OpenType Sanitizer

[alonbl]

Hello,

Is there any reason to keep block the font-face objects while there is the OpenType Sanitizer in firefox?

Maybe a new filter based on[1] can be added to match chrome level?

I don't quite understand the filter mechanism of noscript, as it is based on mime type, so for this it cannot be used as site can send whatever mime for font.

Alon

[1] http://code.google.com/p/ots/source/browse/trunk/README

[Tom T.]

Is there any reason to keep block the font-face objects while there is the OpenType Sanitizer in firefox?

Is there any reason to get rid of it, as another layer of defense-in-depth, in the event of bugs in Fx OTS (they have occurred)?
You can uncheck it, should you like.

I don't quite understand the filter mechanism of noscript, as it is based on mime type, so for this it cannot be used as site can send whatever mime for font.

If you wish, every time you encounter a new MIME type for font, you can add it to an ABE rule. ABE FAQ

Code: Select all

Site somenewfontmime@https?://*./
Deny