3 ms·

Google fonts is just another way for Google to track users.

javajosh 3y ago
Indeed, but there are ways around that. Check out fontsource (e.g. `npm install @fontsource-variable/roboto-flex`) to add fonts as a locally hosted dependency.
fsckboy 3y ago
explain? are you talking about "if you use them on the web, they track"? If I install the packages on my linux distro, that doesn't get tracked does it? they're just fonts? or do they keep pulling things down?
- systemz 3y ago
  linux package is downloaded once or every upgrade by generic http client, not that frequent vs when loading lot of different pages which use Google Fonts and gives some info from browser
atoav 3y ago
If you use their cdn instead of putting them on your own server sure. There is an Austrian ruling that this is a violation of the GDPR, so you might not wanna do it anyways. For the ultra paranoid font files are to be avoided because fonts raise the complexity and thus the attack surface — I can't imagine an attacker couldn't use a malicous font or a zero-day in the font rendering engine to exploit a client.
jmprspret 3y ago
Not if you download the zip and host it yourself - which you can do
- hackernewds 3y ago
  That is not what most people will do. if you have a reasonable % sample, you can make valid assessments of the population
- KronisLV 3y ago
  > Not if you download the zip and host it yourself - which you can do I don't think it's quite the same, though! If you go to Open Sans, for example (https://fonts.google.com/specimen/Open+Sans?query=open+sans https://fonts.google.com/specimen/Open+Sans?query=open+sans), and preview the CSS that it generates for the Regular style, then you'll get this: https://fonts.googleapis.com/css2?family=Open+Sans&display=swap https://fonts.googleapis.com/css2?family=Open+Sans&display=s... You'll notice that it uses a lot of the unicode-range property, to split the font up into different languages, so not everything needs to be downloaded for every site (e.g. if your site doesn't have cyrillic characters), in addition to them serving WOFF2 as well: /* latin */ @font-face { font-family: 'Open Sans'; font-style: normal; font-weight: 400; font-stretch: 100%; font-display: swap; src: url(https://fonts.gstatic.com/s/opensans/v35/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } In the downloaded archive, realistically you'll only have the TTF variation, like OpenSans-Regular.ttf, and will have to think about WOFF and WOFF2 conversions yourself. While those aren't too hard to do, splitting fonts up I still haven't figured out, so many of my sites with self hosted fonts have like 400 KB of arguably unnecessary overhead (I rather like the PT font family), which in some cases is the majority of the total download size. I actually started building my own site where I'd keep some of the converted fonts that I personally like, but obviously it's not meant for greatness: https://fonts.kronis.dev/ https://fonts.kronis.dev/ (maybe some day I'll go back to it and actually figure out the font splitting) Edit: in case anyone is curious about how to convert fonts, on Debian/Ubuntu I found these tools to be helpful: woff-tools woff2 I use them like so: sfnt2woff "some-font.ttf" woff2_compress "some-font.ttf"
  - moritz 3y ago
    The tool parent and sibling comment listed allows you to do basic subsetting [1], and generates the formats you need. If you do this more often, it is of course useful to learn how to do this yourself. A commonly used tool is pyftsubset, part of fonttools [2]. I am not sure, but afair Google is running this under the hood. [1]: https://fonts.google.com/knowledge/glossary/subsetting https://fonts.google.com/knowledge/glossary/subsetting [2]: https://github.com/fonttools/fonttools https://github.com/fonttools/fonttools
- john-doe 3y ago
  The google-webfonts-helper makes it easy: https://gwfh.mranftl.com/fonts https://gwfh.mranftl.com/fonts
- throwaway914 3y ago
  I use an extension called LocalCDN (iirc) to locally supply copies of common JS frameworks so I'm less likely to be tracked on that front. I'm sure it skews some log somewhere if I never request those libs. Now I'm off to find an extension that serves local copies of common Google fonts.
- toastal 3y ago
  Most of them are available thru Nixpkgs too. You can make a small derivation to turn any font into WOFF2 with GNU Parallel + `fontforge --lang=ff -c 'Open($1); Generate($2);' {} $out/{/.}.woff2`.
davidcollantes 3y ago
Just use the google-webfonts-helper (https://gwfh.mranftl.com/fonts https://gwfh.mranftl.com/fonts) and host the fonts you want locally if you don’t want to use Google's CDN.
reacharavindh 3y ago
It is. Why does anyone expect a private company to serve fonts for them without any interest to extract value. If you want the fonts, read its license and find a way to acquire them and host it yourself for performance, security, privacy and peace of mind. Someone here already linked the Google font downloader tool…
Jabbles 3y ago
I guess it depends how much you want to believe them, but they deny this in their FAQ: https://developers.google.com/fonts/faq/privacy#:~:text=For%20clarity%2C%20Google%20does%20not%20use%20any%20information%20collected%20by%20Google%20Fonts%20to%20create%20profiles%20of%20end%20users%20or%20for%20targeted%20advertising https://developers.google.com/fonts/faq/privacy#:~:text=For%....
niederman 3y ago
This is one purpose of Google fonts, but it's not the only purpose. Google has nearly 100% search market share, so one of the only ways that they can increase search traffic at this point is by increasing web traffic in general. One of the ways they do this is by making it easier to create web content by e.g. distributing fonts. See Gwern Branwen's excellent article on the subject: https://gwern.net/complement https://gwern.net/complement

Indeed, but there are ways around that. Check out fontsource (e.g. `npm install @fontsource-variable/roboto-flex`) to add fonts as a locally hosted dependency.

fsckboy 3y ago

explain? are you talking about "if you use them on the web, they track"? If I install the packages on my linux distro, that doesn't get tracked does it? they're just fonts? or do they keep pulling things down?

systemz 3y ago
linux package is downloaded once or every upgrade by generic http client, not that frequent vs when loading lot of different pages which use Google Fonts and gives some info from browser

atoav 3y ago

If you use their cdn instead of putting them on your own server sure. There is an Austrian ruling that this is a violation of the GDPR, so you might not wanna do it anyways. For the ultra paranoid font files are to be avoided because fonts raise the complexity and thus the attack surface — I can't imagine an attacker couldn't use a malicous font or a zero-day in the font rendering engine to exploit a client.

jmprspret 3y ago

Not if you download the zip and host it yourself - which you can do

hackernewds 3y ago
That is not what most people will do. if you have a reasonable % sample, you can make valid assessments of the population
KronisLV 3y ago
> Not if you download the zip and host it yourself - which you can do I don't think it's quite the same, though! If you go to Open Sans, for example (https://fonts.google.com/specimen/Open+Sans?query=open+sans https://fonts.google.com/specimen/Open+Sans?query=open+sans), and preview the CSS that it generates for the Regular style, then you'll get this: https://fonts.googleapis.com/css2?family=Open+Sans&display=swap https://fonts.googleapis.com/css2?family=Open+Sans&display=s... You'll notice that it uses a lot of the unicode-range property, to split the font up into different languages, so not everything needs to be downloaded for every site (e.g. if your site doesn't have cyrillic characters), in addition to them serving WOFF2 as well: /* latin */ @font-face { font-family: 'Open Sans'; font-style: normal; font-weight: 400; font-stretch: 100%; font-display: swap; src: url(https://fonts.gstatic.com/s/opensans/v35/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } In the downloaded archive, realistically you'll only have the TTF variation, like OpenSans-Regular.ttf, and will have to think about WOFF and WOFF2 conversions yourself. While those aren't too hard to do, splitting fonts up I still haven't figured out, so many of my sites with self hosted fonts have like 400 KB of arguably unnecessary overhead (I rather like the PT font family), which in some cases is the majority of the total download size. I actually started building my own site where I'd keep some of the converted fonts that I personally like, but obviously it's not meant for greatness: https://fonts.kronis.dev/ https://fonts.kronis.dev/ (maybe some day I'll go back to it and actually figure out the font splitting) Edit: in case anyone is curious about how to convert fonts, on Debian/Ubuntu I found these tools to be helpful: woff-tools woff2 I use them like so: sfnt2woff "some-font.ttf" woff2_compress "some-font.ttf"
- moritz 3y ago
  The tool parent and sibling comment listed allows you to do basic subsetting [1], and generates the formats you need. If you do this more often, it is of course useful to learn how to do this yourself. A commonly used tool is pyftsubset, part of fonttools [2]. I am not sure, but afair Google is running this under the hood. [1]: https://fonts.google.com/knowledge/glossary/subsetting https://fonts.google.com/knowledge/glossary/subsetting [2]: https://github.com/fonttools/fonttools https://github.com/fonttools/fonttools
john-doe 3y ago
The google-webfonts-helper makes it easy: https://gwfh.mranftl.com/fonts https://gwfh.mranftl.com/fonts
throwaway914 3y ago
I use an extension called LocalCDN (iirc) to locally supply copies of common JS frameworks so I'm less likely to be tracked on that front. I'm sure it skews some log somewhere if I never request those libs. Now I'm off to find an extension that serves local copies of common Google fonts.
toastal 3y ago
Most of them are available thru Nixpkgs too. You can make a small derivation to turn any font into WOFF2 with GNU Parallel + `fontforge --lang=ff -c 'Open($1); Generate($2);' {} $out/{/.}.woff2`.

davidcollantes 3y ago

Just use the google-webfonts-helper (https://gwfh.mranftl.com/fonts https://gwfh.mranftl.com/fonts) and host the fonts you want locally if you don’t want to use Google's CDN.

reacharavindh 3y ago

It is. Why does anyone expect a private company to serve fonts for them without any interest to extract value. If you want the fonts, read its license and find a way to acquire them and host it yourself for performance, security, privacy and peace of mind. Someone here already linked the Google font downloader tool…

Jabbles 3y ago

I guess it depends how much you want to believe them, but they deny this in their FAQ: https://developers.google.com/fonts/faq/privacy#:~:text=For%20clarity%2C%20Google%20does%20not%20use%20any%20information%20collected%20by%20Google%20Fonts%20to%20create%20profiles%20of%20end%20users%20or%20for%20targeted%20advertising https://developers.google.com/fonts/faq/privacy#:~:text=For%....

niederman 3y ago

This is one purpose of Google fonts, but it's not the only purpose. Google has nearly 100% search market share, so one of the only ways that they can increase search traffic at this point is by increasing web traffic in general. One of the ways they do this is by making it easier to create web content by e.g. distributing fonts. See Gwern Branwen's excellent article on the subject: https://gwern.net/complement https://gwern.net/complement