Hacker News Reader

Comment by tolmasky | Hacker News Reader

We’re basically forced to switch to self hosting due to the bizarre way Google implements statistics for Google Fonts. 1 out of 1000 requests will include a “tracking font” which is actually invalid and breaks document.fonts.load. This was an incredibly frustrating bug to track down.

Bug for those interested: https://github.com/google/fonts/issues/2345

View on HN

Thanks for sharing! Also `fonts.gstatic.com` is a CNAME alias for `gstaticadssl.l.google.com` which is commonly blocked by ad blockers. uBlock Origin recently added CNAME based blocking, and PiHole is rolling out support for it too. Just another reason to host it yourself.

And this is probably a good reason why they do it this way, they would be stupid not to. Not that I'm happy we end up with this, but business wise it makes way too much sense.

The guy who is affiliated with Google Fonts who showed up on a thread a few days ago said that he didn't think there was any tracking related to new implementations of Google Fonts stuff.

I guess this says the opposite. Let me try to dig up the thread for completeness...

EDIT: Well that was faster than I thought I'd be able to do. Here's the comment, and the thread: https://news.ycombinator.com/item?id=22369415

I actually don’t care what they’re doing with the data, I care that it crashes the site.

The font that gets loaded once every thousand requests is https://fonts.gstatic.com/stats/Roboto/normal/400 so it’s some form of statistics. But again, my actual concern is that it breaks.

Here’s the code I used to “catch” it. Here, it took roughly 500 requests: https://runkit.com/tolmasky/5e49b314ef61f900146c9a3b

Edit: To be clear, I’m not implying this is something they try to keep secret, just showing a way to observe it since it purposely rarely shows up.

Your users might... But who cares, right?

I don’t think there’s super meaningful data to be gleaned from server-side tracking, especially with browsers increasingly sending little to no information to third party resources. This is CSS, not a JS script that might collect more info and phone home. So yeah, the site going blank is higher priority to me than them knowing if I, the service provider, not my users, prefer Roboto over Open Sans, or if most users now support woff2 vs. ttf. But either way, we’re not going to use them anymore.

CSS can be crafted to conditionally load additional resources, which means it can be a vector for fairly sophisticated information gathering and tracking. For example: https://github.com/kkuchta/css-only-chat

Right but that’s not what’s happening on google fonts.

Makes you wonder if it's one node with bad content in a set of one thousand servers!

Or bad content cached on one of these/cdn server.

Incidentally, not that it helps you if you're concerned about your users' privacy, you can use a lot of these third party resources pretty securely with a single Firefox setting:

    network.http.referer.XOriginPolicy = 2

This tells Firefox to only send the referer header to sites on the same origin. This seems to break very few sites, but means there's no way Google could track me through web fonts even if they wanted to, since they don't know what site I've requested the font from.

That said, I think it's pretty plausible (as another user noted) that Google is only keeping general metrics here, not tracking anyone. 1/1000 requests is not very useful data, even if it provided them something on top of the Referer, which they already have.

That helps in some cases, but google would still know what font was requested and when. So if a certain site uses Noto Sans and Montserrat that narrows down which site you visited to ones that use those two. Considering google regularly crawls the whole web it definitely knows which sites match those two. That would be a pretty big group of sites, but the more sites that use the features that google fonts touts as performance gains like subsetting and the display parameter the more tracking bits google gains. The more fonts and options sites use the more unique the request signature becomes.

Basically if you don't want to be tracked the only good way is to not request anything from the tracking companies. As soon as your browser connects to them they have gained something. Use uMatrix to block all third parties by default, and only whitelist what is absolutely critical for the site to work.

There's also https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes...

It's a nice add-on but sadly it doesn't cache fonts and some other resources.

See: https://git.synz.io/Synzvato/decentraleyes/issues/34

Ah I just assumed it did for some reason; thanks

There's a difference between user activity tracking (the context of the discussion you linked) and generic metric gathering, which is clearly a thing given that the post was a link to the public fonts analytics page.

(I work at Google, I know nothing specific about fonts)

I agree, but it's a problem because a big part of googles business relies on the former, so I can't trust them when they say that one of their products only does the latter.

Why not?

A growing part of Google's business relies on b2b transactions. Are you also concerned that you're going to suddenly have to subscribe to search?

> Why not?

I thought that was pretty clear in my previous comment, what part was unclear?

> A growing part of Google's business relies on b2b transactions. Are you also concerned that you're going to suddenly have to subscribe to search?

No, because search is profitable and already explicitly data-milked for most of it's worth. I'm concerned about the data collected in unprofitable services just because they are not profitable and claim to not have every iota of data extracted from them.

So I'm concerned that Google Fonts, ajax.googleapis.com and so on will start to be milked for data just like search is.

Why are you so confident that these services are unprofitable?

You're already assuming the main profit source would be second order effects (analytics value add). Why not go further and assume that there already are second order effects that make fonts profitable.

For example, more internet users means more profit for Google, and accessible cross language fonts lead to more web users.

Totally understand and agree that there is a difference: I just half-remembered an at-least tangentially related post and wanted to call it out in case others didn't catch it in the last couple days.

I think some actually conflate the generic vs. user-specific metrics collection quite frequently in arguments that I see on this site and I agree that it's definitely not the same but I still felt it was worth the call-out.

Useful information on self-hosting 3rd party resources: https://calendar.perfplanet.com/2019/self-hosting-third-part...

Good! Yet another benefit of having control of your site.

And another potential cost of relying on someone elses servers.

Have you been able to verify 1 of 1,000? Or was that only this site, this instance of the error?

I'm ask because, I wonder if Google adjusts that depending on the site? The traffic?? And/or what it thinks it need to know?

Reply on news.ycombinator.com