Hacker News Reader

I think the mitigation advice is incomplete, allowFontOps is disabled by default, so the mitigation is only necessary if you've enabled it.. but in that case you would need to put 'allowFontOps: false' after the stanza enabling it, right?

View on HN

> allowFontOps is disabled by default

It's enabled by default upstream.

https://invisible-island.net/xterm/manpage/xterm.html#VT100-...

That's what the manual on fedora says too, but it is disabled by default. I admit, I didn't try building from pristine source, so it could be patched!

It looks patched indeed:

https://src.fedoraproject.org/rpms/xterm/blob/rawhide/f/xter...

Ah-ha, I stand corrected :)

Debian's patch is nicer, as the build process pulls the default from the man page, so: https://sources.debian.org/patches/xterm/375-1/904_fontops.d...

> the build process pulls the default from the man page

Interesting idea, but I don't think that's what happens:

https://sources.debian.org/src/xterm/375-1/debian/rules/#L22

Reply on news.ycombinator.com