Google Webfonts, the Spy Inside? • Hacker News Board

Re: Google Webfonts, the Spy Inside?

#51

Post by majika » Sat, Feb 21, 2015, 1:16 AM UTC

mp3geek wrote: post #4

For the end user 3rd party fonts can be blocked via Adblock Plus; https://secure.fanboy.co.nz/filters.html

I've found ABP's filters to be sporadic in their effectiveness. Open up the network inspector tab and browse to theguardian.com and others - look through what cross-site requests are still getting through.

I detail what I use in this comment [1], but I still set up friends and family with ABP because it's easier to use. I just find I have to manually blacklist a lot of domains to get it to actually work. You only need to make one request to Google for them to know what page you're on.

[1]: https://news.ycombinator.com/item?id=9083895

Re: Google Webfonts, the Spy Inside?

#52

Post by cromwellian » Sat, Feb 21, 2015, 1:24 AM UTC

MichaelGG wrote: post #43

cromwellian wrote: post #28

This may be an unpopular sentiment, but here goes. The hyperbole over this kind of reasoning threatens the very fabric of the Web. Snowden did the world a service in revealing all of the NSA hacking going on, but the paranoia that is resulting from this is breaking the original spirit of the Web. It is, after all, a Web of links, and those links were intended to be not just between siloed content, but between differe…

A simple "noreferrer" (or referer if you like) tag on elements or in pages would solve a lot of this. 3rd parties would obviously still get the request, but they wouldn't know what page it comes from. Interesting that "norel" got adopted so quickly for spam. So it shouldn't be hard to have a "noreferrer" tag added, right? Yes, users can install addons to modify header behaviour, but site designers should be able to u…

I like this proposal. Although as you say, it only cuts the direct link between the site and the resource.

Re: Google Webfonts, the Spy Inside?

#53

Post by pascalculator » Sat, Feb 21, 2015, 1:27 AM UTC

cromwellian wrote: post #28

This may be an unpopular sentiment, but here goes. The hyperbole over this kind of reasoning threatens the very fabric of the Web. Snowden did the world a service in revealing all of the NSA hacking going on, but the paranoia that is resulting from this is breaking the original spirit of the Web. It is, after all, a Web of links, and those links were intended to be not just between siloed content, but between differe…

cromwellian, you are not alone in this. I have been using CDNs for years and now, all of a sudden, they are deemed the root of all evil? I get it though, digital fingerprinting, heartbleed attacks, superfish, those are some serious privacy issues. But this blogpost? It feels like the whole debate about not implementing socialism because it allows for a small percentage of people to abuse the system. What about the amount of energy saved by using a CDN, the decrease in latency, the browser support? Doesn't that count for anything?

This is a serious question: What damage does Google Fonts do to the users visiting my website using these CDNs and does it outweigh the benefits? Why should I take this "Hey, CDNs can deliver JS and therefor are able serve customized code, which theoretically means they are spying on us" seriously?

More and more am I starting to believe this privacy thing is turning into mass hysteria and it's being cleverly spinned by some organizations in order to gain traction. Maybe am I missing the point and if so, please, enlighten me.

Re: Google Webfonts, the Spy Inside?

#54

Post by majika » Sat, Feb 21, 2015, 1:28 AM UTC

cromwellian wrote: post #47

majika wrote: post #31

Earlier quoted context omitted.

And here we see the contempt for privacy that some employees of Google hold. What would you regard as private, pray tell, if it's not being able to access a web page without telling Google (and other advertizing companies) that you're doing so? You regard a pursuit for that freedom as "paranoid"? Linking is the great power of the Web, and is why it is what it is today. That's all. Scripting is sometimes useful, but m…

I've held this basic view of the Web far longer than I've been a Google employee ( http://timepedia.blogspot.com/2008/05/decentralizing-web.htm... ) I wrote one of the first anonymizing proxy servers for the Web ( http://cypherpunks.venona.com/archive/1996/02/msg00885.html ) which was later referenced by others (Ian Goldberg references it here: http://www.cs.berkeley.edu/~daw/papers/privacy-compcon97-www... ) In the…

Aside your abstract commentary here is a defense of your argument that the web will lose something valuable if more sites stop directing their visitors' browsers to send requests to advertizing companies and CDNs for resources. I think that's baloney - the web will be better off for it, because it will be faster, more private, and simpler.

No semantic information is lost (except for the semantic information in Google's profile graph - let me play my violin). There's no balkanization, because there's no noticeable difference to end-users (which is why cross-site requests for things like fonts is so nefarious).

The web would provide all the value it currently does, because that value is founded entirely on linking.

You seem to maintain that wanting to achieve private browsing is "paranoid". Can you expand on this belief?

Re: Google Webfonts, the Spy Inside?

#55

Post by cpeterso » Sat, Feb 21, 2015, 1:29 AM UTC

GeneralMayhem wrote: post #40

JetSpiegel wrote: post #30

I still don't understand why don't the major browsers ship with at the very least a copy of jQuery installed locally, and then create a way to replace that URL for the locally installed version. No request made, faster access times, is there any downside?

If sites are reliably hitting a major CDN (like Google) for jQuery, then you get that advantage through caching anyway. The problem is that they don't, and if they're hosting their own jquery.js, there's no way to know before you download it that the script can safely be replaced with the known jQuery. I can imagine a scheme where the browser sends a hash of what it thinks the file is and the server only sends new co…

You've just reinvented HTTP Etags. :) It's a cookie-like resource caching mechanism where the server can return an arbitrary value (usually a hash or timestamp).

https://en.wikipedia.org/wiki/HTTP_ETag

Re: Google Webfonts, the Spy Inside?

#56

Post by acdha » Sat, Feb 21, 2015, 1:29 AM UTC

A good way for Google to address this would be by enabling CORS and encouraging the use of crossorigin=anonymous to avoid credentials being sent for fonts:

http://fonts.googleapis.com/css?family=Open+Sans' rel='stylesheet' type='text/css' crossorigin='anonymous'>

Unfortunately, a quick test (http://chris.improbable.org/experiments/browser/webfonts/goo...) shows that this can't be done currently because fonts.google.com doesn't have an Access-Control-Allow-Origin header:

https://redbot.org/?uri=http%3A%2F%2Ffonts.googleapis.com%2F...

(Oddly, the actual fonts are served with "Access-Control-Allow-Origin: *" so it works if you self-host the CSS, which would presumably be a bad idea: https://redbot.org/?uri=http%3A%2F%2Ffonts.gstatic.com%2Fs%2...)

This is the behaviour defined in the HTML5 spec:

https://html.spec.whatwg.org/multipage/infrastructure.html#c...

In some ways, this feels like an oversight in the spec because crossorigin=anonymous is actually better than the legacy behaviour but any use of the crossorigin attribute triggers mandatory full CORS checks.

Re: Google Webfonts, the Spy Inside?

#57

Post by grimmdude » Sat, Feb 21, 2015, 1:30 AM UTC

I do find it odd that Wordpress would call these fonts from the authenticated section of the site. If it was just a bundled theme or plugin served publicly I don't really see the big deal, it is the web after all. But in my opinion authenticated sessions are authenticated for a reason, thus requesting assets from an un-authenticated resource does seem to be a concern. Just bundle the font!

Re: Google Webfonts, the Spy Inside?

#58

Post by throwaway420 » Sat, Feb 21, 2015, 1:33 AM UTC

An even better reason to avoid using Google fonts is that they're frequently slow as molasses. Part of the issue is that fonts are frequently used badly and that browsers often don't handle them well, but it's still one of the more annoying things online.

Re: Google Webfonts, the Spy Inside?

#59

Post by userbinator » Sat, Feb 21, 2015, 1:34 AM UTC

joosters wrote: post #10

Another good reason to install Privoxy - http://www.privoxy.org/ Add the following to the config and you'll still be able to retrieve fonts and other shared stuff from Google's servers, but it'll block any tracking cookies and hide the referring site: { +crunch-incoming-cookies \ +crunch-outgoing-cookies \ +hide-referer(forge) } .googleapis.com apis.google.com Unfortunately, it won't help against SSL sites.

Unfortunately, it won't help against SSL sites.

Proxomitron will, although its not open-source, its author has passed away, and it's only being maintained by the community. Among the things I use it to block are these "unexpected links to Google" and if it's something like jQuery or fonts I can have the proxy host it locally.

Re: Google Webfonts, the Spy Inside?

#60

Post by cozuya » Sat, Feb 21, 2015, 1:35 AM UTC

Throwaway90283 wrote: post #39

kbar13 wrote: post #8

Earlier quoted context omitted.

using font files from a popular public cdn like google fonts is a good idea as they are generally highly available and are generally already cached on the user's machine from use on other sites.

Keep in mind the Google CDN is blocked in countries such as China, so your web fonts are not going to render for those visitors, and if you rely on jQuery from the Google CDN, those visitors will experience a broken site. If you have a global reach, this is one reason to self host.

window.jQuery || document.write('');

This has to be pretty standard in 2015 right?