Github became the web's largest font piracy site (2017)
pixelambacht.nl
pixelambacht.nl
Me publishing something on Github does not grant everyone free rights to it -- in fact, copyright law says no one has rights to it unless I specifically grant those rights. This is most commonly done with a LICENSE file. The copyright rules apply to everything in the repository, including my code, and any fonts, icons or stock images. The fact something is on Github (or the internet, in general) doesn't make it public domain, you still have to abide by the license terms.
While I think the suggestion that "on github" = "piracy" is stupid, I could see a couple things that could apply:
(1) If the license for the font explicitly states it's for "use" or "distribution" on a single domain. Unless the license is clear about it, it'd really be up to lawyers to argue over whether hosting the code in a public repository on Github can be considered "use" or "distribution" -- and ultimately that argument is about one non-authenticating public URL being okay while another non-authenticating public URL is not.
(2) If I've put a commercial font in my repository along with a typical LICENSE file containing MIT/GPL/BSD/whatever without explicitly stating the fonts are not under that license, then I'm basically mis-representing the license for that font (which I should not be allowed to do).
Given that putting a font on Github is technically no different from publishing on my site in terms of someone being able to 'pirate' it, personally I think a Github repository with a proper license (not doing (2)) is fine, because the LICENSE file effectively says it's not okay to just copy that font.
The problem is not that you're misrepresenting the font as copyleft when it isn't. The problem is that you simply don't have a license to redistribute the font at will: merely uploading the font to a public GitHub repo violates the license.
You have the right to serve the font from your webserver, and link it into your site via CSS. You absolutely have not been granted the right to redistribute the font in any other manner.
If you post a page on your site with "Like this webfont? Download here!" and link to the same URL that you are using to host the font for display purposes, you'd be violating the license. It's the same exact URL, but you can't post a clickable download link to it. It's not allowed, and if you do, they can at a minimum yank your license to use it at all.
https://processtypefoundry.com/help/base/webfont-license-agr...
Editing to add: trying to solve the problem by adjusting your LICENSE file is roughly equivalent to the "I don't own this!!" disclaimers that people put on YouTube uploads. They get DMCA'd just the same.
When you say 'the right to serve the font from your webserver' -- in this case, 'your webserver' may simply be GitHub's web-server, a service they provide to you as part of your payment to them (either because it's part of the app you host on GH, or as a piece of the website hosted via GH Pages [0])...
Assuming that the font's usage for the repo'd app/site is OK per the license terms, then I'd be surprised if its availability in the repo would solely cause it to fall out of compliance with the license. I suppose that the licensor could, if they chose to do so, specifically include terms to preclude the usage of the font on any sites hosted with "repository or other open file listing indexes", or any other similarly restrictive arbitrary terms.
It would be the same if you publicly hosted a zip file containing your site's contents, including the fonts. Or offered an open read-only FTP account to your /web/ directory. Or any number of ways to make the font available publicly that isn't via a web browser making a request triggered by a CSS rule.
If it's a private repository, I expect you'd be in the clear, since it's just acting as a very fancy webhost, and you can obviously upload your fonts to your webhost.
In that case, it seems as though the rights-owner should simply take the standard route (even if suboptimal) to enforce their rights -- given the volume, they could likely work out a much better way to protect their IP (or automate it, in the worst case).
I'd be a little bit surprised if they cared a whole lot, given that finding the fonts is trivial for the reasons stated above. Almost comes across blog-spammy at that point, heh.
It depends on the file format. Commercial web font providers typically don't offer TTF or OTF formats but only (subsetted) WOFF. You can't use WOFF fonts with most graphics design software (although conversion to TTF is probably trivial). That's basically the reason why WOFF was invented as it doesn't have much technical benefit over compressed TTF files.
The article on the other hand shows that lots of TTF and OTF files can be found on Github which is something the copyright holders certainly have a problem with.
(While irrelevant: As for the technical difference or lack of between the two, from a license drafting perspective, it wouldn't really matter since you could easily write in the distinction to eg. the allowed purpose part of the license grant.)
> So, what to do when you want to use commercial fonts and be legit about it?
> Long story short, you can’t commit them to a public repository. There’s really no way around it: if you are not allowed to share the font with folks who don’t fall under its license, you can’t make it a part of your repo.
> Your options are to go for a private repo, or keep a note in your public repo telling the folks who’ll be using your project to license the fonts and add ‘em themselves. Stick your assets/fonts directory in a .gitignore so you’ll never accidentally commit them, and Bob’s your uncle.
It clearly isn't obvious. It seems explicit to me that the author is talking about all commercial fonts and that NONE of them should be in public github repos.
For an article that spends such a long time talking about how they searched for filenames, there is very little time spent exploring the actual copyright implications of using licensed fonts in opensource software or .
Someone hosts a pirated copy of a film somewhere. Does it make everyone who's looking at it a pirate, just because they know the URL?
> The following are allowed by this agreement; you may:
> 1b. Use the WOFF, WOFF2, and EOT web font formats provided by Process to style text on your websites via the CSS @font-face rule for an unlimited number of websites whose content is controlled by you. You agree to use reasonable measures to ensure the fonts are available only for the process of styling text on websites. At a minimum, and by way of illustration not limitation, reasonable measures include i) preventing unlicensed third-party access, i.e. hotlinking and, ii) not allowing direct download of the fonts unrelated to the process of styling text for your website.
and
> This agreement expressly prohibits the following; you may not:
> 2e. Store or use the fonts in any way that makes them accessible to the public or non-licensed third parties, except where such use is expressly allowed by this Agreement. This includes, but is not limited to, distribution of the fonts through file sharing services and online version control repositories accessible by the public.
https://processtypefoundry.com/help/base/webfont-license-agr...
Seems pretty clear!
It's not clear. How on earth are you supposed to implement ii)?
I'm not interested in answers which mention the Referer header. There are a myriad of factors which can prevent it being sent with the original request required the style elements on the site.
It might also just be: you have to check the referer. If your website has technical issues such that sometimes the referer isn't available, you have to change it so it always is. Or host it on one of the approved third-party hosts referenced in the license.
However a user of yours could just download the font from your web server or record the fight on their phone.
This is just bit coloring again: https://ansuz.sooke.bc.ca/entry/23
> The following are allowed by this agreement; you may:
> 1b. Use the WOFF, WOFF2, and EOT web font formats provided by Process to style text on your websites via the CSS @font-face rule for an unlimited number of websites whose content is controlled by you. You agree to use reasonable measures to ensure the fonts are available only for the process of styling text on websites. At a minimum, and by way of illustration not limitation, reasonable measures include i) preventing unlicensed third-party access, i.e. hotlinking and, ii) not allowing direct download of the fonts unrelated to the process of styling text for your website.
and
> This agreement expressly prohibits the following; you may not:
> 2e. Store or use the fonts in any way that makes them accessible to the public or non-licensed third parties, except where such use is expressly allowed by this Agreement. This includes, but is not limited to, distribution of the fonts through file sharing services and online version control repositories accessible by the public.
https://processtypefoundry.com/help/base/webfont-license-agr...
technically the font is just a bunch of 1s and 0s but here we are.
I think what would be useful would be to highlight the many fonts that can be used. E.g Google's open source fonts.
https://en.wikipedia.org/wiki/Scalable_Inman_Flash_Replaceme...
EDIT: TLDR Downloading a publicly available font you don't have a license to use violates copyright.
Same as if you accidentally exposed to the internet your home server of legally-created DVD backups. You'd still be violating the license under which you bought the DVDs.
I would genuinely be interested in case law's stance on this. Also interested in what happens to the value of non-public domain fonts if you require the digital asset to be handled as a secret (and all of the hassle that goes along with that).
There are some pretty sleazy lawyers out there.
https://www.huffpost.com/entry/grandmother-sued-downloading-...
https://arstechnica.com/tech-policy/2019/07/prenda-law-porn-...
Why would anyone use a non-public domain / CC / open source font in a publicly available project? If the project has an open source license and is in a public repository on Github, why would there even been non-public resources (fonts, icons, images, etc) in the repository at all?
If you have any private resources (code or otherwise) in the repository, it shouldn't be in a public repo to begin with.
Are there any examples of open source projects that are including commercially licensed fonts?
Toomuchtodo you are not an acidental violator after publishing this comment on hn :)
As you suspect, there is no practical difference. The difference being perceived is that when you put them on your website, you're doing that for the purpose of displaying text using the font, whereas when you put them on github, the purpose of github is file sharing. The first purpose is good, the second purpose is bad, so the first use should be allowed and the second use shouldn't be, even though -- technically -- they are exactly the same thing. That's just a detail; they're spiritually different.
Unfortunately, this point of view is very much not limited to lawyers; it is how most people think about most things.
The files this article is talking about are not in that format. They are all TTFs, which you can drop into your system’s font directory and use anywhere on your computer.
Also, these TTFs are linked in a public manner rather than being a file whose link is buried deep in the page source where no human is ever intended to see it.
1: or font conversion tools
Just like in the real world, someone handing you the keys to their car doesn't mean you own it.
However the license does not explicitly limit the tools you can use to build the website, and the website is allowed by the license to have the font. The argument could be made by licensing the font for a website they have implicitly licensed it to be on github because it is a widely used tool for managing the source code of websites and if they (the font owners) wanted to restrict its usage they should have specified.
Your best bet is to just use open source fonts, of which there are numerous.
That's not very useful, so the license says "you may distribute this font file as part of a website; you must be using this font to style a webpage. Any other kind of distribution at all is still prohibited." There's no "common practice" exception- just because they open up a little window that allows you to distribute the font in a particular manner doesn't mean they've accidentally given you the right to distribute it according to "common practice."
Sharing MP3s on P2P sites is also a common practice, but obviously you don't have a license to do that when you buy a CD.
So the argument would go as follows:
the contract says "you may distribute this font file as part of a website; you must be using this font to style a webpage. Any other kind of distribution at all is still prohibited."
We have used this font to style a webpage, as is industry practice we have placed the font in our site code, which is stored on github, which is also the most widely used tool for distributing website code. The website code must be distributed in order for the purpose of the license to be fulfilled - obviously the font cannot be distributed as part of a website if the website itself is not distributed.
At that point the court will have to determine what distribution of a website means, if the font to be distributed as part of the website means that the website will need to be distributed, and if github is so commonly used that the license giver neglecting to mention it have given tacit approval to its usage.
Aside from all this if one wanted to contest the issue the court would have to determine if the font being in your github repository is you distributing it just because someone else can fork it. For another silly analogy, just because you put your beer on the table, walked outside, and a kid came in and drank the beer, doesn't mean you sold liquor to a minor.
Perhaps I'm wrong but it doesn't seem as open and shut as everyone wants to argue, unless there is specific prohibition of github in the license in which case there is no longer a case to be made.
Anyway, long story short, the small-time designer guy was thrilled to get $30k, and turns out he wasn't at all even monitoring for pirated versions of his font anywhere... he didn't have any idea who had bought his font, so to him it was just some random big company offering to give him free money. The places that sell fonts should do a better job of passing on payment (obviously) to designers, but also a list of who bought their fonts so they can take some pride in knowing where their designs are being used.
https://en.wikipedia.org/wiki/Helvetica#Arial_and_MS_Sans_Se...
So you can replace Helvetica with Arial in any document and it'll still print right, but at its core the letterforms are just distorted Grotesque MT.
And it's not the only font Microsoft and Monotype collaborated on like this. For example, Century Gothic is Monotype's Twentieth Century distorted to match ITC Avant Garde's metrics.
Funny thing is, legendary type designer Hermann Zapf actually worked with URW to create knockoffs of fonts he'd originally designed for Linotype years before. Some of them even got open-sourced, which is why there's a free version of Palatino in the Ghostscript fonts (URW Palladio L).
That said I only missed MATTEL on that one. Helv has a few giveaways and refinements but most people don't care—though the differences Arial and other modified Helveticas do have arguably render the type less neutral.
I got MATTEL and TOYOTA both right based on the heuristic "Helvetica apparently has fatter lines", which I learned from the quiz itself.
For TOYOTA, I have the impression that in one option all letters have the same weight, while in the other one the A is a bit bolder than the other letters. I figured the one with all the same weight should be Helvetica, but I was wrong.
Looking at the fatness of the lines feels quite fragile: aren't there versions of Helvetica in all kinds of weights?
The difference of course is we all know what to look for & were purposely looking for those differences.
This is a feature not a bug.
There will be times when I need to use this font and make something that will go live. That's the time to buy a font.
If font making is not profitable, then don't make fonts.
Someone is making a product and telling you what you can and cannot do with it, and then you decide that none of that applies to you, because...I don't know, you're entitled to use it if you happen to see it?
"There will be times when I need to use this font and make something that will go live. That's the time to buy a font." - that depends on the license that the font foundry grants you.
"If font making is not profitable [due to lost sales via piracy], then don't make fonts"...some kind of mental gymnastics there. "I will take freely from you and if you can't afford to let me do that, it's your fault for making it in the first place" is a tough ground to stand on.
There is a market for paid specialty fonts used on a website. People should pay for that. However, there is not much of a market for paid fonts used in Sketch when developers and designers are testing out different concepts they MIGHT use in production. You complaining that you are failing to monetizing off that non-existent market is completely bonkers for me.
The ground I stand on is reality. You're living in a fantasy land where musicians still get paid big dollars for records and where journalism is a lucrative career.
"It's easy for me to acquire content against the content creator's wishes, therefore I should dictate the market."
> There is not much of a market for paid fonts used in Sketch when developers and designers are testing out different concepts they MIGHT use in production.
Never said there was. There's an easy solution: don't take a font that doesn't belong to you.
This all boils down to "I want something and don't want to pay what the creator thinks it's worth." It's disrespectful, and it's straight-up entitlement. Just don't use the font. Nobody owes you a particular typeface.
> The ground I stand on is reality.
The reality is that it's easy to do the wrong thing here, so you do it, then try to pretzel your way into thinking that it's not morally wrong. Think someone's overcharging? Then don't buy the product.
And you can scream and write these type of blog posts all you want but really it just ads to the Streisand effect. You think this blog post net increased or decreased the awareness and use of github as a source of fonts?
I see you chose more of a passive tone here, as though you're just a cog in the machine, totally helpless and unable to take action on your own.
The Internet is what people make of it, in part based on the sum of individual choices.
> And you can scream
Not screaming.
> it just ads to the Streisand effect
Possibly. Maybe it alerts GitHub devs to the problem and they try to come up with a solve. If font creators read it, they can work with repo owners to get things in order. For my part, it pointed out a problem that I can take steps to mitigate in the future with my own repos.
Anyways, obviously I can't stop you or anyone else from taking digital goods at will. But in part, I wish that people would be more transparent about their motives instead of talking themselves into thinking that they're not actually doing something wrong.
Just say "I take things that don't belong to me because I deserve to have them, it's easy to do so, and I won't get in trouble". At least it'd be an honest assessment.
And now in the future if I fork a project for my personal use I will make sure to remove any fonts I find in it.
I could see this happening in a repo by Google/MS/FB/etc., but it probably would be extremely expensive for them. Any other instance of this sort of sharing is unlikely enough that it can be assumed to be illegitimate.
Many professional fonts are the work of a single type designer who may have spent thousands of hours creating the typeface. Modern typefaces can have a dozen or more weights and hundreds of glyphs.
It's hard work and time-consuming to create a professional type family. It's depressing to come here and see how little people care for the work of other professions.
If I were ever asked to install some DRM to render a font I'd nuke that thing from my system in a heartbeat.
Though, it begs the question: who and how will find out that you simply borrowed the font?
I used to work for a company that got hit up by Monotype for a six figure fine to pay for using one of their fonts. The previous head of design hadn’t bothered to sort tricky things like paying for fonts, mainly, I think, because he knew senior management wouldn’t spring for it.
We switched them out for free alternatives and negotiated down the fee, but they still had to part with a good amount of cash.
They had us bang to rights for using one of their fonts on a site with over 1bn annual pageviews without a licence.
The case itself says this: "defendants contend that the numerical reference points that define an outline of a glyph are unprotectable as a matter of law" but then "the court finds that the Adobe font software programs are protectable original works of authorship."
Note: when they say "font software programs" here, they simply mean a vector (say, ttf) font file rather than a bitmap (say, bdf or pcf) font file.
David 'Novalis' Turner probably put it best when he wrote this: "A font face -- that is, the look of a font, is not copyrightable... But font 'programs' (truetype fonts, for example) are. Another ruling has extended the definition of 'programs' to include certain outline data. Why this outline data is not equivalent to a font face, nobody knows." [3]
[1] https://web.archive.org/web/20100522133154/http://lw.bna.com...
[2] https://en.wikipedia.org/wiki/Adobe_Systems,_Inc._v._Souther....
Could you imagine an upload filter or moderation queue before you were allowed to push code to GitHub?
The technicalities, as far as the license is concerned, are not really the point. It's not about whether you're physically sending the bits of the font over the wire, but the whole context in which you're doing it.
Not that I don't think the foundries should get paid for their work - I don't have a fully formed opinion on this. But there is a definite upside to sharing information freely, and this is better than mere copying.
For example, back in 2012, I supported three SIL OFL licensed fonts on Kickstarter:
https://www.kickstarter.com/projects/typesenses/font-design-... https://www.kickstarter.com/projects/impallari/fast-brush-sc... https://www.kickstarter.com/projects/marcelommp/folk-is-a-gr...
The font file is published on the web page itself, just like the images, CSS, etc. So everybody could already grab it from the web page itself, and in fact this is what the browser does automatically, in order to render the font. It's the whole point.
It doesn't really matter if it's committed to public github.
That way you aren't distributing but pointing the interested ones to the source website.
Or am I missing anything here?
Thanks, Barbra Streisand.
I simply do not understand its presence or popularity here.
Like, Github is taking an niche subject matter, packaging it up for a more general audience, and then distributing it worldwide?
I Assume this is probably possible for FontAwesome premium icons as well ?
Having the server host the assets is probably the best solution (same rep) but if it's not in Git then it needs to be managed in the build for other open source developers. What's the Correct way of handling this situation?
I would rather expect an open source project to use open-source fonts in the first place, not least because it makes this precise problem a non-issue.