Re: [ServiceWorker] "no-cors" CSS SOP violation (#719)

Actually, I ran into some questions about how to implement.  I posted https://lists.w3.org/Archives/Public/www-style/2015Jul/0150.html with two possibilities for handling this.

The proposal I prefer still exposes the *existence* of FontFace objects from the tainted stylesheet, and their loading status and promise.  Everything else is hidden, tho.

(If you know the name of the font, its loading status is *already* exposed to the page via layout/timing channels. This approach would further expose the *number* of fonts present in tainted sheets and the loading status/promises of the mystery fonts, which wasn't previously available, but any further restrictions seem kinda insane to spec/implement.)

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/719#issuecomment-121028352

Received on Monday, 13 July 2015 19:21:03 UTC