Glenn Adams wrote:
> However, if authors do not explicitly declare a restriction, then we
> believe that is tantamount to declaring that access is unrestricted. That is
> the current Web model, not the converse.
>
The current Web model is not "unrestricted access". It is "permit
unrestricted cross-origin *embedding*, deny cross-origin *reading*".
Unfortunately this model requires constructing a distinction between
"embedding" and "reading" which introduces all sorts of problems, as I
described in the blog post others linked to.
Given that Firefox and IE enforce same-origin restrictions on font loads by
default, when we talk about compatibility with the "current Web model",
we're almost always talking about compatibility with the (harmful) tradition
of having a embedding/reading distinction, not compatibility with actual Web
content. People argue that font loading and other new resource loaders
should have the same problems as other resource loaders for the sake of
consistency, and I can see their point, but I still think that would be the
wrong tradeoff.
Rob
--
"If we claim to be without sin, we deceive ourselves and the truth is not in
us. If we confess our sins, he is faithful and just and will forgive us our
sins and purify us from all unrighteousness. If we claim we have not sinned,
we make him out to be a liar and his word is not in us." [1 John 1:8-10]