3 ms·

I'm confused. This petition talks about cross-domain fonts, but it links to http://bugzil.la/475891 http://bugzil.la/475891 which has nothing to do with cross-

I'm confused. This petition talks about cross-domain fonts, but it links to http://bugzil.la/475891 http://bugzil.la/475891 which has nothing to do with cross-domain issues. (It's about using different fonts for different Unicode characters.) Did you mean to link to http://bugzil.la/604421 http://bugzil.la/604421 instead? Note that IE also applies same-origin restrictions to web fonts, and in fact this is required by the CSS Fonts standard [1], although this has been a somewhat contentious part of the spec [2]. The Blink team has discussed implementing this part of the spec too; Google's Tab Atkins believes that any new resource linking mechanism added to the web platform should be subject to same-origin restrictions by default [3] because this gives the platform better security characteristics. The publisher of a web font can enable cross-origin use in all browsers by sending CORS headers [4]. [1] http://www.w3.org/TR/css-fonts-3/#same-origin-restriction http://www.w3.org/TR/css-fonts-3/#same-origin-restriction [2] http://lists.w3.org/Archives/Public/www-style/2011Jun/thread.html#msg476 http://lists.w3.org/Archives/Public/www-style/2011Jun/thread... [3] https://groups.google.com/a/chromium.org/d/msg/blink-dev/TT9D5-Zfnzw/UKMHYjVe3scJ https://groups.google.com/a/chromium.org/d/msg/blink-dev/TT9... [4] https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS https://developer.mozilla.org/en-US/docs/HTTP/Access_control...

jdorfman 13y ago
Updated, thanks for pointing that out. "The publisher of a web font can enable cross-origin use in all browsers by sending CORS headers." I agree they can, but why do we need to add "Access-Control-Allow-Origin" header? What is the security risk? I am not being facetious, I really want to know.
- mbrubeck 13y ago
  So, you fixed the bug number, but what about my other points? Why single out Firefox when IE9+ has the same behavior and that behavior is required by the spec? Why don't you (or your CDN) use CORS? Why do you say this is "breaking the web" when thousands of sites are using cross-domain web fonts just fine in Firefox and IE (for example, any site that uses Google Web Fonts)? Edit: I see you added more to your comment now. There are a few reasons to require CORS for cross-domain font loads. One is so that you can use fonts that have single-site licenses in a way that satisfies the licensor, by not allowing other sites to use the font too without your authorization. Another is to prevent unintended data leaks where a malicious site can deduce things about a user based on whether that user can load a font from a different site, or based on the contents of that font. This isn't about a known attack, but a class of attack that we know from experience is likely to crop up in the future for any type of cross-origin resource load that we allow.
  - jdorfman 13y ago
    "Why single out Firefox when IE9+ has the same behavior and that behavior is required by the spec?" I don't expect Microsoft to listen to their customers/users. I used to think Mozilla did but apparently not.
    - mbrubeck 13y ago
      Hey, I'm part of Mozilla and I spent a significant part of my day researching this spec, and asking questions and listening to try and find out why your use case wasn't being met. Usually we prefer well-reasoned bug reports or emails as apposed to "Fucking fix it" on the HN front page, but we'll take feedback where we find it. :) Also note that if you can't convince Microsoft to change this as well, then it doesn't matter too much what Mozilla does (at least for sites that need to support IE).
    - jdorfman 13y ago
      @mbrubeck I know you are part of Mozilla and I respect the work that you and Mozilla have done for the FOSS community, I just think Mozilla is off on this one issue. "Usually we prefer well-reasoned bug reports or emails as apposed to "Fucking fix it" on the HN front page, but we'll take feedback where we find it. :)" You know just as much as I know that email is dead ;)
    - mbrubeck 13y ago
      Your first comment on your own petition was "Because every other browser supports cross-domain fonts except you" which is false. It looks like you filed this based on the blog post you linked to, which is three years out of date. (For example, it said S3 does not support CORS, which is no longer true.)
  - jdorfman 13y ago
    "One is so that you can use fonts that have single-site licenses in a way that satisfies the licensor, by not allowing other sites to use the font too without your authorization." Good point but I believe that the only way to combat that particular edge-case is to use something like the valid_referers directive: https://gist.github.com/jdorfman/6737413 https://gist.github.com/jdorfman/6737413 "This isn't about a known attack, but a class of attack that we know from experience is likely to crop up in the future for any type of cross-origin resource load that we allow." You bring up another good point, but I am not talking about every cross-origin resource here, I am talking about Content-Type: font/ttf, application/x-woff, application/vnd.ms-fontobject & image/svg+xml.

jdorfman 13y ago

Updated, thanks for pointing that out. "The publisher of a web font can enable cross-origin use in all browsers by sending CORS headers." I agree they can, but why do we need to add "Access-Control-Allow-Origin" header? What is the security risk? I am not being facetious, I really want to know.

mbrubeck 13y ago
So, you fixed the bug number, but what about my other points? Why single out Firefox when IE9+ has the same behavior and that behavior is required by the spec? Why don't you (or your CDN) use CORS? Why do you say this is "breaking the web" when thousands of sites are using cross-domain web fonts just fine in Firefox and IE (for example, any site that uses Google Web Fonts)? Edit: I see you added more to your comment now. There are a few reasons to require CORS for cross-domain font loads. One is so that you can use fonts that have single-site licenses in a way that satisfies the licensor, by not allowing other sites to use the font too without your authorization. Another is to prevent unintended data leaks where a malicious site can deduce things about a user based on whether that user can load a font from a different site, or based on the contents of that font. This isn't about a known attack, but a class of attack that we know from experience is likely to crop up in the future for any type of cross-origin resource load that we allow.
- jdorfman 13y ago
  "Why single out Firefox when IE9+ has the same behavior and that behavior is required by the spec?" I don't expect Microsoft to listen to their customers/users. I used to think Mozilla did but apparently not.
  - mbrubeck 13y ago
    Hey, I'm part of Mozilla and I spent a significant part of my day researching this spec, and asking questions and listening to try and find out why your use case wasn't being met. Usually we prefer well-reasoned bug reports or emails as apposed to "Fucking fix it" on the HN front page, but we'll take feedback where we find it. :) Also note that if you can't convince Microsoft to change this as well, then it doesn't matter too much what Mozilla does (at least for sites that need to support IE).
  - jdorfman 13y ago
    @mbrubeck I know you are part of Mozilla and I respect the work that you and Mozilla have done for the FOSS community, I just think Mozilla is off on this one issue. "Usually we prefer well-reasoned bug reports or emails as apposed to "Fucking fix it" on the HN front page, but we'll take feedback where we find it. :)" You know just as much as I know that email is dead ;)
  - mbrubeck 13y ago
    Your first comment on your own petition was "Because every other browser supports cross-domain fonts except you" which is false. It looks like you filed this based on the blog post you linked to, which is three years out of date. (For example, it said S3 does not support CORS, which is no longer true.)
- jdorfman 13y ago
  "One is so that you can use fonts that have single-site licenses in a way that satisfies the licensor, by not allowing other sites to use the font too without your authorization." Good point but I believe that the only way to combat that particular edge-case is to use something like the valid_referers directive: https://gist.github.com/jdorfman/6737413 https://gist.github.com/jdorfman/6737413 "This isn't about a known attack, but a class of attack that we know from experience is likely to crop up in the future for any type of cross-origin resource load that we allow." You bring up another good point, but I am not talking about every cross-origin resource here, I am talking about Content-Type: font/ttf, application/x-woff, application/vnd.ms-fontobject & image/svg+xml.