A latency and performance nightmare... yes, quite possibly. A privacy nightmare? I don't see how (unless you had to register on the font-serving machine and i

A latency and performance nightmare... yes, quite possibly. A privacy nightmare? I don't see how (unless you had to register on the font-serving machine and it tracked fonts downloaded -- but is that really privacy invading?) Yes, there would be trade-offs (didn't I say that a couple of times?), but such is the price potentially paid for font renderer security... That is -- get rid of the font renderer software component... Hey, one other idea, while I'm at it... run the font renderer in a virtual machine... that could possibly work too... although given that virtual machines have the same issues with complexity and security bugs, I'm sort of 50/50 about that... Another idea: You could have a completely sandboxed language VM -- (e.g., JVM), and if that language VM is provably secure -- run the font renderer code on it... But again, we've seen JVM security bugs so... I'm going to have to go with either "shrink a big bitmap" or "put the font renderer on an entirely different server and serve exact-sized bitmaps" ideas... Or... use a 64K computer from the 1980's where the glyphs are in ROM... <g>