Ask HN: Why can't I apply custom fonts to HN?

Re:Ask HN: Why can't I apply custom fonts to HN? by efortis on Saturday January 24, 2026 @06:12PM (#46748704)

Since this works

  const style = document.createElement('style')
  style.textContent = `* { font-family: Arial }`
  document.head.appendChild(style)

I'd say the `data:` URL of the font is violating the Content-Security-Policy, which should show an error in the Console.

Their CSP has `default-src 'self'` and has no font-src, so font-src is 'self' too (it would need `data:` as well)

[ Parent | on HN ]

Re:Ask HN: Why can't I apply custom fonts to HN? by lupire on Saturday January 24, 2026 @08:36PM (#46749753)

A custom browser can set its own CSP, right?

[ Parent | on HN ]

Re:Ask HN: Why can't I apply custom fonts to HN? by bangaladore on Saturday January 24, 2026 @09:50PM (#46750221)

CSP is inherently a client-side browser security feature, so yes.

[ Parent | on HN ]