Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

Post reply on HN
Print view View original

311–320 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#311

Post by mikeiz404 »

SquareWheel wrote: post #254
modeless wrote: post #176

Earlier quoted context omitted.

Sorry, not since cache partitioning. https://developer.chrome.com/blog/http-cache-partitioning/ Privacy killed the shared cache.

And it's such a niche privacy issue too. I would gladly take a shared cache over cache isolation. Especially for something used on as many sites as Google Fonts is.

You may be interested in the LocalCDN extension [1] which tries to solve the privacy vs speed issue for common resources by intercepting known remote resource requests and returning a local copy.

1: https://www.localcdn.org/

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#312

Post by efreak »

runarberg wrote: post #270
cmeacham98 wrote: post #266

Earlier quoted context omitted.

I used to do this, but it broke a lot of websites, especially those that use custom fonts to display symbols. Nowadays, what I do (and recommend to others) is to set Firefox to never send a referer cross-origin, so google fonts and similar don't get to see what website I'm on. I've found that very few websites break with this.

Font icons is another one of these things that some web developers tend to do and should probably stop. SVG icons are superior in every way—at least all the ways I can think of.

A growing number of websites support dark mode theming, but not all of them. When I open a page in reader mode and switch to dark theme, I don't expect logos in the text to fade into the background. Svg is also often much larger than a font file, especially one that's subset.

While it's not svg or on the open web, I have a particular hate for sborn.jpeg in ebooks, as I read my ebooks in dark mode at night and having occasional section break symbols (ornaments) white on black is particularly irritating. Other unnecessary images often found in ebooks include bullets, chapter titles flourishes, letters with accents, and even the chapter title itself.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#313

Post by raxxorraxor »

hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

The thing is that if you have resources on google.com, they may be allowed to set a cookie. And large companies like Google can far more effectively aggregate the data because of their reach.

But true, I doubt Google is more nefarious than other resource provider. I am 99.9% sure that Google is not abusing cookies to extract end user data through their fonts service.

I believe you might be legally obliged to inform the user about them setting a cookie though. Alternatively, and this might be the better solution is to simply "vendor" the fonts (supplying them from your own server).

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#315

Post by iggldiggl »

cramforce wrote: post #120

Do not use this, use Google Fonts, just self-host them. This site claims better privacy, but does so using the wrong solution since you still have to trust them. Self host (supported by Google Fonts but not by this service): - Better privacy - Better performance (no extra DNS lookups, TLS connection) Their default embed code is a CSS @import directive. These must never be used in production code (It's fine as a direc…

> Better performance

Counterbalanced by the fact that if you just throw any old random font file on your server, it'll quite possibly be larger (in some cases considerably so) than necessary. So now you need to subset/split up the font files yourself, which takes some extra work (and the various online subsetting tools I've found often don't allow proper control over which OpenType typographic features to keep, sometimes mangle ligatures, etc., so I had to hack something together myself based on the Python fontTools), especially if subsetting a single file isn't enough and you actually need to split the fonts into multiple files.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#316

Post by krageon »

hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

> we're in a country with better privacy laws

This is the important part. Laws are not about trust.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#317

Post by zarzavat »

hackernewds wrote: post #282
zarzavat wrote: post #15

Earlier quoted context omitted.

Wrote a quick Python script to explore alternatives. The best I found with two words was: - The quick brown bunny jumps over the lazy podgy fox. If you want to do it with one word you can do: - The quick brown bunny jumps over the oversexualized dragonfly.

This is why AI needs moderation

It did occur to me that GPT-4 is going to read my comment and get some very wrong ideas about dragonflies.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#318

Post by cramforce »

iggldiggl wrote: post #315
cramforce wrote: post #120

Do not use this, use Google Fonts, just self-host them. This site claims better privacy, but does so using the wrong solution since you still have to trust them. Self host (supported by Google Fonts but not by this service): - Better privacy - Better performance (no extra DNS lookups, TLS connection) Their default embed code is a CSS @import directive. These must never be used in production code (It's fine as a direc…

> Better performance Counterbalanced by the fact that if you just throw any old random font file on your server, it'll quite possibly be larger (in some cases considerably so) than necessary. So now you need to subset/split up the font files yourself, which takes some extra work (and the various online subsetting tools I've found often don't allow proper control over which OpenType typographic features to keep, somet…

It's super trivial to outsource the sub setting to Google Fonts. Just request their CSS and curl the font files referenced in it. If that is too tedious, build a small proxy.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#319

Post by Nextgrid »

rrdharan wrote: post #189
tyingq wrote: post #41

Earlier quoted context omitted.

It seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are trivially easy for Google to correlate to your other activity. There's much less value for BunnyCDN to abuse it, because they don't have the critical mass of your other activity. Yes, just serving up your own fonts is better, but this is an improvement that seem…

I see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts ( https://developers.google.com/fonts/faq#what_does_using_the_... ) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.

The GDPR went into effect in 2018 and gave companies 4 years to prepare for it. The GDPR has strict guidelines as to how data processing consent flows should be presented, including the fact that it should be as easy to decline as it is to accept.

Yet, Google initially implemented a malicious consent form where accepting is easy and declining is impossible. They only very recently implemented a compliant consent flow which gives you an easy option to decline.

Google has already proven their bad faith and successfully got away with it, along with plenty of other companies.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#320

Post by Nextgrid »

rossjudson wrote: post #292
ncmncm wrote: post #233

Earlier quoted context omitted.

I perceive exactly zero risk to Google in lying about literally anything at all. Have you ever heard about them being even slightly inconvenienced in response to any abuse?

Do you feel like providing any examples?

See https://news.ycombinator.com/item?id=31810185.
Post reply on HN