RE: [css3-fonts] recent edits

Cross-posting w3c-css-wg-answer below, with minor edits...

> -----Original Message-----
> From: www-font-request@w3.org [mailto:www-font-request@w3.org] On Behalf
> Of Håkon Wium Lie
> Sent: Wednesday, May 11, 2011 6:07 AM
> To: John Daggett
> Cc: W3C style mailing list; www-font@w3.org
> Subject: Re: [css3-fonts] recent edits
> 
> John Daggett wrote:
> 
>  > Based on discussions with the Fonts WG, in the latest editor's  > draft
> of the CSS3 Fonts spec I've moved the description of the  > same-origin
> restriction from an appendix into the section where  > the @font-font rule
> is defined:
>  >
>  >   http://dev.w3.org/csswg/css3-fonts/#same-origin-restriction
>  >
>  > This was done to reflect the rough consensus that allowing for  > some
> form of origin restriction for fonts with the ability to  > relax it was
> desirable.
>  >
>  > There's been disagreement about the exact way to relax the  >
> restriction, whether to use CORS which both Firefox and IE9 use,  > or to
> come up with a more general mechanism for all linked  > resource types
> (Anne's From-Origin proposal), so there's wording  > noting that the exact
> mechanism used may change.
> 
> Anne's proposal is sketched here:
> 
>   http://dvcs.w3.org/hg/from-origin/raw-file/tip/Overview.html
> 
> and argued for here:
> 
>   http://annevankesteren.nl/2011/02/from-origin
> 
> I like the idea of having one mechanism for all web resources. This way,
> css3-fonts doesn't need to say anything about HTTP headers and such (which
> arguable is outside its scope). If we -- in CSS -- introduce a mechanism
> for @font-face, it's unlikely that a web-wide mechanism will be
> established.
> 
> However, introducing a new web-wide mechanism is a big deal which needs
> acceptance from more than just the css/fonts folks.
> 
> For now, I propose adding references to Anne's proposal in the issues:
> 
>   http://dev.w3.org/csswg/css3-fonts/#same-origin-restriction
> 

As you well know, the problem for the Fonts WG is not whether a web-wide mechanism 
is better than a type-specific one. The open issue is to agree on what the default 
origin policy is for fonts downloaded through the src descriptor in @font-face. 
The Fonts WG consensus to date was that @font-face should assume a From-Origin:same 
response when the server doesn't set the header's value.

This is where the disagreement, I think, remains. I don't believe anyone cares what the 
header name or value are. I certainly don't (modulo the fact that we'll need to handle 
both for backward compatibility but that comes with the territory).

Once this is resolved, the issue of which spec should define the solution is a relatively 
simple cross-group agreement imo. Followed by the harder part of actually taking the new 
From-Origin draft to REC and getting implementations. 

In the meantime, it's reasonable for the Fonts WG to document this requirement until the
issue is fully resolved.

Received on Wednesday, 11 May 2011 16:09:46 UTC