Ever gotten pwned by a font?

[cooper]

On the down slope of the Flash frenzy, you get this:

https://technet.microsoft.com/library/security/MS15-078

It's an out-of-band update, so you know this isn't 'just' bad...

[Sildaekar]

LMFAO! Wow, this is priceless.

[digip]

OOB updates are better than having to wait for weeks to patch though. Not defending Microsoft, but everyone these days takes for granted the fact that browsers for a long time, have been able to use web fonts. I've been using custom fonts converted for the web on sites I design for a number of years now(check out font squirell if you want to customize your own sites fonts for use across most* browsers with the font styling of your choice), so the chance of a drive by is much higher unless you disable web fonts. IE I think* is the only browser I know of that blocks web fonts by default and has to be enabled(download of fonts under settings), which honestly, if you're using IE, you probably have other things to worry about. All other browsers view them by default.

Fortunately you can disable it on most browsers either built in or by extension:

Older opera (opera:config) search for webfonts to uncheck and save settings, close and re-open browser

Newer opera and chrome, no way to disable without an extension, but opera://flags/ lets you enable the blocking of DirectWrite font rendering ( https://msdn.microsoft.com/en-us/library/windows/desktop/dd371554(v=vs.85).aspx )

(I couldn't find any settings for Chrome or latest Opera nor an extension) - Extension : https://chrome.google.com/webstore/detail/disable-web-fonts/olmabeadgbpmhllgdkemfdnmkngkbkeg?hl=en

FireFox (about:config) search gfx.downloadable_fonts.enabled and set to disable

Safari, I don't use or have installed but feel free to post if you can disable it.