Bert Bos | CSS tutorial – fonts
WOFF (by means of an HTTP header) and EOT (by means of embedded info) allow the browser to check if the font is used for the right documents.
A tool like Microsoft's WEFT or my own mkeot (both of them for creating EOT files) will check the OpenType flags and refuse to create an EOT file if the license flag indicates a license that doesn't allow font embedding.
(You can always use a tool such as Fontforge to change the flags, but that doesn't change the fact that putting the font on a server may be illegal.)
In the case of WOFF, you have to configure the HTTP server to
return a special header (Access-Control-Allow-Origin,
borrowed from CORS) whenerver the client (the browser) asks to
verify a document. The verification is not for an individual
document, but for a whole domain.
This is quite difficult to set up, but in the case that the font is licensed for all documents on the same server as the font, the header is not necessary.
EOT is more flexible and more precise. The EOT file and the document can be on any kind of server (not just HTTP). The EOT file contains the list of documents (their URLs or a common prefix)
Luckily more and more font makers are satisfied with a restriction to a whole domain (and thus with WOFF). But some font makers set the “restricted” flag in the OpenType font file to force you to read their special conditions or contact them.
PDF is a single file containing everythng the document needs: images, text and fonts. ePUB is the same: one file (a zip file in this case) with everything in it. But on the Web we prefer “virtual” inclusions. Using a term invented by Ted Nelson in the 60s, we call that “transclusion:” a component of a document is itself a document, with its own address (URL), allowing it to be re-used, cached and updated independently.
„Font embedding” works like that: a document points to a style sheet and the style sheet points to a font file. All three are independent docuyments, but th elink indicates that this is a transclusion.
(Compression, market position, CORS)