Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

Post reply on HN
Print view View original

261–270 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#261

Post by 1vuio0pswjnm7 »

hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

"Which is an imperfect solution at best, and given I have no idea who bunny.net is it's a questionable solution at best."

Anyone who is a bunny.net customer would have an idea. Unlike many of the myriad wesbites using Google fonts, they would also have an agreement with Bunny they could potentially enforce.

Anyone doing internet research who peruses publicly available scans of DNS ports in the last five years would likely be familiar with bunny.net as they are a large enough CDN to have many thousands of subdomains for customer IPs. It is seemingly impossible to miss this company's presence toward the beginning of the scan.

The founder of bunny.net recently posted a question in an nginx forum. This is not AWS or Google. Amazon sells goods. Google sells online advertising services. Both are primarily intermediaries (middlemen) who try to prioritise their own competing goods/services. All the data those companies collect may feed into other business that strives to study and understand consumer behaviour, e.g., placing internet-connected microphones (referred to only as "speakers") in people's homes or internet-cnnected GPS trackers in their pockets. There are strong incentives for those companies to conduct extensive surveillance. Bunny sells CDN services. At present, that's all, AFAICT.

1. https://bunny.net/our-story

This HN submission purports to mirror the recent announcement of fonts on the bunny.net blog on 16 June however it currently points to an "About" page, not the blog entry. The blog entry discloses in more detail the rationale for the decision to offer fonts.

https://bunny.net/blog/bringing-privacy-back-into-your-own-h...

There is an argument supported by legal decisions in Austria, Denmark and Germany that neither Google Fonts nor Google Analytics are GDPR-compliant.

https://www.theregister.com/2022/01/31/website_fine_google_f...

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#262

Post by ByteJockey »

KennyBlanken wrote: post #242
ByteJockey wrote: post #227

Earlier quoted context omitted.

> I don't think Americans and American companies understand how little trust rest of us have for the American government. Have you... have you seen our politics? What makes you think that we think other people trust our government? We don't trust our government. Hell, it's trusted so little that one of our large political parties is basically entirely devoted to making sure that the government can't get anything done…

That political party's actions are about weakening the federal government so as to make it easier for large corporations to behave abusively, not because of trust. States have less resources, and can be played against each other. The public-facing excuse for Joe Q Public is "they can't be trusted!", "less taxes on your hard-earned money" (when corporate share of taxes has plunged from the 50-50 split it used to be, i…

> That political party's actions are about weakening the federal government so as to make it easier for large corporations to behave abusively, not because of trust.

Can you think of a reason people would do that if they didn't trust those corporations more than the federal government?

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#263

Post by dang »

fritigern wrote: post #154
kube-system wrote: post #128

Earlier quoted context omitted.

Unless you're under a totalitarian government, spies aren't really interested in most people's data. Data brokers, on the other hand, are willing to sell anything they can profit from.

Quoted post unavailable.

Can you please stop posting unsubstantive and/or flamebait comments to HN? You've unfortunately been doing it a lot lately. It's not what this site is for, and it destroys what it is for.

I can understand why people have strongly held views about foreign policy but this sort of political flamewar is repetitive and predictable, and therefore off topic here. It has veered particularly extremely off topic in a "Bunny fonts" thread. And I'm afraid you've been posting flamebaity/unsubstantive comments in other threads too.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#264

Post by technion »

rmbyrro wrote: post #257
hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

Can someone point out a good reason for not downloading the font files and serving them directly from your CDN or servers, without any calls to third-parties in your HTML?

"The bikeshed"

I've been down this road. I don't know what it is, but many web developers are extremely adverse to doing it. Even once you've convinced people to let you do it, the first PR from a new hire is a fix for this "bug".

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#265

Post by chrismorgan »

zinekeller wrote: post #259
chrismorgan wrote: post #250

Earlier quoted context omitted.

Superfluous: it’s there for Android, but I believe that sans-serif will normally resolve to that anyway. (I’m not certain about that, and can’t confirm it as I don’t have ready access to Chrome on Android but I got the impression some years ago that Chrome on Android uses the system font, which is Roboto. But even apart from that, the general idea is “stop specifying specific fonts and let the browser do its thing an…

looks at Samsung and Chinese manufacturers having their own house fonts ... and now you know why Roboto is explicitly included - because sans-serif won't necessarily resolve to Roboto on an Android device.

Including its name doesn’t mean it’s available. Or that it should necessarily be used even if it is—when the purpose of including Roboto was to get a default font, you probably shouldn’t complain when you get a default font.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#266

Post by cmeacham98 »

ncmncm wrote: post #231
_fat_santa wrote: post #59

Earlier quoted context omitted.

> If you embed a font hosted somewhere else you expose some of your user data to them. Now with fonts there's a really simple solution: Just don't. As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. I never quite understood the debate around fonts. You could use the CSS/Link import that Google provides, but that's never the optimal solution. Like you I always do…

On Firefox desktop, I force literally all fonts -- serif, sans, what-have-you -- to Linux Libertine. Dingbats can look odd, but you get used to that. For reasons I am sure I will never fathom, browsers on mobile provide all the same settings options, and religiously ignore them.

I used to do this, but it broke a lot of websites, especially those that use custom fonts to display symbols.

Nowadays, what I do (and recommend to others) is to set Firefox to never send a referer cross-origin, so google fonts and similar don't get to see what website I'm on. I've found that very few websites break with this.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#267

Post by cmeacham98 »

blip54321 wrote: post #249
jfk13 wrote: post #211

Earlier quoted context omitted.

Sounds like you're basically reinventing SRI: https://en.wikipedia.org/wiki/Subresource_Integrity One issue with cross-site caching, though, is that it may enable timing-based attacks on privacy.

No, I'm not reinventing it, but extending it by: 1) Mandating it for certain types of resources 2) Extending caching to cover the cross-site case. Can you please explain the proposed timing-based attack?

Websites can use whether or not a resource is cached (one way to measure that is how long it takes to load) to uniquely identify your browser and track you across the internet.

Another attack is to determine if you visited $popularWebsite by checking if resources it uses are cached (this could be useful to, for example, the Chinese government for surveillance on its citizens).

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#268

Post by keithnz »

hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

> As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection.

I thought the whole point is that using a common resource your chances of a cache hit are much higher such that they don't need to download. Having said that, if you are worried about GDPR you are probably way better off hosting them yourself anyways

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#269

Post by dundarious »

fritigern wrote: post #151
dundarious wrote: post #117

Earlier quoted context omitted.

I’m surprised you emphasized government wrt. privacy here. Sure, despite the fact that the US government institutions have more mechanisms for oversight and transparency after 20 or 40 years, etc., they are certainly the most profligate in their use of surveillance and hacking, etc., and US three letter agencies are the most adept at completely side-stepping those publicized limitations — so it’s not like the governm…

I am not worried too much about corporate surveillance. I can always shop somewhere else. I can't change my government. I use DDG because I don't like Google. I can't do the same with my government.

Fair enough, and in a sense I don't even really disagree, but my point is essentially that self-hosting eliminates the class of problems almost entirely, meaning there would be no need to rely on this kind of 2nd order competition at all.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#270

Post by runarberg »

cmeacham98 wrote: post #266
ncmncm wrote: post #231

Earlier quoted context omitted.

On Firefox desktop, I force literally all fonts -- serif, sans, what-have-you -- to Linux Libertine. Dingbats can look odd, but you get used to that. For reasons I am sure I will never fathom, browsers on mobile provide all the same settings options, and religiously ignore them.

I used to do this, but it broke a lot of websites, especially those that use custom fonts to display symbols. Nowadays, what I do (and recommend to others) is to set Firefox to never send a referer cross-origin, so google fonts and similar don't get to see what website I'm on. I've found that very few websites break with this.

Font icons is another one of these things that some web developers tend to do and should probably stop. SVG icons are superior in every way—at least all the ways I can think of.
Post reply on HN