Re: IE4 font security flaw

Jelle Bosma wrote:

>For the porpose of embedding: TrueType and OpenType
>is the same thing. OpenType is a more like an extension of TrueType
>than TrueType a subset of OpenType.

Correct. The signature table in OpenType has the potential to improve
overall security, or at least make stray copies easily identifiable, but the
security re. embedding is still based on the embedding bit information.

Foundries need to be clear about the importance of the ebedding bit, and it
helps no one to speak of 'stupid' foundries if the foundries have been
misinformed. Nor is it helpful to speak of 'stupid foundries' if a new
technology (WEFT) extends an old technology (font embedding) to a new
medium. It is quite within reason that a foundry might have little
opposition to font embedding in Word documents, but serious opposition to
embedding in websites. The potential for piracy is drastically increased by
web embedding. For a font to be embeddable in a Word document increases the
value of that font for the user, and this increase in value may offset the
risk of piracy. When the risk factor is increased, this will almost
certainly no longer be the case.

When Adobe first invited the major type companies to extend their EULAs to
permit embedding in Acrobat, they were less than forthright about the
security risks involved. I wonder to what degree MS stressed the importance
of the embedding bit setting; after all, embeddable fonts increase the value
of MS apps.

John Hudson

Tiro Typeworks
Vancouver, BC
www.tiro.com
tiro@tiro.com

Received on Friday, 24 October 1997 17:53:05 UTC