4 ms·

> Browsers should not load fonts installed in the operating system Already in the works, and some browsers don’t today (eg Safari). They permit the default sys

> Browsers should not load fonts installed in the operating system Already in the works, and some browsers don’t today (eg Safari). They permit the default system fonts (eg Helvetica) but nothing more from user space. In the future it will be a permission you grant a site: https://wicg.github.io/local-font-access/ https://wicg.github.io/local-font-access/ It’s a great move. The benefits of local fonts are negligible and the downsides are clearly enormous

jonnycomputer 4y ago
Crazy, in a way, that it wasn't already this way from the beginning.
- gfaster 4y ago
  imo it's more crazy that people thought of tracking users by using a font in the first place. The level of human ingenuity that has gone into spying on people is staggering.
  - greyhair 4y ago
    Follow the money. It is always about the money. I was at a corporate security conference where one of the speakers stated that organized crime groups hire the top mathematicians and computer scientists from the top universities every year. They provide them with laboratories that you wish your company could afford.
    - regentbowerbird 4y ago
      Did the speaker have a source for that claim beyond their own word? Surely there would be issues with such a scheme.
- enkrs 4y ago
  The web and ideas back then were different. It was so cool to choose wingdings as a font, and make it <blink>. The web would not have evolved the way it is now if we hadn’t had the freedom back then.
- bagpuss 4y ago
  many years ago, too many fonts would cripple an average Windows install.
- layer8 4y ago
  There weren’t any good permissibly-licenced fonts available back then, and browser fingerprinting only became a thing a decade or so later.
- lelandfe 4y ago
  WebKit/Safari gets dunked on a lot for being slow to implement features (sometimes rightfully so), but for many features, this is exactly why. Check out this long list of APIs they're purposefully dragging their feet on out of privacy concerns: https://webkit.org/tracking-prevention/#table-of-contents-toggle:~:text=Here%20are%20some%20examples%20of%20features%20we%20have%20decided%20to%20not%20yet%20implement%20due%20to%20fingerprinting%2C%20security%2C%20and%20other%20concerns%2C%20and%20where%20we%20do%20not%20yet%20see%20a%20path%20to%20resolving%20those%20concerns https://webkit.org/tracking-prevention/#table-of-contents-to...
  - SahAssar 4y ago
    Many of those are gated behind permissions in the browsers that have implemented them, and safari could gate the rest too. Or they could collaborate with the working groups to reduce the fingerprinting hazard. Many other features that safari has been late with have basically no fingerprinting usefulness like web push.
dingleberry420 4y ago
I don't understand why they don't just ship a huge set of fonts by default. I'm probably missing some licensing bullshit, but look at Google Fonts and all the amazing fonts there. They're called open source fonts. Is there anything stopping firefox et al from just bundling them, or at least downloading them on-demand from a trusted server (not google)? It would be lovely if all web developers could just assume that the entirety of google fonts is at their disposal in a native way without having to resort to webfonts and the overhead that brings.
- pbhjpbhj 4y ago
  I'd be happy to have many more resources this way, use a hash and some sort of frecency -- but we've moved away from sharing resources across sites, unfortunately.
- layer8 4y ago
  The problem is not shipping alternative fonts, but blocking access to the system fonts. For compatibility reasons, there needs to be a mechanism to still allow access for specific websites. That’s what the planned feature linked by the parent is for.
- d2wa 4y ago
  > I don't understand why they don't just ship a huge set of fonts by default. It takes a lot of work to draw a reasonable large set of all the Unicode characters for a given language. Time is money and fonts are ridiculously expensive. That being said, Firefox has funded a few fonts over the years but they don’t bundle them with the browser. Google has a huge collection but doesn’t bundle them either. It makes more sense with Google as it can collect user data from its WebFont as a service system.
  - dingleberry420 4y ago
    Right, but the Google Fonts are open source so the work has already been done. https://developers.google.com/fonts/faq https://developers.google.com/fonts/faq

jonnycomputer 4y ago

Crazy, in a way, that it wasn't already this way from the beginning.

gfaster 4y ago
imo it's more crazy that people thought of tracking users by using a font in the first place. The level of human ingenuity that has gone into spying on people is staggering.
- greyhair 4y ago
  Follow the money. It is always about the money. I was at a corporate security conference where one of the speakers stated that organized crime groups hire the top mathematicians and computer scientists from the top universities every year. They provide them with laboratories that you wish your company could afford.
  - regentbowerbird 4y ago
    Did the speaker have a source for that claim beyond their own word? Surely there would be issues with such a scheme.
enkrs 4y ago
The web and ideas back then were different. It was so cool to choose wingdings as a font, and make it <blink>. The web would not have evolved the way it is now if we hadn’t had the freedom back then.
bagpuss 4y ago
many years ago, too many fonts would cripple an average Windows install.
layer8 4y ago
There weren’t any good permissibly-licenced fonts available back then, and browser fingerprinting only became a thing a decade or so later.
lelandfe 4y ago
WebKit/Safari gets dunked on a lot for being slow to implement features (sometimes rightfully so), but for many features, this is exactly why. Check out this long list of APIs they're purposefully dragging their feet on out of privacy concerns: https://webkit.org/tracking-prevention/#table-of-contents-toggle:~:text=Here%20are%20some%20examples%20of%20features%20we%20have%20decided%20to%20not%20yet%20implement%20due%20to%20fingerprinting%2C%20security%2C%20and%20other%20concerns%2C%20and%20where%20we%20do%20not%20yet%20see%20a%20path%20to%20resolving%20those%20concerns https://webkit.org/tracking-prevention/#table-of-contents-to...
- SahAssar 4y ago
  Many of those are gated behind permissions in the browsers that have implemented them, and safari could gate the rest too. Or they could collaborate with the working groups to reduce the fingerprinting hazard. Many other features that safari has been late with have basically no fingerprinting usefulness like web push.

dingleberry420 4y ago

I don't understand why they don't just ship a huge set of fonts by default. I'm probably missing some licensing bullshit, but look at Google Fonts and all the amazing fonts there. They're called open source fonts. Is there anything stopping firefox et al from just bundling them, or at least downloading them on-demand from a trusted server (not google)? It would be lovely if all web developers could just assume that the entirety of google fonts is at their disposal in a native way without having to resort to webfonts and the overhead that brings.

pbhjpbhj 4y ago
I'd be happy to have many more resources this way, use a hash and some sort of frecency -- but we've moved away from sharing resources across sites, unfortunately.
layer8 4y ago
The problem is not shipping alternative fonts, but blocking access to the system fonts. For compatibility reasons, there needs to be a mechanism to still allow access for specific websites. That’s what the planned feature linked by the parent is for.
d2wa 4y ago
> I don't understand why they don't just ship a huge set of fonts by default. It takes a lot of work to draw a reasonable large set of all the Unicode characters for a given language. Time is money and fonts are ridiculously expensive. That being said, Firefox has funded a few fonts over the years but they don’t bundle them with the browser. Google has a huge collection but doesn’t bundle them either. It makes more sense with Google as it can collect user data from its WebFont as a service system.
- dingleberry420 4y ago
  Right, but the Google Fonts are open source so the work has already been done. https://developers.google.com/fonts/faq https://developers.google.com/fonts/faq