4 ms·
It seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are t
by tyingq 4y ago
It seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are trivially easy for Google to correlate to your other activity. There's much less value for BunnyCDN to abuse it, because they don't have the critical mass of your other activity.
Yes, just serving up your own fonts is better, but this is an improvement that seems to work with only a minor change.
- judge2020 4y agoFor both bunny.net and Google Fonts, using a CDN is useless with the advent of timing attacks related to the browser cache https://news.ycombinator.com/item?id=24894135 https://news.ycombinator.com/item?id=24894135. Storing fonts on the same domain avoids a DNS lookup and extra TCP connection.
- rrdharan 4y agoI see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts (https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_...) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.
- tyingq 4y agoI read that pretty carefully, and didn't see anything about not saving and correlating the visit with other logs they have.
- ncmncm 4y agoI perceive exactly zero risk to Google in lying about literally anything at all. Have you ever heard about them being even slightly inconvenienced in response to any abuse?
- rossjudson 4y agoDo you feel like providing any examples?
- KerryJones 4y agoUh, yes, many times. https://www.reuters.com/article/us-alphabet-google-privacy-lawsuit/google-faces-5-billion-lawsuit-in-u-s-for-tracking-private-internet-use-idUSKBN23933H https://www.reuters.com/article/us-alphabet-google-privacy-l...
- Nextgrid 4y agoThe GDPR went into effect in 2018 and gave companies 4 years to prepare for it. The GDPR has strict guidelines as to how data processing consent flows should be presented, including the fact that it should be as easy to decline as it is to accept. Yet, Google initially implemented a malicious consent form where accepting is easy and declining is impossible. They only very recently implemented a compliant consent flow which gives you an easy option to decline. Google has already proven their bad faith and successfully got away with it, along with plenty of other companies.