8 ms·

We’re basically forced to switch to self hosting due to the bizarre way Google implements statistics for Google Fonts. 1 out of 1000 requests will include a “tr

We’re basically forced to switch to self hosting due to the bizarre way Google implements statistics for Google Fonts. 1 out of 1000 requests will include a “tracking font” which is actually invalid and breaks document.fonts.load. This was an incredibly frustrating bug to track down. Bug for those interested: https://github.com/google/fonts/issues/2345 https://github.com/google/fonts/issues/2345

alwillis 7y ago
Useful information on self-hosting 3rd party resources: https://calendar.perfplanet.com/2019/self-hosting-third-party-resources-the-good-the-bad-and-the-ugly/ https://calendar.perfplanet.com/2019/self-hosting-third-part...
arthurcolle 7y ago
The guy who is affiliated with Google Fonts who showed up on a thread a few days ago said that he didn't think there was any tracking related to new implementations of Google Fonts stuff. I guess this says the opposite. Let me try to dig up the thread for completeness... EDIT: Well that was faster than I thought I'd be able to do. Here's the comment, and the thread: https://news.ycombinator.com/item?id=22369415 https://news.ycombinator.com/item?id=22369415
- tolmasky 7y ago
  I actually don’t care what they’re doing with the data, I care that it crashes the site. The font that gets loaded once every thousand requests is https://fonts.gstatic.com/stats/Roboto/normal/400 https://fonts.gstatic.com/stats/Roboto/normal/400 so it’s some form of statistics. But again, my actual concern is that it breaks. Here’s the code I used to “catch” it. Here, it took roughly 500 requests: https://runkit.com/tolmasky/5e49b314ef61f900146c9a3b https://runkit.com/tolmasky/5e49b314ef61f900146c9a3b Edit: To be clear, I’m not implying this is something they try to keep secret, just showing a way to observe it since it purposely rarely shows up.
  - tjoff 7y ago
    Your users might... But who cares, right?
    - tolmasky 7y ago
      I don’t think there’s super meaningful data to be gleaned from server-side tracking, especially with browsers increasingly sending little to no information to third party resources. This is CSS, not a JS script that might collect more info and phone home. So yeah, the site going blank is higher priority to me than them knowing if I, the service provider, not my users, prefer Roboto over Open Sans, or if most users now support woff2 vs. ttf. But either way, we’re not going to use them anymore.
      - RodgerTheGreat 7y ago
        CSS can be crafted to conditionally load additional resources, which means it can be a vector for fairly sophisticated information gathering and tracking. For example: https://github.com/kkuchta/css-only-chat https://github.com/kkuchta/css-only-chat
        tolmasky 7y ago
        Right but that’s not what’s happening on google fonts.
  - dorfsmay 7y ago
    Makes you wonder if it's one node with bad content in a set of one thousand servers! Or bad content cached on one of these/cdn server.
- joshuamorton 7y ago
  There's a difference between user activity tracking (the context of the discussion you linked) and generic metric gathering, which is clearly a thing given that the post was a link to the public fonts analytics page. (I work at Google, I know nothing specific about fonts)
  - arthurcolle 7y ago
    Totally understand and agree that there is a difference: I just half-remembered an at-least tangentially related post and wanted to call it out in case others didn't catch it in the last couple days. I think some actually conflate the generic vs. user-specific metrics collection quite frequently in arguments that I see on this site and I agree that it's definitely not the same but I still felt it was worth the call-out.
  - SahAssar 7y ago
    I agree, but it's a problem because a big part of googles business relies on the former, so I can't trust them when they say that one of their products only does the latter.
    - joshuamorton 7y ago
      Why not? A growing part of Google's business relies on b2b transactions. Are you also concerned that you're going to suddenly have to subscribe to search?
      - SahAssar 7y ago
        > Why not? I thought that was pretty clear in my previous comment, what part was unclear? > A growing part of Google's business relies on b2b transactions. Are you also concerned that you're going to suddenly have to subscribe to search? No, because search is profitable and already explicitly data-milked for most of it's worth. I'm concerned about the data collected in unprofitable services just because they are not profitable and claim to not have every iota of data extracted from them. So I'm concerned that Google Fonts, ajax.googleapis.com and so on will start to be milked for data just like search is.
- bscphil 7y ago
  Incidentally, not that it helps you if you're concerned about your users' privacy, you can use a lot of these third party resources pretty securely with a single Firefox setting: network.http.referer.XOriginPolicy = 2 This tells Firefox to only send the referer header to sites on the same origin. This seems to break very few sites, but means there's no way Google could track me through web fonts even if they wanted to, since they don't know what site I've requested the font from. That said, I think it's pretty plausible (as another user noted) that Google is only keeping general metrics here, not tracking anyone. 1/1000 requests is not very useful data, even if it provided them something on top of the Referer, which they already have.
  - SahAssar 7y ago
    That helps in some cases, but google would still know what font was requested and when. So if a certain site uses Noto Sans and Montserrat that narrows down which site you visited to ones that use those two. Considering google regularly crawls the whole web it definitely knows which sites match those two. That would be a pretty big group of sites, but the more sites that use the features that google fonts touts as performance gains like subsetting and the display parameter the more tracking bits google gains. The more fonts and options sites use the more unique the request signature becomes. Basically if you don't want to be tracked the only good way is to not request anything from the tracking companies. As soon as your browser connects to them they have gained something. Use uMatrix to block all third parties by default, and only whitelist what is absolutely critical for the site to work.
  - ubercow13 7y ago
    There's also https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes...
    - turrini 7y ago
      It's a nice add-on but sadly it doesn't cache fonts and some other resources. See: https://git.synz.io/Synzvato/decentraleyes/issues/34 https://git.synz.io/Synzvato/decentraleyes/issues/34
tjoff 7y ago
Good! Yet another benefit of having control of your site. And another potential cost of relying on someone elses servers.
lightswitch05 7y ago
Thanks for sharing! Also `fonts.gstatic.com` is a CNAME alias for `gstaticadssl.l.google.com` which is commonly blocked by ad blockers. uBlock Origin recently added CNAME based blocking, and PiHole is rolling out support for it too. Just another reason to host it yourself.
- nolok 7y ago
  And this is probably a good reason why they do it this way, they would be stupid not to. Not that I'm happy we end up with this, but business wise it makes way too much sense.
chiefalchemist 7y ago
Have you been able to verify 1 of 1,000? Or was that only this site, this instance of the error? I'm ask because, I wonder if Google adjusts that depending on the site? The traffic?? And/or what it thinks it need to know?

alwillis 7y ago

Useful information on self-hosting 3rd party resources: https://calendar.perfplanet.com/2019/self-hosting-third-party-resources-the-good-the-bad-and-the-ugly/ https://calendar.perfplanet.com/2019/self-hosting-third-part...

arthurcolle 7y ago

The guy who is affiliated with Google Fonts who showed up on a thread a few days ago said that he didn't think there was any tracking related to new implementations of Google Fonts stuff. I guess this says the opposite. Let me try to dig up the thread for completeness... EDIT: Well that was faster than I thought I'd be able to do. Here's the comment, and the thread: https://news.ycombinator.com/item?id=22369415 https://news.ycombinator.com/item?id=22369415

tolmasky 7y ago
I actually don’t care what they’re doing with the data, I care that it crashes the site. The font that gets loaded once every thousand requests is https://fonts.gstatic.com/stats/Roboto/normal/400 https://fonts.gstatic.com/stats/Roboto/normal/400 so it’s some form of statistics. But again, my actual concern is that it breaks. Here’s the code I used to “catch” it. Here, it took roughly 500 requests: https://runkit.com/tolmasky/5e49b314ef61f900146c9a3b https://runkit.com/tolmasky/5e49b314ef61f900146c9a3b Edit: To be clear, I’m not implying this is something they try to keep secret, just showing a way to observe it since it purposely rarely shows up.
- tjoff 7y ago
  Your users might... But who cares, right?
  - tolmasky 7y ago
    I don’t think there’s super meaningful data to be gleaned from server-side tracking, especially with browsers increasingly sending little to no information to third party resources. This is CSS, not a JS script that might collect more info and phone home. So yeah, the site going blank is higher priority to me than them knowing if I, the service provider, not my users, prefer Roboto over Open Sans, or if most users now support woff2 vs. ttf. But either way, we’re not going to use them anymore.
    - RodgerTheGreat 7y ago
      CSS can be crafted to conditionally load additional resources, which means it can be a vector for fairly sophisticated information gathering and tracking. For example: https://github.com/kkuchta/css-only-chat https://github.com/kkuchta/css-only-chat
      - tolmasky 7y ago
        Right but that’s not what’s happening on google fonts.
- dorfsmay 7y ago
  Makes you wonder if it's one node with bad content in a set of one thousand servers! Or bad content cached on one of these/cdn server.
joshuamorton 7y ago
There's a difference between user activity tracking (the context of the discussion you linked) and generic metric gathering, which is clearly a thing given that the post was a link to the public fonts analytics page. (I work at Google, I know nothing specific about fonts)
- arthurcolle 7y ago
  Totally understand and agree that there is a difference: I just half-remembered an at-least tangentially related post and wanted to call it out in case others didn't catch it in the last couple days. I think some actually conflate the generic vs. user-specific metrics collection quite frequently in arguments that I see on this site and I agree that it's definitely not the same but I still felt it was worth the call-out.
- SahAssar 7y ago
  I agree, but it's a problem because a big part of googles business relies on the former, so I can't trust them when they say that one of their products only does the latter.
  - joshuamorton 7y ago
    Why not? A growing part of Google's business relies on b2b transactions. Are you also concerned that you're going to suddenly have to subscribe to search?
    - SahAssar 7y ago
      > Why not? I thought that was pretty clear in my previous comment, what part was unclear? > A growing part of Google's business relies on b2b transactions. Are you also concerned that you're going to suddenly have to subscribe to search? No, because search is profitable and already explicitly data-milked for most of it's worth. I'm concerned about the data collected in unprofitable services just because they are not profitable and claim to not have every iota of data extracted from them. So I'm concerned that Google Fonts, ajax.googleapis.com and so on will start to be milked for data just like search is.
bscphil 7y ago
Incidentally, not that it helps you if you're concerned about your users' privacy, you can use a lot of these third party resources pretty securely with a single Firefox setting: network.http.referer.XOriginPolicy = 2 This tells Firefox to only send the referer header to sites on the same origin. This seems to break very few sites, but means there's no way Google could track me through web fonts even if they wanted to, since they don't know what site I've requested the font from. That said, I think it's pretty plausible (as another user noted) that Google is only keeping general metrics here, not tracking anyone. 1/1000 requests is not very useful data, even if it provided them something on top of the Referer, which they already have.
- SahAssar 7y ago
  That helps in some cases, but google would still know what font was requested and when. So if a certain site uses Noto Sans and Montserrat that narrows down which site you visited to ones that use those two. Considering google regularly crawls the whole web it definitely knows which sites match those two. That would be a pretty big group of sites, but the more sites that use the features that google fonts touts as performance gains like subsetting and the display parameter the more tracking bits google gains. The more fonts and options sites use the more unique the request signature becomes. Basically if you don't want to be tracked the only good way is to not request anything from the tracking companies. As soon as your browser connects to them they have gained something. Use uMatrix to block all third parties by default, and only whitelist what is absolutely critical for the site to work.
- ubercow13 7y ago
  There's also https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes...
  - turrini 7y ago
    It's a nice add-on but sadly it doesn't cache fonts and some other resources. See: https://git.synz.io/Synzvato/decentraleyes/issues/34 https://git.synz.io/Synzvato/decentraleyes/issues/34

tjoff 7y ago

Good! Yet another benefit of having control of your site. And another potential cost of relying on someone elses servers.

lightswitch05 7y ago

Thanks for sharing! Also `fonts.gstatic.com` is a CNAME alias for `gstaticadssl.l.google.com` which is commonly blocked by ad blockers. uBlock Origin recently added CNAME based blocking, and PiHole is rolling out support for it too. Just another reason to host it yourself.

nolok 7y ago
And this is probably a good reason why they do it this way, they would be stupid not to. Not that I'm happy we end up with this, but business wise it makes way too much sense.

chiefalchemist 7y ago

Have you been able to verify 1 of 1,000? Or was that only this site, this instance of the error? I'm ask because, I wonder if Google adjusts that depending on the site? The traffic?? And/or what it thinks it need to know?