Re: [Bimi] SVG P/S Feedback

[Jakub Olexa <[e-mail]>]

Hi,

I consider text and font elements as potentionally abuseable especially
in context of use of the SVG Tiny P/S for BIMI logos.

Text - a brand logo should always have the text converted to curves as
that is the only way to make sure it will be represented as it should.
It could lead to minor rendering differences that could lead to brand
complaints.

Fonts - increases the SVG file size. When I tested this the results were
abysmal - essentially most of the exports resulted in massive files - 4
glyphs up to 8kb SVG, all glyphs of a single font easily in 200kb+...
and most importantly they did not render correctly under chrome, IE or
FF but Times is being used instead.

This brings in the abuse vector - I could create an SVG with custom
glyphs that will result in a completely different output if rendered
correctly (using the glyphs). Essentially I could have an SVG that reads
"Hello" in Chrome, IE, FF and most rendering engines while resulting in
a logo of a bank in a rendering engine with more advanced support of glyphs.

This could lead to logos being rendered not only incorrectly using
incorrect typeface but more importanlty logos that may render a
completely different content in specific engines.

This is bad user experience and could make brand managers resent BIMI.
It's better to keep it simple and restrict these elements rather than
getting surprising results in the output in my opinion.

Jakub Olexa
Founder & CEO
E-mail: [e-mail] <mailto:[e-mail]>
Tel: [phone] <tel:[phone]>

Mailkit - Closing the circle between Deliverability and Engagement
<https://www.mailkit.com>

On 28.8.2020 14:57, Brotman, Alex wrote:
> Hello,
>
> [Apologies for the cross-posting]
>
> As part of a separate project, we wanted to create a smaller SVG profile[1].  It is based on SVG Tiny 1.2, with several components removed.  The goal is to try to keep the document self-contained, remove animations, and generally more portable and secure (hence P/S).  Personally, I've been curious if we should be trying to create a new baseProfile as we've specified, given that it may behoove a developer to only target this subset of Tiny features, reducing footprint and attack surface.  We also welcome feedback about the text and font elements that we've permitted in the draft, and their security implications.
>
> We thank you for any advice or feedback you can provide.
>
> [1] https://datatracker.ietf.org/doc/draft-svg-tiny-ps-abrotman/
>
> --
> Alex Brotman
> Sr. Engineer, Anti-Abuse & Messaging Policy
> Comcast
>