3 ms·
I actually don’t care what they’re doing with the data, I care that it crashes the site. The font that gets loaded once every thousand requests is https://font
by tolmasky 7y ago
I actually don’t care what they’re doing with the data, I care that it crashes the site.
The font that gets loaded once every thousand requests is https://fonts.gstatic.com/stats/Roboto/normal/400 https://fonts.gstatic.com/stats/Roboto/normal/400 so it’s some form of statistics. But again, my actual concern is that it breaks.
Here’s the code I used to “catch” it. Here, it took roughly 500 requests: https://runkit.com/tolmasky/5e49b314ef61f900146c9a3b https://runkit.com/tolmasky/5e49b314ef61f900146c9a3b
Edit: To be clear, I’m not implying this is something they try to keep secret, just showing a way to observe it since it purposely rarely shows up.
- tjoff 7y agoYour users might... But who cares, right?
- tolmasky 7y agoI don’t think there’s super meaningful data to be gleaned from server-side tracking, especially with browsers increasingly sending little to no information to third party resources. This is CSS, not a JS script that might collect more info and phone home. So yeah, the site going blank is higher priority to me than them knowing if I, the service provider, not my users, prefer Roboto over Open Sans, or if most users now support woff2 vs. ttf. But either way, we’re not going to use them anymore.
- RodgerTheGreat 7y agoCSS can be crafted to conditionally load additional resources, which means it can be a vector for fairly sophisticated information gathering and tracking. For example: https://github.com/kkuchta/css-only-chat https://github.com/kkuchta/css-only-chat
- tolmasky 7y agoRight but that’s not what’s happening on google fonts.
- dorfsmay 7y agoMakes you wonder if it's one node with bad content in a set of one thousand servers! Or bad content cached on one of these/cdn server.