Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

Post reply on HN
Print view View original

31–40 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#31

Post by hannob »

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best.

If you embed a font hosted somewhere else you expose some of your user data to them. Now with fonts there's a really simple solution: Just don't. As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection.

There are situations where you can't completely avoid privacy issues, and then you can try to do better than others. But if you can completely get rid of a privacy issue then obviously that's what you should do.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#32

Post by aldebran »

mimsee wrote: post #17

Or better yet, include the ttf/woff/woff2 files inside your project as an npm package using Fontsource[0]. [0]: https://github.com/fontsource/fontsource

Won’t that cause the fonts to download again if they were loaded by Google fonts? I thought the reason to use something like Google fonts was to have the fonts download only once.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#33

Post by jefftk »

lbotos wrote: post #25
sdze wrote: post #5

Why wouldn't I just self-host the fonts on my server? What are the benefits of such CDN? Years ago I could understand it because it may reduce latency (cache), but since browsers don't cache from 3rd party servers anymore, also this is argument is obsolet.

Browsers don't use cross-site cache anymore (so if 2 sites are both using google fonts you don't get the speedup) but I think browsers still cache content from request to request for a domain. Additionally, a CDN will let that content be closer to your customer, so even if it wasn't cached with the magic of CDNs it should be faster than one origin server.

> Browsers don't use cross-site cache anymore

Correct. The last major browser stopped in early 2021.

> I think browsers still cache content from request to request for a domain.

Definitely! A cache still provides substantial speedup. Modern browsers fragment the cache on a per-site basis: www.example.com and www.example.org don't share, but www.example.com and forums.example.com do share.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#34

Post by [deleted] »

gbear605 wrote: post #24
Raed667 wrote: post #3

All these hoops we have to jump though and products to create, juste because the USA decided that no other country matters, and pushed the CLOUD Act https://en.m.wikipedia.org/wiki/CLOUD_Act

It’s also good because Google almost certainly uses data from Fonts for selling ads. I’m much more concerned about that than the theoretical uses by the US Govt, though I’m not a fan of those either.

[deleted]

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#35

Post by vehemenz »

usrn wrote: post #19
mimsee wrote: post #17

Or better yet, include the ttf/woff/woff2 files inside your project as an npm package using Fontsource[0]. [0]: https://github.com/fontsource/fontsource

Or even better just don't use custom fonts because they break a lot of things anyway.

Can you give some examples? Custom web fonts have been well supported since the late aughts.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#36

Post by jhanschoo »

usrn wrote: post #19
mimsee wrote: post #17

Or better yet, include the ttf/woff/woff2 files inside your project as an npm package using Fontsource[0]. [0]: https://github.com/fontsource/fontsource

Or even better just don't use custom fonts because they break a lot of things anyway.

Font variety help legibility through creating distinctions in context and hierarchy, though.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#37

Post by johnchristopher »

jefftk wrote: post #30
thematrixturtle wrote: post #28

Earlier quoted context omitted.

https://developers.google.com/fonts/faq#:~:text=/google/font... .

The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Use of Google Fonts API is unauthenticated. The Google Fonts API does not set or log cookies. In other words, data from font serving does not feed into advertising personalization. (Disclosure: I used to work on ads at Google)

> Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure.

and https://www.theregister.com/2022/01/31/website_fine_google_f...

leads me to believe that Google has PI when people visit sites using google fonts.

Even if they don't use it for advertising purposes long term log keeping is not required to serve fonts.

It doesn't really matter what the service is doing, they didn't ask for consent to log the IP of people downloading fonts.

To be perfectly clear: it wouldn't keep me from sleeping at night and fonts permissions should be bundled with cookie consent or there should be a permission prompt (just like when asking for youtube vid.).

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#38

Post by eurasiantiger »

aldebran wrote: post #32
mimsee wrote: post #17

Or better yet, include the ttf/woff/woff2 files inside your project as an npm package using Fontsource[0]. [0]: https://github.com/fontsource/fontsource

Won’t that cause the fonts to download again if they were loaded by Google fonts? I thought the reason to use something like Google fonts was to have the fonts download only once.

That hasn’t worked for a while. Browsers will NOT use cached resources loaded for foo.com when loading bar.com, even if they are the same resource from the same CDN.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#39

Post by eurasiantiger »

jefftk wrote: post #30
thematrixturtle wrote: post #28

Earlier quoted context omitted.

https://developers.google.com/fonts/faq#:~:text=/google/font... .

The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Use of Google Fonts API is unauthenticated. The Google Fonts API does not set or log cookies. In other words, data from font serving does not feed into advertising personalization. (Disclosure: I used to work on ads at Google)

The service serves very fine-grained CSS based on device detection. I’m sure there is some fingerprinting going on.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#40

Post by jefftk »

johnchristopher wrote: post #37
jefftk wrote: post #30

Earlier quoted context omitted.

The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Use of Google Fonts API is unauthenticated. The Google Fonts API does not set or log cookies. In other words, data from font serving does not feed into advertising personalization. (Disclosure: I used to work on ads at Google)

> Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure. and https://www.theregister.com/2022/01/31/website_fine_google_f... leads me to believe that Google has PI when people visit sites using google fonts. Even if they don't use it for advertising purposes long term log keeping is not required to serve fonts. It doesn't really matter what the service is doing, they…

"by including Google-Fonts-hosted font on its pages, passed the unidentified plaintiff's IP address to Google without authorization and without a legitimate reason for doing so"

It isn't about whether the IP address was logged, but about whether it was sent. Which is an unavoidable aspect of loading a resource from a server.

Post reply on HN