00:04:14 jdaggett has joined #css 00:08:06 danield has joined #css 00:08:39 smfr has joined #css 00:10:30 shans has joined #css 00:11:33 ScribeNick: hober 00:11:44 Topic: CSS3 Fonts 00:12:10 vhardy has joined #css 00:12:16 jdaggett: Two issues: same-origin restriction & super/sub-script handling 00:12:29 http://dev.w3.org/csswg/css3-fonts/#same-origin-restriction 00:12:34 jdaggett: starting with the same-origin restriction 00:12:44 sylvaing has joined #css 00:13:50 jdaggett: came out of discussion in fonts/woff group 00:14:34 jdaggett: description of SOR used to be in an appendix of the css3 fonts spec 00:14:50 jdaggett: fonts group's charter calls for making SOR a requirement 00:15:04 jdaggett: now we have a split between woff spec & css3 fonts spec 00:15:22 jdaggett: objection from apple that it doesn't make sense for SOR to be tied to the format 00:15:37 jdaggett: we came to conclusion that it makes sense for this to live in the css3 fonts spec 00:15:46 jdaggett: the text has been moved into the body from the appendix 00:16:05 TabAtkins has joined #css 00:16:08 jdaggett: open issues: what should the default behavior be 00:16:23 ff & ie? restrict by default, allow CORS for relaxing 00:16:34 jdaggett: annevk thinks this is weird 00:16:51 jdaggett: inconsistent with other parts of web platform 00:17:04 jdaggett: problems with data leakage 00:17:23 jdaggett: e.g. canvas' dirty flag 00:17:43 jdaggett: [describes example of embedding security problem on whiteboard] 00:18:51 murakami has joined #css 00:19:41 jdaggett: these issues are beyond fonts & images 00:20:09 jdaggett: there are even issues if script can see the response code from certain cross-origin images 00:20:24 jdaggett: we have normative prose (section 4.8.1) 00:20:33 jdaggett: annevk doesn't like the default restriction 00:20:53 jdaggett: he'd prefer no restriction by default & users would need to explicitly set an exception 00:21:12 sylvaing: annevk's first objection is that CORS isn't the right tech for this 00:21:26 florian has joined #css 00:21:38 jdaggett: [as annevk] the web has evolved because people can link willy-nilly 00:21:44 florian: why solve this for fonts only? 00:21:51 Bert: fonts are different 00:22:06 siteA --> siteB gimme xxx 00:22:06 siteA <-- here you go (no CORS header) 00:22:06 UA sees no CORS header, doesn't download resource 00:22:07 jdaggett: how does the existing text in 4.8.1 work? 00:22:27 florian has left #css 00:22:40 siteA --> siteB gimme xxx 00:22:40 siteA <-- here you go (CORS header: siteB use ok -or- all sites ok) 00:22:40 UA sees CORS header, check for a match, downloads resource 00:22:58 florian has joined #css 00:23:41 jdaggett: instead, annevk's proposal: 00:23:59 siteA --> siteB gimme xxx 00:23:59 link to where annevk discusses this: http://annevankesteren.nl/2011/02/from-origin 00:23:59 siteA <-- siteB here you go (no From-Origin header) 00:23:59 UA sees no From-Origin restriction, 00:24:04 jdaggett: explicit restriction instead of explicit relaxation 00:24:24 siteA --> siteB gimme xxx 00:24:25 siteA <-- siteB here you go (From-Origin: no cross-linking please) 00:24:25 UA sees From-Origin restriction, doesn't download resource 00:24:51 szilles has joined #css 00:24:56 jdaggett: this could be used for images, scripts, wider set of resource types 00:25:13 jdaggett: both ff & ie have implemented the cors approach 00:25:21 jdaggett: others haven't impled eithet 00:25:25 s/eithet/either/ 00:25:36 jdaggett: consensus that some kind of mechanism is a good thing 00:25:53 jdaggett: don't want to allow cross-origin font linking by default 00:26:09 jdaggett: the cors approach hits the 80/20 point for fonts 00:26:29 jdaggett: vs. the from-origin proposal, which requires you to raise a flag to get the typical behavior 00:26:45 florian: yes for fonts, but for all resources, from-origin hits the default correctly 00:26:59 jdaggett: should the default for fonts be different? 00:27:26 jdaggett: our (ff) security guys think all new resource types should default to SOR 00:27:49 TabAtkins: [describes attack that extracts font data out of a tainted ] 00:27:57 Bert: the problem is the javascript, not the resources 00:28:12 TabAtkins: then you wouldn't be able to do anything with fonts in javascript 00:28:16 TabAtkins: e.g. canvas 00:28:29 dbaron: or figure out the width of text 00:28:42 Bert: there should be 2 kinds of things on the web: programs and documents 00:28:58 Bert: text/html is document, maybe application/html could have these restrictions 00:29:04 jdaggett: existing content 00:29:28 Bert: the power of the web is transclusion 00:30:19 jdaggett: we can't get there from here 00:30:50 TabAtkins: [describes