News for hackers. Stuff that matters.

A comment on Firefox is showing the way back to a world that’s private by default. Parent comment

Re:Firefox is showing the way back to a world that’s private... by Santosh83 on Monday March 02, 2020 @08:57AM (#22464435)
Correct me if I am wrong but aren't they including built-in tracker blocking with a 'strict' list that can be chosen, plus they are working on site-level isolation that is behind a config flag for now (1st party isolation) and as far as I know, they're the only browser that has multiple anti-fingerprinting measures that can be toggled by the resistFingerprinting config flag? If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already. You can still disable all of them either by means of about:config toggles or through simple extensions like uMatrix. Not sure if Chrome even allows disabling any/all of them.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by dependenttypes on Monday March 02, 2020 @09:08AM (#22464533)
> aren't they including built-in tracker blocking with a 'strict' list that can be chosen

This is not in any way better than ublock origin. Anyone who knows to select the strict list also knows how to install an adblocker.

> If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already

I am not saying that they should disable them by default, but they should at least make it easier for people who care about their privacy to disable them. (Although I do not think that any desktop user is going to miss geolocation)

In addition to that I am annoyed that they keep supporting such technologies that can be used for tracking in the working groups rather than push back on them.

[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by cptskippy on Monday March 02, 2020 @09:37AM (#22464752)
> web fonts

I installed NoScript recently and was surprised to see so many sites linking to typekit or other centralized repos for JS related to rendering fonts. Why do sites using webfonts have JS dependencies? Is it something to do with licensing?

Between products like DTM and typekit, Adobe has been quietly positioning itself to be a tracking/advert power house.

[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by monadic2 on Monday March 02, 2020 @09:01AM (#22464467)
> If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already.

I doubt people would even notice the font side of things.

[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by imgabe on Monday March 02, 2020 @09:04AM (#22464494)
They'd notice. Maybe they wouldn't notice that they notice, but they'd get a general feel that things look worse.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by robolange on Monday March 02, 2020 @09:14AM (#22464580)
Agreed. I used panopticlick and it showed me that web fonts were one of the biggest discriminators. I disabled them and tested on a sample of normal end user type Web sites. The web got real ugly looking real fast. If Mozilla disabled web fonts by default, normal end users would draw the conclusion that Firefox couldn't properly render the web, and would flock back into the arms of Chrome.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by zzzcpan on Monday March 02, 2020 @09:18AM (#22464618)
They could ship web browser with all common web fonts to render them from disk without fetching. This would allow disabling of fetching of web fonts without breaking websites. Also could eliminate fonts as a fingerprinting vector altogether if system fonts were ignored as well.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by robolange on Monday March 02, 2020 @09:25AM (#22464657)
What about fonts which are not licensed under an open source compatible license. What about fonts that are not "common" but are used by some popular Web site? Your request is doomed to failure. Like it or not, Web authors have been given the power by Web fonts to have total control of the fonts on their Web pages, and they ARE using that power. Any attempt by a low market share browser to change that fact is doomed to blow back on that browser.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by zzzcpan on Monday March 02, 2020 @09:36AM (#22464746)
I'm sure they can afford to buy rights to important non open source fonts or fund the design of similarly looking open source fonts to ship as aliases. There is no reason for the madness with fonts to continue.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by snazz on Monday March 02, 2020 @09:22AM (#22464642)
That’s actually not a bad idea. Lots of sites do have custom fonts, so maybe it would be a good idea to still put some icon in the address bar when the site has web fonts that didn’t come with the browser.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by dependenttypes on Monday March 02, 2020 @09:33AM (#22464713)
Decentraleyes does exactly that (at least with scripts, I do not know if they do the same with webfonts and css files)
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by have_faith on Monday March 02, 2020 @09:08AM (#22464536)
Even google news renders weird without custom fonts if I remember correctly. Lots of sites use font files as icon sets etc.
[ Parent | on HN ]
Re:Firefox is showing the way back to a world that’s private... by dependenttypes on Monday March 02, 2020 @09:28AM (#22464675)
The only think that they would notice is when buttons break due to the lack of web fonts.
[ Parent | on HN ]