4 ms·

It would also be nice if Firefox would solve this. If we can load an image from another domain we should be able to load a font from another domain by default.

It would also be nice if Firefox would solve this. If we can load an image from another domain we should be able to load a font from another domain by default. Though I do see how a font has more potential for malware than an image, the other browser makers apparently don’t see any qualms with cross-domain font loading. Anyone know Firefox’s rationale for doing this differently from the other vendors?

gcp 14y ago
It's required by the standard. Firefox complies with the standard, the other browsers don't, so there is nothing for Firefox to "fix". http://dev.w3.org/csswg/css3-fonts/#same-origin-restriction http://dev.w3.org/csswg/css3-fonts/#same-origin-restriction Some related discussion: https://bugzilla.mozilla.org/show_bug.cgi?id=604421 https://bugzilla.mozilla.org/show_bug.cgi?id=604421
- wiradikusuma 14y ago
  At least they should allow it for root domain to access subdomain's. I put all static files in a subdomain to make them free of cookies, but such restriction makes things difficult.
- lucisferre 14y ago
  The reasoning given, that font vendors don't want people linking to their fonts, seems pretty wrong headed. This is just another stupid standard making life harder and hurting productivity for web developers. I've never managed to fully understand the purpose of any cross-domain rules on the browser. So many can be easily (relatively) circumvented, why waste people's time at all?
robin_reala 14y ago
An image is data. A font is an executable. There’re good reasons to not allow this.
- camo 14y ago
  So is javascript. This is a ridiculous argument - there are no "good" reasons only a lot of FUD and font vendors who want this as a roundabout form of asset protection. The fonts are accessible by anyone who can use wget and can be copied and hosted anywhere else instead. Useless on all fronts, this just restricts the public web from end users. Do not forget that the website must link to the asset in question. Why would they link to something they don't trust? Everyone trusts jQuery to not be malicious and everyone has links to cross-origin code running on their site. This is what makes the web a "web". Otherwise you would only be able to link with yourself.
- barrkel 14y ago
  Code is data; data is code. There is no fundamental distinction. Image decoders interpret a code, the output of which is a bitmap.

gcp 14y ago

It's required by the standard. Firefox complies with the standard, the other browsers don't, so there is nothing for Firefox to "fix". http://dev.w3.org/csswg/css3-fonts/#same-origin-restriction http://dev.w3.org/csswg/css3-fonts/#same-origin-restriction Some related discussion: https://bugzilla.mozilla.org/show_bug.cgi?id=604421 https://bugzilla.mozilla.org/show_bug.cgi?id=604421

wiradikusuma 14y ago
At least they should allow it for root domain to access subdomain's. I put all static files in a subdomain to make them free of cookies, but such restriction makes things difficult.
lucisferre 14y ago
The reasoning given, that font vendors don't want people linking to their fonts, seems pretty wrong headed. This is just another stupid standard making life harder and hurting productivity for web developers. I've never managed to fully understand the purpose of any cross-domain rules on the browser. So many can be easily (relatively) circumvented, why waste people's time at all?

robin_reala 14y ago

An image is data. A font is an executable. There’re good reasons to not allow this.

camo 14y ago
So is javascript. This is a ridiculous argument - there are no "good" reasons only a lot of FUD and font vendors who want this as a roundabout form of asset protection. The fonts are accessible by anyone who can use wget and can be copied and hosted anywhere else instead. Useless on all fronts, this just restricts the public web from end users. Do not forget that the website must link to the asset in question. Why would they link to something they don't trust? Everyone trusts jQuery to not be malicious and everyone has links to cross-origin code running on their site. This is what makes the web a "web". Otherwise you would only be able to link with yourself.
barrkel 14y ago
Code is data; data is code. There is no fundamental distinction. Image decoders interpret a code, the output of which is a bitmap.