Subject: Re: [websec] font sniffing

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 09 Nov 2011 10:29:10 -0700

On 10/25/11 12:42 AM, Tobias Gondrom wrote:
> On 25/10/11 07:30, "Martin J. Dürst" wrote:
>> On 2011/10/25 11:34, Anne van Kesteren wrote:
>>> On Tue, 25 Oct 2011 10:43:25 +0900, Martin J. Dürst
>>> <[email-masked]> wrote:
>>>>> But who is at fault is not what we are interested in here I think. We
>>>>> are interested in defining when implementations have to sniff. They
>>>>> very
>>>>> much have to sniff for fonts.
>>>>
>>>> Yes. If somebody has enough energy, it would still make sense to
>>>> register font types.
>>>
>>> Because..?
>>
>> - Font formats, as well as other Mime types, are not only used by Web
>> browsers.
>> - There may be new formats, for which no sniffing is done yet.
>> - Servers may prefer to declare what they are sending out rather than
>> to be silent about it, even if not all clients use that information.
>> - Once we have registered types, sniffing could in the long term maybe
>> even go away.
>>
>> Regards,   Martin.
> +1 for that.

Based on discussion here and at the W3C TPAC last week, I raised this 
issue on the apps-discuss list:

http://www.ietf.org/mail-archive/web/apps-discuss/current/msg03447.html

The immediate reaction was: "do you mean fonts or typefaces?"

Before taking on this work, it would be helpful to understand exactly 
what typographic entities are being sent around by browsers and other 
applications.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Adam Barth <[email-masked]>
Date: Wed, 9 Nov 2011 09:30:35 -0800

On Wed, Nov 9, 2011 at 9:29 AM, Peter Saint-Andre <[email-masked]> wrote:
> Based on discussion here and at the W3C TPAC last week, I raised this issue
> on the apps-discuss list:
>
> Before taking on this work, it would be helpful to understand exactly what
> typographic entities are being sent around by browsers and other
> applications.

Mechanically, resource representations that might get shoved into
@font-face rules.

Adam

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 09 Nov 2011 10:39:56 -0700

On 11/9/11 10:30 AM, Adam Barth wrote:
> On Wed, Nov 9, 2011 at 9:29 AM, Peter Saint-Andre<[email-masked]>  wrote:

Based on Anne's previous message to this list [1], it seems that we're 
actually talking about font representation formats (his examples are 
TrueType Collection, OpenType, TrueType, and Web Open Font Format) 
instead of particular fonts (e.g., "12pt Georgia Bold Italic") or 
typefaces (e.g., "Georgia").

Correct?

/psa

[1] http://www.ietf.org/mail-archive/web/websec/current/msg00235.html

---

From: "Anne van Kesteren" <[email-masked]>
Date: Wed, 09 Nov 2011 09:42:47 -0800

> typefaces (e.g., "Georgia").

Yes. Font formats, not font families.

-- 
Anne van Kesteren
http://annevankesteren.nl/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 09 Nov 2011 10:44:22 -0700

On 11/9/11 10:42 AM, Anne van Kesteren wrote:
> On Wed, 09 Nov 2011 09:39:56 -0800, Peter Saint-Andre
> <[email-masked]> wrote:

Thanks for the clarification. That makes like much easier. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 09 Nov 2011 10:45:55 -0700

> Thanks for the clarification. That makes like much easier. :)

s/like/life/

There's still the general question of how useful it would be to define 
either a top-level content type or subtypes like application/woff, but 
at least we've constrained the problem space quite a bit here...

/psa

---

From: Adam Barth <[email-masked]>
Date: Wed, 9 Nov 2011 10:13:56 -0800

On Wed, Nov 9, 2011 at 9:39 AM, Peter Saint-Andre <[email-masked]> wrote:
>>> what
> TrueType Collection, OpenType, TrueType, and Web Open Font Format) instead
> of particular fonts (e.g., "12pt Georgia Bold Italic") or typefaces (e.g.,
> "Georgia").
>
> Correct?

Yep.

Adam