Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

Post reply on HN
Print view View original

301–310 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#301

Post by zzo38computer »

blip54321 wrote: post #171

If it were me, I'd make third-party font sources require a SHA hash. In pseudocode: url("https://fonts.googleapis.com/comic-sans", sha="abcd1234") This way: - If my browser has comic-sans cached, no request is made - Caching works even if the same resource is sourced from multiple places (e.g. I can host comic-sans locally, but if they got it from a CDN, they don't need to get it again) - If a malicious site replaces…

I had a similar idea. In addition to caching and detecting if it has been unexpectedly changed, there are other benefits:

- The end user could have the option to enable/disable caching, and to clear the cache. Further configuration is also possible, e.g. to enable same-origin caching only.

- The end user could have the option to replace resources with their own regardless of where the files come from; there is one table keyed by hash and the value is the file to use instead, which might or might not be the same file (so the hash does not necessarily need to match the file that is being used instead).

- Features specific to the browser to make it more efficient could also be used when the user configures replacement of resources, e.g. if it can somehow implement jQuery in native code, or uses a different font format which is more efficient on the computer that it is running on.

- If archived copies of parts of web sites are being made, it can efficiently check if it already has some file which is being used in such a way.

However, requiring a hash probably should not be made mandatory.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#303

Post by KerryJones »

ncmncm wrote: post #233
rrdharan wrote: post #189

Earlier quoted context omitted.

I see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts ( https://developers.google.com/fonts/faq#what_does_using_the_... ) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.

I perceive exactly zero risk to Google in lying about literally anything at all. Have you ever heard about them being even slightly inconvenienced in response to any abuse?

Uh, yes, many times.

https://www.reuters.com/article/us-alphabet-google-privacy-l...

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#305

Post by bitofhope »

ajsnigrutin wrote: post #219
bitofhope wrote: post #181

Earlier quoted context omitted.

>And we can thank EU for the extremely annoying cookie pop-up’s on every website. Every site has a slightly different UI and the options/button labels always vary. Declining is always a multi-step process with various checkboxes. No we can't. We can think of scummy adtech companies who feel entitled to their business model. The GDPR very specifically says that the option to decline tracking must be at least as easily…

Criminals will avoid laws, and lawmakers should write laws in a way that makes them hard to be avoided. If they asked anyone with atleast a minimal technical knowledge, they'd get a lot better solutions.

In this case the problem with GDPR is not how it's written but how it's enforced (or rather, how little it's enforced). Most of the cookie popups that appear while browsing are already blatant violations of the law, but the violators get away with them because the relevant authorities are overwhelmed/underfunded/dysfunctional.

>If they asked anyone with atleast a minimal technical knowledge, they'd get a lot better solutions.

This sentence implies that: (1) Nobody with even minimal technical knowledge was consulted when writing GDPR. (2) The problem of websites tracking their users can be solved through technical means. (3) One or more of the solutions are so trivial anyone with minimal technical knowledge could come up with them.

I disagree with all of the above assertions.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#306

Post by dx034 »

justsomehnguy wrote: post #275
yetanother12345 wrote: post #225

Earlier quoted context omitted.

> have no idea who bunny.net is $ whois bunny.net (...) Registrant Name: Registration Private Registrant Organization: Domains By Proxy, LLC Registrant Street: DomainsByProxy.com Registrant Street: 2155 E Warner Rd Registrant City: Tempe Registrant State/Province: Arizona Registrant Postal Code: 85284 Registrant Country: US (...) > we're in a country with better privacy laws" ...it appears that the domain registrant…

domain registrant != site/host location Their web-site is located in the UK[0] Their fonts CDN is originating from AS60068 which is registered in UK too[1][2] [0] https://bgp.he.net/dns/bunny.net#_ipinfo [1] https://bgp.he.net/AS60068#_whois [2] https://bgp.he.net/dns/fonts.bunny.net#_ipinfo

Is privacy in the UK really going to be that much better over the coming years in comparison to the US? For company based in the EU I would've said so, for the UK I'm not too sure.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#307

Post by dorgo »

pdimitar wrote: post #130
dorgo wrote: post #114

Earlier quoted context omitted.

Goverments and intelligence agencies can't target everyone. But they can gather data for future use. So if you don't give them your data you won't be targeted in the future.

This goes both ways, the lack of the usual amount of data about you is a data point in itself. `SELECT * from citizens where data_points And then somebody aims a botnet armed with zero-days in your direction. But yeah, that requires dedicated adversaries that actually notice you -- which is not a given, I'll agree.

If they have to run a query and pay for the botnet I already won a small battle.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#308

Post by mritzmann »

heretogetout wrote: post #163
_fat_santa wrote: post #59

Earlier quoted context omitted.

> If you embed a font hosted somewhere else you expose some of your user data to them. Now with fonts there's a really simple solution: Just don't. As an added bonus, hosting fonts on your own server is faster as it goes through the same HTTP connection. I never quite understood the debate around fonts. You could use the CSS/Link import that Google provides, but that's never the optimal solution. Like you I always do…

If the font is already in your browser cache (which it might be if they're hosting it on a common CDN) web pages should load with the correct font right away instead of either loading blank areas or a default fallback font before switching to the correct font, causing jank. The best solution here is to use standard fonts that are available in all browsers, of course.

For data protection reasons, this has not been the case for a long time. Both for Firefox and Chrome.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#309

Post by bitofhope »

ajsnigrutin wrote: post #241
anyfoo wrote: post #223

Earlier quoted context omitted.

Sounds good, can you name a few ways? I'm being serious. If there are better ideas, which there probably are, let's put them out there.

Client side blocking (by that I mean removing them after the tab/page close)? First for third party cookies, then for all of them, and add a "button" next to the url bar, to enable cookies for that specific site (to allow logins).

This breaks multiple desirable uses of cookies, unless they're explicitly allowed on a per-site basis. It doesn't help if a site uses cookies for both desirable and undesirable purposes. If this solution became ubiquitous, I'd predict websites would start showing popup banners nagging you to click the "enable cookies" button from next to the URL bar. Finally, even if this did work to stop websites from tracking users via cookies, the data harvesters would simply keep using non-cookie tracking methods like browser fingerprinting.

In contrast, the GDPR does not place requirements for cookies if they're not used for storing or processing personal data (the ePrivacy directive which I'm less familiar with might require a notification about them). It does not even require a popup or user's confirmation if personal data is processed on a legal basis other than consent (though these uses may need to be listed in some kind of available privacy policy document). Finally, as GDPR is mostly technology agnostic, its requirements remain the same regardless of whether the data collection is done using cookies or any other means.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#310

Post by rebelpixel »

cramforce wrote: post #120

Do not use this, use Google Fonts, just self-host them. This site claims better privacy, but does so using the wrong solution since you still have to trust them. Self host (supported by Google Fonts but not by this service): - Better privacy - Better performance (no extra DNS lookups, TLS connection) Their default embed code is a CSS @import directive. These must never be used in production code (It's fine as a direc…

Here's a great little helper to self-host google fonts: https://google-webfonts-helper.herokuapp.com/fonts
Post reply on HN