search

WICG / local-font-access

Web API for enumerating fonts on the local system
https://wicg.github.io/local-font-access
Apache License 2.0
76 stars 16 forks source link

Is this approach compatible with iOS? #60

Closed my2iu closed 3 years ago

my2iu commented 4 years ago

Is the proposed approach to local font access compatible with the iOS 13 font security model? I’m not well-versed in the issue since I don’t think anyone uses the new font stuff in iOS 13, but my understanding was that the new iOS 13 approach to font privacy means that font enumeration isn’t allowed; only font pickers and querying for specific fonts are allowed.

I suppose it doesn’t matter since Safari is not subject to the security mechanisms of normal apps.

oyiptong commented 3 years ago

Hi @my2iu, thanks for filing the issue.

I'm not familiar with the system APIs on iOS. Our MacOS implementation uses CoreText APIs. The documentation pages state that the APIs are available on iOS 3.2+.

Could you please link to a page describing the iOS13+ Font privacy policy? Also, I assume this is about the new custom fonts capabilities for iOS apps.

Indeed, Safari could be treated differently from other iOS applications. I'm going to close this bug, but feel free to re-open if you feel this is relevant.

my2iu commented 3 years ago

Yes, I was referring to this: https://developer.apple.com/videos/play/wwdc2019/227/

My concerns are that

  1. you may be pursuing a font security model that differs from and is incompatible with the direction that other major systems are going with, which is fine but it should be acknowledged
  2. the fact that your design docs don't mention this other security model suggests a general lack of due diligence
  3. the API you propose is looser than the iOS model, but you could design your API to offer a more restrictive subset that would be compatible with the iOS model. That way, developers could code to the more restrictive subset if they want something compatible with iOS
  4. Web developers won't use an API unless it's available on iOS too. Making your API more compatible with iOS will make it more likely that Apple will implement it in Safari.