Re: css3-fonts: should not dictate usage policy with respect to origin

ok, we have reviewed, and determined we prefer the from-origin, or "opt-in"
approach; we think the opt-out approach of same-origin to be
counterproductive and incompatible with current Web behavior;

regards,
glenn

On Mon, Jun 20, 2011 at 6:48 AM, Glenn Adams <glenn@skynav.com> wrote:

> We are reviewing the differences between the two mechanisms, and will
> respond shortly with an answer.
>
> G.
>
>
> On Mon, Jun 20, 2011 at 1:37 AM, Florian Rivoal <florianr@opera.com>wrote:
>
>> On Sat, 18 Jun 2011 13:02:36 +0900, Glenn Adams <glenn@skynav.com> wrote:
>>
>>  There appear to be a number of options the group(s) may consider:
>>>
>>>   - leave WOFF and CSS3-FONTS as is with respect to same-origin
>>>   requirements, and fail to resolve a formal objection from Samsung,
>>>  leaving
>>>   it to W3C management to (eventually) determine a conclusion;
>>>   - move same-origin requirements from WOFF and CSS3-FONTS to a third
>>>   "WebFonts Conformance Specification";
>>>   - move same-origin requirements from WOFF and CSS3-FONTS to HTML5 or
>>>   another definition of a UA that actually performs access functions;
>>>   - remove same-origin requirements from WOFF and CSS3-FONTS, and leave
>>>  in their place a recommendation that UA specifications or other
>>>  specifications that perform access functions using WOFF and/or
>>>   CSS3-FONTS consider and resolve access issues in the context of
>>>   those other specifications; one way of doing this would be to adopt
>>>   the alternative text I provided in an
>>>   earlier message "If a user agent that makes normative use of this
>>>   specification includes a same-origin policy, then that policy, and the
>>>   mechanisms it uses to enforce that policy should apply to the loading
>>>  of fonts via the @font-face mechanism.";
>>>   - simply remove the same-origin requirements and take no further
>>>  action;
>>>
>>
>> If we take the same origin requirements out of the WOFF and CSS3-FONTS
>> spec, and agree to put them into another document. Do you have any opinion
>> on whether the policy to be specified in this other document should be the
>> same origin policy, or rather From-Origin[1]? We (Opera) would prefer the
>> later, and as Håkon has pointed out, we agree it is better to have it in a
>> separate document.
>>
>> - Florian
>>
>> [1] Cross-Origin Resource Embedding Restrictions, aka From-Origin
>> ED: http://dvcs.w3.org/hg/from-**origin/raw-file/tip/Overview.**html<http://dvcs.w3.org/hg/from-origin/raw-file/tip/Overview.html>
>> Blog: http://annevankesteren.nl/**2011/02/from-origin<http://annevankesteren.nl/2011/02/from-origin>
>>
>
>