Fast Google Fonts with Cloudflare Workers • Hacker News Board

Re: Fast Google Fonts with Cloudflare Workers

#11

Post by skybrian » Fri, Nov 23, 2018, 4:18 AM UTC

Sylos wrote: post #10

_8j50 wrote: post #5

Earlier quoted context omitted.

It's a tricky issue. I think you mean privacy implications,I don't see how this would add security risk. For privacy,loading third party fonts like google fonts on your site allows the 3rd party(google) to track users. To avoid that,I try to load google fonts from my domain(and for performance when google is slow or unreachable). Arguably,if your site already uses google fonts,putting cloudflare between google and us…

To elaborate on how Google can track your users: The user's browser downloads the font off of Google's server, which gives Google their IP address, and the browser also tells Google's server what webpage it's currently visiting, via the HTTP referer. And given that almost every webpage ships something from Google, Google has an almost complete browsing history for every public IP. There's generally multiple devices b…

Is this allowed under Google's privacy policy? How about the GDPR?

I mean, it's one thing to talk about what Google's technically capable of, and quite another for it to be legal.

Re: Fast Google Fonts with Cloudflare Workers

#12

Post by rgbrenner » Fri, Nov 23, 2018, 7:57 AM UTC

kentonv wrote: post #7

partiallypro wrote: post #4

Couldn't you just download the Google fonts and serve them up yourself and use a Cloudflare rule to cache it on the edge, instead of going through all this work?

Sure! But note that Google serves different font formats depending on your user-agent, so you'll have to make sure to cover all the different formats and do your own user-agent matching. And keep it updated as user-agent capabilities change over time. It's not quite as easy as it sounds.

You can specify multiple formats in the CSS. Just put them in order, and the browser will download the first one it supports.

And the css is going to be gzip'd anyway.. so we're talking a few extra bytes. Nothing that would make any difference in page load time.

There's no need for all of that extra work you listed. But I get why you want it to sound complicated, so people will use your work instead. Shouldn't you put a "I work at cloudflare" in there somewhere?

Re: Fast Google Fonts with Cloudflare Workers

#13

Post by Flimm » Fri, Nov 23, 2018, 8:22 AM UTC

rgbrenner wrote: post #12

kentonv wrote: post #7

Earlier quoted context omitted.

Sure! But note that Google serves different font formats depending on your user-agent, so you'll have to make sure to cover all the different formats and do your own user-agent matching. And keep it updated as user-agent capabilities change over time. It's not quite as easy as it sounds.

You can specify multiple formats in the CSS. Just put them in order, and the browser will download the first one it supports. And the css is going to be gzip'd anyway.. so we're talking a few extra bytes. Nothing that would make any difference in page load time. There's no need for all of that extra work you listed. But I get why you want it to sound complicated, so people will use your work instead. Shouldn't you pu…

Google Fonts will serve a different .woff2 font file depending on the user-agent. You cannot accomplish that with just CSS. See https://news.ycombinator.com/item?id=8802748

Re: Fast Google Fonts with Cloudflare Workers

#14

Post by rgbrenner » Fri, Nov 23, 2018, 8:38 AM UTC

Flimm wrote: post #13

rgbrenner wrote: post #12

Earlier quoted context omitted.

You can specify multiple formats in the CSS. Just put them in order, and the browser will download the first one it supports. And the css is going to be gzip'd anyway.. so we're talking a few extra bytes. Nothing that would make any difference in page load time. There's no need for all of that extra work you listed. But I get why you want it to sound complicated, so people will use your work instead. Shouldn't you pu…

Google Fonts will serve a different .woff2 font file depending on the user-agent. You cannot accomplish that with just CSS. See https://news.ycombinator.com/item?id=8802748

the only difference is that on non-windows platforms google strips font hinting. That's just a (very minor) performance optimization done to reduce file sizes. Just download the windows version of the fonts (in all of the formats - woff, woff2, eof, etc).. the minor difference in size isnt worth the effort.

You can also just download the ttf files, and run them through a web font generator w/ proper support for hinting, etc... and then you'll have all of the formats you need.

Re: Fast Google Fonts with Cloudflare Workers

#15

Post by capevace » Fri, Nov 23, 2018, 8:41 AM UTC

dillondoyle wrote: post #6

partiallypro wrote: post #4

Couldn't you just download the Google fonts and serve them up yourself and use a Cloudflare rule to cache it on the edge, instead of going through all this work?

And I wonder what speed tradeoff there will be for commonly cached/repeated fonts like Roboto, like maybe only makes since to inline less common fonts

AFAIK Google Fonts doesn’t allow browsers to cache the fonts for tracking purposes...

Re: Fast Google Fonts with Cloudflare Workers

#16

Post by chrismeller » Fri, Nov 23, 2018, 9:42 AM UTC

> An alternative would be to keep accumulating data and only process it when there is no split link tag at the end, but this way we can return more data to the browser sooner.

> One thing I was initially worried about was having to modify the “content-length” response header from the original response since we are modifying the content. Luckily, the worker takes care of that automatically and it isn’t something you have to implement.

If the worker is able to do this for you it’s clearly waiting for all of the incoming data to be processed before it begins sending to the browser, so dealing with the incoming data as chunks is actually needlessly complex.

Re: Fast Google Fonts with Cloudflare Workers

#17

Post by krageon » Fri, Nov 23, 2018, 12:51 PM UTC

skybrian wrote: post #11

Sylos wrote: post #10

Earlier quoted context omitted.

To elaborate on how Google can track your users: The user's browser downloads the font off of Google's server, which gives Google their IP address, and the browser also tells Google's server what webpage it's currently visiting, via the HTTP referer. And given that almost every webpage ships something from Google, Google has an almost complete browsing history for every public IP. There's generally multiple devices b…

Is this allowed under Google's privacy policy? How about the GDPR? I mean, it's one thing to talk about what Google's technically capable of, and quite another for it to be legal.

It's not allowed under the GDPR. But let us get real; this is Google doing it, and anyone complaining about this practice would first need to prove that it happens (which is not easy). You can (and should) expect large American companies to always ignore as many laws as they can get away with.

Re: Fast Google Fonts with Cloudflare Workers

#18

Post by Cenk » Fri, Nov 23, 2018, 2:20 PM UTC

rgbrenner wrote: post #12

kentonv wrote: post #7

Earlier quoted context omitted.

Sure! But note that Google serves different font formats depending on your user-agent, so you'll have to make sure to cover all the different formats and do your own user-agent matching. And keep it updated as user-agent capabilities change over time. It's not quite as easy as it sounds.

You can specify multiple formats in the CSS. Just put them in order, and the browser will download the first one it supports. And the css is going to be gzip'd anyway.. so we're talking a few extra bytes. Nothing that would make any difference in page load time. There's no need for all of that extra work you listed. But I get why you want it to sound complicated, so people will use your work instead. Shouldn't you pu…

If anyone wants to do this, I have used this tool in the past: https://google-webfonts-helper.herokuapp.com/fonts

Re: Fast Google Fonts with Cloudflare Workers

#19

Post by _8j50 » Fri, Nov 23, 2018, 4:23 PM UTC

Sylos wrote: post #10

_8j50 wrote: post #5

Earlier quoted context omitted.

It's a tricky issue. I think you mean privacy implications,I don't see how this would add security risk. For privacy,loading third party fonts like google fonts on your site allows the 3rd party(google) to track users. To avoid that,I try to load google fonts from my domain(and for performance when google is slow or unreachable). Arguably,if your site already uses google fonts,putting cloudflare between google and us…

To elaborate on how Google can track your users: The user's browser downloads the font off of Google's server, which gives Google their IP address, and the browser also tells Google's server what webpage it's currently visiting, via the HTTP referer. And given that almost every webpage ships something from Google, Google has an almost complete browsing history for every public IP. There's generally multiple devices b…

You're forgetting user agent strings as well. On mobile,They tell google the exact device make and model and in case of in-app browsers the specific app and version.

Re: Fast Google Fonts with Cloudflare Workers

#20

Post by Sylos » Fri, Nov 23, 2018, 4:33 PM UTC

skybrian wrote: post #11

Sylos wrote: post #10

Earlier quoted context omitted.

To elaborate on how Google can track your users: The user's browser downloads the font off of Google's server, which gives Google their IP address, and the browser also tells Google's server what webpage it's currently visiting, via the HTTP referer. And given that almost every webpage ships something from Google, Google has an almost complete browsing history for every public IP. There's generally multiple devices b…

Is this allowed under Google's privacy policy? How about the GDPR? I mean, it's one thing to talk about what Google's technically capable of, and quite another for it to be legal.

I don't know Google's privacy policy too well and I'm not a lawyer, but I think, this is still kind of uncharted legal territory.

No end user ever gets to see Google's privacy policy before their data is submitted to Google. Not even for Google Analytics, where I am pretty sure that Google does use the data, if the webpage owner isn't paying.

At the same time, Google will point to webpage owners, saying that they need to inform their users (which they do), but if Google wanted to "do the right thing", they would acknowledge that clearly webpage owners don't do that, and that therefore essentially any usage of Google Analytics data happens without user consent.

Under the GDPR, something like this would almost certainly not be legal and Google would be responsible, too, even if they're not the "controller", just the "processor", as the GDPR calls it.

Of course, we'll only know for sure once the lawsuits against Google have gone through.