Re: css3-fonts: should not dictate usage policy with respect to origin

A simple use case:

   1. a font server in the cloud wishes to provide fonts for reference by
   arbitrary authors without restrictions on access;
   2. a web page author creates a page that references that font and places
   the page on a server in a different domain;
   3. the web page author expects that a UA will download the font and use
   it;
   4. the web page author does not expect to have to configure its server to
   include the entity headers to relax same-origin restrictions;

That's the way the Web works today, not only for fonts, but for all
resources.

The onus of a new mechanism should be for authors that want to use it to pay
the price of using it, namely, the ones that want restrictions have the
obligation to declare their restrictions. However, the way that you have
argued is that the burden is on those who do not use the mechanism to relax
the restrictions.

This approach is fundamentally adverse to the principle of "pay only for
what you use". You are asking those who do not use the mechanism to pay the
price, and those that use it to pay nothing.

I'm sorry, but Samsung cannot agree with this approach, and will retain the
formal objection unless the polarity is inverted.

G.


On Mon, Jun 20, 2011 at 3:22 PM, Levantovsky, Vladimir <
Vladimir.Levantovsky@monotypeimaging.com> wrote:

> Glenn,****
>
> ** **
>
> It appears that you have completely misread my intentions. I very much
> value your comments on the specification produced by the WebFonts WG, which
> reflects the consensus of the group that both same-origin restriction for
> webfonts and the provision for a mechanism to relax it is a good thing for
> web authors. Many implementers have agreed, and the recent success and
> proliferation of the use of web fonts seems to be a testament of the WG
> success. We do see the room for improvement and agree that WOFF
> specification isn’t the best place for these features to be specified, as
> noted by “feature at risk” notes placed in the spec.****
>
> ** **
>
> You seem to have a strong opinion against implementing the same origin
> restriction for webfonts, despite numerous arguments that were presented on
> this list by many people representing different categories of WG
> constituents – authors, font vendors and implementers. Like Martin Dürst
> noted earlier on this thread, I think you made it very clear as to **what**
> you want, but I am struggling to understand **why** you want this. I
> appreciate your willingness to agree to making an authorial opt-in mechanism
> a mandatory feature, but I am trying to understand the specific reasons why
> you maintain your strong objection against making same origin restriction a
> default for webfonts, something that by many other people is deemed to be a
> benefit because it solves real problems [1] that exist on the web today.
> What is the problem that you’re trying to solve by maintaining the formal
> objection against same origin restriction? I believe this discussion would
> be much more productive if we could review a use case where this creates
> problems for users or web authors.****
>
> ** **
>
> Thank you,****
>
> Vladimir****
>
> ** **
>
> [1] http://www.w3.org/TR/html-design-principles/#solve-real-problems****
>
> ** **
>
> ** **
>
> *From:* Glenn Adams [mailto:glenn@skynav.com]
> *Sent:* Monday, June 20, 2011 4:31 PM
> *To:* Levantovsky, Vladimir
> *Cc:* John Hudson; Florian Rivoal; Martin J. Dürst; Jonathan Kew; Tab
> Atkins Jr.; W3C Style; 3668 FONT; www-font@w3.org
>
> *Subject:* Re: css3-fonts: should not dictate usage policy with respect to
> origin****
>
> ** **
>
> Vlad,****
>
> ** **
>
> You appear to persist in mis-reading or mis-stating what I am saying. I
> just previously said:****
>
> ** **
>
> "I believe Samsung could agree to making an authorial opt-in mechanism a
> mandatory feature on UAs that access WOFF"****
>
> ** **
>
> That translates to respecting the consideration of authors. However, if
> authors do not explicitly declare a restriction, then we believe that is
> tantamount to declaring that access is unrestricted. That is the current Web
> model, not the converse.****
>
> ** **
>
> So please stop implying that Samsung is pursuing this point of view from a
> position of theoretical purity or lack of consideration.****
>
> ** **
>
> Samsung is pursuing this point of view because we believe that a
> restrictive default in the absence of a declaration of authorial intention
> is incompatible with current Web practice, and that it represents a backward
> incompatible change to such practice.****
>
> ** **
>
> Samsung will continue to object to a position to the contrary, so please
> record our formal objection to such a position in your documentation.****
>
> ** **
>
> G.****
>
> ** **
>
> On Mon, Jun 20, 2011 at 1:56 PM, Levantovsky, Vladimir <
> Vladimir.Levantovsky@monotypeimaging.com> wrote:****
>
> … or doesn’t work, as the case may be. Considering the existing and
> agreed-upon HTML design principle “consider users over authors over
> implementers over specifiers over theoretical purity” [1] – can you offer a
> particular use case that would justify your position?****
>
>  ****
>
> Thank you,****
>
> Vlad****
>
>  ****
>
> [1]
> http://www.w3.org/TR/html-design-principles/#priority-of-constituencies***
> *
>
>  ****
>
>  ****
>
> *From:* Glenn Adams [mailto:glenn@skynav.com]
> *Sent:* Monday, June 20, 2011 3:18 PM
> *To:* John Hudson
> *Cc:* Levantovsky, Vladimir; Florian Rivoal; Martin J. Dürst; Jonathan
> Kew; Tab Atkins Jr.; W3C Style; 3668 FONT; www-font@w3.org****
>
>
> *Subject:* Re: css3-fonts: should not dictate usage policy with respect to
> origin****
>
>  ****
>
> All. Because that is the way the Web works today.****
>
>  ****
>
> G.****
>
> On Mon, Jun 20, 2011 at 1:06 PM, John Hudson <tiro@tiro.com> wrote:****
>
> Glenn wrote:****
>
> I believe we could agree to the first, but not to the second. In fact, we
> want to make the second to read as:****
>
>  ****
>
>       UAs MUST NOT, by default, treat webfont resources as
>       same origin restricted.****
>
>  ****
>
> In the absence of an author declaring either a restriction or a relaxation,
> we believe the default should be NO restriction.****
>
>  ****
>
> For all resources, or for webfonts in particular?
>
> May I echo Tab's question, and ask why? I'd like to get a clearer idea of
> whether Samsung's position is essentially a matter of principle or has some
> particular practical import for UAs.
>
> JH****
>
>  ****
>
> ** **
>