Blocking web fonts for speed and privacy (2016) • Hacker News Board

Re: Blocking web fonts for speed and privacy (2016)

#131

Post by marssaxman » Sat, Sep 17, 2022, 2:11 PM UTC

9dev wrote: post #96

ogurechny wrote: post #91

Earlier quoted context omitted.

Let me explain how it actually works. I visit the website, see horrible text (because designer expected everyone to use high DPI screen or specific rasterization/hinting back-end), click on the icon to disable fonts, and then, yes, I am able to read the text. Which is the only reason I am on this page. Not even the slightest thought about page design appears in my head, just temporary irritation from the obstruction.

But you do realise that you’re part of a very small, albeit vocal, minority here? Most people actually do value a coherent visual design, which can be and repeatedly has been proven in studies and A/B testing. This holds true, whether you like it or not.

I certainly do value a coherent visual design! That's why it bugs me so much when designers mess with the standards, trying to make their little slices of the web look different from the rest.

Blocking web fonts, zapping away floaty banners and other design irritations via uBlock Origin, and making liberal use of Reader Mode gives me a much more coherent experience of the web.

Re: Blocking web fonts for speed and privacy (2016)

#132

Post by alok-g » Sat, Sep 17, 2022, 3:10 PM UTC

phantomathkg wrote: post #31

This is a very shortsighted view from developer who forget a web page is not only a bunch of text. Designer also play an important role to provide the subtle design element that developers don't value. By blocking all web fonts and fallback to only system font, you may still be able to read the text, but will completely missed the design.

How bad do you find my website? :-) (Asking genuinely)

Sample post: https://alokgovil.com/understanding-self-reliance/

It's using just Arial and Times New Roman.

Re: Blocking web fonts for speed and privacy (2016)

#133

Post by ikt » Sat, Sep 17, 2022, 3:15 PM UTC

pas wrote: post #113

ikt wrote: post #102

Earlier quoted context omitted.

> Look at their customers - https://fingerprint.com/ . Welp that's scary, can detect me when I'm on VPN, off it, in private browsing mode, different country in private browsing mode...

that's nice claim, but for it to work you need to leak enough entropy, and you can check that on various sites.

there's a little widget on the site that can check that for you

Re: Blocking web fonts for speed and privacy (2016)

#134

Post by legitster » Sat, Sep 17, 2022, 3:20 PM UTC

manigandham wrote: post #104

legitster wrote: post #76

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer header) to track what sites you visit, building a valuable profile about you that they could sell to marketers. As a person who works in martech it's patently bizarre to read this stuff. There's a difference between something being provent theoretically possible…

I've spent 12 years in adtech and built 3 ad platforms from the ground up. Fingerprinting is used everywhere. It's a wide spectrum from basic metrics to very in-depth tracking, all depending on the scale, latency and functionality of each scenario. This can range from frequency capping to fraud detection to stopping bots, to uniquely identifying devices. I will say that it's mostly used to improve UX by increasing se…

How does a fingerprint remain stable over any reasonable period of time? How do you distinguish between different user accounts on the same device? How do you tie a fingerprint to your database of existing customers? How do you keep cookie data from conflicting with fingerprint data?

I have yet to ever see a database of fingerprints or what it even looks like. It could very well be that advertisers keep it as part of a secret black-box, but every vendor we have ever used has been entirely dependent on cookies and the only data we've ever collected has been cookie or session-based. I've been sold a lot of garbage adtech over the years, so my hunch was that this was another bit of industry vaporware.

Re: Blocking web fonts for speed and privacy (2016)

#135

Post by legitster » Sat, Sep 17, 2022, 3:38 PM UTC

ffpip wrote: post #92

legitster wrote: post #76

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer header) to track what sites you visit, building a valuable profile about you that they could sell to marketers. As a person who works in martech it's patently bizarre to read this stuff. There's a difference between something being provent theoretically possible…

> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world. Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible". They are even being so…

Sure, but I was specifically referring to a marketing context.

We maintain pretty robust customer databases and our needs are much different. Just proving you are a unique device isn't useful in most contexts if we don't have good or reliable ways of associating it with existing profiles. Notice that none of their customers are marketing companies.

What this site won't tell you is that fingerprints have a half-life less than 24 hours (when you lose the fingerprint). Useful for anti-abuse measures, somewhat useful for ad-attribution, absolutely garbage for long-term tracking.

Re: Blocking web fonts for speed and privacy (2016)

#136

Post by legitster » Sat, Sep 17, 2022, 3:43 PM UTC

ikt wrote: post #102

ffpip wrote: post #92

Earlier quoted context omitted.

> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world. Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible". They are even being so…

> Look at their customers - https://fingerprint.com/ . Welp that's scary, can detect me when I'm on VPN, off it, in private browsing mode, different country in private browsing mode...

Try it again with cookies disabled. It looks like they only do the browser fingerprinting if cookies are disabled.

Re: Blocking web fonts for speed and privacy (2016)

#137

Post by morjom » Sat, Sep 17, 2022, 4:06 PM UTC

Dracophoenix wrote: post #130

dngray wrote: post #106

Earlier quoted context omitted.

Yes "we" (privacyguides.org) consult with the authors of that project as well as a few others. It was nice to see they quoted our blog article https://www.privacyguides.org/blog/2021/12/01/firefox-privac... We've been on a bit of a mission of trying to dissuade people from "old thinking" of installing a gazillion "privacy extensions".

Why do "you" (as in PrivacyGuides) keep ProtonMail on the recommended list of email services after it was revealed the company disclosed IP information on a consumer to French authorities? I would think this would be an important consideration in your assessment of the company. https://www.theverge.com/2021/9/6/22659861/protonmail-swiss-... At the very least mentioning this information would be beneficial to your rea…

Doesn't ProtonMail the company fight back on most inquiries and demands and they get and that French thing was just one of the ones they lost the ground on because France used Europol contacts to file the warrant Switzerland? (Might be misremembering)

Re: Blocking web fonts for speed and privacy (2016)

#138

Post by vmoore » Sat, Sep 17, 2022, 7:13 PM UTC

pbronez wrote: post #15

molticrystal wrote: post #12

In a similar vein, LocalCDN is an extension to serve the most common javascript libraries from your browser instead of going to 3rd party servers, while there are edge cases when you use a local copy, I've rarely had an issue. https://codeberg.org/nobody/LocalCDN/ Removes integrity and crossorigin tags from embedded script and style elements to replace even more frameworks Font Awesome Google Material Icons jQuery Bo…

Another option for this is https://decentraleyes.org/

Tried this when it was actively developed and it done nothing but spew a load of errors in my browser console. Not sure if that was intended, but it made me cry looking at all the errors. It also broke many sites, where the proper jQuery version wasn't served, and a bunch of CSP errors in my console too. On top of this, it increases the fingerprintability of the browser, so this was an easy uninstall.

Re: Blocking web fonts for speed and privacy (2016)

#139

Post by dylan604 » Sat, Sep 17, 2022, 7:41 PM UTC

kmeisthax wrote: post #38

dylan604 wrote: post #35

Earlier quoted context omitted.

and exactly how large of a download would be "download entire font library"? all that just to use one font? that's like downloading an entire JS library to use one thing from it if not worse.

If you're selfhosting you only need to have the fonts you actually intend to use, not the entire library. Having the entire library would only make sense for an extension that replaces Google Fonts requests with itself.

isn't that exactly what was being proposed? if not, that's how i interpreted it.

Re: Blocking web fonts for speed and privacy (2016)

#140

Post by FractalHQ » Sat, Sep 17, 2022, 9:42 PM UTC

Dalewyn wrote: post #69

FractalHQ wrote: post #53

Earlier quoted context omitted.

As both a developer and designer, this comment seems absurd to me. Art and information both play vital roles in the human experience.

A computer and any code that execute within one are tools, and tools must first and foremost serve to enable its user. This means when it comes to software design, function always trumps form. A tool should never be designed with form over function in mind, it must always be function over form. Any form (design) that impedes the function must be culled with extreme prejudice. When it comes to remote fonts, they slow…

One of the functions of computers is to provide entertainment or evoke positive emotions. Many people use computers to explore and consume art. The reality is that people value how things make them feel. Even outside of entertainment, design and form can improve function when done right.

Sure, bad designs that inhibit functionality are bad. But good design that enhances it are better than no design, so removing good designers from a pipeline is a bad thing.

In my opinion, products driven entirely by developers with no design sense are just as bad as those driven by designers with no development sense. The solution involves good teamwork between both parties.