Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

271–280 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#271
post #238

Earlier quoted context omitted.

Can you give some examples? Custom web fonts have been well supported since the late aughts.

They're a big reason pages load slowly and cause text to jump around when they do. Custom web fonts are awful.

Web fonts are pretty small and only load if used, and loaded only if they're not cached. It's definitely added requests, but those can be deferred intelligently.

Reflowing is preventable using modern techniques, but honestly it doesn't seem like that big of a deal. The tradeoff is you get access to lots of different type options. More type options means more you can convey with type, which is a good thing for people who need to communicate on the web. It's more than just marketing sometimes.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#272

Earlier quoted context omitted.

Can someone point out a good reason for not downloading the font files and serving them directly from your CDN or servers, without any calls to third-parties in your HTML?

"The bikeshed" I've been down this road. I don't know what it is, but many web developers are extremely adverse to doing it. Even once you've convinced people to let you do it, the first PR from a new hire is a fix for this "bug".

What is the bikeshed?

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#273

Earlier quoted context omitted.

"The bikeshed" I've been down this road. I don't know what it is, but many web developers are extremely adverse to doing it. Even once you've convinced people to let you do it, the first PR from a new hire is a fix for this "bug".

What is the bikeshed?

"Organizations spend disproportionate time on trivial issues" - cn parkinson

not sure how it's relevant here though

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#274
post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

Can someone point out a good reason for not downloading the font files and serving them directly from your CDN or servers, without any calls to third-parties in your HTML?

Ha, you want an anecdote?

Years ago, when I worked at MSP serving quite a big federal customer... We received a ticket what $companysite.tld isn't working. Pretty unusual, but the first things first, so I just type $companysite.tld in the browser. It works fine.

Okay, ignore then.

But, no, 15 minutes later we receive an email with a tons of people in CC and a lot of !!!!s in the subject and body what the site is still down.

I again check it from my machine (which of course was in the MSP office, not on customer premises), it works fine, DNS, tracert, yada-yada.

Our network team replies what $companysite.tld responds to ping so everything works fine from their POV. Duuuh.

Okay, I hop to the management station located in the customer's DC, test the site there... and it doesn't work there. Just a blank screen, no errors, nothing. Which is pretty strange because the site is hosted in the same DC. DNS resolves to the proper records, ICMP works including traceroute...

Well, long story short, after 30 minutes of head scratching and dozens of emails with ever longer list of people in CC it occurs to me to hit F12.

I open the developer console, switch to Network tab, type in $companysite.tld and I see what the traffic is starting to flow just fine, only to stall to a halt at... googlefonts.com (or whatever TLD they used).

At this point I just calmly sent an email explaining what the site was working just fine, it just wasn't able to properly load from the customer premises because of the block of Google services.

To summarize:

somebody from the customer ordered to block Google services on the network level (don't even ask);

network team (certified Cisco CC** folks!) implemented it by dropping traffic instead of denying - so the firewall would notify the client station about that and the browser would abort the request to googlefonts.com and wouldn't wait a full timeout for each request (don't forget DNS records resolved just fine, if they sent NXDOMAIN for it there wouldn't habe been even an attempt to connect);

network team diagnoses the availability of the web-sites by using ICMP ping... but that wasn't the first or the last time when I was quite... disappointed of their qualification.

While it is very rare for major CDNs to go down, it happens, and even more shenanigans can happen on a network level between some client and your website (and proliferation of DPI by various countries, agencies and enterprises doesn't help here too).

So if you are on the payroll just host the fonts (and honestly - all assets, if applicable) with the web-site and sleep soundly. Of course if you are paid for each "incident", then Web3.0 is all yours. *grin*

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#275
post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

> have no idea who bunny.net is $ whois bunny.net (...) Registrant Name: Registration Private Registrant Organization: Domains By Proxy, LLC Registrant Street: DomainsByProxy.com Registrant Street: 2155 E Warner Rd Registrant City: Tempe Registrant State/Province: Arizona Registrant Postal Code: 85284 Registrant Country: US (...) > we're in a country with better privacy laws" ...it appears that the domain registrant…

domain registrant != site/host location

Their web-site is located in the UK[0]

Their fonts CDN is originating from AS60068 which is registered in UK too[1][2]

[0] https://bgp.he.net/dns/bunny.net#_ipinfo

[1] https://bgp.he.net/AS60068#_whois

[2] https://bgp.he.net/dns/fonts.bunny.net#_ipinfo

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#276
post #146

Earlier quoted context omitted.

I'm an American and I have next to zero trust for governments in general. "Absolute power corrupts absolutely" and humanity has given too few entirely too much "absolute power". I feel much the same about most of the massive corporate entities as well.

The difference is Europe is better at restricting corporate overreach than the US is, regardless of how similar their governments have become. That said, I'd take almost any European government over any US government of my entire lifetime, especially when it comes to actually enacting privacy legislation. I couldn't care less about web fonts though. I'm not downloading them from Google or "bunny.net" or anywhere else…

Hmm. Well over the past century, European governments have collectively murdered a lot more people than any of the North American governments have.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#277
post #162

Earlier quoted context omitted.

Yep, and also the whole EU... Every few months, they either want to make encrpytion illegal, scan more private data, scan files on end user devices, outright ban e2e encryption, or worse.

And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. They are never geo-filtered either so everyone is forced to see them. I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better way…

> And we can thank EU for the extremely annoying cookie pop-up’s on every website.

I've never heard anybody who wasn't in or adjacent to the tech surveillance industry complain about this.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#278

Earlier quoted context omitted.

> Not using fonts is not always an option The silliness of this is that someone is going through the effort to set up hosting for a website but hosting the fonts is just too difficult and has to be delegated to a third party. The laziness of webdevs never fails to astound.

I don't think it's laziness. My conscious brain knows that it's anachronistic, but I still have the instinct to use a CDN for the shared caching between sites. Obviously, browser privacy changes mean that isn't a valid reason any more, but for me the instinct is still there.

Sites will setup a CDN to serve their own custom assets, but fonts? nope not doable. It's 100% laziness.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#279
post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

Can someone point out a good reason for not downloading the font files and serving them directly from your CDN or servers, without any calls to third-parties in your HTML?

Wouldn't initial page load be affected? On the user side this only really happens on the very first load when the font isn't cache'd but this might affect SEO bots more?

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#280
post #146

Earlier quoted context omitted.

I'm an American and I have next to zero trust for governments in general. "Absolute power corrupts absolutely" and humanity has given too few entirely too much "absolute power". I feel much the same about most of the massive corporate entities as well.

The difference is Europe is better at restricting corporate overreach than the US is, regardless of how similar their governments have become. That said, I'd take almost any European government over any US government of my entire lifetime, especially when it comes to actually enacting privacy legislation. I couldn't care less about web fonts though. I'm not downloading them from Google or "bunny.net" or anywhere else…

Here are the GDPR fines: https://www.enforcementtracker.com/

Enacting legislation is one thing. Somalia is excellent at enacting gun control legislation.

Post reply on HN