W3C home > Mailing lists > Public > www-font@w3.org > July to September 1996

Re: Protecting WebFonts

From: <lee@sq.com>
Date: Fri, 23 Aug 96 12:46:52 EDT
Message-Id: <9608231646.AA03967@sqrex.sq.com>
To: gdr@cataneo.bitstream.com, mduerst@ifi.unizh.ch
Cc: lee@sq.com, michael@cascadilla.com, www-font@w3.org
>> [...]  people in a corporate environment using a firewall probably can't
>> see the font at all.  Worse, SSL isn't in all browsers, and there are

> Actually, I think this has a positive for people in a corporate site
> behind the firewall.

That they can't see embedded fonts at anyone else's sites?
I don't think that will go over very well.

Corporate users are a large part of Netscape and Microsoft's revenue :-)

Maybe Netscape could say that relying on SSL to use fonts would increase
their Communications Server sales, though, and not mind too much.

However all that may be, SSL only pretects data from being copied whilst
in transmission.  If the (encryptyed) font is available at a published
URL, there is no point in uing SSL whatsoever -- instead of stealing
the transmitted packets, you could easily fetch the same data from the
URL directly.

Once the font has arrived, the issues are
1 is it ever stored decrypted
  (e.g. what is stored in the browser cache should be the same byte sequence
  that was received over the network, not the decrypted font)

2 when you print to a file, making a PostScript file on disk,
  how easy is it ti remove the font and reuse it?
  (this is where I suggested the use of random encodings)

3 is the font ever installed as a system font?
  (not doing this requires that the browser have its own font renderer.
  This will be necessary under X Windows, which does not in general allow
  dynamic font downloading; in environments that are more typographically
  aware, care is needed to make sure that the font remains private to the
  browser.  If I'm looking at a page in Bembo, I shouldn't be able to get
  out MS Word and use Bembo & print just because another application is
  using the font.

4 can a font published at one site be used by another site without an
  intervening font purchase?  In other words, if you use Berthold Bembo 
  for your web pages, and I decide I like it better than Monotype Bembo,
  I must not be able to use the URL of your copy of Membo in my style sheets,
  because then I am publishing using someone else's font.  I should have
  to buy Berthold Bembo.

  It would be helpful if the OpenType font format could include
  * the URL for the vendor who sold the font
  * the URL for the foundry where the font was made
  along with copyright notices and a textual version of the URLs.
  Eventually these may become URNs, I suppose.

  Then I can say:

5 Web User Agents must be able to display font copyright and vendor contact
  information, using a method that is visible (e.g. a menu item, not an
  undocumented control-shift-meta-right-click Easter-egg option)

Lee
Received on Friday, 23 August 1996 12:48:16 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 22:37:29 UTC