBEE 500,1215 500,1215 500,1215 500,1200 500,1215 500,1215 U+F810 428,1509 428,1509 428,1509 428,1509 428,1509 428,1509 U+FFFF 636,1200 636,1200 636,1200 602,1200 636,1200 636,1200 U+007F 0,1200 0,1200 0,1200 0,1200 0,1200 0,1200 U+10A0 723,1200 874,1200 723,1200 874,1200 874,1200 874,1200 U+1D790 696,1240 774,1268 696,1240 774,1200 774,1268 774,1268 U+0700 600,1240 600,1240 600,1240 600,1200 600,1240 600,1240 U+1950 537,1240 537,1240 537,1240 537,1200 537,1240 537,1240 U+3095 1000,1215 1000,1215 1000,1215 1000,1200 1000,1215 1000,1215 U+532D 1000,1383 1000,1383 1000,1383 1000,1309 1000,1383 1000,1383 U+061C 0,0 0,0 0,0 0,0 0,0 0,0 U+20E3 0,1240 0,1200 0,1240 0,1200 0,1200 0,1200 U+FFF9 0,1200 0,1200 0,1200 602,1200 0,1200 0,1200 U+0218 685,1200 635,1200 685,1200 602,1200 635,1200 635,1200 U+058F 735,1240 735,1240 735,1240 735,1200 735,1240 735,1240 U+08E4 0,1215 0,1215 0,1215 0,1200 0,1215 0,1215 U+09B3 1000,1215 1000,1215 1000,1215 1000,1200 1000,1215 1000,1215 U+1C50 500,1215 500,1215 500,1215 500,1200 500,1215 500,1215 U+2619 800,1240 896,1200 800,1240 602,1200 896,1200 896,1200

Checksum: 1-83e97f7d Date: 2015-08-06T04:36:37.600Z User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0 Browser version: Tor Browser 5.0a4 OS: Linux 3.16 Debian 8 x86_64 Notes:

U+20B9 572,1362 572,1362 559,1362 572,1369 559,1362 559,1362 U+2581 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+20BA 572,1362 572,1362 559,1362 572,1369 559,1362 559,1362 U+A73D 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+FFFD 1000,1362 1000,1362 1000,1362 1000,1369 1000,1362 1000,1362 U+20B8 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+05C6 379,1362 379,1362 379,1362 600,1133 379,1362 379,1362 U+1E9E 709,1362 709,1362 682,1362 600,1133 682,1362 682,1362 U+097F 571,1477 571,1477 571,1477 571,1304 571,1477 571,1477 U+F003 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+1CDA 0,1477 0,1477 0,1477 0,1304 0,1477 0,1477 U+17DD 594,1460 594,1460 467,1807 594,1322 594,1460 594,1460 U+23AE 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+0D02 1031,1452 1031,1452 1031,1452 1031,1253 1031,1452 1031,1452 U+0B82 914,1439 914,1439 914,1439 914,1240 914,1439 914,1439 U+115A 920,1480 920,1480 920,1480 920,1480 920,1480 920,1480 U+2425 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+302E 1250,1480 1250,1480 1250,1480 1250,1480 1250,1480 1250,1480 U+A830 237,1477 237,1477 237,1477 237,1304 237,1477 237,1477 U+2B06 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+21E4 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+20BD 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+2C7B 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+20B0 572,1362 572,1362 559,1362 600,1133 559,1362 559,1362 U+FBEE 744,1703 744,1703 744,1703 744,1703 744,1703 744,1703 U+F810 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+FFFF 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+007F 0,1362 0,1362 0,1362 0,1133 0,1362 0,1362 U+10A0 781,1362 781,1362 781,1362 781,1369 781,1362 781,1362 U+1D790 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+0700 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+1950 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+3095 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+532D 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+061C 0,0 0,0 0,0 0,0 0,0 0,0 U+20E3 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+FFF9 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+0218 549,1362 549,1362 544,1362 600,1133 544,1362 544,1362 U+058F 745,1362 745,1362 699,1362 745,1369 699,1362 699,1362 U+08E4 0,1703 0,1703 0,1703 0,1703 0,1703 0,1703 U+09B3 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+1C50 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+2619 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362

Checksum: 1-ee150545 Date: 2015-08-06T06:03:53.800Z User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0 Browser version: Tor Browser 5.0a3 OS: Linux 4.0 Debian 8 x86_64 Notes:

U+20B9 636,1200 636,1200 636,1200 602,1200 636,1200 636,1200 U+2581 769,1200 769,1200 769,1200 602,1200 769,1200 769,1200 U+20BA 636,1200 636,1200 636,1200 500,1270 636,1200 636,1200 U+A73D 824,1200 818,1200 824,1200 818,1200 818,1200 818,1200 U+FFFD 1025,1200 1025,1200 1025,1200 602,1200 1025,1200 1025,1200 U+20B8 636,1200 636,1200 636,1200 602,1200 636,1200 636,1200 U+05C6 350,1240 442,1200 350,1240 442,1200 442,1200 442,1200 U+1E9E 829,1200 769,1200 829,1200 500,1270 769,1200 769,1200 U+097F 524,1598 524,1598 524,1598 524,1598 524,1598 524,1598 U+F003 1000,1200 978,1200 1000,1200 978,1200 978,1200 978,1200 U+1CDA 0,1215 0,1215 0,1215 0,1200 0,1215 0,1215 U+17DD 0,1215 0,1215 0,1215 0,1200 0,1215 0,1215 U+23AE 521,1200 521,1200 521,1200 602,1200 521,1200 521,1200 U+0D02 1449,1455 1449,1455 1449,1455 1449,1539 1449,1455 1449,1455 U+0B82 763,2000 763,2000 763,2000 763,2000 763,2000 763,2000 U+115A 1000,1215 1000,1215 1000,1215 1000,1200 1000,1215 1000,1215 U+2425 800,1240 500,1340 800,1240 500,1270 500,1340 500,1340 U+302E 1000,1303 1000,1303 1000,1303 1000,1260 1000,1303 1000,1303 U+A830 1000,1215 1000,1215 1000,1215 1000,1200 1000,1215 1000,1215 U+2B06 838,1200 838,1200 838,1200 602,1200 838,1200 838,1200 U+21E4 838,1200 838,1200 838,1200 602,1200 838,1200 838,1200 U+20BD 636,1200 636,1200 636,1200 636,1200 636,1200 636,1200 U+2C7B 553,1200 491,1200 553,1200 507,1270 491,1200 491,1200 U+20B0 489,1240 636,1200 489,1240 602,1200 636,1200 636,1200 U+FBEE 500,1215 500,1215 500,1215 500,1200 500,1215 500,1215 U+F810 1600,1200 1600,1200 1600,1200 1600,1200 1600,1200 1600,1200 U+FFFF 636,1200 636,1200 636,1200 602,1200 636,1200 636,1200 U+007F 0,1200 0,1200 0,1200 0,1200 0,1200 0,1200 U+10A0 723,1200 874,1200 723,1200 874,1200 874,1200 874,1200 U+1D790 696,1240 774,1268 696,1240 774,1200 774,1268 774,1268 U+0700 600,1240 600,1240 600,1240 600,1200 600,1240 600,1240 U+1950 537,1240 537,1240 537,1240 537,1200 537,1240 537,1240 U+3095 790,1220 1000,1340 790,1220 1000,1270 1000,1340 1000,1340 U+532D 1000,1303 1000,1303 1000,1303 1000,1260 1000,1303 1000,1303 U+061C 0,0 0,0 0,0 0,0 0,0 0,0 U+20E3 0,1240 1000,1340 0,1240 1000,1270 1000,1340 1000,1340 U+FFF9 0,1200 0,1200 0,1200 602,1200 0,1200 0,1200 U+0218 685,1200 635,1200 685,1200 602,1200 635,1200 635,1200 U+058F 735,1240 735,1240 735,1240 735,1200 735,1240 735,1240 U+08E4 0,1215 0,1215 0,1215 0,1200 0,1215 0,1215 U+09B3 1000,1215 1000,1215 1000,1215 1000,1200 1000,1215 1000,1215 U+1C50 500,1215 500,1215 500,1215 500,1200 500,1215 500,1215 U+2619 800,1240 896,1200 800,1240 602,1200 896,1200 896,1200

Checksum: 1-83e97f7d Date: 2015-08-06T05:16:04.200Z User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0 Browser version: Tor Browser 5.0a4 OS: Linux 4.0 Debian 8 x86_64 Notes:

U+20B9 572,1362 572,1362 559,1362 572,1369 559,1362 559,1362 U+2581 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+20BA 572,1362 572,1362 559,1362 572,1369 559,1362 559,1362 U+A73D 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+FFFD 1000,1362 1000,1362 1000,1362 1000,1369 1000,1362 1000,1362 U+20B8 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+05C6 379,1362 379,1362 379,1362 600,1133 379,1362 379,1362 U+1E9E 709,1362 709,1362 682,1362 600,1133 682,1362 682,1362 U+097F 571,1477 571,1477 571,1477 571,1304 571,1477 571,1477 U+F003 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+1CDA 0,1477 0,1477 0,1477 0,1304 0,1477 0,1477 U+17DD 594,1460 594,1460 467,1807 594,1322 594,1460 594,1460 U+23AE 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+0D02 1031,1452 1031,1452 1031,1452 1031,1253 1031,1452 1031,1452 U+0B82 914,1439 914,1439 914,1439 914,1240 914,1439 914,1439 U+115A 920,1480 920,1480 920,1480 920,1480 920,1480 920,1480 U+2425 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+302E 1250,1480 1250,1480 1250,1480 1250,1480 1250,1480 1250,1480 U+A830 237,1477 237,1477 237,1477 237,1304 237,1477 237,1477 U+2B06 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+21E4 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+20BD 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+2C7B 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+20B0 572,1362 572,1362 559,1362 600,1133 559,1362 559,1362 U+FBEE 744,1703 744,1703 744,1703 744,1703 744,1703 744,1703 U+F810 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+FFFF 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+007F 0,1362 0,1362 0,1362 0,1133 0,1362 0,1362 U+10A0 781,1362 781,1362 781,1362 781,1369 781,1362 781,1362 U+1D790 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+0700 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+1950 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+3095 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+532D 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 1000,1480 U+061C 0,0 0,0 0,0 0,0 0,0 0,0 U+20E3 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+FFF9 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+0218 549,1362 549,1362 544,1362 600,1133 544,1362 544,1362 U+058F 745,1362 745,1362 699,1362 745,1369 699,1362 699,1362 U+08E4 0,1703 0,1703 0,1703 0,1703 0,1703 0,1703 U+09B3 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+1C50 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362 U+2619 590,1362 590,1362 602,1362 600,1133 602,1362 602,1362

Checksum: 1-e77cd884 Date: 2015-08-06T06:32:06.200Z User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0 Browser version: Tor Browser 5.0a3 OS: Windows 8.1 Pro Notes: According to Firefox about:support: Direct2D Enabled Blocked for your graphics card because of unresolved driver issues. DirectWrite Enabled false (6.3.9600.17795) WebGL Renderer Blocked for your graphics card because of unresolved driver issues. AzureCanvasBackend skia AzureContentBackend cairo

U+20B9 800,1840 890,1839 800,1840 780,1472 800,2229 890,1811 U+2581 1501,2129 1501,2129 1501,2129 1219,1793 1501,2229 1501,2129 U+20BA 800,1840 890,1839 800,1840 650,1548 800,2229 890,1811 U+A73D 1053,2129 1053,2129 1053,2129 856,1793 1053,2229 1053,2129 U+FFFD 1484,1989 1484,1974 1484,1989 1206,1697 1484,2229 980,1811 U+20B8 977,1840 977,1839 977,1840 780,1472 977,2229 890,1811 U+05C6 488,1840 564,1839 488,1840 780,1472 564,2229 560,1811 U+1E9E 1141,1840 1124,1839 1141,1840 780,1472 1141,2229 1018,1811 U+097F 962,2129 962,2129 962,2129 781,1793 962,2229 962,2129 U+F003 641,1840 706,1839 641,1840 780,1472 749,2229 704,1811 U+1CDA 641,1840 706,1839 641,1840 780,1472 749,2229 704,1811 U+17DD 995,1855 995,1840 995,1855 808,1588 995,2229 995,1811 U+23AE 864,2129 864,2129 864,2129 702,1793 864,2229 864,2129 U+0D02 2035,2282 2035,2282 2035,2282 1653,1854 2035,2472 2035,2282 U+0B82 1684,2195 1684,2195 1684,2195 1368,1784 1684,2358 1684,2195 U+115A 1600,1840 1600,1839 1600,1840 1300,1506 1600,2229 1600,1811 U+2425 1277,2129 1277,2129 1277,2129 1037,1793 1277,2229 1277,2129 U+302E 2400,2112 2400,2112 2400,2112 1950,1766 2400,2229 2400,2112 U+A830 388,2129 388,2129 388,2129 315,1793 388,2229 388,2129 U+2B06 874,2129 874,2129 874,2129 710,1793 874,2229 874,2129 U+21E4 1445,2129 1445,2129 1445,2129 1174,1793 1445,2229 1445,2129 U+20BD 800,1840 890,1839 800,1840 650,1548 800,2229 890,1811 U+2C7B 711,1840 784,1839 711,1840 780,1472 711,2229 711,1821 U+20B0 800,1840 834,1839 800,1840 780,1472 800,2229 828,1811 U+FBEE 1021,1840 1021,1839 1021,1840 780,1472 1336,2229 1042,1811 U+F810 641,1840 706,1839 641,1840 780,1472 749,2229 704,1811 U+FFFF 800,1840 800,1839 800,1840 650,1506 800,2229 800,1811 U+007F 0,1840 0,1839 0,1840 0,1472 0,2229 0,1811 U+10A0 1123,2107 1123,2107 1123,2107 913,1712 1123,2259 1123,2107 U+1D790 1120,8928 1120,8928 1120,8928 910,7254 1120,8928 1120,8928 U+0700 846,1962 846,1976 846,1962 687,1490 846,2265 846,1977 U+1950 864,2035 864,2035 864,2035 702,1653 864,2314 864,2035 U+3095 1319,1840 1319,1839 1319,1840 1071,1507 1319,2229 1319,1811 U+532D 1600,1840 1600,1839 1600,1840 1300,1507 1600,2229 1600,1811 U+061C 0,0 0,0 0,0 0,0 0,0 0,0 U+20E3 0,2129 0,2129 0,2129 0,1793 0,2229 0,1811 U+FFF9 641,1840 706,1839 641,1840 780,1472 749,2229 704,1811 U+0218 890,1840 1067,1839 890,1840 780,1472 1109,2229 1067,1811 U+058F 1217,1840 971,2107 1217,1840 789,1712 971,2259 971,2107 U+08E4 0,1840 0,1839 0,1840 0,1472 0,2229 0,1811 U+09B3 641,1840 706,1839 641,1840 780,1472 749,2229 704,1811 U+1C50 977,2129 977,2129 977,2129 794,1793 977,2229 977,2129 U+2619 1445,2129 1445,2129 1445,2129 1174,1793 1445,2229 1445,2129

Checksum: 1-0fe1d60b Date: 2015-08-06T12:52:04.700Z User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0 Browser version: Tor Browser 5.0a4 OS: Windows 8.1 Pro Notes: According to Firefox about:support: Direct2D Enabled Blocked for your graphics card because of unresolved driver issues. DirectWrite Enabled false (6.3.9600.17795) WebGL Renderer Blocked for your graphics card because of unresolved driver issues. AzureCanvasBackend skia AzureContentBackend cairo

U+20B9 915,2179 915,2179 895,2179 743,1780 895,2179 895,2179 U+2581 1600,2368 1600,2368 1600,2368 1300,1924 1600,2368 1600,2368 U+20BA 915,2179 915,2179 895,2179 743,1780 895,2179 895,2179 U+A73D 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+FFFD 1600,2179 1600,2179 1600,2179 1300,1780 1600,2179 1600,2179 U+20B8 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+05C6 606,2179 606,2179 606,2179 780,1472 606,2179 606,2179 U+1E9E 1134,2179 1134,2179 1091,2179 780,1472 1091,2179 1091,2179 U+097F 913,2363 913,2363 913,2363 742,1696 913,2363 913,2363 U+F003 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+1CDA 0,2363 0,2363 0,2363 0,1696 0,2363 0,2363 U+17DD 747,2891 747,2891 747,2891 607,2349 747,2891 747,2891 U+23AE 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+0D02 1649,2323 1649,2323 1649,2323 1340,1629 1649,2323 1649,2323 U+0B82 1461,2302 1461,2302 1461,2302 1188,1612 1461,2302 1461,2302 U+115A 1472,2368 1472,2368 1472,2368 1196,1924 1472,2368 1472,2368 U+2425 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+302E 2000,2368 2000,2368 2000,2368 1625,1924 2000,2368 2000,2368 U+A830 379,2363 379,2363 379,2363 308,1696 379,2363 379,2363 U+2B06 1600,2368 1600,2368 1600,2368 1300,1924 1600,2368 1600,2368 U+21E4 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+20BD 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+2C7B 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+20B0 915,2179 915,2179 895,2179 780,1472 895,2179 895,2179 U+FBEE 1190,2724 1190,2724 1190,2724 967,2214 1190,2724 1190,2724 U+F810 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+FFFF 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+007F 0,2179 0,2179 0,2179 0,1472 0,2179 0,2179 U+10A0 1249,2179 1249,2179 1249,2179 1015,1780 1249,2179 1249,2179 U+1D790 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+0700 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+1950 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+3095 1600,2368 1600,2368 1600,2368 1300,1924 1600,2368 1600,2368 U+532D 1600,2368 1600,2368 1600,2368 1300,1924 1600,2368 1600,2368 U+061C 0,0 0,0 0,0 0,0 0,0 0,0 U+20E3 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+FFF9 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+0218 878,2179 878,2179 870,2179 780,1472 870,2179 870,2179 U+058F 1118,2179 1118,2179 1118,2179 908,1780 1118,2179 1118,2179 U+08E4 0,2724 0,2724 0,2724 0,2214 0,2724 0,2724 U+09B3 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+1C50 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179 U+2619 944,2179 944,2179 963,2179 780,1472 963,2179 963,2179

On Thu, Aug 06, 2015 at 11:16:39AM +0200, Moritz Bartl wrote:

On 08/06/2015 08:38 AM, david@bamsoftware.com wrote:

...

Good news, the checksums on two of my Debian computers is the same under 5.0a4

I don't get the same on my Debian 8 with 5.0a4. (at 100% zoom level; different checksum at different zoom levels)

Checksum: 1-05fc9f99 Date: 2015-08-06T09:12:22.700Z User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0 Browser version: Tor Browser 5.0a4 OS: Debian 8 x64 i3wm Notes:

Oh, very interesting. It seems the difference is only in one code point, in the "cursive" and "fantasy" styles (last two columns):

-U+058F 745,1362 745,1362 699,1362 745,1369 699,1362 699,1362 +U+058F 745,1362 745,1362 699,1362 745,1369 745,1362 745,1362

Could you make screenshots of the two renderings? I will attach mine. The easy way to make a screenshot is to open the developer toolbar with Shift+F2, then type screenshot [filename] --fullpage Go to https://people.torproject.org/~dcf/fonttest.html#viewer and enter "058f" in the box. Select "default" from the dropdown and take a screenshot. Then select "cursive" and take another.

For me, the "default" glyph is using the font "Noto Sans Armenian" and the "cursive" glyph is using "Noto Serif Armenian". I found that out by typing Ctrl+Shift+I, clicking the arrow icon ("Pick an element from the page"), clicking the big glyph, then selecting the "Fonts" tab.

On Thu, Aug 06, 2015 at 01:36:57PM +0200, Moritz Bartl wrote:

On 08/06/2015 11:43 AM, David Fifield wrote:

...

Oh, very interesting. It seems the difference is only in one code point, in the "cursive" and "fantasy" styles (last two columns): [...] Could you make screenshots of the two renderings?

Attached. I don't see any difference between default and cursive.

That's very interesting. In just that one code point, your computer chooses a sans-serif font for the "fantasy" and "cursive" styles, while mine chooses a serif font. Probably we would find more examples if we tested more of Unicode.

I would not have expected a difference like this. It does not come down to small rendering differences; the browser is simply choosing a different font. Perhaps there is something non-deterministic about how Firefox (or Fontconfig) loads its font files. Like, maybe it iterates a directory in inode order and takes the first match when there is a tie.

Interestingly, even our two "default" screenshots are not pixel-identical. It looks like it comes down to different hinting settings. It is especially apparent in the small text at the top. I attach an animation comparing the two renderings. This is the realm of #16739.

On Thu, Aug 6, 2015 at 9:41 AM, David Fifield david@bamsoftware.com wrote:

On Thu, Aug 06, 2015 at 01:36:57PM +0200, Moritz Bartl wrote:

...

On 08/06/2015 11:43 AM, David Fifield wrote:

...

Oh, very interesting. It seems the difference is only in one code point, in the "cursive" and "fantasy" styles (last two columns): [...] Could you make screenshots of the two renderings?

Attached. I don't see any difference between default and cursive.

That's very interesting. In just that one code point, your computer chooses a sans-serif font for the "fantasy" and "cursive" styles, while mine chooses a serif font. Probably we would find more examples if we tested more of Unicode.

I would not have expected a difference like this. It does not come down to small rendering differences; the browser is simply choosing a different font. Perhaps there is something non-deterministic about how Firefox (or Fontconfig) loads its font files. Like, maybe it iterates a directory in inode order and takes the first match when there is a tie.

If you add "Noto Serif Armenian" or "Noto Sans Armenian" to the lists in the prefs "font.name-list.fantasy.x-unicode" and "font.name-list.cursive.x-unicode" (these can be edited in about:config) does that determine the font chosen for that code point and allow you to get a checksum match? If so, it seems we should include as many fonts as possible in each "name-list" to ensure the font priority is consistent across platforms.

On Thu, Aug 06, 2015 at 11:37:20PM +0200, Moritz Bartl wrote:

On 08/06/2015 08:09 PM, Arthur D. Edelstein wrote:

...

If you add "Noto Serif Armenian" or "Noto Sans Armenian" to the lists in the prefs "font.name-list.fantasy.x-unicode" and "font.name-list.cursive.x-unicode" (these can be edited in about:config) does that determine the font chosen for that code point and allow you to get a checksum match?

I tried the three options, adding one of each and adding both, including browser restarts in between, but that didn't affect the checksum at all.

Same here. I tried adding the strings in both orders to the end of the list, with checksum 1-83e97f7d in every case.

I noticed the original settings had what seems to be an erroneous backslash after "Noto Sans Lao": Noto Serif, Noto Sans Canadian Aboriginal, Noto Sans Cherokee, Noto Sans Lao, Noto Sans Myanmar, Noto Sans Mongolian, Noto Sans Thaana, Noto Sans Yi, Noto Serif Lao I removed it, and still no change.

There's a way to get Fontconfig debugging information with the FC_DEBUG environment variable. It's been a while since I had to do it, but the details are in "man fonts-conf" (http://linux.die.net/man/5/fonts-conf): MATCH 1 Brief information about font matching MATCHV 2 Extensive font matching information EDIT 4 Monitor match/test/edit execution FONTSET 8 Track loading of font information at startup CACHE 16 Watch cache files being written CACHEV 32 Extensive cache file writing information PARSE 64 (no longer in use) SCAN 128 Watch font files being scanned to build caches SCANV 256 Verbose font file scanning information MEMORY 512 Monitor fontconfig memory usage CONFIG 1024 Monitor which config files are loaded LANGSET 2048 Dump char sets used to construct lang values OBJTYPES 4096 Display message when value typechecks fail So if you want MATCHV, FONTSET, and CONFIG output, then you add 2+8+1024=1034 and set FC_DEBUG=1034 before starting the program.

On 08/06/2015 11:43 AM, David Fifield wrote:

Oh, very interesting. It seems the difference is only in one code point, in the "cursive" and "fantasy" styles (last two columns): [...] Could you make screenshots of the two renderings?

Attached. I don't see any difference between default and cursive.

For me, the "default" glyph is using the font "Noto Sans Armenian" and the "cursive" glyph is using "Noto Serif Armenian". I found that out by typing Ctrl+Shift+I, clicking the arrow icon ("Pick an element from the page"), clicking the big glyph, then selecting the "Fonts" tab.

Same for me, Noto Serif Armenian.

anonym:

On 07/31/2015 12:38 AM, Mike Perry wrote:

...

• Update Tor to 0.2.7.2-alpha with patches:

Are you planning to ship Tor 0.2.7.x-alpha in the final Tor Browser 5.0 release? If so, what are the reasons? On Tails' side of things we're a bit concerned about having to ship a Tor alpha version.

No worries. We plan to ship the latest Tor stable version. Note, however, we'll very likely include the Tor patches we shipped so far in the stable and the alpha series.

Georg