Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocking web fonts for speed and privacy (2016)

collinmbarrett.com

Post reply on HN
Print view View original

11–20 of 146 posts

Re: Blocking web fonts for speed and privacy (2016)

#11

Post by userbinator »

behnamoh wrote: post #4
DanAtC wrote: post #3

iOS' Lockdown Mode blocks web fonts. Sad to see how many sites still use icon fonts instead of SVGs.

The method in the article also turns Reddit's upvote/downvote buttons into squares (unknown characters).

Yet HN's vote buttons are unaffected.

Re: Blocking web fonts for speed and privacy (2016)

#12

Post by molticrystal »

In a similar vein, LocalCDN is an extension to serve the most common javascript libraries from your browser instead of going to 3rd party servers, while there are edge cases when you use a local copy, I've rarely had an issue.

https://codeberg.org/nobody/LocalCDN/

  Removes integrity and crossorigin tags from embedded script and style elements to replace even more frameworks
  Font Awesome
  Google Material Icons
  jQuery
  Bootstrap CSS
  Bootstrap JavaScript
  AngularJS, AngularJS-Animate, AngularJS-Sanitize, AngularJS-Cookies and AngularJS-Touch
  React, Vue.js, Chart.js and many other frameworks/libraries
  MathJax (minimal)
  TinyMCE (without plugins)
  Prepared rules for uBlock Origin, uMatrix, AdGuard and NoScript
More complete lists can be found in the source code, there are a lot of them:

https://codeberg.org/nobody/LocalCDN/src/branch/main/core/ma...

https://codeberg.org/nobody/LocalCDN/src/branch/main/core/re...

Re: Blocking web fonts for speed and privacy (2016)

#13

Post by upbeat_general »

One thing I don’t see mentioned here is the possibility of additional profiling by disabling web fonts. Doesn’t this make you more more unique as a user since very few people disable web fonts?

I suppose you could argue that many users can be uniquely identified either way but it’s no doubt a strong additional piece of info.

Re: Blocking web fonts for speed and privacy (2016)

#14

Post by markdown »

kmeisthax wrote: post #7

>Additionally, most of the time web fonts are downloaded from a third-party delivery network such as Google Web Fonts or Adobe Fonts. One of the advantages of using these systems is that the likelihood that a visitor’s browser already has a font cached locally from a previous visit to any other site using the same font is relatively high. That likelihood is relatively low (though not as low as JS CDNs). Modern browse…

> That likelihood is relatively low (though not as low as JS CDNs). Modern browsers explicitly forbid sharing cache entries across websites; so the likelihood is zero now.

Even a decade ago when this was common practice, it was absolutely pointless because Google Fonts used to (still does?) set a cache time of only 2hrs.

Re: Blocking web fonts for speed and privacy (2016)

#15

Post by pbronez »

molticrystal wrote: post #12

In a similar vein, LocalCDN is an extension to serve the most common javascript libraries from your browser instead of going to 3rd party servers, while there are edge cases when you use a local copy, I've rarely had an issue. https://codeberg.org/nobody/LocalCDN/ Removes integrity and crossorigin tags from embedded script and style elements to replace even more frameworks Font Awesome Google Material Icons jQuery Bo…

Another option for this is https://decentraleyes.org/

Re: Blocking web fonts for speed and privacy (2016)

#18

Post by makeitdouble »

upbeat_general wrote: post #13

One thing I don’t see mentioned here is the possibility of additional profiling by disabling web fonts. Doesn’t this make you more more unique as a user since very few people disable web fonts? I suppose you could argue that many users can be uniquely identified either way but it’s no doubt a strong additional piece of info.

The absence of info can’t be “additional” info. It’s a differentiating factor, but at best it’s on par with any other single info you would have sent through the font fetching request.

Arguably that single boolean characteristic (“fonts disabled”) is way less info than the dozens of characteristics you expose when fetching a font.

Re: Blocking web fonts for speed and privacy (2016)

#19

Post by molticrystal »

pbronez wrote: post #15
molticrystal wrote: post #12

In a similar vein, LocalCDN is an extension to serve the most common javascript libraries from your browser instead of going to 3rd party servers, while there are edge cases when you use a local copy, I've rarely had an issue. https://codeberg.org/nobody/LocalCDN/ Removes integrity and crossorigin tags from embedded script and style elements to replace even more frameworks Font Awesome Google Material Icons jQuery Bo…

Another option for this is https://decentraleyes.org/

LocalCDN actually started as a fork of decentraleyes with much more included and is updated more often.

Re: Blocking web fonts for speed and privacy (2016)

#20

Post by cmeacham98 »

molticrystal wrote: post #12

In a similar vein, LocalCDN is an extension to serve the most common javascript libraries from your browser instead of going to 3rd party servers, while there are edge cases when you use a local copy, I've rarely had an issue. https://codeberg.org/nobody/LocalCDN/ Removes integrity and crossorigin tags from embedded script and style elements to replace even more frameworks Font Awesome Google Material Icons jQuery Bo…

LocalCDN provides no meaningful privacy gains over enabling Total Cookie Protection (i.e. dynamic FPI, already enabled by default in modern versions of Firefox) and disabling cross-site referers, which you should do anyways.
Post reply on HN