Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

Post reply on HN
Print view View original

191–200 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#191

Post by judge2020 »

brnt wrote: post #82
judge2020 wrote: post #65

Earlier quoted context omitted.

How do the laws play out in practice? If bunny.net started storing user agent and IP address information indefinitely, and someone complained, how likely is it enforcement action is actually enacted on them? It seems such a low-impact privacy violation would be a waste of time for a GDPR/etc agency to focus on compared to things like ad companies selling location data.

> How do the laws play out in practice? I think this is important to consider. In practice, it's difficult to have any recourse with an American company. In Europe it's more expected and common that government and consumer orgs take an active role. Both legal culture and culture-culture (?) are just very different, leading people to preferring to steer clear of this expensive and adversarial (compared to EU climes) e…

That's the exact scentiment the parent to my comment is suggesting; I'm saying that GDPR agencies probably aren't going to care at all about the type of data sent to a web host when all they're doing is serving fonts for 3p websites.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#192

Post by hedora »

johnchristopher wrote: post #175
jefftk wrote: post #40

Earlier quoted context omitted.

"by including Google-Fonts-hosted font on its pages, passed the unidentified plaintiff's IP address to Google without authorization and without a legitimate reason for doing so" It isn't about whether the IP address was logged, but about whether it was sent. Which is an unavoidable aspect of loading a resource from a server.

My concern is totally about whether or not the IP is logged though and google's vague language doesn't clear doubts about that. On the contrary: > Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure. Why does it point this data is kept secure if there is no PI in the first place ?

Secure from whom? The mob? China? The US government? Google?

I'm more worried about the last two than the first two. It'd be illegal for them to secure it against US law enforcement, and they don't claim they're secure the data they log against access from themselves.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#193

Post by 6510 »

judge2020 wrote: post #74
itake wrote: post #73

Earlier quoted context omitted.

My understanding of privacy international privacy stuff is if a European gov wants to spy on their own citizens, but the law prevents them, they phone up the USA and have the USA do the spying(hacking?) and get the data from them. European countries do the same for USA gov on US citizens.

https://en.wikipedia.org/wiki/Five_Eyes?wprov=sfti1 In the US at least, any spying is illegal when both parties are within the US and the packets never leave the US.

More interesting : Anyone outside the US is fair game. Anything goes - by law.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#194

Post by 6510 »

lolinder wrote: post #179
dspillett wrote: post #161

Earlier quoted context omitted.

That is the website owners implementing the rules in the worst way possible, either through incompetence or through deliberately trying to annoy (or fool) you into accepting everything. Be angry at the sites, not the legislation.

Can I be angry at both? Legislation is only required to regulate bad behavior by some set of entities. As such, legislation should be written assuming that those entities will exploit any loopholes. Malicious compliance is exactly what the EU should have expected and planned for.

They are now forced to tell you what they are doing. That it makes you angry is a design goal.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#195

Post by tyingq »

rrdharan wrote: post #189
tyingq wrote: post #41

Earlier quoted context omitted.

It seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are trivially easy for Google to correlate to your other activity. There's much less value for BunnyCDN to abuse it, because they don't have the critical mass of your other activity. Yes, just serving up your own fonts is better, but this is an improvement that seem…

I see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts ( https://developers.google.com/fonts/faq#what_does_using_the_... ) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.

I read that pretty carefully, and didn't see anything about not saving and correlating the visit with other logs they have.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#196

Post by bscphil »

jefftk wrote: post #30
thematrixturtle wrote: post #28

Earlier quoted context omitted.

https://developers.google.com/fonts/faq#:~:text=/google/font... .

The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Use of Google Fonts API is unauthenticated. The Google Fonts API does not set or log cookies. In other words, data from font serving does not feed into advertising personalization. (Disclosure: I used to work on ads at Google)

Thank you for saying this. Memory suggested that this was the case; I think one problem that happens on this site is that people distrust Google so much that they will trust some completely unknown organization that they've never heard of before over one (Google) that has presumably made themselves legally liable if they use your data to track you.

(I would also note to everyone that you can simply disable sending referrers third party, which means that even if Google is using this data to track you, they won't know what sites you are visiting unless those sites use very specific combinations of fonts.)

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#197

Post by 6510 »

kube-system wrote: post #185
fritigern wrote: post #178

Earlier quoted context omitted.

No one expects zero risk, it's about reducing risk. I choose to avoid American companies in favour of non-American competitors because the American government is hostile to privacy and is a warmonger.

90%+ of governments are more hostile to privacy than the US. It might make sense to prefer countries with GDPR, but the vast majority of "non-American countries" have even worse protections for your data. > and is a warmonger. This is flamebait unrelated to data privacy risk. If you don't want to use American companies because you have an political opposition to supporting US companies, that's also a valid opinion. Y…

I think he is referring to the drone strikes based on meta data.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#198

Post by chrismorgan »

favourable wrote: post #50

This is a great project, but I learned to use a system font stack[0] instead to address latency issues on my sites. I run an e-commerce site and every millisecond in rendering time is potentially a lost sale. It needs to be fast, especially for those on 3G (or 2G?) connections. [0] https://systemfontstack.com/

The particular stacks advocated by that site aren’t particularly good (though they’re not all that bad either). It was discussed at https://news.ycombinator.com/item?id=31543054 a few weeks ago.

I would scrap at least Avenir Next, Avenir, Helvetica Neue, Helvetica, Ubuntu, Roboto, Noto, Arial, Apple Garamond, Times New Roman, Droid Serif, Times, Source Serif Pro, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Monaco, Liberation Mono and Lucida Console, and probably a couple more, for one of three reasons: that the family is superfluous, for an obsolete platform, or inferior.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#199

Post by ayushnix »

_fat_santa wrote: post #60
favourable wrote: post #50

This is a great project, but I learned to use a system font stack[0] instead to address latency issues on my sites. I run an e-commerce site and every millisecond in rendering time is potentially a lost sale. It needs to be fast, especially for those on 3G (or 2G?) connections. [0] https://systemfontstack.com/

I have a question about system fonts. Whenever I declare system fonts I always use: `serif`, `sans-serif`, or `monospaced` rather than the actual fonts like: ``` font-family: -apple-system, BlinkMacSystemFont, avenir next, avenir, segoe ui, helvetica neue, helvetica, Cantarell, Ubuntu, roboto, noto, arial, sans-serif; ``` Am I doing it wrong by declaring it just like `font-family: sans-serif`?

No, you're not doing anything wrong. In fact, you're giving users choice to use the fonts that they want, if they customize their fonts in their web browser. However, this choice comes at the cost of potentially ugly default fonts out of the box. Courier New, Times New Roman, Arial, for example. Of course, this is completely subjective.

Use `font-family: sans-serif` for your everything on your website except code blocks and inline code elements, which should use `font-family: monospace, monospace`. Yeah, you have to specify `monospace` twice. If you don't, monospace fonts will be unnaturally smaller than sans-serif fonts.

Please don't use serif fonts on your website, ever. Most people on the planet don't have a high resolution display and serif fonts look chipped and broken on those displays. Serif fonts make sense if you're using them inside a media query for print.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#200

Post by kube-system »

6510 wrote: post #197
kube-system wrote: post #185

Earlier quoted context omitted.

90%+ of governments are more hostile to privacy than the US. It might make sense to prefer countries with GDPR, but the vast majority of "non-American countries" have even worse protections for your data. > and is a warmonger. This is flamebait unrelated to data privacy risk. If you don't want to use American companies because you have an political opposition to supporting US companies, that's also a valid opinion. Y…

I think he is referring to the drone strikes based on meta data.

Maybe, but that doesn’t have any relation to the state of data privacy in a particular country. Most of the countries with almost no data protection at all (or laws that require your data to be compromised) don’t even have drones.
Post reply on HN