Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Webfonts, the Spy Inside?

fontfeed.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Google Webfonts, the Spy Inside?

#61

Post by userbinator »

cromwellian wrote: post #28

This may be an unpopular sentiment, but here goes. The hyperbole over this kind of reasoning threatens the very fabric of the Web. Snowden did the world a service in revealing all of the NSA hacking going on, but the paranoia that is resulting from this is breaking the original spirit of the Web. It is, after all, a Web of links, and those links were intended to be not just between siloed content, but between differe…

While I agree with your argument regarding the paranoia, I think what bothers users the most is that this is not just some random site, but Google that the resources are coming from.

Understandably, there are users who would prefer to have much less Google in their online experience.

Re: Google Webfonts, the Spy Inside?

#62

Post by detaro »

cozuya wrote: post #60
Throwaway90283 wrote: post #39

Earlier quoted context omitted.

Keep in mind the Google CDN is blocked in countries such as China, so your web fonts are not going to render for those visitors, and if you rely on jQuery from the Google CDN, those visitors will experience a broken site. If you have a global reach, this is one reason to self host.

window.jQuery || document.write(' '); This has to be pretty standard in 2015 right?

This still has to time out on the first request to trigger, right?

Re: Google Webfonts, the Spy Inside?

#63

Post by cromwellian »

majika wrote: post #54
cromwellian wrote: post #47

Earlier quoted context omitted.

I've held this basic view of the Web far longer than I've been a Google employee ( http://timepedia.blogspot.com/2008/05/decentralizing-web.htm... ) I wrote one of the first anonymizing proxy servers for the Web ( http://cypherpunks.venona.com/archive/1996/02/msg00885.html ) which was later referenced by others (Ian Goldberg references it here: http://www.cs.berkeley.edu/~daw/papers/privacy-compcon97-www... ) In the…

Aside your abstract commentary here is a defense of your argument that the web will lose something valuable if more sites stop directing their visitors' browsers to send requests to advertizing companies and CDNs for resources. I think that's baloney - the web will be better off for it, because it will be faster, more private, and simpler. No semantic information is lost (except for the semantic information in Google…

In this particular case, I'm not particularly arguing against it, just in general, the way I see things going.

There are lots of other promising ways that people compose Web services beyond this issue with fonts, services like Stripe or Geo, technologies like the upcoming Web Components, embedding media like Tweets, where I don't particularly think we will be served well by a paranoid model.

Your model of blue-links-only almost entirely prevents the kinds of service composition that almost all sites engage in these days.

It's also not clear it's a net win for speed or security. CDN sites are likely significantly more hardened than most regular sites, and most regular sites don't necessarily scale, or don't want to pay to scale, to reach top performance. That means people cut corners.

Re: Google Webfonts, the Spy Inside?

#64

Post by acdha »

Throwaway90283 wrote: post #39
kbar13 wrote: post #8

Earlier quoted context omitted.

using font files from a popular public cdn like google fonts is a good idea as they are generally highly available and are generally already cached on the user's machine from use on other sites.

Keep in mind the Google CDN is blocked in countries such as China, so your web fonts are not going to render for those visitors, and if you rely on jQuery from the Google CDN, those visitors will experience a broken site. If you have a global reach, this is one reason to self host.

Interestingly, that's true for scripts but it's not for webfonts because @font-face allows multiple sources, including local system fonts, and the browser will keep trying until it finds one which works.

Here's a test page: http://chris.improbable.org/experiments/browser/webfonts/web...

You can see that it first gets a 404 before continuing on to a URL which works:

http://www.webpagetest.org/result/150221_J4_43K/1/details/

Re: Google Webfonts, the Spy Inside?

#65

Post by LeoNatan25 »

acdha wrote: post #56

A good way for Google to address this would be by enabling CORS and encouraging the use of crossorigin=anonymous to avoid credentials being sent for fonts: http://fonts.googleapis.com/css?family=Open+Sans' rel='stylesheet' type='text/css' crossorigin='anonymous'> Unfortunately, a quick test ( http://chris.improbable.org/experiments/browser/webfonts/goo... ) shows that this can't be done currently because fonts.google…

Google has little to gain from these.

Re: Google Webfonts, the Spy Inside?

#66

Post by acdha »

detaro wrote: post #62
cozuya wrote: post #60

Earlier quoted context omitted.

window.jQuery || document.write(' '); This has to be pretty standard in 2015 right?

This still has to time out on the first request to trigger, right?

Yes – you could do something creative with async scripts but then you're transferring too much data for everyone to benefit only the subset of users who experience failures on the first script.

Re: Google Webfonts, the Spy Inside?

#67

Post by orivej »

Nux wrote: post #5

Aren't these web fonts just files they can include with their code? Why include anything from any 3rd party, it's a security and privacy issue.

No, Google Web Fonts tailor served CSS to the browser agent. Now, Firefox receives 'woff' with all requested languages combined in the single file, recent Chrome receives 'woff2' with all available languages in separate files. Try visiting http://fonts.googleapis.com/css?family=Open+Sans:400&subset=... in different browsers.

Re: Google Webfonts, the Spy Inside?

#69

Post by petercooper »

MichaelGG wrote: post #43
cromwellian wrote: post #28

This may be an unpopular sentiment, but here goes. The hyperbole over this kind of reasoning threatens the very fabric of the Web. Snowden did the world a service in revealing all of the NSA hacking going on, but the paranoia that is resulting from this is breaking the original spirit of the Web. It is, after all, a Web of links, and those links were intended to be not just between siloed content, but between differe…

A simple "noreferrer" (or referer if you like) tag on elements or in pages would solve a lot of this. 3rd parties would obviously still get the request, but they wouldn't know what page it comes from. Interesting that "norel" got adopted so quickly for spam. So it shouldn't be hard to have a "noreferrer" tag added, right? Yes, users can install addons to modify header behaviour, but site designers should be able to u…

So it shouldn't be hard to have a "noreferrer" tag added, right?

It's so not hard that it's actually already a part of HTML5 and supported by several browsers :-) http://www.w3.org/TR/html5/links.html#rel-noreferrer

Re: Google Webfonts, the Spy Inside?

#70

Post by acdha »

LeoNatan25 wrote: post #65
acdha wrote: post #56

A good way for Google to address this would be by enabling CORS and encouraging the use of crossorigin=anonymous to avoid credentials being sent for fonts: http://fonts.googleapis.com/css?family=Open+Sans' rel='stylesheet' type='text/css' crossorigin='anonymous'> Unfortunately, a quick test ( http://chris.improbable.org/experiments/browser/webfonts/goo... ) shows that this can't be done currently because fonts.google…

Google has little to gain from these.

Google has an interesting position advocating for improved privacy and security. This would be a cheap way for them to back that up at relatively minimal expense.
Post reply on HN