Live data from Hacker News

Bunny fonts – privacy respecting drop-in replacement for Google Fonts

fonts.bunny.net

71–80 of 346 posts

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#71

Earlier quoted context omitted.

Shortest I could find in a few minutes: The quick brown fox jumps over the glazed bunny.

If a fox encountered a glazed bunny in the wild, it probably wouldn't jump over it...

By this logic, why would it also jump over a lazy dog?

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#72

Earlier quoted context omitted.

What exactly do you believe doing this will accomplish, other than cutting off access from a search engine?

Stops the biggest advertiser from profiling you on every site, obviously.

It doesn't, though. Google use other domains.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#73
post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

> we're in a country with better privacy laws Speaking as a European: I think this is a very important topic for us. I don't think Americans and American companies understand how little trust rest of us have for the American government. Working with a company that is not subject to the whims of the American government is a huge privacy win. If a company pitches me a product, they start 1 points ahead if they are base…

My understanding of privacy international privacy stuff is if a European gov wants to spy on their own citizens, but the law prevents them, they phone up the USA and have the USA do the spying(hacking?) and get the data from them.

European countries do the same for USA gov on US citizens.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#74
post #73

Earlier quoted context omitted.

> we're in a country with better privacy laws Speaking as a European: I think this is a very important topic for us. I don't think Americans and American companies understand how little trust rest of us have for the American government. Working with a company that is not subject to the whims of the American government is a huge privacy win. If a company pitches me a product, they start 1 points ahead if they are base…

My understanding of privacy international privacy stuff is if a European gov wants to spy on their own citizens, but the law prevents them, they phone up the USA and have the USA do the spying(hacking?) and get the data from them. European countries do the same for USA gov on US citizens.

https://en.wikipedia.org/wiki/Five_Eyes?wprov=sfti1

In the US at least, any spying is illegal when both parties are within the US and the packets never leave the US.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#75
post #47
post #30

Earlier quoted context omitted.

The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Use of Google Fonts API is unauthenticated. The Google Fonts API does not set or log cookies. In other words, data from font serving does not feed into advertising personalization. (Disclosure: I used to work on ads at Google)

Does Chrome send the unique identifier with Google Fonts API requests? If so, they don't need cookies.

Are you talking about the x-client-data header (which isn't unique, but is relatively high entropy at For example, when I look at a Google Fonts request in Chrome developer tools I see:

    x-client-data: CKe1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiVocsBCOeEzAEIhKvMAQjys8wBCL+1zAE=
    Decoded:
    message ClientVariations {
      // Active client experiment variation IDs.
      repeated int32 variation_id = [3300007, 3300114, 3300130, 3300164, 3313321, 3330197, 3342951, 3347844, 3348978, 3349183];
    }
Each of those numbers represents an experimental treatment that is currently active for my Chrome instance. (It looks like more entropy because it's multiple values, but they're all derived from a single 13-bit per-instance seed.)

[1] https://www.google.com/chrome/privacy/whitepaper.html#variat...

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#76

Earlier quoted context omitted.

What exactly do you believe doing this will accomplish, other than cutting off access from a search engine?

Stops the biggest advertiser from profiling you on every site, obviously.

I'd suggest 1e100.net[1] too.

1: https://support.google.com/faqs/answer/174717?hl=en

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#77
post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

you won't believe this, but as the end user you can solve this in your life once and for all, and also improve your life! something rare for online annoyances nowadays. any decent browser, i mostly use firefox, have a checkbox in the font screen that prevents sites from changing the page font. i set all sites to user Ubuntu Mono. always. all the time. everywhere. the only downside are sites that use winding-like font…

I used to disable font overrides altogether. Another failure mode of that mode is that the omnipresent Material Icons displays words (the font contains ligatures replacing words with icons) instead of icons.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#78
post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

you won't believe this, but as the end user you can solve this in your life once and for all, and also improve your life! something rare for online annoyances nowadays. any decent browser, i mostly use firefox, have a checkbox in the font screen that prevents sites from changing the page font. i set all sites to user Ubuntu Mono. always. all the time. everywhere. the only downside are sites that use winding-like font…

And that I don't get to see the site as the original designer intended. It's of course perfectly fine for others to not care about that, but I enjoy it.

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#79
post #73

Earlier quoted context omitted.

My understanding of privacy international privacy stuff is if a European gov wants to spy on their own citizens, but the law prevents them, they phone up the USA and have the USA do the spying(hacking?) and get the data from them. European countries do the same for USA gov on US citizens.

https://en.wikipedia.org/wiki/Five_Eyes?wprov=sfti1 In the US at least, any spying is illegal when both parties are within the US and the packets never leave the US.

But if you arrange for the packets to be routed outside the US and then back all sorts of possibilities open up

Re: Bunny fonts – privacy respecting drop-in replacement for Google Fonts

#80
post #31

I find it really strange where some privacy debates have gone wrong, and this is a perfect example. It's basically a form of "don't trust them, better trust us, also we're in a country with better privacy laws". Which is an imperfect solution at best, and given that I have no idea who bunny.net is it's a questionable one at best. If you embed a font hosted somewhere else you expose some of your user data to them. Now…

> we're in a country with better privacy laws Speaking as a European: I think this is a very important topic for us. I don't think Americans and American companies understand how little trust rest of us have for the American government. Working with a company that is not subject to the whims of the American government is a huge privacy win. If a company pitches me a product, they start 1 points ahead if they are base…

People are talking about the possibility of being spied on by governments. I think if you’re targeted by government or intelligence agencies, then even self hosting most likely won’t save you from them.

What is important here, and why these laws matter, is how trivial it is to get access to your data, or for companies to sell your data. That’s why I appreciate the European’s effort to have better laws for our privacy.

If you really want to be government proof, then you better host everything in a server in a remote secret location out of their reach.

Post reply on HN