Hacker News Reader

Comment by tyingq | Hacker News Reader

It seems okay to me for the case of google. Since Google-owned sites, Adsense, Gmail, and Google Analytics are so ubiquitous, things like a font download are trivially easy for Google to correlate to your other activity. There's much less value for BunnyCDN to abuse it, because they don't have the critical mass of your other activity.

Yes, just serving up your own fonts is better, but this is an improvement that seems to work with only a minor change.

View on HN

For both bunny.net and Google Fonts, using a CDN is useless with the advent of timing attacks related to the browser cache https://news.ycombinator.com/item?id=24894135. Storing fonts on the same domain avoids a DNS lookup and extra TCP connection.

I see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts (https://developers.google.com/fonts/faq#what_does_using_the_...) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.

I read that pretty carefully, and didn't see anything about not saving and correlating the visit with other logs they have.

I perceive exactly zero risk to Google in lying about literally anything at all. Have you ever heard about them being even slightly inconvenienced in response to any abuse?

Do you feel like providing any examples?

Lack of examples,you mean?

See https://news.ycombinator.com/item?id=31810185.

Status of that, two years on, appears to be complaints that Google is violating its discovery obligations.

Uh, yes, many times.

https://www.reuters.com/article/us-alphabet-google-privacy-l...

The GDPR went into effect in 2018 and gave companies 4 years to prepare for it. The GDPR has strict guidelines as to how data processing consent flows should be presented, including the fact that it should be as easy to decline as it is to accept.

Yet, Google initially implemented a malicious consent form where accepting is easy and declining is impossible. They only very recently implemented a compliant consent flow which gives you an easy option to decline.

Google has already proven their bad faith and successfully got away with it, along with plenty of other companies.

Reply on news.ycombinator.com