15:48:09 <RRSAgent> RRSAgent has joined #webfonts
15:48:14 <RRSAgent> logging to https://www.w3.org/2025/05/20-webfonts-irc
15:55:36 <Vlad> zakim, start meeting
15:55:36 <Zakim> RRSAgent, make logs Public
15:55:38 <Zakim> Meeting: Web Fonts Working Group Teleconference
15:55:48 <Vlad> present+
16:00:54 <skef> skef has joined #webfonts
16:01:52 <Garret> Garret has joined #webfonts
16:04:02 <scott> scott has joined #webfonts
16:05:36 <skef> present+
16:06:27 <ChrisL> present+
16:06:58 <Garret> Topic: review open issue #276
16:07:06 <Garret> present+
16:07:25 <scott> present+
16:07:36 <Vlad> scribenick Garret
16:08:35 <Garret> Garret: makes sense, I initially left this a little vague.
16:09:03 <Garret> Chris: you can use css fonts 4 which now includes the use of fetch as a reference.
16:09:07 <ChrisL> See https://drafts.csswg.org/css-fonts-4/#font-fetching-requirements for an example
16:09:13 <Garret> Garret: sounds good, I'll look at that and can draft some changes.
16:10:54 <Garret> Topic: issue #275 defining what happens when url fails to parse.
16:11:11 <Garret> Garret: I believe this is already addressed, but I'll double check and update the issue/spec as needed.
16:11:26 <Garret> Chris: need to stop trying to extend the font in some failure cases.
16:11:36 <Garret> Garret: yes, I believe we have language for this, but I'll double check.
16:14:28 <Garret> Topic: issue #272 leaking exact content of an element.
16:14:55 <Vlad> related to review comment: https://github.com/w3ctag/design-reviews/issues/1057#issuecomment-2857845270
16:19:11 <Garret> Chris: talked to author of the exploit and didn'tsee IFT as an issue.
16:20:44 <Garret> Skef: have some questions about dynamic patch generation. If you have a server that can accept a dynamic patch how do you know it came from a valid patch map.
16:25:21 <Garret> Garret: one way to solve this is to have the dynamic urls encrypted to make sure the hoster is the only one who can craft valid urls
16:25:43 <Garret> Skef: I think we should have security guidance that the dynamic mappings should be deterministic.
16:25:50 <Garret> Skef: is dynamic patching an exception?
16:26:06 <Garret> Garret: yes, static patching is intended to be the main use case. The open source encoder will likely only do static.
16:26:25 <Garret> Garret: agreed, we should add some text to the security section about the dynamic graphs being deterministic.
16:27:26 <Garret> Garret: one additional change from that issue is we should make non invalidating patch fetch ordering deterministic (use patch map entry order).
16:30:43 <Garret> Garret: will close issue 272 and open new issue for fetch ordering.
16:31:17 <Garret> Topic: issue 267
16:31:28 <Garret> Garret: have a plan for this one, just haven't had time to get to it yet.
16:32:18 <Garret> Topic: issue 259 uri templates
16:32:56 <Garret> Garret: will ping Anne and see if the op code approach is OK.
16:37:37 <Garret> Garret: ift encoder updates - CFF/CFF2 support in client and server and demo, preload lists (for invalidating patches) added to encoder and client (not demo yet, but comingsoon)
16:38:16 <Garret> Skef: want to say thanks from Adobe for getting CFF/CFF2 support and for harfbuzz. Recently we opened a harfbuzz issue and it got fixed very quickly which was really nice.
16:41:42 <Garret> Vlad: for next call aim to be on June 10th, possible might need to postpone to 17th due to availability.
16:41:50 <ChrisL> Looks like some of the fetch stuff was moved to css-cascade-4
16:41:52 <ChrisL> https://github.com/w3c/csswg-drafts/commit/69379fb02650162271e2d4e6bd8c0c8f6bb27903
16:43:07 <Vlad> rrsagent, make minutes
16:43:09 <RRSAgent> I have made the request to generate https://www.w3.org/2025/05/20-webfonts-minutes.html Vlad
18:29:52 <Zakim> Zakim has left #webfonts