Post B43ckNAzVCiKXOTw2a by mirabilos@toot.mirbsd.org
 (DIR) More posts by mirabilos@toot.mirbsd.org
 (DIR) Post #B43cgZwK6eLexqoP3I by socketwench@masto.hackers.town
       0 likes, 1 repeats
       
       No, bunny.net. Your fonts are still trackable because there's an HTTP header which will be sent back to your CDN through the GET request with the site URL. The best practice is to self host the font if you want to avoid CDN tracking.
       
 (DIR) Post #B43cgajx882zRm22PQ by socketwench@masto.hackers.town
       0 likes, 1 repeats
       
       The key argument for using a font CDN, any font CDN, not just google's, is "performance, performance, performance". In practice, however, font selection is highly specific per site, and even branded particularly for a site, so...it doesn't help at all.EDIT: As others have pointed out, modern browsers don't do cross domain caching for security purposes, meaning that even with a font CDN, you're redownloading the font *anyways*.
       
 (DIR) Post #B43cgbCfPN12spSyAK by socketwench@masto.hackers.town
       0 likes, 1 repeats
       
       The other reason is latency and offloading. You want to "relieve" the web server of the traffic for serving the font. In practice, this doesn't happen.High performance sites will put the entire site behind a CDN, removing traffic from the web server entirely for cached content. The goal is to eliminate "font flash", where the site loads before the font does. And there's a deviously simple way to fix it:Make. Simpler. Sites.No SPAs, no massive JS frameworks. Less stuff, less load.
       
 (DIR) Post #B43cgbbptn9I8tF4Oe by socketwench@masto.hackers.town
       0 likes, 1 repeats
       
       "But we're wasting bandwidth because the fonts and CSS aren't compressed! We need a CDN for that!"[slams buzzer] WRONG.WOFF2 is already compressed. Many web content managers *already* compress their CSS. CSS compression can also be done as a build time task for simpler sites.Make. Simpler. Sites.
       
 (DIR) Post #B43cgbzwSAQnLeWJyC by socketwench@masto.hackers.town
       0 likes, 0 repeats
       
       Bunny.net's argument is that *their* CDN doesn't do tracking.That may be true, now, but in practice they will still have the web server logs tracking the HTTP Ref which effectively gives you tracking and informatics. Old school informatics *used* web server logs.If you don't want to have any tracking with fonts at all, you need to stop relying on a third party CDN and self-host the resources.You trade a little performance for more privacy.
       
 (DIR) Post #B43ckNAzVCiKXOTw2a by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @socketwench it’s also a GDPR violation (court-proven) to not selfhost your fonts.
       
 (DIR) Post #B43dGXMz8f6lQ1QfZY by socketwench@masto.hackers.town
       0 likes, 1 repeats
       
       @dalias Really? That just makes font and JS CDNs even more ridiculous.
       
 (DIR) Post #B43dQCogPUBAZNzkPI by socketwench@masto.hackers.town
       0 likes, 1 repeats
       
       @dalias I'm going to go back to my little backend blanket room now and cry.
       
 (DIR) Post #B43dTxJXzMiZeIDfiy by tixie@guerilla.studio
       0 likes, 1 repeats
       
       @socketwench this point is not even true since all caches are isolated by website for security, so yea… the "performance" aspect end up just to "we serving it through a server closer to the user by having infrastructure all over the world". That's not a lot, especially if the rest of the website is not deployed all over the world. Also its overkill for most need, not everyone has the need of a Facebook or stuff like that.Anywayyyy, yup I completely agree with you on the all this bullshit
       
 (DIR) Post #B43iut8A9Q5GGNYYEq by c0debabe@masto.hackers.town
       0 likes, 0 repeats
       
       @mirabilos @socketwench *makes notes in notebook*
       
 (DIR) Post #B43iutLdLKrKw9rJEe by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @c0debabe @socketwench https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/Basically, anything external you make the page visitor’s browser automatically load (<img src=, <script src=, <style src=, webfonts loaded from CSS, inclusions from CSS, etc.) is the same as handing your page visitor’s PII to a third party, and this is forbidden without prior(!) consent (a “cookie banner” but doing the loading in the background is not permitted either).Best fix is to host everything yourself.