4 ms·

CDN+Web font-related PSAs: Users: it’s a good idea to block all third-party fonts so you’re not leaking data (filter rule: *$font,third-party). Unlike scripts/

CDN+Web font-related PSAs: Users: it’s a good idea to block all third-party fonts so you’re not leaking data (filter rule: *$font,third-party). Unlike scripts/styles, fonts generally don’t hurt the UX (unless a developer is using icon font which haven’t been best practice in a decade--which is ironic considering this blog is broken). Developers: vendor these Google Fonts (most are licensed SIL) as other have noted in this thread & host them first-party for the benefit of your users. If the cost (hosting or performance) is too much to host the fonts, consider using less fonts because users are still paying for the bandwidth. (I am still pro-web fonts, as they can be in improvement on the UX, just be smart about it).

V__ 3y ago
Fyi: Under GDPR you have to host these fonts yourself.
- onethought 3y ago
  is that true? Using a font is not trafficking any of the users Pii data? Google might be breaching gdpr if they are doing some crazy tracking, but I don’t see how a consumer of their fonts could be breaching. I am probably missing something.
  - cjpearson 3y ago
    Using a Google font causes the client to send a request to Google servers. The Google server then receives the client's IP address. Occasionally a judge will consider that a GDPR violation. [0] Sometimes using a CDN will also be considered a GDPR violation under the same logic. [1] But it seems like it just depends on which judge you get. There are thousands of sites in Europe that use Cloudflare, Google Fonts and Shopify and only a few that have been fined because of it. [0]: https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... [1]: https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&...
    - V__ 3y ago
      To expand on this. One difference between CDNs and Google Fonts is, that you normally sign a contract with your CDN under GDPR. I think the English term is data processing agreement. If the CDN is above board, and you have this contract, the situation is different.
    - onethought 3y ago
      Important context: - this is ridiculous. “Leaking an ip address on the internet!?” - so isps are screwed? - it was a 100£ fine.
  - deleted 3y ago
    [deleted]
- brycewray 3y ago
  For any who doubt you on this count: https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495 ...still apparently up in the air, more than five years after the GDPR went into effect.
  - V__ 3y ago
    I have found a clarifying comment, but while the comment [1] says: > The Google Fonts Web API does not log or store IP addresses. The linked source [2] only says that they don't use IPs to create profiles or to target ads. They very well might store them. Even giving them the benefit of the doubt, they can change their mind at any time and suddenly one is in legal jeopardy. [1] https://github.com/google/fonts/issues/5463#issuecomment-1297422332 https://github.com/google/fonts/issues/5463#issuecomment-129... [2] https://developers.google.com/fonts/faq/privacy https://developers.google.com/fonts/faq/privacy
formerly_proven 3y ago
CDNs (the kind where a third-party domain shows up in your HTML) have been largely pointless for a long time anyway and were probably purely around for generating metadata in the last couple years, since browsers segregate all caches by top-level origin. So ten years ago "but what if the user already was on a site using the same exact version of jQuery/font/whatever has already been to another site using the same CDN, then that might be cached and save 50 kB" turned into "it will always be downloaded" years ago.
- toastal 3y ago
  Folks interested in reading more about this assertion: Public CDNs Are Useless and Dangerous <https://httptoolkit.tech/blog/public-cdn-risks/ https://httptoolkit.tech/blog/public-cdn-risks/>
rpastuszak 3y ago
Psst https://fontsource.org/ https://fontsource.org/ Is a really good, privacy-friendly Google Fonts alternative.
- toastal 3y ago
  Privacy-friendly ∨ GitHub+Discord … pick one? This is just another way to get fonts, no? It could be convenient to some, but doesn’t do much more than let you preview the a font & download it. Is a Node package manager the right tool to be downloading fonts?
  - FireInsight 3y ago
    npm is pretty good for downloading fonts when the alternative is downloading, hosting, and configuring webfonts by hand.
    - hulitu 3y ago
      NPM is good also at downloading malware.
      - FireInsight 3y ago
        Fontsource is not malware. But being good at downloading malware does translate into downloading fonts, too
  - rpastuszak 3y ago
    Perhaps try cloning the repo do Codeberg and pull from there? Should be trivial.
lapcat 3y ago
> unless a developer is using icon font which haven’t been best practice in a decade This is sadly quite common though, even and especially on hugely popular web sites.
- toastal 3y ago
  I usually message support anyhow. Icon fonts helped webdevs support Internet Explorer with *.eot but after IE finally got SVG support, there was no reason to continue with icon fonts. The biggest general offenders are Font Awesome users (even when they offer SVG sprites) & Material Icons—with the latter being particularly broken with the icon name in plaintext (like this site) making it impossible to read versus just a broken Unicode tofu you’d expect. If the developer did the right thing & added title attributes, at least when you have a cursor you can see the name of the action.
garrickvanburen 3y ago
Vendoring is the correct answer. I maintained a webfont service for a couple years, and stopped when I determined there wasn’t any overwhelming technical complexity preventing vendoring….just serve fonts like any other asset. No need to introduce a third party service.

V__ 3y ago

Fyi: Under GDPR you have to host these fonts yourself.

onethought 3y ago
is that true? Using a font is not trafficking any of the users Pii data? Google might be breaching gdpr if they are doing some crazy tracking, but I don’t see how a consumer of their fonts could be breaching. I am probably missing something.
- cjpearson 3y ago
  Using a Google font causes the client to send a request to Google servers. The Google server then receives the client's IP address. Occasionally a judge will consider that a GDPR violation. [0] Sometimes using a CDN will also be considered a GDPR violation under the same logic. [1] But it seems like it just depends on which judge you get. There are thousands of sites in Europe that use Cloudflare, Google Fonts and Shopify and only a few that have been fined because of it. [0]: https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... [1]: https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&...
  - V__ 3y ago
    To expand on this. One difference between CDNs and Google Fonts is, that you normally sign a contract with your CDN under GDPR. I think the English term is data processing agreement. If the CDN is above board, and you have this contract, the situation is different.
  - onethought 3y ago
    Important context: - this is ridiculous. “Leaking an ip address on the internet!?” - so isps are screwed? - it was a 100£ fine.
- deleted 3y ago
  [deleted]
brycewray 3y ago
For any who doubt you on this count: https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495 ...still apparently up in the air, more than five years after the GDPR went into effect.
- V__ 3y ago
  I have found a clarifying comment, but while the comment [1] says: > The Google Fonts Web API does not log or store IP addresses. The linked source [2] only says that they don't use IPs to create profiles or to target ads. They very well might store them. Even giving them the benefit of the doubt, they can change their mind at any time and suddenly one is in legal jeopardy. [1] https://github.com/google/fonts/issues/5463#issuecomment-1297422332 https://github.com/google/fonts/issues/5463#issuecomment-129... [2] https://developers.google.com/fonts/faq/privacy https://developers.google.com/fonts/faq/privacy

formerly_proven 3y ago

CDNs (the kind where a third-party domain shows up in your HTML) have been largely pointless for a long time anyway and were probably purely around for generating metadata in the last couple years, since browsers segregate all caches by top-level origin. So ten years ago "but what if the user already was on a site using the same exact version of jQuery/font/whatever has already been to another site using the same CDN, then that might be cached and save 50 kB" turned into "it will always be downloaded" years ago.

toastal 3y ago
Folks interested in reading more about this assertion: Public CDNs Are Useless and Dangerous <https://httptoolkit.tech/blog/public-cdn-risks/ https://httptoolkit.tech/blog/public-cdn-risks/>

rpastuszak 3y ago

Psst https://fontsource.org/ https://fontsource.org/ Is a really good, privacy-friendly Google Fonts alternative.

toastal 3y ago
Privacy-friendly ∨ GitHub+Discord … pick one? This is just another way to get fonts, no? It could be convenient to some, but doesn’t do much more than let you preview the a font & download it. Is a Node package manager the right tool to be downloading fonts?
- FireInsight 3y ago
  npm is pretty good for downloading fonts when the alternative is downloading, hosting, and configuring webfonts by hand.
  - hulitu 3y ago
    NPM is good also at downloading malware.
    - FireInsight 3y ago
      Fontsource is not malware. But being good at downloading malware does translate into downloading fonts, too
- rpastuszak 3y ago
  Perhaps try cloning the repo do Codeberg and pull from there? Should be trivial.

lapcat 3y ago

> unless a developer is using icon font which haven’t been best practice in a decade This is sadly quite common though, even and especially on hugely popular web sites.

toastal 3y ago
I usually message support anyhow. Icon fonts helped webdevs support Internet Explorer with *.eot but after IE finally got SVG support, there was no reason to continue with icon fonts. The biggest general offenders are Font Awesome users (even when they offer SVG sprites) & Material Icons—with the latter being particularly broken with the icon name in plaintext (like this site) making it impossible to read versus just a broken Unicode tofu you’d expect. If the developer did the right thing & added title attributes, at least when you have a cursor you can see the name of the action.

garrickvanburen 3y ago

Vendoring is the correct answer. I maintained a webfont service for a couple years, and stopped when I determined there wasn’t any overwhelming technical complexity preventing vendoring….just serve fonts like any other asset. No need to introduce a third party service.