I never quite understood the debate around fonts. You could use the CSS/Link import that Google provides, but that's never the optimal solution. Like you I always download the fonts and use them directly via @font-face.

The only advantage I see to using Google Fonts / some privacy respecting font service like this one, is when you are first prototyping an app and want to either test fonts, or want to move quickly and not worry about setting up fonts properly. We also used in a places like Storybook where having correctly set fonts is not as important.

But even if you did use it in prototyping, it's best practice to pull down those fonts and store them locally before going to production (at least in my mind).

Am I missing something?

For reasons I am sure I will never fathom, browsers on mobile provide all the same settings options, and religiously ignore them.

Nowadays, what I do (and recommend to others) is to set Firefox to never send a referer cross-origin, so google fonts and similar don't get to see what website I'm on. I've found that very few websites break with this.

While it's not svg or on the open web, I have a particular hate for sborn.jpeg in ebooks, as I read my ebooks in dark mode at night and having occasional section break symbols (ornaments) white on black is particularly irritating. Other unnecessary images often found in ebooks include bullets, chapter titles flourishes, letters with accents, and even the chapter title itself.

    svg { fill: currentColor; }
    .parent { color: var(--text-color); }

    @media (prefers-color-scheme: dark) {
        --text-color: wheat;
    }

Subsetting is where SVG shines, though.

For icon fonts, you can much more easily subset SVG icons than a font file. Font file subsetting needs dedicated tools like font editors (with Icomoon being a common choice these days) and often manual maintenance/upkeep, whereas SVG tree shaking is a natural part of any web bundler (webpack, etc) and automatically adapts to your icon usage and tools in your web bundler such as bundle splitting/lazy loading.

The Fort Awesome JS libraries behind Font Awesome's SVG icon fonts reduce things further from SVG XML files to tree-shakeable ESM files [EcmaScript Modules] that include just a few pieces of metadata and the lone important path text (sticking to a single SVG path per icon), then build the SVG DOM at runtime (as VDOM in the case of the React library), including making sure it follows fill: currentColor to pick up the text color. Minified and tree-shaken by most web bundlers the ESM files are very competitive with any other font format and the convenience wins of automatic subsetting by web bundler are hard to match.

I've never used webpack or any other bundler on any personal website I've written, nor have I ever used react or other heavy frameworks (I used jQuery when I was in school). Perhaps these are useful on larger websites, but I prefer to avoid scripts in general, with the sole exception being scripts that parse a data source to generate a page client-side (most pages on my system are static, so I don't even have php or such installed). To me, automation means I make changes to the html on my server and reload the page.

You aren't going to get easier subsetting in a modern browser than a folder full of SVGs and the browser only pulling the URLs it needs as it needs them rather than an entire bloated icon font format all at once up front. No need to double check that Calibre has got the right font subset from your CSS or to open Calibre at all, just upload the folder of SVGs and let the browser "subset" it, in the classic ways of HTML going back to its origins. Even less "automation" than Calibre.

You can use @media (prefers-color-scheme: dark) { ... } in the style inside the .svg and browsers render it accordingly in dark/light mode. But yes, not being able to set the color from the page CSS is annoying.

    <svg><use href="/path/to/sprite.svg#my-icon" /></svg>

    svg { fill: currentColor; }

Off course I usually wrap this in a component and only write <app-icon icon="my-icon"></app-icon>.

The best solution here is to use standard fonts that are available in all browsers, of course.

Privacy killed the shared cache.

1: https://www.localcdn.org/

Yes, just serving up your own fonts is better, but this is an improvement that seems to work with only a minor change.

https://www.reuters.com/article/us-alphabet-google-privacy-l...

Yet, Google initially implemented a malicious consent form where accepting is easy and declining is impossible. They only very recently implemented a compliant consent flow which gives you an easy option to decline.

Google has already proven their bad faith and successfully got away with it, along with plenty of other companies.

But with HTTP2+, serving from your own domain has no performance impact unless you're limited by bandwidth or extreme latency, and often can improve things by avoiding another DNS/TLS/TCP connection.

I've been down this road. I don't know what it is, but many web developers are extremely adverse to doing it. Even once you've convinced people to let you do it, the first PR from a new hire is a fix for this "bug".

not sure how it's relevant here though

As I understood the answer, the expanded version would be "the only disadvantage is having to spend an unreasonable amount of time arguing about this issue, which will drag on forever since it is relatively minor."

Years ago, when I worked at MSP serving quite a big federal customer... We received a ticket what $companysite.tld isn't working. Pretty unusual, but the first things first, so I just type $companysite.tld in the browser. It works fine.

Okay, ignore then.

But, no, 15 minutes later we receive an email with a tons of people in CC and a lot of !!!!s in the subject and body what the site is still down.

I again check it from my machine (which of course was in the MSP office, not on customer premises), it works fine, DNS, tracert, yada-yada.

Our network team replies what $companysite.tld responds to ping so everything works fine from their POV. Duuuh.

Okay, I hop to the management station located in the customer's DC, test the site there... and it doesn't work there. Just a blank screen, no errors, nothing. Which is pretty strange because the site is hosted in the same DC. DNS resolves to the proper records, ICMP works including traceroute...

Well, long story short, after 30 minutes of head scratching and dozens of emails with ever longer list of people in CC it occurs to me to hit F12.

I open the developer console, switch to Network tab, type in $companysite.tld and I see what the traffic is starting to flow just fine, only to stall to a halt at... googlefonts.com (or whatever TLD they used).

At this point I just calmly sent an email explaining what the site was working just fine, it just wasn't able to properly load from the customer premises because of the block of Google services.

To summarize:

somebody from the customer ordered to block Google services on the network level (don't even ask);

network team (certified Cisco CC** folks!) implemented it by dropping traffic instead of denying - so the firewall would notify the client station about that and the browser would abort the request to googlefonts.com and wouldn't wait a full timeout for each request (don't forget DNS records resolved just fine, if they sent NXDOMAIN for it there wouldn't habe been even an attempt to connect);

network team diagnoses the availability of the web-sites by using ICMP ping... but that wasn't the first or the last time when I was quite... disappointed of their qualification.

While it is very rare for major CDNs to go down, it happens, and even more shenanigans can happen on a network level between some client and your website (and proliferation of DPI by various countries, agencies and enterprises doesn't help here too).

So if you are on the payroll just host the fonts (and honestly - all assets, if applicable) with the web-site and sleep soundly. Of course if you are paid for each "incident", then Web3.0 is all yours. *grin*

any decent browser, i mostly use firefox, have a checkbox in the font screen that prevents sites from changing the page font.

i set all sites to user Ubuntu Mono. always. all the time. everywhere.

the only downside are sites that use winding-like fontawesome. you will get "S" instead of the magnifyingglass icon... i got used to things like that. Google meet screen is particularly weird. meh.

but after you are past the initial shock, having the same font everywhere is the ideal usability hack. faster reading. less distraction. it's perfect.

and as a bonus i don't even care (as i block referrer headers xdomain), not a single request ever goes to googlefont and the likes.

eg: https://opendyslexic.org / https://github.com/antijingoist/opendyslexic

Ubuntu Mono coverage is only 1200 glyphs as per its website, that's very very few.

If I self-host my fonts, the people I have to trust are only those people I have no choice but to trust: those who get my site into the user's browser. Every additional cross-domain request I add is an extra party I have to trust.

$ whois bunny.net (...) Registrant Name: Registration Private Registrant Organization: Domains By Proxy, LLC Registrant Street: DomainsByProxy.com Registrant Street: 2155 E Warner Rd Registrant City: Tempe Registrant State/Province: Arizona Registrant Postal Code: 85284 Registrant Country: US (...)

> we're in a country with better privacy laws"

...it appears that the domain registrant is not, so you will just have to trust that the company is not in the US or not owned by a US entity (mostly relevant for the rest of the world, probably).

> with fonts there's a really simple solution: Just don't

This was worth repeating :)

This isn't an advertisement, I had a very specific use-case, but it follows into this:

Of course, just like with Google, we are the product here. Google Fonts is an analytics data collection platform, Bunny Fonts is an advertisement for their CDN services.

I'm going to stick with a /fonts/ directory, I think, despite being one of their current users. It's really not very much bandwidth for the fonts, it's not 2010 anymore, and I prefer the control (and the local development environment being the same, I don't always have internet and I don't want a dev toggle for something as silly as fonts).

Their web-site is located in the UK[0]

Their fonts CDN is originating from AS60068 which is registered in UK too[1][2]

[0] https://bgp.he.net/dns/bunny.net#_ipinfo

[1] https://bgp.he.net/AS60068#_whois

[2] https://bgp.he.net/dns/fonts.bunny.net#_ipinfo

Now since they are no longer in the EU they want to use this opportunity to deviate from the GDPR and relax the rules even more (not that they've been enforced to begin with). Ironically, the justification for relaxing the rules is that the GDPR didn't have the expected effects - well of course if won't have any effect if you don't enforce it.

Well, this is what all the fuss is about: respecting the law. I'm not saying the laws are good or bad, just that it is the only thing that most companies really care about.

Anyone who is a bunny.net customer would have an idea. Unlike many of the myriad wesbites using Google fonts, they would also have an agreement with Bunny they could potentially enforce.

Anyone doing internet research who peruses publicly available scans of DNS ports in the last five years would likely be familiar with bunny.net as they are a large enough CDN to have many thousands of subdomains for customer IPs. It is seemingly impossible to miss this company's presence toward the beginning of the scan.

The founder of bunny.net recently posted a question in an nginx forum. This is not AWS or Google. Amazon sells goods. Google sells online advertising services. Both are primarily intermediaries (middlemen) who try to prioritise their own competing goods/services. All the data those companies collect may feed into other business that strives to study and understand consumer behaviour, e.g., placing internet-connected microphones (referred to only as "speakers") in people's homes or internet-cnnected GPS trackers in their pockets. There are strong incentives for those companies to conduct extensive surveillance. Bunny sells CDN services. At present, that's all, AFAICT.

1. https://bunny.net/our-story

This HN submission purports to mirror the recent announcement of fonts on the bunny.net blog on 16 June however it currently points to an "About" page, not the blog entry. The blog entry discloses in more detail the rationale for the decision to offer fonts.

https://bunny.net/blog/bringing-privacy-back-into-your-own-h...

There is an argument supported by legal decisions in Austria, Denmark and Germany that neither Google Fonts nor Google Analytics are GDPR-compliant.

https://www.theregister.com/2022/01/31/website_fine_google_f...

But true, I doubt Google is more nefarious than other resource provider. I am 99.9% sure that Google is not abusing cookies to extract end user data through their fonts service.

I believe you might be legally obliged to inform the user about them setting a cookie though. Alternatively, and this might be the better solution is to simply "vendor" the fonts (supplying them from your own server).

Not using fonts is not always an option

The silliness of this is that someone is going through the effort to set up hosting for a website but hosting the fonts is just too difficult and has to be delegated to a third party. The laziness of webdevs never fails to astound.

Do you have an example where doing something in an external font is not possible in one that's built into the browser?

This is the important part. Laws are not about trust.

Self-hosting is probably a better habit to acquire anyway, the only alternative being explicitly contracting with a company that offers edge CDN.

https://google-webfonts-helper.herokuapp.com/fonts

is great for quick self hosted local Google Webfonts

I thought the whole point is that using a common resource your chances of a cache hit are much higher such that they don't need to download. Having said that, if you are worried about GDPR you are probably way better off hosting them yourself anyways

Speaking as a European: I think this is a very important topic for us. I don't think Americans and American companies understand how little trust rest of us have for the American government. Working with a company that is not subject to the whims of the American government is a huge privacy win. If a company pitches me a product, they start 1 points ahead if they are based on Switzerland, Netherlands or somewhere similar.

I couldn't care less about web fonts though. I'm not downloading them from Google or "bunny.net" or anywhere else. My computer has some of the nicest-looking fonts around as system defaults, and websites can either work with that or get put into reader mode.

Enacting legislation is one thing. Somalia is excellent at enacting gun control legislation.

They are never geo-filtered either so everyone is forced to see them.

I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better ways to do it and I doubt 99% of people do anything but click okay without reading it.

At least if the browsers did it the UI would be standardized and you could have default persistent settings.

Now that there has been a massive effort to implement it I doubt it will ever get fixed or go away. Even though the decline of supercookies and Firefox’s new 3rd party policy has largely made it obsolete.

No we can't. We can think of scummy adtech companies who feel entitled to their business model.

The GDPR very specifically says that the option to decline tracking must be at least as easily accessible as the option to accept.

The only way the EU is to blame for the pop-ups is that the regulation hasn't been enforced strictly enough.

If they asked anyone with atleast a minimal technical knowledge, they'd get a lot better solutions.

>If they asked anyone with atleast a minimal technical knowledge, they'd get a lot better solutions.

This sentence implies that: (1) Nobody with even minimal technical knowledge was consulted when writing GDPR. (2) The problem of websites tracking their users can be solved through technical means. (3) One or more of the solutions are so trivial anyone with minimal technical knowledge could come up with them.

I disagree with all of the above assertions.

I don't understand this line of thinking. You are declining the cookies, so obviously you prefer not to be tracked. And it's obvious that it's not the EU who made the varying, annoying, and often purposely misleading dialog boxes to decline the cookies, but the companies who want to force their tracking on you. Without the EU law, they would just do it without asking for permission. So why blame the EU?

Would some design guidelines be helpful? Maybe but it's still fundamentally flawed and I doubt it'd be enforced.

As I said the only possible option where there could be design cohesion is via the browsers (or maybe a EU-controlled open source JS plugin but that's even worse).

I don't ever use the cookie popups because fine-tune control of cookies doesn't have much privacy ROI. I want to use cookies on most sites and ublock does the rest.

I highly, highly doubt the tiny percentage of people not using an adblocker but are still technical enough to uses cookie popups regularly and effectively is really worth the cost.

I get the impression people want this to be a good idea, because it sounds like one, instead of considering whether it is.

Has the ever been a study that shows the real-world utility of forcing sites to use cookie popups?

"Of course burglars choosing less protected houses is the only predictable outcome... so why wouldn't the makers of security systems be responsible? Who else would be?"

I still don't get it. Without the EU laws, it wouldn't be magically easier to block tracking cookies, they wouldn't offer a choice at all? What are you arguing for?

> As I said the only possible option where there could be design cohesion is via the browsers (or maybe a EU-controlled open source JS plugin but that's even worse).

We tried that, it failed: https://en.wikipedia.org/wiki/Do_Not_Track

> I don't ever use the cookie popups because fine-tune control of cookies doesn't have much privacy ROI. I want to use cookies on most sites and ublock does the rest.

The cookies for functionality/session are not affected by the cookie popup.

> I highly, highly doubt the tiny percentage of people not using an adblocker but are still technical enough to uses cookie popups regularly and effectively is really worth the cost.

I use an adblocker and still decline on the cookie popups. I assume you are doing, too, otherwise you wouldn't complain about popups you don't see?

> Has the ever been a study that shows the real-world utility of forcing sites to use cookie popups?

Me able to decline them is real-world utility. If a majority or at least significant portion of users is successfully tricked into accepting the cookies, then that calls for a refinement of the law along with better enforcement, not for retraction of the law. "Let them have it", what a bleak, defeatist thing to suggest.

You are blaming the makers of the law for what is very obviously the fault of the perpetrators, who are trying to get around the law in profoundly shady and just downright shitty ways.

I am glad the EU law exists, without it there wouldn't even be the option.

I'm being serious. If there are better ideas, which there probably are, let's put them out there.

In contrast, the GDPR does not place requirements for cookies if they're not used for storing or processing personal data (the ePrivacy directive which I'm less familiar with might require a notification about them). It does not even require a popup or user's confirmation if personal data is processed on a legal basis other than consent (though these uses may need to be listed in some kind of available privacy policy document). Finally, as GDPR is mostly technology agnostic, its requirements remain the same regardless of whether the data collection is done using cookies or any other means.

I've never heard anybody who wasn't in or adjacent to the tech surveillance industry complain about this.

Feigning ignorance. People in or adjacent to the tech surveillance industry (either working in it or having a substantial portion of their net worth invested in the industry) whine about cookie consents constantly, but nobody else gives a shit.

Are you telling me that you have no financial or professional stake in the matter? You haven't worked for or invested in a company that profits from tracking people online? Nor any of your friends or family?

https://oblador.github.io/hush/

You're welcome!

European countries do the same for USA gov on US citizens.

In the US at least, any spying is illegal when both parties are within the US and the packets never leave the US.

And no doubt it must be even more illegal to then perjure yourself in front of congress about not having engaged in such illegal spying, when in fact you have.

These laws are a formality and have no teeth.

Noone? Why am I not surprised?

Laws can be enforced without executing people.

What is important here, and why these laws matter, is how trivial it is to get access to your data, or for companies to sell your data. That’s why I appreciate the European’s effort to have better laws for our privacy.

If you really want to be government proof, then you better host everything in a server in a remote secret location out of their reach.

`SELECT * from citizens where data_points < 50;`

And then somebody aims a botnet armed with zero-days in your direction. But yeah, that requires dedicated adversaries that actually notice you -- which is not a given, I'll agree.

EU privacy laws are a step in the right direction. It’s progress. We can build on it.

Against modern sophisticated governments who are busy, lazy, distracted to ask Netherlands to give them my data. I'm not exactly a high priority target. All I have to do is to make it a little harder for them to access my data.

Also, proper client side encryption is really difficult to break. Usually they need to compromise the client in order to read it.

What are they going to do, fly to my fringe country, knock on my door and politely ask me to stop storing encrypted blobs on their servers? No, they will not. First, their TOC does not forbid it and second, they are way too lazy to scope me out of the crowd, and third, they will only start shutting users down if their free plan starts costing them too much. I've been doing this for years and nobody seems to give a frak (Google included).

And I am just a regular guy who wants to make sure his code and passion projects (and personal / family photos) are never going to get lost even in a case of disaster. I never in my life did anything to warrant government attention.

Let's be honest: all those big players sing all our data to whoever they like, any moment they like. Pretending one is better than another is dishonest.

At this point we're supposed to believe what amounts to feel-good talk.

But I keep asking: "How do we know for sure?"

I haven't done anything illegal nor do I need to protect some mega-important knowledge but I still dislike giving easy access to my data so I automated parts of my workflow to double-encrypt my most important data and send it to several off-sites plus an own self-hosted server.

Sure, they likely know remote Linux network zero-days but the odds of them wanting to target me in particular are minuscule so... ¯\_(ツ)_/¯

You are trusting them just as much as a server in any other country. Saying "Switzerland" is all marketing for privacy enthusiasts who aren't going to do anything on their own.

Be angry at the sites, not the legislation.

And if it makes people angry at the legislation, the lying back-stabbing “your privacy matters to us” arseholes in marketing are successfully making that goal backfire.

It usually isn't compliance, malicious or otherwise.

It is malicious “we know we are breaking both the letter and the intent, but we know they don't have resources to properly enforce against everyone, so we are going to chance it for as long as we can”. The vast majority of these consent systems are not compliant with any of the relevant regulations (ePrivacy Directive, GDPR, CCPA, …). They will fix it when they get a slap on the wrist. If they get anything it will be a slap or a warning because while anyone in their right mind is pretty sure that the non-compliance is deliberate, that is nigh-on impossible to conclusively prove.

Have you... have you seen our politics? What makes you think that we think other people trust our government? We don't trust our government. Hell, it's trusted so little that one of our large political parties is basically entirely devoted to making sure that the government can't get anything done.

The public-facing excuse for Joe Q Public is "they can't be trusted!", "less taxes on your hard-earned money" (when corporate share of taxes has plunged from the 50-50 split it used to be, increasing individual taxes), "the government is not efficient" (usually because of lots of onerous regulations and reporting and oversight that, ahem, a certain political party insisted on to fight "abuse")

Can you think of a reason people would do that if they didn't trust those corporations more than the federal government?

But when it comes to surveillance on this quotidian level, I think private/corporate surveillance it’s far more relevant and problematic. In that regard, I’d slightly prefer a European country with good privacy laws like those you listed, because (probably) Bunny is not itself at the level of a panopticon such as Google, and the likelihood it has or would avail of avenues for resale to panopticon capable data brokers is less than it would be for US companies.

But even there, it does seem like a quite incremental improvement. The door is still wedged open, but now probably less wide, and probably with a stronger doorstop. It would be nice to not leave the door open at all.

I use DDG because I don't like Google. I can't do the same with my government.

You can only trust services like signal which make it impossible for the operators to access your data

GDPR is mainly against corporations making money out of knowing who you are across the web, it won't save you from a government actor

So you're safer from the USG inside the US.

Then again, they don't have a great track record of following those restrictions, so I doubt it really matters.

Of course it is. After American Wars in the Middle East killed and displaced millions, there is good reason to be wary of Americans and the American government.

What? Your government is the worst one to go not respecting your rights.

I think this is important to consider. In practice, it's difficult to have any recourse with an American company. In Europe it's more expected and common that government and consumer orgs take an active role. Both legal culture and culture-culture (?) are just very different, leading people to preferring to steer clear of this expensive and adversarial (compared to EU climes) environment.

Crypto AG was based out of switzerland.

You don't know who secretly owns any companies in Switzerland today. Your favorite Swiss VPN could be owned by Equifax or Acxiom for all you know.

> and is a warmonger.

This is flamebait unrelated to data privacy risk. If you don't want to use American companies because you have an political opposition to supporting US companies, that's also a valid opinion. You don't have to twist it into a data privacy argument.

It's not flamebait, it's a legitimate reason. A country who has been killing people in various wars/invasions is unlikely to behave ethically when it comes to privacy.

If you behave unethically in one area, I have every reason to assume that you'll also behave unethically in another area.

Rather than drawing a broad hand-wavy link between ethics concerns and respect for privacy, you'd be much more accurate in measuring privacy by directly considering their practical legal frameworks that protect privacy.

> A country who has been killing people in various wars/invasions is unlikely to behave ethically when it comes to privacy.

This doesn't hold up. There are many countries that will straight up man-in-the-middle internet traffic with no oversight that have been at peace longer than Germany.

Some are worse than others. America is one of the worst. War, invasions, mass surveillance, mass incarcaration...

A country like America that has been murdering people in many wars around the world without hesitation is unlikely to take my privacy seriously. They don't respect my right to live, do you think they will respect my right to privacy?

Several countries in SE-Asia have been at peace for much longer and will happily man-in-the-middle your internet traffic at the whim of their unchecked government powers [e.g. https://en.wikipedia.org/wiki/Internet_censorship_in_Vietnam].

A country's participation in war and their effective protections for privacy are not strongly correlated, demonstrably so.

I can understand why people have strongly held views about foreign policy but this sort of political flamewar is repetitive and predictable, and therefore off topic here. It has veered particularly extremely off topic in a "Bunny fonts" thread. And I'm afraid you've been posting flamebaity/unsubstantive comments in other threads too.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

or any government, especially our own, for that matter. Some just have a better track record at being bound by the rules they give themselves than others.

So no, this is not one of those examples, this is a great example of someone setting up a service to remove all those free, extra data points that Google harvests. Today it's fonts. Maybe tomorrow, it's the rest of their "it's not explicitly Google Analytics" offerings.

Do we know whether bunny.net is any better? In the abstract, no we don't, but we're not dealing in abstracts, so we actually do because of where they operate. A real European operation (not an international company with EU presence but an HQ outside of direct EU jurisdiction) is by default quite a bit better at not violating GDPR, and runs the actual risk of being fined into financial insolvency (rather than getting a few hundred million slap on wrist that a multibillion dollar company goes "pff, whatever, let legal sort it out" to).

By virtue of Google's track record, and by virtue of where this new service is located, and the track record of EU based services with regards to privacy compared to their US counterparts:

Yes, we can _very_ reasonably assume both of those things.

Why do you think you know how it works? What do you actually know about Google that doesn't come from outside speculation?

That link says that a website leaked an IP address to Google. It doesn't say that Google did anything with the IP address.

I guess I'll say what I always say: Look at the public privacy statements for Google, or for a particular Google product. If you have any evidence that Google does anything different from what's in that statement, contact Google and there will definitely be people interested in figuring out what's going on and fixing it.