3 ms·

This is a bit glib, I know, but my method of not needing to show an annoying cookies box on my personal website was to... Not use cookies. Or analytics. Or th

This is a bit glib, I know, but my method of not needing to show an annoying cookies box on my personal website was to... Not use cookies. Or analytics. Or third party fonts. Or even JavaScript—I just haven't needed it yet. It's just a content site; why bother? I bought some fonts I could host myself. Bought a base CSS / HTML template for so cheap I kinda felt bad about it. Did some edits to the template. I also had a blind person to review the site with their screen reader and we pleased when they came back saying it was one of the best they'd ever, uh, heard? I host my own images too. It's all first party and it honestly feels great to focus on the content rather than stress about random numbers on an analytics dashboard. I have no idea how many reads the stuff has, but people are translating[0] articles for free and requesting RSS feeds. (Which I also quickly coded up. Did I mention I rolled my own static site compiler too? Ruby is really great at this kind of thing.) The only thing I don't like right now is that I don't have an easy way to write first drafts and have them edited unless I want to shuffle the data from something like Google Docs. In an ideal world I'd pay my editor to learn the markdown inspired template language I created[1] and how to run a pull request in GitHub. [0] Never did I expect someone to offer to translate something for me for free; let alone into languages as obscure as Uzbek. [1] Markdown is great, but if you want to make content that's more HTML-y with ease I find it gets out of the way too quickly. I want to be able to open a <blockquote> and not have to put a bunch of paragraph tags in there.

raphlinus 8y ago
I'm with you, I don't cookie up any of my websites and have no intention of doing so. (Right now, my sites are super-primitive; my main one I've had for 22 years or so, but I'll be doing more). But I do need to say that third-party fonts are not the problem here, or shouldn't be. Neither Google Fonts[1] nor Typekit[2] sets cookies. I don't know off the top of my hand if any of the other services do, but if so I would agree it's a good reason not to use them. Disclosure: I helped launch Google Fonts and was involved in the decisions to make it privacy-friendly. [1] https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_... [2] https://www.adobe.com/privacy/policies/typekit.html https://www.adobe.com/privacy/policies/typekit.html
- 3pt14159 8y ago
  I'm certainly not going to rail against third party fonts. The web is a mess and this is just a small part of the mess and certainly not the worst offender. That being said, however, it's certainly possible to fingerprint traffic if you serve fonts as a third party; even if you don't use cookies. Most third party font suppliers use JS, and even if they didn't, let's not pretend that cookies is the only thing we have to worry about. One of the issues I have with the web is that I want technical guarantees when the answer is often "just trust us" even if we shouldn't need to. Take fonts, for example. There is zero reason that fonts need to be served third party. All we should need to do is to specify a URL-based UUID for a font in our HTML and provide a cryptographic signature from the font owner that authorizes its use at this URL. Complex licensing is completely pushed to a different layer. The only tricky part is keeping ownership keys secure. No judgements—I get that people are lazy and use the tools they have, so JS wins. But for me, and my lowly personal website, we shall use secure headers. We shall host our fonts and images ourselves; and as the monks of yesteryear, our austereness advances an end unto itself.
  - andrethegiant 8y ago
    > There is zero reason that fonts need to be served third party. I use the service Icomoon[0] in production. It's been immensely helpful for generating a custom icon font. Our designers upload icons they create, and Icomoon bundles them all in one font file. Easier than multiple SVGs and only one HTTP request. I wouldn't want to manage that myself — so there's one reason for fonts to be served third party. [0] https://icomoon.io https://icomoon.io
    - joobus 8y ago
      I personally don't like sites that bundle icons into fonts. I got sick of reading a different font on every website, some being very hard to read, so I override the font on every website with stylus. All the icons, which should be images, become square boxes.
    - 3pt14159 8y ago
      Right but you shouldn't need to. In my proposed solution the browser could just make a separate, non-third party request for the font to icomoon.io and on load, if browser needs that font and doesn't already have it. It should get it from your OS provisioner (Google / Mozilla / Apple / Microsoft) directly and if they don't have it (or Icomoons public key) they could request it from Icomoon on your behalf. Or, if Icomoon is up to shady tactics, refuse the request.
megous 8y ago
Nice, you've described my website too. :) One other thing, that I've not seen offered anywhere, that I have on my website in addition to what you described, is a download link for a tarball of the offline version of the website that works perfectly for offline reading via file:// protocol. I have made it because I have made my static site generator for the purpose of storing my Linux administration knowledge, and having an offline version is good if you get cut off from the internet, or you're offline and want to figure out how to setup that gprs modem again on Linux. I added the feature to my public websites too, because why not. It might be useful to someone somewhere and it also adds weight to the claim that "I don't track you".
ksec 8y ago
What happened to single pixel analytics that we used to do? Not everyone ditching Javascript analytics wants to do Goaccess self host route. I know a lot of people wanted to go Web Apps direction or even what I called a Web OS direction, where you have the whole OS write in Javascript running inside your browser. But I just want good old Web Page, may be with a little interaction. Why cant we have a few Web Fonts as default and ship with every browser instead of downloading it 10 zillion times? Most of the time I hate Web Fonts because I hate reflow.
deleted 8y ago
[deleted]

raphlinus 8y ago

I'm with you, I don't cookie up any of my websites and have no intention of doing so. (Right now, my sites are super-primitive; my main one I've had for 22 years or so, but I'll be doing more). But I do need to say that third-party fonts are not the problem here, or shouldn't be. Neither Google Fonts[1] nor Typekit[2] sets cookies. I don't know off the top of my hand if any of the other services do, but if so I would agree it's a good reason not to use them. Disclosure: I helped launch Google Fonts and was involved in the decisions to make it privacy-friendly. [1] https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_... [2] https://www.adobe.com/privacy/policies/typekit.html https://www.adobe.com/privacy/policies/typekit.html

3pt14159 8y ago
I'm certainly not going to rail against third party fonts. The web is a mess and this is just a small part of the mess and certainly not the worst offender. That being said, however, it's certainly possible to fingerprint traffic if you serve fonts as a third party; even if you don't use cookies. Most third party font suppliers use JS, and even if they didn't, let's not pretend that cookies is the only thing we have to worry about. One of the issues I have with the web is that I want technical guarantees when the answer is often "just trust us" even if we shouldn't need to. Take fonts, for example. There is zero reason that fonts need to be served third party. All we should need to do is to specify a URL-based UUID for a font in our HTML and provide a cryptographic signature from the font owner that authorizes its use at this URL. Complex licensing is completely pushed to a different layer. The only tricky part is keeping ownership keys secure. No judgements—I get that people are lazy and use the tools they have, so JS wins. But for me, and my lowly personal website, we shall use secure headers. We shall host our fonts and images ourselves; and as the monks of yesteryear, our austereness advances an end unto itself.
- andrethegiant 8y ago
  > There is zero reason that fonts need to be served third party. I use the service Icomoon[0] in production. It's been immensely helpful for generating a custom icon font. Our designers upload icons they create, and Icomoon bundles them all in one font file. Easier than multiple SVGs and only one HTTP request. I wouldn't want to manage that myself — so there's one reason for fonts to be served third party. [0] https://icomoon.io https://icomoon.io
  - joobus 8y ago
    I personally don't like sites that bundle icons into fonts. I got sick of reading a different font on every website, some being very hard to read, so I override the font on every website with stylus. All the icons, which should be images, become square boxes.
  - 3pt14159 8y ago
    Right but you shouldn't need to. In my proposed solution the browser could just make a separate, non-third party request for the font to icomoon.io and on load, if browser needs that font and doesn't already have it. It should get it from your OS provisioner (Google / Mozilla / Apple / Microsoft) directly and if they don't have it (or Icomoons public key) they could request it from Icomoon on your behalf. Or, if Icomoon is up to shady tactics, refuse the request.

megous 8y ago

Nice, you've described my website too. :) One other thing, that I've not seen offered anywhere, that I have on my website in addition to what you described, is a download link for a tarball of the offline version of the website that works perfectly for offline reading via file:// protocol. I have made it because I have made my static site generator for the purpose of storing my Linux administration knowledge, and having an offline version is good if you get cut off from the internet, or you're offline and want to figure out how to setup that gprs modem again on Linux. I added the feature to my public websites too, because why not. It might be useful to someone somewhere and it also adds weight to the claim that "I don't track you".

ksec 8y ago

What happened to single pixel analytics that we used to do? Not everyone ditching Javascript analytics wants to do Goaccess self host route. I know a lot of people wanted to go Web Apps direction or even what I called a Web OS direction, where you have the whole OS write in Javascript running inside your browser. But I just want good old Web Page, may be with a little interaction. Why cant we have a few Web Fonts as default and ship with every browser instead of downloading it 10 zillion times? Most of the time I hate Web Fonts because I hate reflow.

deleted 8y ago

[deleted]