Slashdot Mirror
Web Open Font Format Gets Backing From Mozilla
A new format specification has reached consensus among web and type designers and is being backed by Mozilla. Dubbed Web Open Font Format (WOFF), it is an effort to bring advanced typography to the Web in a much better way. Support for the new spec will be included as a part of Firefox 3.6 which just recently hit beta. "WOFF combines the work Leming and Blokland had done on embedding a variety of useful font metadata with the font resource compression that Kew had developed. The end result is a format that includes optimized compression that reduces the download time needed to load font resources while incorporating information about the font's origin and licensing. The format doesn't include any encryption or DRM, so it should be universally accepted by browser vendors — this should also qualify it for adoption by the W3C."
Surely there are security concerns around sites using fonts where the letters are 'swapped' to obfusicate where links are actually directed?
Actually, Opera did have a hole like this recently: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3832
This might seem minor to you, but due to this restriction some of the large font foundries like fontfont and linotype will license their professional fonts for web use for the first time
I believe it when I see it. It is trivial to convert a WOFF font back to Truetype or CFF. And most WOFF fonts probably won't be subsetted, so the foundries are essentially allowing their licensees to put their complete fonts on the web downloadable for everyone.
I actually already had that unchecked; I was remembering poorly. The real tricky attack is to use onmousedown to swap out the link, something like this:
Nerd rage is the funniest rage.