(last updated 2008-05-13)

Name : George Williams

Email : gww&silcom.com

MIME media type name : Application

MIME subtype name : Vendor Tree - vnd.font-fontforge-sfd

Required parameters : (None)

Optional parameters : (None)

Encoding considerations : 7bit


Security considerations :
1. This datatype contains no mechanism for attaching the downloader's
file system.
2. It may contain "active content" in the form of TrueType
instructions. These instructions operate in a controlled interpreter.
Infinite loops are possible, though all interpreters I know of guard
against them. These instructions cannot allocate memory. These
instructions cannot affect the file system or anything other than
the rasterization process.
3. There is no mechanism for sending information back to the server.
4. When a font is rasterized, especially if rasterized at a large point
size it is possible for the process to consume large amounts of memory.
Generally an upper bound can be placed on this in advance (by bounding
box analysis) and a rasterizer can refuse to perform an operation which
would require excessive resources.
5. Fonts are meant to be used. Restrictions on usage are described in
License Agreements (and the format allows for a Licence Agreement to be
specified within it).
6. Privacy considerations are not an issue in fonts.
7. Confidentiality protection is not needed for this type. (All
standard font formats are well documented. Once released the data are
exposed to all an sundry, protecting those data before they are released
seems unnecessary).
8. No protection is provided against tampering in transit, nor is there
a mechanism to check that the data are consistent.

Interoperability considerations :
This datatype has been used for ~10 years on many flavors of Unix and
Linux (including Macs) as well as Windows boxes. Its design goals
included being specified in plain, readable text using only the
printable characters of US-ASCII (and space and newline).

The only interoperability problem I recall occurred early on in locales
which used "," for the decimal point. That has been fixed.

Published specification :
A specification has been available on the web for approximately 10
years:
http://fontforge.sf.net/sfdformat.html
(it is ~60K so I shall not include it here)

Applications which use this media :
FontForge -- http://fontforge.sf.net/
Xgridfit -- http://xgridfit.sf.net/

The creators of FontLab (http://www.fontlab.com/) have discussed the
specification with me and say that they may implement it in the future.

Additional information :

1. Magic number(s) : <match type="string" offset="0"
value="SplineFontDB"/>
2. File extension(s) : sfd
3. Macintosh file type code : TEXT
4. Object Identifiers:

In specifying the "Magic number" I am using the syntax of the
freedesktop. An sfd file will always contain the text "SplineFontDB" at
the beginning of the file.

No parameters are used. RFC4288 says not to use "None" but if I leave
the fields blank the form is rejected.


Person to contact for further information :

1. Name : George Williams
2. Email : gww&silcom.com

Intended usage : Limited Use
I'm not sure exactly what section 4.9 of RFC4288 means by limited use.

There are not a large number of font designers when compared to users
of Word. But there are thousands of them, and the sfd format is in use
in many opensource projects (for example: http://dejavu.sf.net/ ).

On the other hand the format is openly specified, and some users have
written their own little programs to do simple modification so the data
specified therein.

Author/Change controller : George Williams (gww&silcom.com)

(file created 2008-05-13)