Hacker News Reader

Comment by eek2121 | Hacker News Reader

Google fonts is just another way for Google to track users.

Just use the google-webfonts-helper (https://gwfh.mranftl.com/fonts) and host the fonts you want locally if you don’t want to use Google's CDN.

I guess it depends how much you want to believe them, but they deny this in their FAQ: https://developers.google.com/fonts/faq/privacy#:~:text=For%....

Not if you download the zip and host it yourself - which you can do

> Not if you download the zip and host it yourself - which you can do

I don't think it's quite the same, though! If you go to Open Sans, for example (https://fonts.google.com/specimen/Open+Sans?query=open+sans), and preview the CSS that it generates for the Regular style, then you'll get this: https://fonts.googleapis.com/css2?family=Open+Sans&display=s...

You'll notice that it uses a lot of the unicode-range property, to split the font up into different languages, so not everything needs to be downloaded for every site (e.g. if your site doesn't have cyrillic characters), in addition to them serving WOFF2 as well:

  /* latin */
  @font-face {
    font-family: 'Open Sans';
    font-style: normal;
    font-weight: 400;
    font-stretch: 100%;
    font-display: swap;
    src: url(https://fonts.gstatic.com/s/opensans/v35/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2) format('woff2');
    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
  }

In the downloaded archive, realistically you'll only have the TTF variation, like OpenSans-Regular.ttf, and will have to think about WOFF and WOFF2 conversions yourself. While those aren't too hard to do, splitting fonts up I still haven't figured out, so many of my sites with self hosted fonts have like 400 KB of arguably unnecessary overhead (I rather like the PT font family), which in some cases is the majority of the total download size.

I actually started building my own site where I'd keep some of the converted fonts that I personally like, but obviously it's not meant for greatness: https://fonts.kronis.dev/ (maybe some day I'll go back to it and actually figure out the font splitting)

Edit: in case anyone is curious about how to convert fonts, on Debian/Ubuntu I found these tools to be helpful: woff-tools woff2

I use them like so:

  sfnt2woff "some-font.ttf"
  woff2_compress "some-font.ttf"

Also Google still cares about serving the correct font version depending on your browser and OS, e.g. by not sending variable fonts (where one font file covers multiple font weights for example) to old browsers that didn't yet support them.

People self-hosting Montserrat are one bane of older browsers, because that seems to be a relatively popular font that got converted to a variable font file at some point, and which in browsers without variable font weight support then gets displayed at the thinnest possible font weight, which is really thin. (I concede that this is a niche complaint, but still…)

The tool parent and sibling comment listed allows you to do basic subsetting [1], and generates the formats you need. If you do this more often, it is of course useful to learn how to do this yourself. A commonly used tool is pyftsubset, part of fonttools [2]. I am not sure, but afair Google is running this under the hood.

[1]: https://fonts.google.com/knowledge/glossary/subsetting

[2]: https://github.com/fonttools/fonttools

For subsetting Glyphhanger works really well: https://github.com/zachleat/glyphhanger

The google-webfonts-helper makes it easy: https://gwfh.mranftl.com/fonts

I use an extension called LocalCDN (iirc) to locally supply copies of common JS frameworks so I'm less likely to be tracked on that front. I'm sure it skews some log somewhere if I never request those libs.

Now I'm off to find an extension that serves local copies of common Google fonts.

Most of them are available thru Nixpkgs too. You can make a small derivation to turn any font into WOFF2 with GNU Parallel + `fontforge --lang=ff -c 'Open($1); Generate($2);' {} $out/{/.}.woff2`.

That is not what most people will do. if you have a reasonable % sample, you can make valid assessments of the population

It is.

Why does anyone expect a private company to serve fonts for them without any interest to extract value.

If you want the fonts, read its license and find a way to acquire them and host it yourself for performance, security, privacy and peace of mind.

Someone here already linked the Google font downloader tool…

This is one purpose of Google fonts, but it's not the only purpose.

Google has nearly 100% search market share, so one of the only ways that they can increase search traffic at this point is by increasing web traffic in general. One of the ways they do this is by making it easier to create web content by e.g. distributing fonts.

See Gwern Branwen's excellent article on the subject: https://gwern.net/complement

explain? are you talking about "if you use them on the web, they track"? If I install the packages on my linux distro, that doesn't get tracked does it? they're just fonts? or do they keep pulling things down?

linux package is downloaded once or every upgrade by generic http client, not that frequent vs when loading lot of different pages which use Google Fonts and gives some info from browser

If you use their cdn instead of putting them on your own server sure. There is an Austrian ruling that this is a violation of the GDPR, so you might not wanna do it anyways.

For the ultra paranoid font files are to be avoided because fonts raise the complexity and thus the attack surface — I can't imagine an attacker couldn't use a malicous font or a zero-day in the font rendering engine to exploit a client.

Indeed, but there are ways around that. Check out fontsource (e.g. `npm install @fontsource-variable/roboto-flex`) to add fonts as a locally hosted dependency.

Reply on news.ycombinator.com