Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

Post reply on HN
Print view View original

101–110 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#101

Post by yunohn »

reaperducer wrote: post #89
jefftk wrote: post #30

Earlier quoted context omitted.

The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Use of Google Fonts API is unauthenticated. The Google Fonts API does not set or log cookies. In other words, data from font serving does not feed into advertising personalization. (Disclosure: I used to work on ads at Google)

The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. There's an awful lot of weasel words in there. If it was a simple "The Google Fonts API doesn't collect or store any user data" that would be good. But there's so much hidden language in that one sentence. - "Designed" — Well, it was designed to do that, but it doesn't. After…

There is no such thing as absolute privacy. By virtue of being a web-hosted service, you will need to interact with the end server, and that already has the potential to expose details like IP, referer, user-agent, etc.

The wording around designing and limiting collection is acknowledging this inherent problem and letting the user know that they’ve done their best to prevent malice.

It’s not weasel wording except for anons who like hating on the internet.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#102

Post by xigoi »

weird-eye-issue wrote: post #48
markx2 wrote: post #44

Firefox > Settings > General > Fonts > Advanced Uncheck "Allow pages to choose their own fonts, instead of your selections above" No remote fonts anywhere.

Breaks lots of icons and such right? I disabled fonts for like a day with Ublock Origin but it was too inconvenient

If you block via uBlock Origin, you can make exceptions for sites that get broken too much.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#103

Post by pdimitar »

the_common_man wrote: post #87
encoderer wrote: post #69

Earlier quoted context omitted.

Surely you realize that if a modern sophisticated government wants to see your data, they are going to be able to access it, even if it’s stored in the Netherlands? What threat are you protecting yourself against?

So, with this logic you would host your data in Russia (just to give a random country) ?

Why not? Make encrypted backups with `borg` and use `rclone` to distribute them to a number of free cloud storage services -- this is what I and many others do. One of my destinations is Yandex Disk. They all only see an encrypted Borg repo. And in the next few weeks or months I'll make sure they won't even be seeing that. Just a few opaque files several tens of megabytes big each. I wish them luck cracking it, lol.

What are they going to do, fly to my fringe country, knock on my door and politely ask me to stop storing encrypted blobs on their servers? No, they will not. First, their TOC does not forbid it and second, they are way too lazy to scope me out of the crowd, and third, they will only start shutting users down if their free plan starts costing them too much. I've been doing this for years and nobody seems to give a frak (Google included).

And I am just a regular guy who wants to make sure his code and passion projects (and personal / family photos) are never going to get lost even in a case of disaster. I never in my life did anything to warrant government attention.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#104

Post by xigoi »

usrn wrote: post #19
mimsee wrote: post #17

Or better yet, include the ttf/woff/woff2 files inside your project as an npm package using Fontsource[0]. [0]: https://github.com/fontsource/fontsource

Or even better just don't use custom fonts because they break a lot of things anyway.

I wish there was a way to use KaTeX/MathJax without custom fonts.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#105

Post by bee_rider »

gandalfgreybeer wrote: post #71
ntoskrnl wrote: post #42

Earlier quoted context omitted.

If a fox encountered a glazed bunny in the wild, it probably wouldn't jump over it...

By this logic, why would it also jump over a lazy dog?

Perhaps the dog had cornered the fox, but in an a location that the dog couldn't reach. So it decided to wait the fox out, but then fell asleep because it is lazy.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#106

Post by moffkalast »

323 wrote: post #93

Don't trust Google, trust us, a 30 person company. This is exactly what a FBI/CIA/GCHQ/FSB front company would say. They love to set up fronts in good-reputation countries, like Switzerland, or Slovenia in this case.

> like Switzerland, or Slovenia

As a Slovenian, thanks for the laugh.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#107

Post by epigramx »

323 wrote: post #93

Don't trust Google, trust us, a 30 person company. This is exactly what a FBI/CIA/GCHQ/FSB front company would say. They love to set up fronts in good-reputation countries, like Switzerland, or Slovenia in this case.

Sites like this have many Google employees though.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#108

Post by pdimitar »

fritigern wrote: post #53
hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

> we're in a country with better privacy laws Speaking as a European: I think this is a very important topic for us. I don't think Americans and American companies understand how little trust rest of us have for the American government. Working with a company that is not subject to the whims of the American government is a huge privacy win. If a company pitches me a product, they start 1 points ahead if they are base…

Have you considered that Switzerland and Netherlands might just, you know, hand other agencies your data without telling you?

At this point we're supposed to believe what amounts to feel-good talk.

But I keep asking: "How do we know for sure?"

I haven't done anything illegal nor do I need to protect some mega-important knowledge but I still dislike giving easy access to my data so I automated parts of my workflow to double-encrypt my most important data and send it to several off-sites plus an own self-hosted server.

Sure, they likely know remote Linux network zero-days but the odds of them wanting to target me in particular are minuscule so... ¯\_(ツ)_/¯

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#109

Post by moffkalast »

usrlocal1023 wrote: post #22

The service doesn't seem to support IPv6 as there are no AAAA DNS records. $ dog A AAAA fonts.bunny.net CNAME fonts.bunny.net. 10s "bunnyfonts.b-cdn.net." A bunnyfonts.b-cdn.net. 10s 195.181.164.130 CNAME fonts.bunny.net. 9s "bunnyfonts.b-cdn.net." A bunnyfonts.b-cdn.net. 9s + 195.181.164.130

I'm still not entirely sure why anyone would load fonts from a 3rd party link that's bound to break sometime. Just add it to your assets like a normal person and Cloudflare will cache it for you anyway.

The license is non-standard too, something called SIL. I'm not gonna bother looking up what that weird thing permits when I can get thousands of CC0 fonts from like a dozen sites.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#110

Post by moffkalast »

xigoi wrote: post #102
weird-eye-issue wrote: post #48

Earlier quoted context omitted.

Breaks lots of icons and such right? I disabled fonts for like a day with Ublock Origin but it was too inconvenient

If you block via uBlock Origin, you can make exceptions for sites that get broken too much.

You underestimate the average person's laziness.
Post reply on HN