W3C home > Mailing lists > Public > public-webfonts-wg@w3.org > February 2011

Re: Minutes, 16 February 2011 WebFonts WG telcon

From: John Daggett <jdaggett@mozilla.com>
Date: Sun, 20 Feb 2011 20:03:23 -0800 (PST)
To: Maciej Stachowiak <mjs@apple.com>
Cc: Dave Crossland <dave@lab6.com>, public-webfonts-wg@w3.org
Message-ID: <483041484.396708.1298261003328.JavaMail.root@cm-mail03.mozilla.org>
Maciej Stachowiak wrote:

> >> and CORS being off the table take us to is either WOFF with
> >> SOR being addressed by FO or with SOR not being addressed.
> >> 
> >> Is CORS really totally off the table?
> > 
> > CORS is a mechanism to relax a same-origin restriction.  The
> > two options here are "same origin restriction by default with
> > CORS to relax" vs. "From-origin with the default for all
> > resource types set to unrestricted".
> Those aren't the only two options, there is also:
> - From-origin with the default for most resource types set to
> unrestricted, but defaulting to same-origin for fonts.
> In general, what protocol to use to change restrictions on font
> embedding can be decoupled from the question of what the
> default is for fonts. As I said before, I think we have the
> following three distinct issues:

Right, this third option is effectively "same origin restriction
by default with From-origin to relax".

> > The first option is what we've spec'ed so far.  To use
> > 'From-Origin' would mean either delaying the WOFF spec until
> > the details of 'From-Origin' are hashed out or decoupling the
> > WOFF format from the discussion of origin restrictions
> > altogether and issuing some form of addendum later after the
> > details of From-Origin have been worked out.
> Another option is to remove normative requirements on this
> topic from WOFF, spec linking restrictions in the CSS3 Fonts
> spec where they actually belong, and at most add a
> non-normative note about it to WOFF.

Yes, but that's just shifting the inter-spec dependency around.
In my mind the key question is whether to wait for 'From-origin'
to be specified.  One possible way to do avoid delaying the
entire CSS3 Fonts spec would be to define the default same origin
restriction for @font-face loading in CSS3 Fonts with a
non-normative note stating that the method for relaxing this
restriction will be worked out later (i.e. CORS or From-origin).
The CSS3 Fonts spec currently describes the same origin
restriction in a non-normative appendix.


John Daggett
Received on Monday, 21 February 2011 04:03:57 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 20:34:15 UTC