Web fonts want for security

It may be hard to imagine, but the future of fonts on the Web depends on Internet security.

CNET News staff
6 min read
It may be hard to imagine, but the future of fonts on the Web--the way letters like these will look on your screen--depends upon Internet security.

Fonts were a hot topic at the recent Seybold Seminars conference in New York. Adobe Systems (ADBE) and Microsoft (MSFT) announced technical specifications for OpenType, a new way to create fonts and deliver them to Web pages. At the same time, Bitstream (BITS) and Netscape Communications (NSCP) called attention to TrueDoc, their own font technology.

The two camps are circling each other warily, promising the computing world open standards and compatibility. Each side is also maneuvering to have its technology become an official Web standard.

Currently, Web browsers use only fonts that are installed on resident systems. Web designers who want to deliver pages in exotic typefaces have to turn the text into images by creating GIFs or JPEGs. The problem is, text within images is not searchable.

It's also a bandwidth hog. So Microsoft, Adobe, Netscape, and Bitstream are all looking to design fonts that can download with a Web page and "display" instantly, as if they were already installed on the user's system.

Neither camp's approach, however, will deliver a wide spectrum of fonts to Web pages and other electronic documents unless it includes security measures. Type designers, sick of seeing their work pirated, want protection. So do users, who don't realize that fonts, like Java applets and ActiveX controls, are pieces of executable code that can be programmed to commit mischief on a user's system.

"Having trust in the things executing on your machine is going to become more and more of an issue," said Philip DesAutels, manager of the World Wide Web Consortium digital signature project. DesAutels is working with W3C member companies to implement digital signatures within font files.

Signatures would not only tell users who created a font and what it is used for, but they would also give type designers some protection against font piracy. The problem has become endemic in the digital age, say members of TypeRight, a grassroots organization lobbying to raise awareness of the issue.

"Currently the only thing protectable is the name of the typeface," said Jonathan Macagba, TypeRight spokesman and president of Handcrafted Fonts in Philadelphia. "I've designed a lot of faces, and it's difficult to make a living from it. What made us come together is this new threat, the ease of use of the software."

Macagba and others are skeptical of the new font technologies. The OpenType technology, which has placeholders for digital signatures in the font files themselves, won't be available until early 1998. Bitstream's TrueDoc technology is available now; beta versions of Netscape Navigator in the new Communicator product suite can read Web pages designed with TrueDoc fonts, and TrueDoc-compliant HTML authoring tools are just now hitting the market.

But type designers aren't impressed with DocLock, TrueDoc's security component that aims to prevent font thieves from stripping the fonts from Web sites and repackaging them as their own.

"Bitstream is doing a poor job of addressing the needs of type designers," said Chris MacGregor, publisher of the Internet Type Foundry Index.

It turns out that DocLock doesn't lock out people using the same server. Therefore, for example, the fonts on an ISP member's home page can be stolen by another customer. It's an oversight that Bitstream acknowledges and promises to fix.

"We have to figure out the best way to extend DocLock," said Joe Welch, director of emerging technologies. "We'll address it next week."

Welch also said that DocLock currently doesn't allow designers to remotely access their sites with a laptop and make changes to the fonts, another glitch the company needs to fix.

Even though Netscape is TrueDoc's biggest proponent, it isn't locking itself into the technology.

"Communicator 4.0 will only have support for TrueDoc as a packaging mechanism, partially because OpenType won't be ready," said Eric Byunn, product manager for Communicator. "We've been talking to Adobe about supporting [OpenType] when it does become available. There's nothing fundamental or technical that says we can't support it."

Assuming Netscape doesn't run to support OpenType on its browser, the picture one year from now is likely to look like this: Internet Explorer users will be able to view Web pages optimized with OpenType, and Communicator users will view pages optimized with TrueDoc. Under any other scenario, users will have to make do with the fonts stored on their systems, no different than today's status quo. One type designer thinks the status quo isn't so bad.

"I can understand as a Web designer why people want to put [nonstandard] fonts onto a Web page, but I find the limitations set in HTML right now need more exploring," said Chris MacGregor, who is both a Web designer with Tenagra and the publisher of the Internet Type Foundry Index, an online resource of typeface information. "People who are designing for the Web need to design with what they have, rather than saying, 'I want to be able to choose my fonts like I do with paper.' If the Web is to find its own design voice, it needs to stop imitating other media."

The W3C is about to release an updated specification for HTML style sheets that will give compliant browsers more leeway in choosing the best fonts for a site. The first step is for the browser to check the fonts needed to display a page.

If the fonts aren't on the user's system, the browser will try to make a close match. If that doesn't work, the browser will use a "synthesis engine" to generate a temporary approximation. By this point, the browser can also download the necessary fonts from the server and replace the synthesized version.

Both camps are in fact working to implement the specifications but are going about it two different ways, according to Chris Lilley, the W3C's technical lead for fonts.

"Both Netscape and Microsoft have helped write [the spec], but OpenType and TrueDoc are two different ways of transmitting the font information when you download," Lilley said.

Another wrinkle in the font story also came at last week's Seybold show as Adobe debuted the latest version of Postscript, Adobe's high-end printing architecture. The new Postscript level 3, which aims to turn printers into Web-savvy systems, could influence the fight over font standards.

First of all, Postscript 3 will support OpenType fonts when they become available, but Adobe is playing wait-and-see to decide on supporting TrueDoc.

"As soon as we see that it's widely adopted, we'll have to provide support for it," said Steve Walsh, director of marketing for Adobe enterprise solutions.

If printer manufacturers abide by the PS 3 specs, high-end Postscript 3 printers will soon be "Web-ready," with the ability to pull down Web pages and print them. To do this, the printers will need their own hard disk and Web server and client software. Given that PS 3 expands the number of fonts stored on the printer from 35 to 136, there will be less need to transport fonts over the network, whether the delivery system is OpenType or TrueDoc.

The first Postscript 3-enabled printers that ship this year will have Type 1 fonts--Adobe's own format popular with professional publishers and printers--but adobe will make OpenType "recognizer" software available this fall that users will install directly to the printer.

All this will be moot if type designers don't feel comfortable licensing their fonts for use on the Web, in PDF files, or other electronic formats, which many type foundries don't currently allow.

That would pose problems for people browsing the Web on non-PC devices such as TV sets, which have little or no space to store fonts locally. The ability to download fonts with each page would reduce the chances of getting ugly displays as well as the need to design a site with several viewing options.

"Heaven forbid you have an alternate input device or display today, because you can't read it," said the W3C's DesAutels. "For people with WebTV and the like, to have a dearth of fonts is painful."

Despite the possible advantages, Web and type designer MacGregor thinks fewer fonts equal better design.

"You'll have people designing Web sites with unreadable text," MacGregor said. "We're going to see really bad typography on the Web. That worries me more than complex licensing issues."