Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-host your fonts for better performance

wicki.io

Post reply on HN
Print view View original

241–250 of 417 posts

Re: Self-host your fonts for better performance

#241

Post by einpoklum »

Why isn't font caching an exception to site cache partitioning?

Can caching (Google) fonts, in itself, be used as some sort of security exploit?

I mean, sure, a site can time whether or not you've already downloaded a certain font before, but that's only useful to determine whether or not you've visited any of the sites with that font. Which is only usable if your sensitive site is also using a custom, nowhere-else-deployed font. That doesn't seem to be that painful security wise, compared to, say, telling websites which browser you're running.

Regardless - I support less reliance on custom fonts and a slimmer web overall.

Re: Self-host your fonts for better performance

#242

Post by hypertele-Xii »

marcus_holmes wrote: post #83
scrollaway wrote: post #30

Earlier quoted context omitted.

Web fonts are a big one in terms of making various websites feel fast because, when implemented incorrectly, they massively slow down initial text paint. With that said, they're a fantastic feature but are also way overused. You don't need web fonts unless your website is either heavily type-centric, or has font-related dependencies (such as embedded content of some kind). Icon fonts are also a neat use of web fonts,…

I've sped up sites before by using inline svg rather than icon fonts - downloading an entire icon font for a few icons is inefficient when the actual SVG needed for those icons is < 1Kb and is waaay faster as inline SVG.

It's only faster on the first load. On all subsequent loads its slower and consumes more bandwidth. I find this irresponsible.

Re: Self-host your fonts for better performance

#243

Post by forgotmypw17 »

robin_reala wrote: post #24
test1235 wrote: post #5

I'm usually the first one to sneer in disbelief at super users who 'go nuclear' and disable the likes of javascript and images when browsing the web, but lately, I've been experimenting with having custom fonts disabled (that is, fonts I don't have locally), and it feels to me that page loads are much faster, and in some case more readable (pages feel 'cleaner'?). The only issues I've come across so far is when a sit…

If you want a really fast web experience, try disabling images and javascript too! (on rereading this I sounded sarcastic, but I really wasn’t trying to be)

I do this. Works great, and it,s easy to skip sites who dgiaf.

Re: Self-host your fonts for better performance

#244

Post by eyelidlessness »

test1235 wrote: post #5

I'm usually the first one to sneer in disbelief at super users who 'go nuclear' and disable the likes of javascript and images when browsing the web, but lately, I've been experimenting with having custom fonts disabled (that is, fonts I don't have locally), and it feels to me that page loads are much faster, and in some case more readable (pages feel 'cleaner'?). The only issues I've come across so far is when a sit…

Fonts are large assets (often larger than a full bleed banner image), so they do add to page weight. They also “swap” by default, replacing a local font after loading, which adds to the perceptible load time. There are other techniques that may feel different depending on usage but unfortunately there’s no silver bullet.

Re: Self-host your fonts for better performance

#245

Post by dingaling »

CaptArmchair wrote: post #97
greenkey wrote: post #73

Earlier quoted context omitted.

Why hasn’t w3c taken on some way to avoid the unnecessary complexity? (Simplified font definition and usage standard.)

> Why hasn’t w3c taken on some way to avoid the unnecessary complexity? They did. Your browser will use the fall back when you use "font-family" selector. But that's just the best the CSS spec can offer. Why? Because the problem isn't a browser problem. It's a system level problem. Operating systems only come with a handful of fonts. And those packs of fonts may differ per OS. Moreover, most fonts are protected by in…

> Needless to say, this dramatically reduces the number of fonts designers can choose from.

Why is a web designer trying to choose fonts? The web is not a print medium.

Re: Self-host your fonts for better performance

#246

Post by konha »

EGreg wrote: post #240
mhils wrote: post #237

Earlier quoted context omitted.

Correct me if I'm wrong, but a CNAME "redirect" on the DNS level does not change the page origin. `fonts.gstatic.com` will only get the cookies set for `fonts.gstatic.com`, even if it is CNAMEd to a different domain.

I am not sure that’s true. Where is your proof... and Can’t they just ask you to set an A record btw?

Well, you can easily verify this by looking at your browser‘s request header. If the cookie is sent, you’ll see it in there for requests to the font cdn subdomain. (Hint: It‘s not.)

Re: Self-host your fonts for better performance

#247

Post by sgtfrankieboy »

hunter2_ wrote: post #234
ffpip wrote: post #220

FYI Google fonts are also loaded from the google.com domain. They can associate your login cookies with every page you visit. As you can see, it is very sneaky by using CNAME Cloaking - https://i.imgur.com/VB2DB75.png The request is to fonts.gstatic.com, but it resolves to gstaticadssl.l.google.com Tracking using CNAME cloacking - https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...

Wait, are you saying that if foo.example.com and bar.example.com are each CNAME records pointing at example.com (and the server has regular name based vhosts to isolate what is served for each), then browsers use a single cookie jar for foo and bar? So if the admin of the foo site and the admin of the bar site are adversarial, they can steal each other's cookies? That doesn't seem right at all... I hope I am misunder…

Its false. CNAMEs are dealt with on the DNS level and are transparent to HTTP. It will use the origin the client connects with which is fonts.gstatic.com

Re: Self-host your fonts for better performance

#248

Post by ViViDboarder »

test1235 wrote: post #5

I'm usually the first one to sneer in disbelief at super users who 'go nuclear' and disable the likes of javascript and images when browsing the web, but lately, I've been experimenting with having custom fonts disabled (that is, fonts I don't have locally), and it feels to me that page loads are much faster, and in some case more readable (pages feel 'cleaner'?). The only issues I've come across so far is when a sit…

I have most blocked as well through my ad blockers. The biggest annoyance is when they use fonts for icons instead of images. I’m not sure where that trend comes from, but it’s obnoxious.

Re: Self-host your fonts for better performance

#249

Post by eyelidlessness »

sslayer wrote: post #214
AstroJetson wrote: post #209

Earlier quoted context omitted.

Which is one of the many reasons I've stopped the almost hourly updates of Chrome. I feel fo people that have bad bandwidth or poor wireless connections. One of my favorite rants if web builders and more importantly the managers of team that build websites were forced to use a DSL speed level connection daily a lot of the cruft would go away.

At this point Big Tech is no different than Big Government and just as out of touch with those forced to live with it's decisions.

If they didn’t do this you (or someone with similar attitudes) would be complaining that cross site caching allows fingerprinting and violates privacy (which is almost certainly why they did do this).

Re: Self-host your fonts for better performance

#250

Post by ape4 »

_underfl0w_ wrote: post #205
colejohnson66 wrote: post #199

Earlier quoted context omitted.

Wasn’t the point of Google Fonts that your browser would have in its cache fonts from Google so it wouldn’t download multiple copies from all over the place? A CDN basically. I know jQuery and Bootstrap recommend using their CDNs so browsers have the copy in their cache. Of course, there’s always the tracking ability, but that’s inherent to every CDN.

From TFA: > Since Chrome v86, released October 2020, cross-site resources like fonts can’t be shared on the same CDN anymore. This is due to the partitioned browser cache

You'd think there should be some technical solution to avoid the privacy issues of this. Eg make it always take one second or something.
Post reply on HN