Re: CSS3 @font-face / EOT Fonts

bare font
 > files with same-origin restrictions, so it is unclear if font vendors 
oppose
 > it.

If they don't like linking fonts without built-in URL-binding, they 
won't like linking fonts without URL-binding but a same-origin 
restriction, because it offers no additional security for the font 
vendor. It is just a default hotlinking protection.
If someone would want to use the font without a license, he would just 
need to visit a site that uses the font, fetch it from the cache and 
upload it to a new website. Or they could install the font locally to do 
print designs with it.  And these are the problems the font foundries fear.

Nethertheless, I think the combination of a same-origin rule and Access 
Control Headers makes a lot of sense and I hope other browser will adapt 
it.

Ralf