# How to prove the font contains no virus?

**URL:** <https://forum.glyphsapp.com/t/how-to-prove-the-font-contains-no-virus/4589>\
**Category:** Meta\
**Created:** [June 11, 2016, 9:58am UTC](https://forum.glyphsapp.com/t/how-to-prove-the-font-contains-no-virus/4589 "2016-06-11T09:58:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![FKLM](https://forum.glyphsapp.com/letter_avatar_proxy/v4/letter/f/f08c70/32.png) [@FKLM](https://forum.glyphsapp.com/u/FKLM)\
**Post date:** [June 11, 2016, 9:58am UTC](https://forum.glyphsapp.com/t/how-to-prove-the-font-contains-no-virus/4589/1 "2016-06-11T09:58:38Z")

</div>

Hello, I am a designer from Tokyo and new here.  
I could really benefit from your professional experience.

Now, I am planning to design a corporate-font with Glyphs for a company in Japan, as my business.  
To do that, I have to prove the font I will deliver (will be .ttf) contains no virus, malware and such a things, since the font will be in the system of the company.

It sounds a bit weird question. But,

- Is there a way to prove that to the client?

If you have the same (or similar) experience in the past, I would appreciate it very much if you could tell me about it.  
Also any suggestion would be thankful!

Thank you very much for your time.

---

<div class="post-metadata">

**Author:** ![GeorgSeifert](https://forum.glyphsapp.com/user_avatar/forum.glyphsapp.com/georgseifert/32/259_2.png) [@GeorgSeifert](https://forum.glyphsapp.com/u/GeorgSeifert)\
**Post date:** [June 11, 2016, 10:03am UTC](https://forum.glyphsapp.com/t/how-to-prove-the-font-contains-no-virus/4589/2 "2016-06-11T10:03:32Z")

</div>

This is a quiet unusual request.  
You can’t prove that, because whatever you tell them is no prove. You can tell them how they can prove it themselves. There are several options:

Run it through a virus scanner.

Convert the font to XML with ttx. Then they can check for hidden code.

Use is as a webfont in FireFox. They have pretty good guards against malicious fonts. If it shows up in the website, ti should be fine.

---

<div class="post-metadata">

**Author:** ![davelab6](https://forum.glyphsapp.com/user_avatar/forum.glyphsapp.com/davelab6/32/429_2.png) [@davelab6](https://forum.glyphsapp.com/u/davelab6)\
**Post date:** [June 11, 2016, 11:58pm UTC](https://forum.glyphsapp.com/t/how-to-prove-the-font-contains-no-virus/4589/3 "2016-06-11T23:58:11Z")

</div>

I 100% agree with all that.

The data in an OpenType/TTF font is relatively inert except for the hinting. If a TT font is not hinted, then it is not executed in computational terms; its just data that is interpreted rather safely.

The data in a OpenType/CFF font is interpreted in a less safe way, and has been the source of some security problems; eg [http://googleprojectzero.blogspot.com/2015/07/one-font-vulnerability-to-rule-them-all.html](http://googleprojectzero.blogspot.com/2015/07/one-font-vulnerability-to-rule-them-all.html)

---

<div class="post-metadata">

**Author:** ![FKLM](https://forum.glyphsapp.com/letter_avatar_proxy/v4/letter/f/f08c70/32.png) [@FKLM](https://forum.glyphsapp.com/u/FKLM)\
**Post date:** [June 13, 2016, 7:18am UTC](https://forum.glyphsapp.com/t/how-to-prove-the-font-contains-no-virus/4589/4 "2016-06-13T07:18:32Z")

</div>

Thank you so much for your reply.  
I might be going to tell those 3 options to my client just as it is.  
Thank you again for the golden tips!

---

<div class="post-metadata">

**Author:** ![FKLM](https://forum.glyphsapp.com/letter_avatar_proxy/v4/letter/f/f08c70/32.png) [@FKLM](https://forum.glyphsapp.com/u/FKLM)\
**Post date:** [June 13, 2016, 7:18am UTC](https://forum.glyphsapp.com/t/how-to-prove-the-font-contains-no-virus/4589/5 "2016-06-13T07:18:34Z")

</div>

Thank you so much for your reply too.  
Since you agreed with GeorgSeifert, the opinion became much persuasive.

- your knowledge and case example is very helpful. Thank you very much!