Hacker News Reader

Comment by blattimwind | Hacker News Reader

The real question is why you used Google Fonts in the first place. You're telling me downloading another megabyte (or more) of stock fonts — no actual corporate branding — is worth both your and my time? Yeah, no. Stick to core fonts which actually work and render well within the UA, or bring your own custom branded fonts, but don't bother me with half-baked stock fonts.

The same question for using random-js-library from googleapis.com: You're trying to tell me that giving Google (and anyone who somewhere between me and them takes control of that domain) full arbitrary code execution privileges within your origin is worth saving a one-off download of some JS library? I don't think so.

View on HN

Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided.

The same can be used with all other "subresources" like stylesheets and fonts! However Google specifically makes this hard as they have been known to update the served font from time to time, which if you are using SRI will break the font entirely.

> Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided.

That's true, but SRI is still rarely deployed; and no surprise there: the official Google docs don't use SRI in their "paste this into your code" examples: https://developers.google.com/speed/libraries/

Also, Edge still doesn't support SRI.

So, yes, for some UAs this specific problem (resource integrity) is a solved problem, but like I said, it's far from the default.

The other issues - lack of necessity, load time, degraded visual quality, giving user data away for free to an advertiser etc. - remain untouched.

I completely agree that it needs to be more widely used, and I absolutely think that google could go a long way toward making it more common.

But to be completely honest, lack of user agent support shouldn't be a reason to not use a feature. Edge doesn't support it, so Edge users are less secure. There are also user agents that have CORS restrictions disabled or don't support HSTS, but i'm still going to use and rely on both of those for security.

And it sounds like you and I disagree completely on the usefulness of fonts. For me a font isn't "unnecessary" any more than paint isn't necessary on a house. Sure, you could live in a house without paint, but I want paint on my house. As for longer load times, and degraded visual quality. The previous is being dealt with via new font-display css descriptor, and in browsers that don't support that they have timeouts of normally 3 seconds at most, and the former is an opinion that I absolutely don't share.

so you think EU law should dictate viable fonts, libraries, and distribution methods? why is the EU so paternalistic and authoritarian? why don't they focus limited economic resources on bigger problems? where is the cost-benefit analysis?

Reply on news.ycombinator.com