Subject: [apps-discuss] Content Types for Fonts?

From: Tobias Gondrom <[email-masked]>
Date: Thu, 24 Mar 2011 19:55:06 +0000

Hello all,

maybe someone here can give some help/advice on this.
At websec we have a draft on Mime type sniffing algorithms to improve on
consistency of browser algorithms for mime type determination (and by
thus improve security):
http://www.ietf.org/id/draft-ietf-websec-mime-sniff-02.txt

Recently a comment came up with regard to identifying fonts (e.g.
referenced in style sheets).
AFAIK fonts don't have registered mime/content types, so browsers
already just use sniffing algorithms for them.
And without them having a registered content/mime type, it's kind of a
flawed logic to add this to the draft for mime sniffing.

On the other hand it might make sense to add content types for fonts to
the IANA registry?
http://www.iana.org/assignments/media-types/index.html

Has that ever come up? Or are they already registered and I missed them?
Or is this a bad idea?

Any opinions welcome...

BR, Tobias
(websec chair)

---

From: Thomas Roessler <[email-masked]>
Date: Thu, 24 Mar 2011 21:03:49 +0100

Relevant here:
	http://www.w3.org/TR/WOFF/#appendix-b

Regards,
--
Thomas Roessler, W3C  <[email-masked]>  (@roessler)

On 24 Mar 2011, at 20:55, Tobias Gondrom wrote:

> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Fri, 25 Mar 2011 06:30:08 +0100

>flawed logic to add this to the draft for mime sniffing.

The draft refers to application/x-rar-compressed, application/x-gzip,
unknown/unknown, application/unknown, application/rss+xml, image/webp,
video/webm. They are all unregistered, and in case of the first two,
cannot be registered without changing BCP 13. Are those a problem as-
well?

>Has that ever come up? Or are they already registered and I missed them?

I don't think there is anything special about fonts that would make
that a bad idea compared to other kinds of resources. There has been
some interest in this and there have been some efforts, for example,
<http://tools.ietf.org/html/draft-singer-font-mime-00>, but as far
as I am aware nobody has gone so far as to ask the IESG to actually
approve a font media type.

(I think it might be best for the Applications Area Working Group to
draw up a list of common data formats with unregistered media types
and make a bulk specification that contains the absolute minimum to
register them all. If it were to do so, throwing in a couple of font
types should be no problem.)
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 25 Mar 2011 20:38:54 +0100

Bjoern Hoehrmann wrote:

>cannot be registered without changing BCP 13.
>
Right.

>Are those a problem as-well?
>
Yes.

>approve a font media type.
I don't see any immediate problem with registering fonts.

>register them all.
That is a fine idea, but who would volunteer to write such a spec?

>If it were to do so, throwing in a couple of font

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Sat, 26 Mar 2011 10:41:32 +0100

>That is a fine idea, but who would volunteer to write such a spec?

Well, I would volunteer to review and contribute some information that
would be necessary for some types, but I have no interest in arguing
with others about some security considerations being inadequate or who
is to go into the Contact Person field or what to put into bizarre
fields like "Macintosh file type code", much less dealing with any legal
issues that might crop up; otherwise I would probably already have tried
to do this.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/