3 ms·

It's an older rule[1]. It does technically apply here, but it's not a great look that they're only enforcing it now. If Gorhill needed to, some of that extra

It's an older rule[1]. It does technically apply here, but it's not a great look that they're only enforcing it now. If Gorhill needed to, some of that extra functionality could be moved out into a separate extension. uBlock has done this before with uBlock Origin Extra[2]. Most of the extra features (eg. remote font blocking) aren't a huge deal, in my opinion. [1] https://blog.chromium.org/2013/12/keeping-chrome-extensions-simple.html https://blog.chromium.org/2013/12/keeping-chrome-extensions-... [2] https://chrome.google.com/webstore/detail/ublock-origin-extra/pgdnlhfefecpicbbihgmbmffkjpaplco?hl=en https://chrome.google.com/webstore/detail/ublock-origin-extr...

MR4D 7y ago
Why doesn’t “blocking” just mean blocking? I shouldn’t need separate extensions to each block css, JavaScript, fonts, cookies, pixels, etc. Remote fonts can be used for tracking and fingerprinting (hence why private browsing modes aren’t private). Am I missing something here?
- dictum 7y ago
  > Remote fonts can be used for tracking and fingerprinting Isn't it the reverse, local fonts can be used for fingerprinting? (There are some snags with remote fonts — rendering bugs/exploits — but they're not exactly low hanging fruit anymore) EDIT: I see what you mean by tracking. If the fonts are loaded with a third party script, this is indeed a problem. If the font files are served by a third party directly (without some intermediate script), this could be remedied with an extension that strips headers. It would obviously run afoul of this only do one thing rule from Google, the company that once attached Google+ to its search results.
  - vanadium 7y ago
    Actually, my Creative Director and I have noticed some Google Fonts have changed over time, producing significant enough (read: negative) changes to the UI of clients’ experiences we have out there that we decided to start downloading and storing them locally to lock in state (and for perf, but that’s another topic). The average user who comes to the site once will never notice it, but we have. It wouldn’t surprise me if it were a hidden vector of some sort, but I haven’t put effort into digging into it.

MR4D 7y ago

Why doesn’t “blocking” just mean blocking? I shouldn’t need separate extensions to each block css, JavaScript, fonts, cookies, pixels, etc. Remote fonts can be used for tracking and fingerprinting (hence why private browsing modes aren’t private). Am I missing something here?

dictum 7y ago
> Remote fonts can be used for tracking and fingerprinting Isn't it the reverse, local fonts can be used for fingerprinting? (There are some snags with remote fonts — rendering bugs/exploits — but they're not exactly low hanging fruit anymore) EDIT: I see what you mean by tracking. If the fonts are loaded with a third party script, this is indeed a problem. If the font files are served by a third party directly (without some intermediate script), this could be remedied with an extension that strips headers. It would obviously run afoul of this only do one thing rule from Google, the company that once attached Google+ to its search results.
- vanadium 7y ago
  Actually, my Creative Director and I have noticed some Google Fonts have changed over time, producing significant enough (read: negative) changes to the UI of clients’ experiences we have out there that we decided to start downloading and storing them locally to lock in state (and for perf, but that’s another topic). The average user who comes to the site once will never notice it, but we have. It wouldn’t surprise me if it were a hidden vector of some sort, but I haven’t put effort into digging into it.