RE: DRAFT: WebFonts WG liaison to CSS WG

Again, my apologies for missing the call today. No excuses :(

As you know the CSS WG did discuss this and it does seem awkward for CSS3 Fonts to define a specific protocol-level mechanism to handle this. Moreover, our charter [1] included a conformance specification that covered 'access policies such as same-origin and CORS', a deliverable that was separate from CSS3 Fonts.

I understand that for all intent and purposes this WG only cares about WOFF and other formats loaded through @font-face so requiring same-origin in CSS3 Fonts does seem attractive. But I'm not sure protocol-level access policy is any more the scope of CSS3 Fonts than file formats ever were, or should be.

I think of Web Fonts conformance as a superset of CSS3 Fonts i.e. conformance with the latter is necessary but not sufficient. Just like we agreed long ago it's not OK to only support SVG fonts, one must support WOFF: this not something CSS3 Fonts can mandate either. Our conformance spec was also supposed to address this exact agreement ('WOFF will be the required format for compliance, the others being optional').

From-Origin or CORS, WOFF and CSS3 Fonts: conformance with all three pieces cannot really be required by any of the three; they are and should imo remain orthogonal to each other. Doesn't this WG define how these three, or four or however many specs define a conformant web fonts UA ?

[1] http://www.w3.org/2009/08/WebFonts/charter.html

From: public-webfonts-wg-request@w3.org [mailto:public-webfonts-wg-request@w3.org] On Behalf Of Levantovsky, Vladimir
Sent: Wednesday, June 22, 2011 8:59 AM
To: 3668 FONT
Subject: DRAFT: WebFonts WG liaison to CSS WG

Hello WG,

Please see below the draft text of the liaison. I would like to discuss this today during the telcon, your comments are very much appreciated.

Thank you,
Vlad


WebFonts WG would like to thank the CSS WG for allocating the time for a detailed discussion of same-origin restriction during the most recent CSS WG meeting (http://lists.w3.org/Archives/Public/www-style/2011Jun/0329.html).

WebFonts WG has been working hard to finalize the text of the WOFF 1.0 specification, where the requirement for same-origin restriction was originally placed according to the group charter. The WG has agreed that same-origin restriction is a very useful feature that plays an important role in advancing the state of the art typography on the web, and that it also facilitates the use of high quality fonts by helping authors to comply with most typical web font license conditions without any additional overhead. As part of the original WOFF specification work, the same-origin restriction is also believed to be a significant factor that influenced a wide-spread offering of commercial fonts for web use.

Even though the WG reached a consensus on same origin restriction and the use of CORS[2] as a way to relax it, the discussion continued as new proposals (such as "From-Origin" proposal from Anne van Kesteren [3]) and other considerations [4] were brought up. As a result, we strongly believe that these features are indeed useful and necessary but will be best addressed in the CSS3 Font module. We believe that same-origin restriction would be easier to implement if it is defined as a use-based (or link-specific) restriction by way of applying it to any resource that is linked via @font-face (as opposed to it being either format or media type specific), and this is actually the way all existing implementations support it today. The WG also believes that "From-Origin" header proposal is a better, more generic way to control resource sharing.

The WebFonts WG asks the CSS WG to support the changes introduced in the most recent version of the Editor's draft of the CSS3 Fonts module and include a normative requirement for same-origin restriction be applied for resources linked via @font-face mechanism. The WG believes that this solution would be most beneficial for the majority of authors by providing them with a way to use web fonts with no additional work, especially in those circumstances where the server configuration headers cannot be modified by authors, or where other solutions (e.g. referrer checking) would be required to comply with font licenses.


[1] http://lists.w3.org/Archives/Public/www-style/2011Jun/0329.html
[2] http://www.w3.org/TR/cors/
[3] http://dvcs.w3.org/hg/from-origin/raw-file/tip/Overview.html
[4] http://lists.w3.org/Archives/Public/public-webfonts-wg/2011Feb/0048.html