Re: [Full-disclosure] Firefox same-origin policy for fonts

2010-09-13 Thread Daniel Veditz
On 9/12/2010 4:43 PM, paul.sz...@sydney.edu.au wrote: > Firefox's interpretation of the same-origin policy is more strict than > most other browsers, and it affects how fonts are loaded with the > @font-face CSS directive. ... > There is a solution to this, however, if you manage the se

Re: [Full-disclosure] Firefox same-origin policy for fonts

2010-09-12 Thread Dan Kaminsky
The idea is the same as crossdomain.xml in flash -- content can explicitly opt into being shared across domain boundaries. Our real problem is that there's no way to know whether content is generically available to the Internet, or just you because of IP firewalling / cookies / whatnot. So we hav

[Full-disclosure] Firefox same-origin policy for fonts

2010-09-12 Thread paul . szabo
One of my users asked me to install MathJax on my server. Reading installation instructions in http://www.mathjax.org/resources/docs/?installation.html#notes-about-shared-installations I came across the following: ... Firefox's same-origin security policy for cross-domain scripting. Firefox