Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

Post reply on HN
Print view View original

211–220 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#211

Post by jfk13 »

blip54321 wrote: post #171

If it were me, I'd make third-party font sources require a SHA hash. In pseudocode: url("https://fonts.googleapis.com/comic-sans", sha="abcd1234") This way: - If my browser has comic-sans cached, no request is made - Caching works even if the same resource is sourced from multiple places (e.g. I can host comic-sans locally, but if they got it from a CDN, they don't need to get it again) - If a malicious site replaces…

Sounds like you're basically reinventing SRI: https://en.wikipedia.org/wiki/Subresource_Integrity

One issue with cross-site caching, though, is that it may enable timing-based attacks on privacy.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#213

Post by anyfoo »

dmix wrote: post #162
ajsnigrutin wrote: post #143

Earlier quoted context omitted.

Yep, and also the whole EU... Every few months, they either want to make encrpytion illegal, scan more private data, scan files on end user devices, outright ban e2e encryption, or worse.

And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. They are never geo-filtered either so everyone is forced to see them. I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better way…

> And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes.

I don't understand this line of thinking. You are declining the cookies, so obviously you prefer not to be tracked. And it's obvious that it's not the EU who made the varying, annoying, and often purposely misleading dialog boxes to decline the cookies, but the companies who want to force their tracking on you. Without the EU law, they would just do it without asking for permission. So why blame the EU?

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#214

Post by [deleted] »

bitofhope wrote: post #181
dmix wrote: post #162

Earlier quoted context omitted.

And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. They are never geo-filtered either so everyone is forced to see them. I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better way…

>And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. No we can't. We can think of scummy adtech companies who feel entitled to their business model. The GDPR very specifically says that the option to decline tracking must be at least as easily…

[deleted]

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#215

Post by vorticalbox »

jokethrowaway wrote: post #180
hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

The only reason is to escape regulatory fines for something 99% of the world doesn't give a shit about. Not using fonts is not always an option

> Not using fonts is not always an option

Do you have an example where doing something in an external font is not possible in one that's built into the browser?

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#216

Post by dmix »

anyfoo wrote: post #213
dmix wrote: post #162

Earlier quoted context omitted.

And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. They are never geo-filtered either so everyone is forced to see them. I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better way…

> And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. I don't understand this line of thinking. You are declining the cookies, so obviously you prefer not to be tracked. And it's obvious that it's not the EU who made the varying, annoying, and…

Of course the outcome of random unfriendly and annoying UIs is the only predictable outcome... so why wouldn't the EU responsible? Who else would be?

Would some design guidelines be helpful? Maybe but it's still fundamentally flawed and I doubt it'd be enforced.

As I said the only possible option where there could be design cohesion is via the browsers (or maybe a EU-controlled open source JS plugin but that's even worse).

I don't ever use the cookie popups because fine-tune control of cookies doesn't have much privacy ROI. I want to use cookies on most sites and ublock does the rest.

I highly, highly doubt the tiny percentage of people not using an adblocker but are still technical enough to uses cookie popups regularly and effectively is really worth the cost.

I get the impression people want this to be a good idea, because it sounds like one, instead of considering whether it is.

Has the ever been a study that shows the real-world utility of forcing sites to use cookie popups?

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#217

Post by ajsnigrutin »

anyfoo wrote: post #213
dmix wrote: post #162

Earlier quoted context omitted.

And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. They are never geo-filtered either so everyone is forced to see them. I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better way…

> And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. I don't understand this line of thinking. You are declining the cookies, so obviously you prefer not to be tracked. And it's obvious that it's not the EU who made the varying, annoying, and…

There are many ways to solve this issues, and EU chose one of the worst ones, that for most people doesn't help at all.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#218

Post by moritzwarhier »

hannob wrote: post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

I always opt for self-hosting, be it fonts or other assets. Sometimes I am briefly envious of the ability to use things like Google Fonts, Unpkg or polyfill.io when setting up a project. But I started doing web dev in 2018 when GDPR was introduced here, and I always was kind of paranoid regarding that.

Self-hosting is probably a better habit to acquire anyway, the only alternative being explicitly contracting with a company that offers edge CDN.

https://google-webfonts-helper.herokuapp.com/fonts

is great for quick self hosted local Google Webfonts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#219

Post by ajsnigrutin »

bitofhope wrote: post #181
dmix wrote: post #162

Earlier quoted context omitted.

And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. They are never geo-filtered either so everyone is forced to see them. I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better way…

>And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. No we can't. We can think of scummy adtech companies who feel entitled to their business model. The GDPR very specifically says that the option to decline tracking must be at least as easily…

Criminals will avoid laws, and lawmakers should write laws in a way that makes them hard to be avoided.

If they asked anyone with atleast a minimal technical knowledge, they'd get a lot better solutions.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#220

Post by blondin »

sdze wrote: post #5

Why wouldn't I just self-host the fonts on my server? What are the benefits of such CDN? Years ago I could understand it because it may reduce latency (cache), but since browsers don't cache from 3rd party servers anymore, also this is argument is obsolet.

people finding excuses against your suggestion are choosing to ignore history.

PDF won the text presentation format war because among other things, PDF embedded the user's font.

for consistency, and if you care about not using google's CDN, just self-host your fonts.

Post reply on HN