Re: [apps-discuss] font/* (and draft-freed-media-type-regs)

["Martin J. Dürst" <[e-mail]>]

On 2011/11/15 3:35, David Singer wrote:
>
> On Nov 12, 2011, at 12:25 , Larry Masinter wrote:
>
>> I see no use case for why having font/opentype is any better than application/opentype
>>
>> The only use case I can imagine from looking at
>> http://tools.ietf.org/html/draft-singer-font-mime-00
>> is the possibility of defining common parameters across font data types (in the same way that text/.. has a common charset parameter).
>
> How serious is the first concern "First, the  "application" sub-tree is treated (correctly) with great caution with respect to viruses and other active code."?

I very much think that having a  font/ top level type is actually a good 
idea. But I hinted at this before: a type shouldn't be treated as "more 
safe" just because it says font/, rather than application/. Many font 
formats contain active code that is executed by the font engine. Several 
security holes have been found in this area. So I'd actually 
de-emphasize or remove this point. draft-singer-font-mime-00 also 
doesn't have a security section, and it of course needs one.


> (The reason I abandoned the draft was not the difficulty of getting it through, by the way, but because the W3C Timed Text group decided it didn't need it).

Can you be more specific? E.g., does Timed Text only use one font 
format? Or does it not contain any field that indicates the format, 
which makes this "somebody else's problem"? Or some other reason?

Regards,    Martin.