26 ms·
Bunny fonts – privacy respecting drop-in replacement for Google Fonts
- neycoda 4y agoI wonder if anyone in the '90s thought being tracked by web fonts would be an issue.
- roneoo 4y agoI prefer localGfonts, "Online tool to provide fonts and css snippets for self-hosting using google fonts" See https://labs.binaryunit.com/localgfonts/ https://labs.binaryunit.com/localgfonts/
- Raed667 4y agoAll these hoops we have to jump though and products to create, juste because the USA decided that no other country matters, and pushed the CLOUD Act https://en.m.wikipedia.org/wiki/CLOUD_Act https://en.m.wikipedia.org/wiki/CLOUD_Act
- gbear605 4y agoIt’s also good because Google almost certainly uses data from Fonts for selling ads. I’m much more concerned about that than the theoretical uses by the US Govt, though I’m not a fan of those either.
- thematrixturtle 4y agohttps://developers.google.com/fonts/faq#:~:text=/google/fonts.-,What%20does%20using%20the%20Google%20Fonts%20API%20mean%20for%20the,not%20set%20or%20log%20cookies https://developers.google.com/fonts/faq#:~:text=/google/font....
- jefftk 4y agoThe Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Use of Google Fonts API is unauthenticated. The Google Fonts API does not set or log cookies. In other words, data from font serving does not feed into advertising personalization. (Disclosure: I used to work on ads at Google)
- johnchristopher 4y ago> Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure. and https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... leads me to believe that Google has PI when people visit sites using google fonts. Even if they don't use it for advertising purposes long term log keeping is not required to serve fonts. It doesn't really matter what the service is doing, they didn't ask for consent to log the IP of people downloading fonts. To be perfectly clear: it wouldn't keep me from sleeping at night and fonts permissions should be bundled with cookie consent or there should be a permission prompt (just like when asking for youtube vid.).
- jefftk 4y ago"by including Google-Fonts-hosted font on its pages, passed the unidentified plaintiff's IP address to Google without authorization and without a legitimate reason for doing so" It isn't about whether the IP address was logged, but about whether it was sent. Which is an unavoidable aspect of loading a resource from a server.
- johnchristopher 4y agoMy concern is totally about whether or not the IP is logged though and google's vague language doesn't clear doubts about that. On the contrary: > Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure. Why does it point this data is kept secure if there is no PI in the first place ?
- hedora 4y agoSecure from whom? The mob? China? The US government? Google? I'm more worried about the last two than the first two. It'd be illegal for them to secure it against US law enforcement, and they don't claim they're secure the data they log against access from themselves.
- 4y ago
- deleted 4y ago[deleted]
- xnacly 4y agoThis looks really interesting, does anybody have an insight on whether or not all families on gfonts are also on bunny fonts?
- phphphphp 4y agoGoogle Fonts: "1424 of 1424 families" Bunny Fonts: "1429 families" Presumably Bunny Fonts is, essentially, just a pass through to Google Fonts.
- politelemon 4y agoOn the font pages, they use this as the example sentence: > The quick brown bunny jumps over the lazy dog. While the site is trying to be quirky and cute, replacing 'fox' with 'bunny' doesn't showcase what 'f' and 'x' look like.
- httpsterio 4y agoyou can replace the text with whatever you wish though so it's not an issue
- RobLach 4y agoIt's an issue because you have to replace the text.
- jobigoud 4y agoShortest I could find in a few minutes: The quick brown fox jumps over the glazed bunny.
- ntoskrnl 4y agoIf a fox encountered a glazed bunny in the wild, it probably wouldn't jump over it...
- gandalfgreybeer 4y agoBy this logic, why would it also jump over a lazy dog?
- bee_rider 4y agoPerhaps the dog had cornered the fox, but in an a location that the dog couldn't reach. So it decided to wait the fox out, but then fell asleep because it is lazy.
- zarzavat 4y agoWrote a quick Python script to explore alternatives. The best I found with two words was: - The quick brown bunny jumps over the lazy podgy fox. If you want to do it with one word you can do: - The quick brown bunny jumps over the oversexualized dragonfly.
- sdze 4y agoWhy wouldn't I just self-host the fonts on my server? What are the benefits of such CDN? Years ago I could understand it because it may reduce latency (cache), but since browsers don't cache from 3rd party servers anymore, also this is argument is obsolet.
- Twixes 4y agoTrue that there's no 3rd party caching benefit anymore, but it's still just very convenient – select fonts a'la carte, copy the CSS/HTML snippet, paste it in, and that's it. All for free, no licensing considerations with Google Fonts.
- nyanpasu64 4y agoI just went through the process of self-hosting Google Fonts. The process is actually surprisingly tricky. Google Fonts lets you download fonts for desktop use, in the form of .ttf or .otf rather than the .woff[2] with one file per Latin/Greek/Vietnamese/etc. script served by Google Fonts itself. If you want the same font-embedding CSS as Google Fonts itself, you can use https://google-webfonts-helper.herokuapp.com/fonts https://google-webfonts-helper.herokuapp.com/fonts (a font browser, outdated, doesn't support font-display: swap), or https://nextgenthemes.com/google-webfont-downloader/ https://nextgenthemes.com/google-webfont-downloader/ (a converter from Google Fonts CSS URLs to downloadable font packs, supports font-display: swap, it works well but I chose to not host the large CSS files with embedded fonts in base64 format). As a technical curiosity, the second site can suffer a race condition resulting in partial or broken file downloads (I never tested what happens), if two people request the same font bundle at the same time, and they overwrite each other: https://github.com/nextgenthemes/open-webfonts#bug-reports-and-improvement-requests https://github.com/nextgenthemes/open-webfonts#bug-reports-a... I wish browsers would give users an option to set the default font-display policy to swap.
- quickthrower2 4y agoI would guess they have a server nearer your client than you do.
- marginalia_nu 4y ago
- huhtenberg 4y agoHow is this service financed exactly? One would expect this to be at the top of their FAQ.
- jorams 4y agoBunny.net is a CDN company with paying customers. This is a free service provided by that company.
- deleted 4y ago[deleted]
- sascha_sl 4y agoPresumably marketing budget. Bunny is an extremely affordable CDN. The business they'd get from medium to large sites that already trust them enough to serve fonts over them should easily make up for it.
- TazeTSchnitzel 4y agoYears ago I did sudo bash -c 'echo ":: fonts.googleapis.com" >> /etc/hosts' sudo bash -c 'echo "0.0.0.0 fonts.googleapis.com" >> /etc/hosts' and I haven't looked back.
- einpoklum 4y agoI am often tempted to push this further to: sudo bash -c 'echo ":: google.com" >> /etc/hosts' sudo bash -c 'echo "0.0.0.0 google.com" >> /etc/hosts'
- 0daystock 4y agoWhat exactly do you believe doing this will accomplish, other than cutting off access from a search engine?
- midislack 4y agoStops the biggest advertiser from profiling you on every site, obviously.
- dan_pixelflow 4y agoIt doesn't, though. Google use other domains.
- midislack 4y agoBlacklist those too then.
- blacksmith_tb 4y agoI'd suggest 1e100.net[1] too. 1: https://support.google.com/faqs/answer/174717?hl=en https://support.google.com/faqs/answer/174717?hl=en
- quickthrower2 4y agoBlazingly fast!
- mimsee 4y agoOr better yet, include the ttf/woff/woff2 files inside your project as an npm package using Fontsource[0]. [0]: https://github.com/fontsource/fontsource https://github.com/fontsource/fontsource
- usrn 4y agoOr even better just don't use custom fonts because they break a lot of things anyway.
- vehemenz 4y agoCan you give some examples? Custom web fonts have been well supported since the late aughts.
- usrn 4y agoThey're a big reason pages load slowly and cause text to jump around when they do. Custom web fonts are awful.
- deleted 4y ago[deleted]
- vehemenz 4y agoWeb fonts are pretty small and only load if used, and loaded only if they're not cached. It's definitely added requests, but those can be deferred intelligently. Reflowing is preventable using modern techniques, but honestly it doesn't seem like that big of a deal. The tradeoff is you get access to lots of different type options. More type options means more you can convey with type, which is a good thing for people who need to communicate on the web. It's more than just marketing sometimes.
- jhanschoo 4y agoFont variety help legibility through creating distinctions in context and hierarchy, though.
- brycewray 4y agoInteresting and cool, although apparently no variable fonts[0] as yet. While it’s best to self-host whenever possible, this appears to be a great alternative to GFs if one isn’t willing or able to do that. [0]: https://web.dev/variable-fonts/ https://web.dev/variable-fonts/
- usrlocal1023 4y agoThe service doesn't seem to support IPv6 as there are no AAAA DNS records. $ dog A AAAA fonts.bunny.net CNAME fonts.bunny.net. 10s "bunnyfonts.b-cdn.net." A bunnyfonts.b-cdn.net. 10s 195.181.164.130 CNAME fonts.bunny.net. 9s "bunnyfonts.b-cdn.net." A bunnyfonts.b-cdn.net. 9s + 195.181.164.130
- moffkalast 4y agoI'm still not entirely sure why anyone would load fonts from a 3rd party link that's bound to break sometime. Just add it to your assets like a normal person and Cloudflare will cache it for you anyway. The license is non-standard too, something called SIL. I'm not gonna bother looking up what that weird thing permits when I can get thousands of CC0 fonts from like a dozen sites.
- matthews2 4y ago> The license is non-standard too, something called SIL. I'm not gonna bother looking up what that weird thing permits It's the same as Google Fonts (because they're the same fonts). Most of the fonts are released under the terms of the SIL Open Font License 1.1, and a handful of them released under the terms of the Apache License 2.0. Most free fonts are OFL'd.
- hannob 4y agoI find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now with fonts there's a really simple solution: Just don't. As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. There are situations where you can't completely avoid privacy issues, and then you can try to do better than others. But if you can completely get rid of a privacy issue then obviously that's what you should do.
- tyingq 4y agoIt seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are trivially easy for Google to correlate to your other activity. There's much less value for BunnyCDN to abuse it, because they don't have the critical mass of your other activity. Yes, just serving up your own fonts is better, but this is an improvement that seems to work with only a minor change.
- judge2020 4y agoFor both bunny.net and Google Fonts, using a CDN is useless with the advent of timing attacks related to the browser cache https://news.ycombinator.com/item?id=24894135 https://news.ycombinator.com/item?id=24894135. Storing fonts on the same domain avoids a DNS lookup and extra TCP connection.
- rrdharan 4y agoI see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts (https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_...) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.
- markx2 4y agoFirefox > Settings > General > Fonts > Advanced Uncheck "Allow pages to choose their own fonts, instead of your selections above" No remote fonts anywhere.
- weird-eye-issue 4y agoBreaks lots of icons and such right? I disabled fonts for like a day with Ublock Origin but it was too inconvenient
- markx2 4y agoI have not noticed any breakage though it may well happen. But pages are fast to load, I get a consistent chosen font across all sites and my privacy (at least for font loading) is respected.
- reaperducer 4y agoA few elections ago, the New York Times used a font of state glyphs to display icons in its real-time election results.† If you didn't have that font, you couldn't figure out the election results without clicking through to each state's page to see the results. † It's quite nice. If memory serves me correctly, the Times even open-sourced it.
- midislack 4y agoJust close the offending site and never, ever return. Works wonderfully!
- xigoi 4y agoIf you block via uBlock Origin, you can make exceptions for sites that get broken too much.
- moffkalast 4y agoYou underestimate the average person's laziness.
- favourable 4y agoThis is a great project, but I learned to use a system font stack[0] instead to address latency issues on my sites. I run an e-commerce site and every millisecond in rendering time is potentially a lost sale. It needs to be fast, especially for those on 3G (or 2G?) connections. [0] https://systemfontstack.com/ https://systemfontstack.com/
- cageface 4y agoThis is my preferred solution too. It’s really not necessary to use custom fonts to achieve a nice design in most cases.
- AtNightWeCode 4y agoExcept for Android, very poor default fonts.
- kube-system 4y agoThey won't notice if your website looks bad: https://images.techhive.com/images/article/2014/04/customize_fonts_primary-100261128-primary.idge.jpg https://images.techhive.com/images/article/2014/04/customize...
- _fat_santa 4y agoI have a question about system fonts. Whenever I declare system fonts I always use: `serif`, `sans-serif`, or `monospaced` rather than the actual fonts like: ``` font-family: -apple-system, BlinkMacSystemFont, avenir next, avenir, segoe ui, helvetica neue, helvetica, Cantarell, Ubuntu, roboto, noto, arial, sans-serif; ``` Am I doing it wrong by declaring it just like `font-family: sans-serif`?
- xigoi 4y agoNo, it's a matter of preference. The default fonts in some browsers are pretty ugly, so if you want at least a chance of getting a better font, you can use a stack like this. But it's fine if you don't.
- ilrwbwrkhv 4y agoPerfect and easy to switch. Great work bunny. Also their cdn is the fastest I have ever used.
- unicornporn 4y agoA CDN for this? Sorry, but just store the fonts on the same d**n server you're serving the site from. Files are tiny, it's not 1080p video we're talking.
- aembleton 4y agod**n? Is that damn, or down, or something else? Why astreisk it out?
- unicornporn 4y agoDamn if you want it spelled out.
- midislack 4y agoDo people still seriously download fonts? I turn that crap off.
- Destiner 4y agoI'd suggest stop using 3rd party font hosting altogether and adopt something like Fontsource [1]. That way, no reliance on 3rd parties, full privacy, and full control over font file changes (yeah, apparently, fonts are changed from time to time). [1] https://fontsource.org https://fontsource.org
- zagrebian 4y agoShouldn’t the website disclose who funds this service? Like, what’s the catch?
- mishafb 4y agoIt is a real cdn with paying customers, trying to advertise its product, there is no catch
- AtNightWeCode 4y agoThis has a joint problem with GF though. There is no option to download the resulting font.
- martini333 4y agoHost your own damn fonts. like holy shit
- 323 4y agoDon't trust Google, trust us, a 30 person company. This is exactly what a FBI/CIA/GCHQ/FSB front company would say. They love to set up fronts in good-reputation countries, like Switzerland, or Slovenia in this case.
- moffkalast 4y ago> like Switzerland, or Slovenia As a Slovenian, thanks for the laugh.
- epigramx 4y agoSites like this have many Google employees though.
- Nextgrid 4y agoGoogle has a proven track record of being malicious and a business model that relies on it. If I had to choose I'd take the unknown evil rather than the 100% known evil, though in this case it's dumb to use either option when you can trivially self-host.
- pdimitar 4y agoAnd I am supposed to believe a semi-pretty marketing site that they don't do server statistics gathering that they periodically sell to Google, Facebook and any other data brokers? Yeah, sure. Or maybe just host your own fonts. 350KB traffic per unique visitor per month isn't going to kill your bill unless you serve millions of visitors a day.
- 60Vhipx7b4JL 4y agoNo info how to host this myself? I thought the top goal was to host the crap yourself so you don't have to load from google.
- cramforce 4y agoDo not use this, use Google Fonts, just self-host them. This site claims better privacy, but does so using the wrong solution since you still have to trust them. Self host (supported by Google Fonts but not by this service): - Better privacy - Better performance (no extra DNS lookups, TLS connection) Their default embed code is a CSS @import directive. These must never be used in production code (It's fine as a directive for the compiler for local files but not with remote URLs). Leads to FOUC and FOIT. Also, next step in amateur hour: They serve their CSS and fonts on the same domain as their marketing website. Cookies galore.
- aembleton 4y ago> Leads to FOUC and FOIT. What are those acronyms?
- wkirby 4y agoFlash of Unstyled Content and Flash of Invisible Text. * FOUC: when you see content in the wrong font, then it switches to the correct font, sometimes leading to page layout jumps. * FOIT: when you see _no_ text content because the desired font is missing with no fallbacks/the CSS directed not to use fallbacks. Once the font loads, page layout might jump.
- cramforce 4y agoHere the definition is actually broader than FOUC just for the font part. It can cause rendering without any CSS
- 0des 4y agoFlash of Unstyled Content, and Flash of Ice Tea
- rebelpixel 4y agoHere's a great little helper to self-host google fonts: https://google-webfonts-helper.herokuapp.com/fonts https://google-webfonts-helper.herokuapp.com/fonts
- jollybean 4y agoCan someone please answer the question ... why don't companies just self-host the fonts? And why aren't people doing that in the first place?
- grzm 4y agoCost of storage and management. Time is money, and it's expensive to pay people to mess with things if they don't have to. I might not choose to make the same tradeoffs, but I can understand why others might.
- abrudz 4y ago> With a zero-tracking and no-logging policy Behold exhibit A: https://i.imgur.com/6F7fZVm.png https://i.imgur.com/6F7fZVm.png
- notpushkin 4y agoNext project idea: cdnjs.bunny.net.
- omoikane 4y agoAfter changing the sample text on fonts.bunny.net to something that is non-English, all missing characters are all rendered with the same font. Chrome inspector will show the actual font being used under "Rendered fonts", and it appears to be whatever the locally configured fallback is. This is in contrast with the behavior on fonts.google.com where missing characters are rendered with an inline image to explicitly show the missing glyph. I prefer the fonts.google.com behavior here, which makes it easier to find fonts that have all the glyphs I need.
- DantesKite 4y agoGoogle uses fonts to track users? I didn't know that. Man, that's crazy.
- mda 4y agoIt doesn't.
- blip54321 4y agoIf it were me, I'd make third-party font sources require a SHA hash. In pseudocode: url("https://fonts.googleapis.com/comic-sans", sha="abcd1234") This way: - If my browser has comic-sans cached, no request is made - Caching works even if the same resource is sourced from multiple places (e.g. I can host comic-sans locally, but if they got it from a CDN, they don't need to get it again) - If a malicious site replaces a resource, that's flagged I think the trick would be to make this optional (but bandwidth/privacy-saving), and gradually to make this increasingly mandatory for different types of resources. AJAX calls obviously can't have SHA hashes, but JavaScript libraries can.
- missblit 4y agoCouldn't you use a Content-Security-Policy for this? https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
- jfk13 4y agoSounds like you're basically reinventing SRI: https://en.wikipedia.org/wiki/Subresource_Integrity https://en.wikipedia.org/wiki/Subresource_Integrity One issue with cross-site caching, though, is that it may enable timing-based attacks on privacy.
- blip54321 4y agoNo, I'm not reinventing it, but extending it by: 1) Mandating it for certain types of resources 2) Extending caching to cover the cross-site case. Can you please explain the proposed timing-based attack?
- cmeacham98 4y agoWebsites can use whether or not a resource is cached (one way to measure that is how long it takes to load) to uniquely identify your browser and track you across the internet. Another attack is to determine if you visited $popularWebsite by checking if resources it uses are cached (this could be useful to, for example, the Chinese government for surveillance on its citizens).
- hedora 4y agoI wonder if browser manufacturers could do a better job of this by just keeping a list of junk that > 99% of web browsers will eventually download anyway, and then just prefetching it all at initial install.
- richdougherty 4y agoWhile we're talking about privacy and CDN delivery, check out Decentraleyes. It's a browser extension which keeps a local cache of common CDN-delivered files. https://decentraleyes.org/ https://decentraleyes.org/ I wondered if it supports fonts out of the box, but not currently. https://github.com/Synzvato/decentraleyes/issues/105 https://github.com/Synzvato/decentraleyes/issues/105
- kadutskyi 4y agoHow many fonts do people use on their websites? 2-3? Just host them on your server. It will add 2-3 more requests when user first loads you websites but after that fonts are cached so no more additional requests.
- 1vuio0pswjnm7 4y agoOne of the numerous advantages of of text-only www, as seen through a text-only browser, is that CSS and Javascript do not matter. As a www user, unless I am filing GDPR complaints against websites using Google Fonts under default configuration, i.e., served from Google computers, , I have no reason to care what fonts a website is using.
- manigandham 4y agoPointless to move from one CDN to another for this. Also their performance is rather poor and about 10x higher latency compared to Google fonts. If your origin is already fast and/or fronted with your own CDN the self-host and serve the fonts directly under you own domain. Trivial work with better security and performance.
- firexcy 4y agoTangentially related -- I just want bloggers to think twice before choosing (mis|ab)used Google Fonts just because they look "fancier" at first sight. Lato and Merriweather have become Arial and Times New Roman of our time.
- partiallypro 4y agoGoogle now allows you to download the fonts in the appropriate formats so you can serve them up yourself, so I don't really see the point.
- amirmaleki 4y agoWhat do fonts have to do with privacy? What am I missing here?
- perlgeek 4y agoLoading fonts from a third-party CDN leaks information (namely your IP address, date/time of activity and possibly a HTTP referrer) to that CDN.
- ThinkBeat 4y agoCan I download these fonts in some normal format and use them in LibreOffice or such?
- davelab6 4y agoI work on the Google Fonts team. https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_... was updated today, confirming Google Fonts doesn't log IP addresses. Given that, it's unclear to me personally what the difference is between Bunny Fonts and Google Fonts.