While I’d love to see it, I’m not holding my breath for a standard font format for fonts… Or anything else…

On a related note, I think I need to begin making a distinction between EULAs and EULA overviews. EULAs must necessarily be carefully and extensively detailed. What I think folks are looking for is a second document – a Creative-Commons-style plain language overview. See: CC overview and CC full license.

The two “EULAs” I mentioned in this post, from Mota Italic and H&FJ, are really not EULAs. They’re plain language overviews.

I have to agree with Richard, you have been too kind regarding EULAs.

I ended up cleaning out the fonts I collected over the years for web projects at the end of last year. I ended up removing over 80% because the EULA was not clear about use with font embedding.

Their blog also describes that they are selling EOT licenses right now.
http://www.ascendercorp.com/pr/2009-07-15/

I do believe that cloud-based apps have a strong future in the software industry. Serving fonts from a cloud is similar to other uses going on today, like Flash games being played on Facebook or Google Docs.

Jens: Just to be sure we’re on the same page, this is the WOFF spec you’re referring to, correct? (I’ve seen several specs as the format has evolved, but this is the most recent one.)

The “Extended Metadata” portion of the spec outlines a place for information about the vendor, license, licensee, trademark, and copyright. My understanding is that someone could download (or view source) a WOFF file, change its XML data, re-upload to his or her own web server, and—voila. The font is now “stolen”.

UPDATE: Tal Leming, a co-author of the WOFF proposal, elaborated on the complexity of “stealing” a WOFF file, writing in an email:

It is more complicated than this. The XML data is compressed, so it would have to be recompressed and then rewritten into the WOFF file. The offsets to the data following the metadata would have to be adjusted. The header would have to be updated to reflect the new metadata length and the offsets to data following the metadata.

However, type sellers have equal access to this XML data, as well as the means to compare it with data in the WOFF file that cannot be changed by would-be type pirates. My assumption is that no type seller would license WOFF typefaces without a system (and/or employees) in place to go out and check for mismatches.

I also assume that browsers will facilitate these checks by making it easier to view WOFF data (formatting it in an easy-to-read way, for example) or by actually doing the check and telling source viewers straight up, “There’s something wrong here.”

Point being: the onus to protect intellectual property is on the type seller rather than on browser security features.

And there isn’t actually anything in the actual WOFF spec to address piracy, just a couple of mentions of the words “digital signature”, sprinkled on like fairy dust. Without any detailed specs for that, it’s just security theater, because if a web browser accepts an un-signed WOFF file, it will be trivial to strip signatures from commercial fonts and use them illegally. Without mandatory signatures, WOFF is just obfuscated TrueType.

Cheers,
Rich