Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocking web fonts for speed and privacy (2016)

collinmbarrett.com

Post reply on HN
Print view View original

91–100 of 146 posts

Re: Blocking web fonts for speed and privacy (2016)

#91

Post by ogurechny »

phantomathkg wrote: post #31

This is a very shortsighted view from developer who forget a web page is not only a bunch of text. Designer also play an important role to provide the subtle design element that developers don't value. By blocking all web fonts and fallback to only system font, you may still be able to read the text, but will completely missed the design.

Let me explain how it actually works. I visit the website, see horrible text (because designer expected everyone to use high DPI screen or specific rasterization/hinting back-end), click on the icon to disable fonts, and then, yes, I am able to read the text. Which is the only reason I am on this page. Not even the slightest thought about page design appears in my head, just temporary irritation from the obstruction.

Re: Blocking web fonts for speed and privacy (2016)

#92

Post by ffpip »

legitster wrote: post #76

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer header) to track what sites you visit, building a valuable profile about you that they could sell to marketers. As a person who works in martech it's patently bizarre to read this stuff. There's a difference between something being provent theoretically possible…

> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world.

Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible".

They are even being sold as a product and are used by many companies.

Look at their customers - https://fingerprint.com/ .

Re: Blocking web fonts for speed and privacy (2016)

#93

Post by onion2k »

upbeat_general wrote: post #13

One thing I don’t see mentioned here is the possibility of additional profiling by disabling web fonts. Doesn’t this make you more more unique as a user since very few people disable web fonts? I suppose you could argue that many users can be uniquely identified either way but it’s no doubt a strong additional piece of info.

The server where the font is being loaded from would have no record of your activity. That's the but that improves privacy. I think there's an expectation that if you're concerned to this extent you'd have JS disabled as well, which would make it hard to detect whether you're displaying the font. Probably not impossible with CSS though.

Re: Blocking web fonts for speed and privacy (2016)

#94

Post by Havoc »

legitster wrote: post #76

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer header) to track what sites you visit, building a valuable profile about you that they could sell to marketers. As a person who works in martech it's patently bizarre to read this stuff. There's a difference between something being provent theoretically possible…

>The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well

You sure? Quick google suggests somewhere in the low single digits of big sites is applying some sort of fingerprinting - though unclear how much is for security vs tracking

[0] https://webtransparency.cs.princeton.edu/webcensus/

Re: Blocking web fonts for speed and privacy (2016)

#95

Post by megous »

bobbylarrybobby wrote: post #5
DanAtC wrote: post #3

iOS' Lockdown Mode blocks web fonts. Sad to see how many sites still use icon fonts instead of SVGs.

As someone who knows nothing about this: what is wrong with icon fonts?

Font choice is a user's choice. https://megous.com/dl/tmp/830725ae5a555c87.png

It's a normal user modifiable choice in the browser. You're just making your webapp much less usable for users who have made that choice. And for no reason, because SVG icons work just fine and are even more flexible. Font icons are basically a hack. They have terrible fallback behavior.

Re: Blocking web fonts for speed and privacy (2016)

#96

Post by 9dev »

ogurechny wrote: post #91
phantomathkg wrote: post #31

This is a very shortsighted view from developer who forget a web page is not only a bunch of text. Designer also play an important role to provide the subtle design element that developers don't value. By blocking all web fonts and fallback to only system font, you may still be able to read the text, but will completely missed the design.

Let me explain how it actually works. I visit the website, see horrible text (because designer expected everyone to use high DPI screen or specific rasterization/hinting back-end), click on the icon to disable fonts, and then, yes, I am able to read the text. Which is the only reason I am on this page. Not even the slightest thought about page design appears in my head, just temporary irritation from the obstruction.

But you do realise that you’re part of a very small, albeit vocal, minority here? Most people actually do value a coherent visual design, which can be and repeatedly has been proven in studies and A/B testing. This holds true, whether you like it or not.

Re: Blocking web fonts for speed and privacy (2016)

#97

Post by masa331 »

legitster wrote: post #76

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer header) to track what sites you visit, building a valuable profile about you that they could sell to marketers. As a person who works in martech it's patently bizarre to read this stuff. There's a difference between something being provent theoretically possible…

It's not bizarre if you realize that the decisions are not really in your hands. You are an engineer working in martech, you do what your company tells you to do and your company is motivated by profit, especially in martech. When your bosses decide it's time to start doing that, you will follow and if not, plenty of other engineers will. It's not like there are not dozens and dozens of examples of companies doing exactly that

Re: Blocking web fonts for speed and privacy (2016)

#98

Post by [deleted] »

userbinator wrote: post #8

I find it somewhat amusing that this is one setting that IE has always had in its GUI: https://i0.wp.com/improveandrepeat.com/wp-content/uploads/20... Firefox has this setting built-in, gfx.downloadable_fonts.enabled and browser.display.use_document_fonts, but AFAIK it's not configurable via GUI by default. Chrome hides it even deeper in a command-line option, --disable-remote-fonts

[deleted]

Re: Blocking web fonts for speed and privacy (2016)

#99

Post by Dalewyn »

phantomathkg wrote: post #81
Dalewyn wrote: post #69

Earlier quoted context omitted.

A computer and any code that execute within one are tools, and tools must first and foremost serve to enable its user. This means when it comes to software design, function always trumps form. A tool should never be designed with form over function in mind, it must always be function over form. Any form (design) that impedes the function must be culled with extreme prejudice. When it comes to remote fonts, they slow…

> When it comes to remote fonts, they slow down page download and consequently load time. Show example please. > they violate privacy rules and laws, Show more example please. Let's not forget when you access a webpage, the server already know what IP address you are connecting form. If the web font is loaded from the same host, the owner of the page does not violate any privacy rules than servicing you the page. > t…

>Show example please.

It's an additional resource that needs to be requested, downloaded, and processed by the browser. While the processing will happen either remote or local, local system fonts don't need to be requested and downloaded which saves bandwidth and time (aka faster page load times).

>Show more example please. Let's not forget when you access a webpage, the server already know what IP address you are connecting form.

EU rulings concerning GDPR and remote fonts.

>If the web font is loaded from the same host, the owner of the page does not violate any privacy rules than servicing you the page.

And in fact, this is suggested by the EU as a way to abide by GDPR while using remote fonts. The vast majority of remote font use cases are not served directly by the website, though. It's all a sad state of affairs.

>You may have experienced designers who are bad at their job, but it does not mean a good design, including using or not using web font, help deliver the function better.

Sure.

Thing is, in recent times I've experienced far too many terrible designs and I can't recall even one example of a good design.

User needs and desires aren't being considered by designers, so fuck it, I'm past the point of caring about throwing babies out with the bathwater. Throw them out, nothing of value will be lost.

>I welcome your view, despite how myopic it is, and I hope you live by your value, which means code using vim/emac, not using any GUI tools, and browse the internet using lynx the text internet browser.

The only thing myopic is your attitude. Good designs can exist, but when it comes to modern software design they've all turned horrible. The very fact you are trying to override user complaints with designer desires is indicative that you too consider form over function, which for a tool is nonsense.

I appreciate that you're a designer and an artist and you want to flaunt and exhibit your vision for all to see, and that's fine. Meanwhile, we've got shit to do and we need/want computers to enable us so we can get shit done, and your visions are getting in the way. So please save your passion for the art museum, tools are not avenues for artistic expressions.

Re: Blocking web fonts for speed and privacy (2016)

#100

Post by post_below »

ffpip wrote: post #92
legitster wrote: post #76

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer header) to track what sites you visit, building a valuable profile about you that they could sell to marketers. As a person who works in martech it's patently bizarre to read this stuff. There's a difference between something being provent theoretically possible…

> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world. Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible". They are even being so…

To add to this, basic fingerprinting is trivial. And more advanced fingerprinting isn't much harder.

I'm so confused by GP post. We were doing fingerprinting 15 years ago.

Post reply on HN