16 ms·

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us,

by hannob 4y ago

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now with fonts there's a really simple solution: Just don't. As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. There are situations where you can't completely avoid privacy issues, and then you can try to do better than others. But if you can completely get rid of a privacy issue then obviously that's what you should do.

tyingq 4y ago
It seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are trivially easy for Google to correlate to your other activity. There's much less value for BunnyCDN to abuse it, because they don't have the critical mass of your other activity. Yes, just serving up your own fonts is better, but this is an improvement that seems to work with only a minor change.
- judge2020 4y ago
  For both bunny.net and Google Fonts, using a CDN is useless with the advent of timing attacks related to the browser cache https://news.ycombinator.com/item?id=24894135 https://news.ycombinator.com/item?id=24894135. Storing fonts on the same domain avoids a DNS lookup and extra TCP connection.
- rrdharan 4y ago
  I see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts (https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_...) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.
  - tyingq 4y ago
    I read that pretty carefully, and didn't see anything about not saving and correlating the visit with other logs they have.
  - ncmncm 4y ago
    I perceive exactly zero risk to Google in lying about literally anything at all. Have you ever heard about them being even slightly inconvenienced in response to any abuse?
    - rossjudson 4y ago
      Do you feel like providing any examples?
      - ncmncm 4y ago
        Lack of examples,you mean?
      - Nextgrid 4y ago
        See https://news.ycombinator.com/item?id=31810185 https://news.ycombinator.com/item?id=31810185.
        ncmncm 4y ago
        Status of that, two years on, appears to be complaints that Google is violating its discovery obligations.
    - KerryJones 4y ago
      Uh, yes, many times. https://www.reuters.com/article/us-alphabet-google-privacy-lawsuit/google-faces-5-billion-lawsuit-in-u-s-for-tracking-private-internet-use-idUSKBN23933H https://www.reuters.com/article/us-alphabet-google-privacy-l...
  - Nextgrid 4y ago
    The GDPR went into effect in 2018 and gave companies 4 years to prepare for it. The GDPR has strict guidelines as to how data processing consent flows should be presented, including the fact that it should be as easy to decline as it is to accept. Yet, Google initially implemented a malicious consent form where accepting is easy and declining is impossible. They only very recently implemented a compliant consent flow which gives you an easy option to decline. Google has already proven their bad faith and successfully got away with it, along with plenty of other companies.
ntoskrnl 4y ago
If you're requesting data over a network, ultimately you have to trust someone. Fwiw bunny.net is pretty well respected. I view them as one level "below" the mega-enterprise CDNs like Cloudfront/Akamai, the same way Digital Ocean is one level "below" AWS/GCP/Azure
- lolinder 4y ago
  > If you're requesting data over a network, ultimately you have to trust someone. If I self-host my fonts, the people I have to trust are only those people I have no choice but to trust: those who get my site into the user's browser. Every additional cross-domain request I add is an extra party I have to trust.
hsjdbdksjsj 4y ago
you won't believe this, but as the end user you can solve this in your life once and for all, and also improve your life! something rare for online annoyances nowadays. any decent browser, i mostly use firefox, have a checkbox in the font screen that prevents sites from changing the page font. i set all sites to user Ubuntu Mono. always. all the time. everywhere. the only downside are sites that use winding-like fontawesome. you will get "S" instead of the magnifyingglass icon... i got used to things like that. Google meet screen is particularly weird. meh. but after you are past the initial shock, having the same font everywhere is the ideal usability hack. faster reading. less distraction. it's perfect. and as a bonus i don't even care (as i block referrer headers xdomain), not a single request ever goes to googlefont and the likes.
- justinclift 4y ago
  Oh, that'd probably work really well with dyslexic style "easier reading" fonts too. eg: https://opendyslexic.org https://opendyslexic.org / https://github.com/antijingoist/opendyslexic https://github.com/antijingoist/opendyslexic
- jstummbillig 4y ago
  Upside: Consistency. Downside: Consistency.
  - HelloNurse 4y ago
    Without forgetting consistent detection of fragile extreme typography that breaks layout or looks strange when fonts are replaced.
- ajvs 4y ago
  Alternatively people can use uBlock Origin and simply block all remote web fonts. It'll break some sites which use fonts to replace icons, but the add-on can easily be disabled for those specific sites.
- nyanpasu64 4y ago
  I used to disable font overrides altogether. Another failure mode of that mode is that the omnipresent Material Icons displays words (the font contains ligatures replacing words with icons) instead of icons.
fritigern 4y ago
> we're in a country with better privacy laws Speaking as a European: I think this is a very important topic for us. I don't think Americans and American companies understand how little trust rest of us have for the American government. Working with a company that is not subject to the whims of the American government is a huge privacy win. If a company pitches me a product, they start 1 points ahead if they are based on Switzerland, Netherlands or somewhere similar.
- shrimp_emoji 4y ago
  I always had the suspicion that the (seemingly higher) interest in privacy/FOSS in Europeans is fueled partly by anti-Americanism. In America, even if you don't trust the government, at least it's your government, so I don't feel like that plays as big a role, and any interest in privacy/FOSS (like mine) is untempered by the anxiety of an alien government's interference. :p Regardless, I love how much more Europeans seem to value privacy.
  - fritigern 4y ago
    > I always had the suspicion that the (seemingly higher) interest in privacy/FOSS in Europeans is fueled partly by anti-Americanism. Of course it is. After American Wars in the Middle East killed and displaced millions, there is good reason to be wary of Americans and the American government.
    - deleted 4y ago
      [deleted]
  - marcosdumay 4y ago
    > at least it's your government What? Your government is the worst one to go not respecting your rights.
    - fritigern 4y ago
      I worry more about my government compared to the government of a county far away that has no power over me.
_fat_santa 4y ago
> If you embed a font hosted somewhere else you expose some of your user data to them. Now with fonts there's a really simple solution: Just don't. As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. I never quite understood the debate around fonts. You could use the CSS/Link import that Google provides, but that's never the optimal solution. Like you I always download the fonts and use them directly via @font-face. The only advantage I see to using Google Fonts / some privacy respecting font service like this one, is when you are first prototyping an app and want to either test fonts, or want to move quickly and not worry about setting up fonts properly. We also used in a places like Storybook where having correctly set fonts is not as important. But even if you did use it in prototyping, it's best practice to pull down those fonts and store them locally before going to production (at least in my mind). Am I missing something?
- heretogetout 4y ago
  If the font is already in your browser cache (which it might be if they're hosting it on a common CDN) web pages should load with the correct font right away instead of either loading blank areas or a default fallback font before switching to the correct font, causing jank. The best solution here is to use standard fonts that are available in all browsers, of course.
  - modeless 4y ago
    Sorry, not since cache partitioning. https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/ Privacy killed the shared cache.
    - SquareWheel 4y ago
      And it's such a niche privacy issue too. I would gladly take a shared cache over cache isolation. Especially for something used on as many sites as Google Fonts is.
      - 4y ago
TheRealPomax 4y ago
We can reasonably assume that bunny.net doesn't also correlate, cross-link, and permanently store which sites our IPs visit, for the purposes of enhanced ad delivery. Which Google does: that's literally what every single service they offer does in addition to "the thing you need that service for". Even sites that don't offer Google ads or Google analytics _still provide Google with behavioural data linked to you_ by using Google fonts. So no, this is not one of those examples, this is a great example of someone setting up a service to remove all those free, extra data points that Google harvests. Today it's fonts. Maybe tomorrow, it's the rest of their "it's not explicitly Google Analytics" offerings.
- skybrian 4y ago
  I don't think we can reasonably assume either of those things. You're speculating about both Google Fonts and Bunny fonts based on very little information.
  - TheRealPomax 4y ago
    No, and yes, respectively. If you consider "Google recording and monteizing on CORS URL requests" speculation, I'm not sure you know much about the company we're talking about here. They've been sued and fined over tracking quite a number of times. Do we know whether bunny.net is any better? In the abstract, no we don't, but we're not dealing in abstracts, so we actually do because of where they operate. A real European operation (not an international company with EU presence but an HQ outside of direct EU jurisdiction) is by default quite a bit better at not violating GDPR, and runs the actual risk of being fined into financial insolvency (rather than getting a few hundred million slap on wrist that a multibillion dollar company goes "pff, whatever, let legal sort it out" to). By virtue of Google's track record, and by virtue of where this new service is located, and the track record of EU based services with regards to privacy compared to their US counterparts: Yes, we can _very_ reasonably assume both of those things.
    - skybrian 4y ago
      I used to work at Google and I'm sure I don't know how most of it works, outside the area I worked in. It's a big company and the systems are complex. Why do you think you know how it works? What do you actually know about Google that doesn't come from outside speculation? That link says that a website leaked an IP address to Google. It doesn't say that Google did anything with the IP address.
miohtama 4y ago
You can self host Google fonts, so you need to trust no one. Not sure if I see the point of this service.
jokethrowaway 4y ago
The only reason is to escape regulatory fines for something 99% of the world doesn't give a shit about. Not using fonts is not always an option
- kevin_thibedeau 4y ago
  > Not using fonts is not always an option The silliness of this is that someone is going through the effort to set up hosting for a website but hosting the fonts is just too difficult and has to be delegated to a third party. The laziness of webdevs never fails to astound.
  - lolinder 4y ago
    I don't think it's laziness. My conscious brain knows that it's anachronistic, but I still have the instinct to use a CDN for the shared caching between sites. Obviously, browser privacy changes mean that isn't a valid reason any more, but for me the instinct is still there.
    - kevin_thibedeau 4y ago
      Sites will setup a CDN to serve their own custom assets, but fonts? nope not doable. It's 100% laziness.
      - lolinder 4y ago
        I'm not talking about setting up a CDN for custom assets, I'm talking about using something like jsdelivr or Google Fonts. Back in the day using those was a "best practice" because most people would (in theory) already have whatever font/library you're using cached. A lot of people, myself included, still have that as a habit that takes conscious effort to avoid falling into.
- vorticalbox 4y ago
  > Not using fonts is not always an option Do you have an example where doing something in an external font is not possible in one that's built into the browser?
1337shadow 4y ago
Can't you self host this?
moritzwarhier 4y ago
I always opt for self-hosting, be it fonts or other assets. Sometimes I am briefly envious of the ability to use things like Google Fonts, Unpkg or polyfill.io when setting up a project. But I started doing web dev in 2018 when GDPR was introduced here, and I always was kind of paranoid regarding that. Self-hosting is probably a better habit to acquire anyway, the only alternative being explicitly contracting with a company that offers edge CDN. https://google-webfonts-helper.herokuapp.com/fonts https://google-webfonts-helper.herokuapp.com/fonts is great for quick self hosted local Google Webfonts
yetanother12345 4y ago
> have no idea who bunny.net is $ whois bunny.net (...) Registrant Name: Registration Private Registrant Organization: Domains By Proxy, LLC Registrant Street: DomainsByProxy.com Registrant Street: 2155 E Warner Rd Registrant City: Tempe Registrant State/Province: Arizona Registrant Postal Code: 85284 Registrant Country: US (...) > we're in a country with better privacy laws" ...it appears that the domain registrant is not, so you will just have to trust that the company is not in the US or not owned by a US entity (mostly relevant for the rest of the world, probably). > with fonts there's a really simple solution: Just don't This was worth repeating :)
- helldritch 4y ago
  This is run by BunnyCDN, I've been one of their smaller users for a few years now (live video hosting and delivery, mostly .m3u8, mpegts, HTTP Live Streaming type of stuff) and I've always found their service reliable and cheap. One of the primary reasons I liked them was that their API is REALLY fast at making changes to the files (you make the call and 100ms later the file attributes / content have been updated throughout all their delivery locations) and the interface is pretty easy to use. This isn't an advertisement, I had a very specific use-case, but it follows into this: Of course, just like with Google, we are the product here. Google Fonts is an analytics data collection platform, Bunny Fonts is an advertisement for their CDN services. I'm going to stick with a /fonts/ directory, I think, despite being one of their current users. It's really not very much bandwidth for the fonts, it's not 2010 anymore, and I prefer the control (and the local development environment being the same, I don't always have internet and I don't want a dev toggle for something as silly as fonts).
- justsomehnguy 4y ago
  domain registrant != site/host location Their web-site is located in the UK[0] Their fonts CDN is originating from AS60068 which is registered in UK too[1][2] [0] https://bgp.he.net/dns/bunny.net#_ipinfo https://bgp.he.net/dns/bunny.net#_ipinfo [1] https://bgp.he.net/AS60068#_whois https://bgp.he.net/AS60068#_whois [2] https://bgp.he.net/dns/fonts.bunny.net#_ipinfo https://bgp.he.net/dns/fonts.bunny.net#_ipinfo
rmbyrro 4y ago
Can someone point out a good reason for not downloading the font files and serving them directly from your CDN or servers, without any calls to third-parties in your HTML?
- technion 4y ago
  "The bikeshed" I've been down this road. I don't know what it is, but many web developers are extremely adverse to doing it. Even once you've convinced people to let you do it, the first PR from a new hire is a fix for this "bug".
  - citizenkeen 4y ago
    What is the bikeshed?
    - nvr219 4y ago
      "Organizations spend disproportionate time on trivial issues" - cn parkinson not sure how it's relevant here though
      - webmaven 4y ago
        > not sure how it's relevant here though As I understood the answer, the expanded version would be "the only disadvantage is having to spend an unreasonable amount of time arguing about this issue, which will drag on forever since it is relatively minor."
        nvr219 4y ago
        Thank you.
- justsomehnguy 4y ago
  Ha, you want an anecdote? Years ago, when I worked at MSP serving quite a big federal customer... We received a ticket what $companysite.tld isn't working. Pretty unusual, but the first things first, so I just type $companysite.tld in the browser. It works fine. Okay, ignore then. But, no, 15 minutes later we receive an email with a tons of people in CC and a lot of !!!!s in the subject and body what the site is still down. I again check it from my machine (which of course was in the MSP office, not on customer premises), it works fine, DNS, tracert, yada-yada. Our network team replies what $companysite.tld responds to ping so everything works fine from their POV. Duuuh. Okay, I hop to the management station located in the customer's DC, test the site there... and it doesn't work there. Just a blank screen, no errors, nothing. Which is pretty strange because the site is hosted in the same DC. DNS resolves to the proper records, ICMP works including traceroute... Well, long story short, after 30 minutes of head scratching and dozens of emails with ever longer list of people in CC it occurs to me to hit F12. I open the developer console, switch to Network tab, type in $companysite.tld and I see what the traffic is starting to flow just fine, only to stall to a halt at... googlefonts.com (or whatever TLD they used). At this point I just calmly sent an email explaining what the site was working just fine, it just wasn't able to properly load from the customer premises because of the block of Google services. To summarize: somebody from the customer ordered to block Google services on the network level (don't even ask); network team (certified Cisco CC** folks!) implemented it by dropping traffic instead of denying - so the firewall would notify the client station about that and the browser would abort the request to googlefonts.com and wouldn't wait a full timeout for each request (don't forget DNS records resolved just fine, if they sent NXDOMAIN for it there wouldn't habe been even an attempt to connect); network team diagnoses the availability of the web-sites by using ICMP ping... but that wasn't the first or the last time when I was quite... disappointed of their qualification. While it is very rare for major CDNs to go down, it happens, and even more shenanigans can happen on a network level between some client and your website (and proliferation of DPI by various countries, agencies and enterprises doesn't help here too). So if you are on the payroll just host the fonts (and honestly - all assets, if applicable) with the web-site and sleep soundly. Of course if you are paid for each "incident", then Web3.0 is all yours. *grin*
1vuio0pswjnm7 4y ago
"Which is an imperfect solution at best, and given I have no idea who bunny.net is it's a questionable solution at best." Anyone who is a bunny.net customer would have an idea. Unlike many of the myriad wesbites using Google fonts, they would also have an agreement with Bunny they could potentially enforce. Anyone doing internet research who peruses publicly available scans of DNS ports in the last five years would likely be familiar with bunny.net as they are a large enough CDN to have many thousands of subdomains for customer IPs. It is seemingly impossible to miss this company's presence toward the beginning of the scan. The founder of bunny.net recently posted a question in an nginx forum. This is not AWS or Google. Amazon sells goods. Google sells online advertising services. Both are primarily intermediaries (middlemen) who try to prioritise their own competing goods/services. All the data those companies collect may feed into other business that strives to study and understand consumer behaviour, e.g., placing internet-connected microphones (referred to only as "speakers") in people's homes or internet-cnnected GPS trackers in their pockets. There are strong incentives for those companies to conduct extensive surveillance. Bunny sells CDN services. At present, that's all, AFAICT. 1. https://bunny.net/our-story https://bunny.net/our-story This HN submission purports to mirror the recent announcement of fonts on the bunny.net blog on 16 June however it currently points to an "About" page, not the blog entry. The blog entry discloses in more detail the rationale for the decision to offer fonts. https://bunny.net/blog/bringing-privacy-back-into-your-own-hands-introducing-bunny-fonts/ https://bunny.net/blog/bringing-privacy-back-into-your-own-h... There is an argument supported by legal decisions in Austria, Denmark and Germany that neither Google Fonts nor Google Analytics are GDPR-compliant. https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f...
keithnz 4y ago
> As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. I thought the whole point is that using a common resource your chances of a cache hit are much higher such that they don't need to download. Having said that, if you are worried about GDPR you are probably way better off hosting them yourself anyways
popcube 4y ago
if their allocated at Europe, this maybe make sense
raxxorraxor 4y ago
The thing is that if you have resources on google.com, they may be allowed to set a cookie. And large companies like Google can far more effectively aggregate the data because of their reach. But true, I doubt Google is more nefarious than other resource provider. I am 99.9% sure that Google is not abusing cookies to extract end user data through their fonts service. I believe you might be legally obliged to inform the user about them setting a cookie though. Alternatively, and this might be the better solution is to simply "vendor" the fonts (supplying them from your own server).
krageon 4y ago
> we're in a country with better privacy laws This is the important part. Laws are not about trust.
XCSme 4y ago
> "we're in a country with better privacy laws" Well, this is what all the fuss is about: respecting the law. I'm not saying the laws are good or bad, just that it is the only thing that most companies really care about.

by hannob 4y ago

tyingq 4y ago

It seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are trivially easy for Google to correlate to your other activity. There's much less value for BunnyCDN to abuse it, because they don't have the critical mass of your other activity. Yes, just serving up your own fonts is better, but this is an improvement that seems to work with only a minor change.

judge2020 4y ago
For both bunny.net and Google Fonts, using a CDN is useless with the advent of timing attacks related to the browser cache https://news.ycombinator.com/item?id=24894135 https://news.ycombinator.com/item?id=24894135. Storing fonts on the same domain avoids a DNS lookup and extra TCP connection.
rrdharan 4y ago
I see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts (https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_...) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.
- tyingq 4y ago
  I read that pretty carefully, and didn't see anything about not saving and correlating the visit with other logs they have.
- ncmncm 4y ago
  I perceive exactly zero risk to Google in lying about literally anything at all. Have you ever heard about them being even slightly inconvenienced in response to any abuse?
  - rossjudson 4y ago
    Do you feel like providing any examples?
    - ncmncm 4y ago
      Lack of examples,you mean?
    - Nextgrid 4y ago
      See https://news.ycombinator.com/item?id=31810185 https://news.ycombinator.com/item?id=31810185.
      - ncmncm 4y ago
        Status of that, two years on, appears to be complaints that Google is violating its discovery obligations.
  - KerryJones 4y ago
    Uh, yes, many times. https://www.reuters.com/article/us-alphabet-google-privacy-lawsuit/google-faces-5-billion-lawsuit-in-u-s-for-tracking-private-internet-use-idUSKBN23933H https://www.reuters.com/article/us-alphabet-google-privacy-l...
- Nextgrid 4y ago
  The GDPR went into effect in 2018 and gave companies 4 years to prepare for it. The GDPR has strict guidelines as to how data processing consent flows should be presented, including the fact that it should be as easy to decline as it is to accept. Yet, Google initially implemented a malicious consent form where accepting is easy and declining is impossible. They only very recently implemented a compliant consent flow which gives you an easy option to decline. Google has already proven their bad faith and successfully got away with it, along with plenty of other companies.

ntoskrnl 4y ago

If you're requesting data over a network, ultimately you have to trust someone. Fwiw bunny.net is pretty well respected. I view them as one level "below" the mega-enterprise CDNs like Cloudfront/Akamai, the same way Digital Ocean is one level "below" AWS/GCP/Azure

lolinder 4y ago
> If you're requesting data over a network, ultimately you have to trust someone. If I self-host my fonts, the people I have to trust are only those people I have no choice but to trust: those who get my site into the user's browser. Every additional cross-domain request I add is an extra party I have to trust.

hsjdbdksjsj 4y ago

you won't believe this, but as the end user you can solve this in your life once and for all, and also improve your life! something rare for online annoyances nowadays. any decent browser, i mostly use firefox, have a checkbox in the font screen that prevents sites from changing the page font. i set all sites to user Ubuntu Mono. always. all the time. everywhere. the only downside are sites that use winding-like fontawesome. you will get "S" instead of the magnifyingglass icon... i got used to things like that. Google meet screen is particularly weird. meh. but after you are past the initial shock, having the same font everywhere is the ideal usability hack. faster reading. less distraction. it's perfect. and as a bonus i don't even care (as i block referrer headers xdomain), not a single request ever goes to googlefont and the likes.

justinclift 4y ago
Oh, that'd probably work really well with dyslexic style "easier reading" fonts too. eg: https://opendyslexic.org https://opendyslexic.org / https://github.com/antijingoist/opendyslexic https://github.com/antijingoist/opendyslexic
jstummbillig 4y ago
Upside: Consistency. Downside: Consistency.
- HelloNurse 4y ago
  Without forgetting consistent detection of fragile extreme typography that breaks layout or looks strange when fonts are replaced.
ajvs 4y ago
Alternatively people can use uBlock Origin and simply block all remote web fonts. It'll break some sites which use fonts to replace icons, but the add-on can easily be disabled for those specific sites.
nyanpasu64 4y ago
I used to disable font overrides altogether. Another failure mode of that mode is that the omnipresent Material Icons displays words (the font contains ligatures replacing words with icons) instead of icons.

fritigern 4y ago

> we're in a country with better privacy laws Speaking as a European: I think this is a very important topic for us. I don't think Americans and American companies understand how little trust rest of us have for the American government. Working with a company that is not subject to the whims of the American government is a huge privacy win. If a company pitches me a product, they start 1 points ahead if they are based on Switzerland, Netherlands or somewhere similar.

shrimp_emoji 4y ago
I always had the suspicion that the (seemingly higher) interest in privacy/FOSS in Europeans is fueled partly by anti-Americanism. In America, even if you don't trust the government, at least it's your government, so I don't feel like that plays as big a role, and any interest in privacy/FOSS (like mine) is untempered by the anxiety of an alien government's interference. :p Regardless, I love how much more Europeans seem to value privacy.
- fritigern 4y ago
  > I always had the suspicion that the (seemingly higher) interest in privacy/FOSS in Europeans is fueled partly by anti-Americanism. Of course it is. After American Wars in the Middle East killed and displaced millions, there is good reason to be wary of Americans and the American government.
  - deleted 4y ago
    [deleted]
- marcosdumay 4y ago
  > at least it's your government What? Your government is the worst one to go not respecting your rights.
  - fritigern 4y ago
    I worry more about my government compared to the government of a county far away that has no power over me.

_fat_santa 4y ago

> If you embed a font hosted somewhere else you expose some of your user data to them. Now with fonts there's a really simple solution: Just don't. As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. I never quite understood the debate around fonts. You could use the CSS/Link import that Google provides, but that's never the optimal solution. Like you I always download the fonts and use them directly via @font-face. The only advantage I see to using Google Fonts / some privacy respecting font service like this one, is when you are first prototyping an app and want to either test fonts, or want to move quickly and not worry about setting up fonts properly. We also used in a places like Storybook where having correctly set fonts is not as important. But even if you did use it in prototyping, it's best practice to pull down those fonts and store them locally before going to production (at least in my mind). Am I missing something?

heretogetout 4y ago
If the font is already in your browser cache (which it might be if they're hosting it on a common CDN) web pages should load with the correct font right away instead of either loading blank areas or a default fallback font before switching to the correct font, causing jank. The best solution here is to use standard fonts that are available in all browsers, of course.
- modeless 4y ago
  Sorry, not since cache partitioning. https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/ Privacy killed the shared cache.
  - SquareWheel 4y ago
    And it's such a niche privacy issue too. I would gladly take a shared cache over cache isolation. Especially for something used on as many sites as Google Fonts is.
    - 4y ago

TheRealPomax 4y ago

We can reasonably assume that bunny.net doesn't also correlate, cross-link, and permanently store which sites our IPs visit, for the purposes of enhanced ad delivery. Which Google does: that's literally what every single service they offer does in addition to "the thing you need that service for". Even sites that don't offer Google ads or Google analytics _still provide Google with behavioural data linked to you_ by using Google fonts. So no, this is not one of those examples, this is a great example of someone setting up a service to remove all those free, extra data points that Google harvests. Today it's fonts. Maybe tomorrow, it's the rest of their "it's not explicitly Google Analytics" offerings.

skybrian 4y ago
I don't think we can reasonably assume either of those things. You're speculating about both Google Fonts and Bunny fonts based on very little information.
- TheRealPomax 4y ago
  No, and yes, respectively. If you consider "Google recording and monteizing on CORS URL requests" speculation, I'm not sure you know much about the company we're talking about here. They've been sued and fined over tracking quite a number of times. Do we know whether bunny.net is any better? In the abstract, no we don't, but we're not dealing in abstracts, so we actually do because of where they operate. A real European operation (not an international company with EU presence but an HQ outside of direct EU jurisdiction) is by default quite a bit better at not violating GDPR, and runs the actual risk of being fined into financial insolvency (rather than getting a few hundred million slap on wrist that a multibillion dollar company goes "pff, whatever, let legal sort it out" to). By virtue of Google's track record, and by virtue of where this new service is located, and the track record of EU based services with regards to privacy compared to their US counterparts: Yes, we can _very_ reasonably assume both of those things.
  - skybrian 4y ago
    I used to work at Google and I'm sure I don't know how most of it works, outside the area I worked in. It's a big company and the systems are complex. Why do you think you know how it works? What do you actually know about Google that doesn't come from outside speculation? That link says that a website leaked an IP address to Google. It doesn't say that Google did anything with the IP address.

miohtama 4y ago

You can self host Google fonts, so you need to trust no one. Not sure if I see the point of this service.

jokethrowaway 4y ago

The only reason is to escape regulatory fines for something 99% of the world doesn't give a shit about. Not using fonts is not always an option

kevin_thibedeau 4y ago
> Not using fonts is not always an option The silliness of this is that someone is going through the effort to set up hosting for a website but hosting the fonts is just too difficult and has to be delegated to a third party. The laziness of webdevs never fails to astound.
- lolinder 4y ago
  I don't think it's laziness. My conscious brain knows that it's anachronistic, but I still have the instinct to use a CDN for the shared caching between sites. Obviously, browser privacy changes mean that isn't a valid reason any more, but for me the instinct is still there.
  - kevin_thibedeau 4y ago
    Sites will setup a CDN to serve their own custom assets, but fonts? nope not doable. It's 100% laziness.
    - lolinder 4y ago
      I'm not talking about setting up a CDN for custom assets, I'm talking about using something like jsdelivr or Google Fonts. Back in the day using those was a "best practice" because most people would (in theory) already have whatever font/library you're using cached. A lot of people, myself included, still have that as a habit that takes conscious effort to avoid falling into.
vorticalbox 4y ago
> Not using fonts is not always an option Do you have an example where doing something in an external font is not possible in one that's built into the browser?

1337shadow 4y ago

Can't you self host this?

moritzwarhier 4y ago

I always opt for self-hosting, be it fonts or other assets. Sometimes I am briefly envious of the ability to use things like Google Fonts, Unpkg or polyfill.io when setting up a project. But I started doing web dev in 2018 when GDPR was introduced here, and I always was kind of paranoid regarding that. Self-hosting is probably a better habit to acquire anyway, the only alternative being explicitly contracting with a company that offers edge CDN. https://google-webfonts-helper.herokuapp.com/fonts https://google-webfonts-helper.herokuapp.com/fonts is great for quick self hosted local Google Webfonts

yetanother12345 4y ago

> have no idea who bunny.net is $ whois bunny.net (...) Registrant Name: Registration Private Registrant Organization: Domains By Proxy, LLC Registrant Street: DomainsByProxy.com Registrant Street: 2155 E Warner Rd Registrant City: Tempe Registrant State/Province: Arizona Registrant Postal Code: 85284 Registrant Country: US (...) > we're in a country with better privacy laws" ...it appears that the domain registrant is not, so you will just have to trust that the company is not in the US or not owned by a US entity (mostly relevant for the rest of the world, probably). > with fonts there's a really simple solution: Just don't This was worth repeating :)

helldritch 4y ago
This is run by BunnyCDN, I've been one of their smaller users for a few years now (live video hosting and delivery, mostly .m3u8, mpegts, HTTP Live Streaming type of stuff) and I've always found their service reliable and cheap. One of the primary reasons I liked them was that their API is REALLY fast at making changes to the files (you make the call and 100ms later the file attributes / content have been updated throughout all their delivery locations) and the interface is pretty easy to use. This isn't an advertisement, I had a very specific use-case, but it follows into this: Of course, just like with Google, we are the product here. Google Fonts is an analytics data collection platform, Bunny Fonts is an advertisement for their CDN services. I'm going to stick with a /fonts/ directory, I think, despite being one of their current users. It's really not very much bandwidth for the fonts, it's not 2010 anymore, and I prefer the control (and the local development environment being the same, I don't always have internet and I don't want a dev toggle for something as silly as fonts).
justsomehnguy 4y ago
domain registrant != site/host location Their web-site is located in the UK[0] Their fonts CDN is originating from AS60068 which is registered in UK too[1][2] [0] https://bgp.he.net/dns/bunny.net#_ipinfo https://bgp.he.net/dns/bunny.net#_ipinfo [1] https://bgp.he.net/AS60068#_whois https://bgp.he.net/AS60068#_whois [2] https://bgp.he.net/dns/fonts.bunny.net#_ipinfo https://bgp.he.net/dns/fonts.bunny.net#_ipinfo

rmbyrro 4y ago

Can someone point out a good reason for not downloading the font files and serving them directly from your CDN or servers, without any calls to third-parties in your HTML?

technion 4y ago
"The bikeshed" I've been down this road. I don't know what it is, but many web developers are extremely adverse to doing it. Even once you've convinced people to let you do it, the first PR from a new hire is a fix for this "bug".
- citizenkeen 4y ago
  What is the bikeshed?
  - nvr219 4y ago
    "Organizations spend disproportionate time on trivial issues" - cn parkinson not sure how it's relevant here though
    - webmaven 4y ago
      > not sure how it's relevant here though As I understood the answer, the expanded version would be "the only disadvantage is having to spend an unreasonable amount of time arguing about this issue, which will drag on forever since it is relatively minor."
      - nvr219 4y ago
        Thank you.
justsomehnguy 4y ago
Ha, you want an anecdote? Years ago, when I worked at MSP serving quite a big federal customer... We received a ticket what $companysite.tld isn't working. Pretty unusual, but the first things first, so I just type $companysite.tld in the browser. It works fine. Okay, ignore then. But, no, 15 minutes later we receive an email with a tons of people in CC and a lot of !!!!s in the subject and body what the site is still down. I again check it from my machine (which of course was in the MSP office, not on customer premises), it works fine, DNS, tracert, yada-yada. Our network team replies what $companysite.tld responds to ping so everything works fine from their POV. Duuuh. Okay, I hop to the management station located in the customer's DC, test the site there... and it doesn't work there. Just a blank screen, no errors, nothing. Which is pretty strange because the site is hosted in the same DC. DNS resolves to the proper records, ICMP works including traceroute... Well, long story short, after 30 minutes of head scratching and dozens of emails with ever longer list of people in CC it occurs to me to hit F12. I open the developer console, switch to Network tab, type in $companysite.tld and I see what the traffic is starting to flow just fine, only to stall to a halt at... googlefonts.com (or whatever TLD they used). At this point I just calmly sent an email explaining what the site was working just fine, it just wasn't able to properly load from the customer premises because of the block of Google services. To summarize: somebody from the customer ordered to block Google services on the network level (don't even ask); network team (certified Cisco CC** folks!) implemented it by dropping traffic instead of denying - so the firewall would notify the client station about that and the browser would abort the request to googlefonts.com and wouldn't wait a full timeout for each request (don't forget DNS records resolved just fine, if they sent NXDOMAIN for it there wouldn't habe been even an attempt to connect); network team diagnoses the availability of the web-sites by using ICMP ping... but that wasn't the first or the last time when I was quite... disappointed of their qualification. While it is very rare for major CDNs to go down, it happens, and even more shenanigans can happen on a network level between some client and your website (and proliferation of DPI by various countries, agencies and enterprises doesn't help here too). So if you are on the payroll just host the fonts (and honestly - all assets, if applicable) with the web-site and sleep soundly. Of course if you are paid for each "incident", then Web3.0 is all yours. *grin*

1vuio0pswjnm7 4y ago

"Which is an imperfect solution at best, and given I have no idea who bunny.net is it's a questionable solution at best." Anyone who is a bunny.net customer would have an idea. Unlike many of the myriad wesbites using Google fonts, they would also have an agreement with Bunny they could potentially enforce. Anyone doing internet research who peruses publicly available scans of DNS ports in the last five years would likely be familiar with bunny.net as they are a large enough CDN to have many thousands of subdomains for customer IPs. It is seemingly impossible to miss this company's presence toward the beginning of the scan. The founder of bunny.net recently posted a question in an nginx forum. This is not AWS or Google. Amazon sells goods. Google sells online advertising services. Both are primarily intermediaries (middlemen) who try to prioritise their own competing goods/services. All the data those companies collect may feed into other business that strives to study and understand consumer behaviour, e.g., placing internet-connected microphones (referred to only as "speakers") in people's homes or internet-cnnected GPS trackers in their pockets. There are strong incentives for those companies to conduct extensive surveillance. Bunny sells CDN services. At present, that's all, AFAICT. 1. https://bunny.net/our-story https://bunny.net/our-story This HN submission purports to mirror the recent announcement of fonts on the bunny.net blog on 16 June however it currently points to an "About" page, not the blog entry. The blog entry discloses in more detail the rationale for the decision to offer fonts. https://bunny.net/blog/bringing-privacy-back-into-your-own-hands-introducing-bunny-fonts/ https://bunny.net/blog/bringing-privacy-back-into-your-own-h... There is an argument supported by legal decisions in Austria, Denmark and Germany that neither Google Fonts nor Google Analytics are GDPR-compliant. https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f...

keithnz 4y ago

> As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. I thought the whole point is that using a common resource your chances of a cache hit are much higher such that they don't need to download. Having said that, if you are worried about GDPR you are probably way better off hosting them yourself anyways

popcube 4y ago

if their allocated at Europe, this maybe make sense

raxxorraxor 4y ago

The thing is that if you have resources on google.com, they may be allowed to set a cookie. And large companies like Google can far more effectively aggregate the data because of their reach. But true, I doubt Google is more nefarious than other resource provider. I am 99.9% sure that Google is not abusing cookies to extract end user data through their fonts service. I believe you might be legally obliged to inform the user about them setting a cookie though. Alternatively, and this might be the better solution is to simply "vendor" the fonts (supplying them from your own server).

krageon 4y ago

> we're in a country with better privacy laws This is the important part. Laws are not about trust.

XCSme 4y ago

> "we're in a country with better privacy laws" Well, this is what all the fuss is about: respecting the law. I'm not saying the laws are good or bad, just that it is the only thing that most companies really care about.