5 ms·

Maybe there could be room for innovation here? Signed font sets with known hashes (maybe piggyback on HTTP ETag?), so over time your browser has a cache of "wel

Maybe there could be room for innovation here? Signed font sets with known hashes (maybe piggyback on HTTP ETag?), so over time your browser has a cache of "well known fonts". Things like Source Sans Pro are not unusual.

mschuster91 10y ago
Why not modify the CSS syntax? For example, what now is src: url("path/my.otf") format("opentype"); can become src: url("path/my.otf") format("opentype"); src: url-hash("path/my.otf", "md5:86fb269d190d2c85f6e0468ceca42a20") format("opentype"); This way, due to the double declaration, older browsers can opt to download the file as usual while a modern browser detects the hash and can look up the file from its cache. Note I chose md5 here as an example, it may very well be possible to use any hashing scheme here.
- dchest 10y ago
  Obligatory: https://hillbrad.github.io/sri-addressable-caching/sri-addressable-caching.html https://hillbrad.github.io/sri-addressable-caching/sri-addre... (List of problems you need to solve to introduce hash-addressable caching to Web)
  - angry-hacker 10y ago
    What if major operating systems would include the popular fonts on Google library with update(s)?
    - dchest 10y ago
      Then you can use them: src: local('Font Name'),
      - mschuster91 10y ago
        Please not. People e.g. download questionable fonts from the net, which e.g. have been stripped of everything non-alphanumeric, and then complain to you "your website looks bad", or they have official, but fossilized versions of fonts... I always strip local-sources when embedding webfonts for this reason.
- IncRnd 10y ago
  You're eventually going to run into trouble attempting to use md5 at a government website. FIPS 140-2 (and soon 140-3) is a standard that stops the use of that particular piece of crufty, broken cryptography.
matt4077 10y ago
Fonts are the only type of vendor resources where this actually somewhat works – Google fonts has a rather large marketshare that allows it, and sites usually just dependent on the font, not a specific version of it. With js or css libraries, there are usually multiple CDNs and every website uses a different patch version anyway.
- WorldMaker 10y ago
  Fonts are also the only resource that you have the option to install directly into your operating system's system cache, as well, and know that your browser will prefer local cached options. A tool like Skyfonts can be used to automatically install the top 50/100/etc fonts from Google Fonts directly into your system's fonts directory. The trade off is that there are system font thumbprinting disclosures that you potentially open yourself to tracking, if you are concerned about your privacy on the web. (I think a good idea would be for one or more of the operating systems and/or browser vendors to directly encourage installing the top so many Google Fonts, because the more people do it, the fewer privacy concerns.)

mschuster91 10y ago

Why not modify the CSS syntax? For example, what now is src: url("path/my.otf") format("opentype"); can become src: url("path/my.otf") format("opentype"); src: url-hash("path/my.otf", "md5:86fb269d190d2c85f6e0468ceca42a20") format("opentype"); This way, due to the double declaration, older browsers can opt to download the file as usual while a modern browser detects the hash and can look up the file from its cache. Note I chose md5 here as an example, it may very well be possible to use any hashing scheme here.

dchest 10y ago
Obligatory: https://hillbrad.github.io/sri-addressable-caching/sri-addressable-caching.html https://hillbrad.github.io/sri-addressable-caching/sri-addre... (List of problems you need to solve to introduce hash-addressable caching to Web)
- angry-hacker 10y ago
  What if major operating systems would include the popular fonts on Google library with update(s)?
  - dchest 10y ago
    Then you can use them: src: local('Font Name'),
    - mschuster91 10y ago
      Please not. People e.g. download questionable fonts from the net, which e.g. have been stripped of everything non-alphanumeric, and then complain to you "your website looks bad", or they have official, but fossilized versions of fonts... I always strip local-sources when embedding webfonts for this reason.
IncRnd 10y ago
You're eventually going to run into trouble attempting to use md5 at a government website. FIPS 140-2 (and soon 140-3) is a standard that stops the use of that particular piece of crufty, broken cryptography.

matt4077 10y ago

Fonts are the only type of vendor resources where this actually somewhat works – Google fonts has a rather large marketshare that allows it, and sites usually just dependent on the font, not a specific version of it. With js or css libraries, there are usually multiple CDNs and every website uses a different patch version anyway.

WorldMaker 10y ago
Fonts are also the only resource that you have the option to install directly into your operating system's system cache, as well, and know that your browser will prefer local cached options. A tool like Skyfonts can be used to automatically install the top 50/100/etc fonts from Google Fonts directly into your system's fonts directory. The trade off is that there are system font thumbprinting disclosures that you potentially open yourself to tracking, if you are concerned about your privacy on the web. (I think a good idea would be for one or more of the operating systems and/or browser vendors to directly encourage installing the top so many Google Fonts, because the more people do it, the fewer privacy concerns.)