4 ms·

It's about time browsers shipped with an option to lock down a standard set of fonts.

bitwize 10y ago
That you're one of the few assholes who don't accept custom fonts is potentially useful tracking information. Forbidding any custom fonts is a non-option; the Web belongs to designers now, and they will certainly raise a fuss if they are not allowed fine-grained control over typography.
- majewsky 10y ago
  If they want to show a web font, that's fine by me (leaving aside the security considerations with web fonts for another thread). But why does there need to be an API for querying the set of installed fonts?
  - ubernostrum 10y ago
    I suspect that as long as getComputedStyle() exists, there will be ways for it to leak identifying information. Browsers already break getComputedStyle for some things (i.e., to close the history leak of being able to query whether the "visited" styling is applied to a link), but it may end up that this API just has to disappear completely.
    - majewsky 10y ago
      True. I always feel like we are at the point where we shouldn't think about which APIs to add to our browsers, but about which APIs to remove. Browser vendors frequently deprecate SSL versions and ciphers, and in the same vein, we should sacrifice at least some backwards compatibility for more privacy.
- jkot 10y ago
  I block custom fonts. Some 'designed' typography gives me zero benefits. Page takes forever to load, and entire page is refreshed once font is downloaded.
- coldtea 10y ago
  >Forbidding any custom fonts is a non-option; Actually it's a very valid option, works well for 99.9% of the websites, and fuck designers.
  - spdustin 10y ago
    That's not a very inclusive or productive thing to say, please don't do that.
- pmontra 10y ago
  We can debate about who the web belongs to, but the browser belongs to users.
beardog 10y ago
I agree, although you can install Random Agent Spoofer on Firefox, which among other things, has am option to limit fonts.
pmontra 10y ago
I don't see many incentives for browser vendors to do it. Google sells ads so they could be benefitting of fingerprinting. Maybe Mozilla could default to not loading webfonts, but there is the risk of people feeling that the browser is broken because it doesn't show the fonts that any other browser does. I'm using NoScripts on FF which stops webfonts by default. I seldom enable them, almost only when I have to check the real formatting of a web page I'm working on. Anything else is perfectly fine even with the default fonts. But fonts are only a drop in the ocean of fingerprinting.

That you're one of the few assholes who don't accept custom fonts is potentially useful tracking information. Forbidding any custom fonts is a non-option; the Web belongs to designers now, and they will certainly raise a fuss if they are not allowed fine-grained control over typography.

majewsky 10y ago
If they want to show a web font, that's fine by me (leaving aside the security considerations with web fonts for another thread). But why does there need to be an API for querying the set of installed fonts?
- ubernostrum 10y ago
  I suspect that as long as getComputedStyle() exists, there will be ways for it to leak identifying information. Browsers already break getComputedStyle for some things (i.e., to close the history leak of being able to query whether the "visited" styling is applied to a link), but it may end up that this API just has to disappear completely.
  - majewsky 10y ago
    True. I always feel like we are at the point where we shouldn't think about which APIs to add to our browsers, but about which APIs to remove. Browser vendors frequently deprecate SSL versions and ciphers, and in the same vein, we should sacrifice at least some backwards compatibility for more privacy.
jkot 10y ago
I block custom fonts. Some 'designed' typography gives me zero benefits. Page takes forever to load, and entire page is refreshed once font is downloaded.
coldtea 10y ago
>Forbidding any custom fonts is a non-option; Actually it's a very valid option, works well for 99.9% of the websites, and fuck designers.
- spdustin 10y ago
  That's not a very inclusive or productive thing to say, please don't do that.
pmontra 10y ago
We can debate about who the web belongs to, but the browser belongs to users.

beardog 10y ago

I agree, although you can install Random Agent Spoofer on Firefox, which among other things, has am option to limit fonts.

pmontra 10y ago

I don't see many incentives for browser vendors to do it. Google sells ads so they could be benefitting of fingerprinting. Maybe Mozilla could default to not loading webfonts, but there is the risk of people feeling that the browser is broken because it doesn't show the fonts that any other browser does. I'm using NoScripts on FF which stops webfonts by default. I seldom enable them, almost only when I have to check the real formatting of a web page I'm working on. Anything else is perfectly fine even with the default fonts. But fonts are only a drop in the ocean of fingerprinting.