Subject: Re: [Bimi] [rfc-i] SVG P/S Feedback

From: Leonard Rosenthol <[email-masked]>
Date: Fri, 28 Aug 2020 16:13:23 +0000

The SVG working group has been working on a similar project for a while now called SVG Native (https://svgwg.org/specs/svg-native/).  Seems like it would be better for you to leverage that work - including any contributions you believe are necessary - rather than create another (very similar) document.

Leonard

On 8/28/20, 8:57 AM, "rfc-interest on behalf of Brotman, Alex" <[email-masked] on behalf of [email-masked]> wrote:

    Hello,

    [Apologies for the cross-posting]

    As part of a separate project, we wanted to create a smaller SVG profile[1].  It is based on SVG Tiny 1.2, with several components removed.  The goal is to try to keep the document self-contained, remove animations, and generally more portable and secure (hence P/S).  Personally, I've been curious if we should be trying to create a new baseProfile as we've specified, given that it may behoove a developer to only target this subset of Tiny features, reducing footprint and attack surface.  We also welcome feedback about the text and font elements that we've permitted in the draft, and their security implications.

    We thank you for any advice or feedback you can provide.

    [1] https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-svg-tiny-ps-abrotman%2F&amp;data=02%7C01%7Clrosenth%40adobe.com%7C1e0e0a4500844cfd94d308d84b51ed91%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C1%7C637342162549841131&amp;sdata=VMyuvgeI4f%2F5bNPSsdNq0kVaY1VDFAAk4N3OpE%2BELII%3D&amp;reserved=0

    --
    Alex Brotman
    Sr. Engineer, Anti-Abuse & Messaging Policy
    Comcast

    _______________________________________________
    rfc-interest mailing list
    [email-masked]
    https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.rfc-editor.org%2Fmailman%2Flistinfo%2Frfc-interest&amp;data=02%7C01%7Clrosenth%40adobe.com%7C1e0e0a4500844cfd94d308d84b51ed91%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C1%7C637342162549841131&amp;sdata=HfGQxw5Aj%2FbXXICoJLnSLUqdHboqFUX9FoFc499r8gs%3D&amp;reserved=0

---

From: "Brotman, Alex" <[email-masked]>
Date: Mon, 31 Aug 2020 14:28:29 +0000

Leonard,

Ah, that's very interesting indeed.  It does look like a similar set of goals, though I need to read the document a bit more to see how they may diverge, as well as discuss with other folks on the BIMI group.  If you know, could you comment on how complete this spec might be?

> -----Original Message-----
> From: Leonard Rosenthol <[email-masked]>
> Sent: Friday, August 28, 2020 12:13 PM
> To: Brotman, Alex <[email-masked]>; rfc-interest@rfc-
> editor.org
> Cc: BIMI (IETF) ([email-masked]) <[email-masked]>
> Subject: [EXTERNAL] Re: [rfc-i] SVG P/S Feedback
>
> The SVG working group has been working on a similar project for a while now
> called SVG Native
> (https://urldefense.com/v3/__https://svgwg.org/specs/svg-
> native/__;!!CQl3mcHX2A!TneMAZKtm3W11WFNWERlDUklHL8zhe6AF2kSl3F
> wtHl3FnDbgcLikCfUrA2pP_-tffQA$ ).  Seems like it would be better for you to
> leverage that work - including any contributions you believe are necessary -
> rather than create another (very similar) document.
>
> Leonard
>
> On 8/28/20, 8:57 AM, "rfc-interest on behalf of Brotman, Alex" <rfc-interest-
> [email-masked] on behalf of [email-masked]> wrote:
>
>     Hello,
>
>     As part of a separate project, we wanted to create a smaller SVG profile[1].
> It is based on SVG Tiny 1.2, with several components removed.  The goal is to
> try to keep the document self-contained, remove animations, and generally
> more portable and secure (hence P/S).  Personally, I've been curious if we
> should be trying to create a new baseProfile as we've specified, given that it
> may behoove a developer to only target this subset of Tiny features,
> reducing footprint and attack surface.  We also welcome feedback about the
> text and font elements that we've permitted in the draft, and their security
> implications.
>
>     [1]
> https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.co
> m/?url=https*3A*2F*2Fdatatracker.ietf.org*2Fdoc*2Fdraft-svg-tiny-ps-
> abrotman*2F&amp;data=02*7C01*7Clrosenth*40adobe.com*7C1e0e0a4500
> 844cfd94d308d84b51ed91*7Cfa7b1b5a7b34438794aed2c178decee1*7C0*7C1
> *7C637342162549841131&amp;sdata=VMyuvgeI4f*2F5bNPSsdNq0kVaY1VDF
> AAk4N3OpE*2BELII*3D&amp;reserved=0__;JSUlJSUlJSUlJSUlJSUlJSU!!CQl3m
> cHX2A!TneMAZKtm3W11WFNWERlDUklHL8zhe6AF2kSl3FwtHl3FnDbgcLikCfU
> rA2pP1DdU8Dw$
>
>     --
>     Alex Brotman
> https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.co
> m/?url=https*3A*2F*2Fwww.rfc-editor.org*2Fmailman*2Flistinfo*2Frfc-
> interest&amp;data=02*7C01*7Clrosenth*40adobe.com*7C1e0e0a4500844cf
> d94d308d84b51ed91*7Cfa7b1b5a7b34438794aed2c178decee1*7C0*7C1*7C6
> 37342162549841131&amp;sdata=HfGQxw5Aj*2FbXXICoJLnSLUqdHboqFUX9F
> oFc499r8gs*3D&amp;reserved=0__;JSUlJSUlJSUlJSUlJSUlJQ!!CQl3mcHX2A!T
> neMAZKtm3W11WFNWERlDUklHL8zhe6AF2kSl3FwtHl3FnDbgcLikCfUrA2pP8f
> D9zSo$

---

From: Leonard Rosenthol <[email-masked]>
Date: Mon, 31 Aug 2020 16:08:46 +0000

AFAIK, it's complete - it reflects the subset of SVG that can/should be used inside of fonts (eg. SVG in OpenType) and for platform native elements (eg icons, etc.).

Leonard

On 8/31/20, 10:29 AM, "Brotman, Alex" <[email-masked]> wrote:

    Leonard,

    > (https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fsvgwg.org%2Fspecs%2Fsvg-&amp;data=02%7C01%7Clrosenth%40adobe.com%7C2d44d2ee6d314d43310708d84dba3355%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637344809407959216&amp;sdata=dOpC%2BH49yPaUfo0XaU%2FFwMXsD%2BVk855MlXld%2FGin64I%3D&amp;reserved=0
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam04.safelinks.protection.outlook.co&amp;data=02%7C01%7Clrosenth%40adobe.com%7C2d44d2ee6d314d43310708d84dba3355%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637344809407969170&amp;sdata=eQABTRZwQOJ60ovAkeVK9DNwDTI1CgU5ekMUF2rfynw%3D&amp;reserved=0
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fnam04.safelinks.protection.outlook.co&amp;data=02%7C01%7Clrosenth%40adobe.com%7C2d44d2ee6d314d43310708d84dba3355%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637344809407969170&amp;sdata=eQABTRZwQOJ60ovAkeVK9DNwDTI1CgU5ekMUF2rfynw%3D&amp;reserved=0