Hacker News Reader

Comment by raphlinus | Hacker News Reader

I was part of the team that founded this, about 10 years ago if memory serves. I'm still loosely involved, though no longer at Google. Inconsolata was one of the 20 fonts for the original launch, and we're now in the process of launching it as a variable font, with both width and weight axes. I'm also getting funding from them for Rust-based font tools.

Feel free to AMA, though no guarantees I'll have good answers.

View on HN

> Inconsolata was one of the 20 fonts for the original launch

Am I understanding this correctly to mean that you were part of a group that invented this font? Independent of the great work you obviously did on everything else, if this is correct, I just wanted to give a specific thank you for that! It's been my go-to font for my terminal, text editor, monospace font in the browser, and even the font my Linux machines use when they boot up before launching the GUI for years now.

No, I drew Inconsolata myself, as well as inventing spiral-based tools for designing fonts, as an alternative to Béziers. I started work on it far in advance of working on the "Google Font API" as it was called at launch, so it was very natural to include it, along with other great fonts by other talented designers.

I'm glad you like the font!

Curious, have your spiral based tools been documented/published somewhere?

Best place is probably my thesis: https://levien.com/phd/phd.html . All of the code is available under permissive open source license. I've been continuing to poke around with this and hope to have a newer set of tools before long.

Let me recommend that anyone interested in fonts, 2d graphics, CAD, etc. read Raph’s thesis. It’s great!

> No, I drew Inconsolata myself, as well as inventing spiral-based tools for designing fonts, as an alternative to Béziers

Oh, wow! Keep up the amazing work!

> No, I drew Inconsolata myself, as well as inventing spiral-based tools for designing fonts, as an alternative to Béziers.

Man, I love your phd thesis! I use it regularly to show my students an example of what a PhD is supposed to be; and, independently, to teach them some planar differential geometry. Your study of Euler's elastica is the best written account of it that exists (and I have read many more geometry books that would like to admit).

https://levien.com/phd/thesis.pdf for the curious

Thanks for your work, as a programmer with minor dyslexia Inconsolata, was heaven sent to me.

Was this created in order to track users across different sites or because google wanted to make the world a better place? :)

The latter.

Do you think it's still used for the latter rather than the former now?

Heh, that's a better question. I have no reason to believe that Google Fonts are being used to track users, but I don't have hard evidence on this either way. I am deeply concerned about the way the modern Internet is turning into a surveillance machine and its potential for abuse, but if I were evil, I'd probably go after much lower hanging fruit than fonts.

Thanks for this honest answer.

either way, loading fonts from google for every website is a stupid idea... it is why an extension like decentraleyes is a good idea (because most website don't think about the consequences).

I think Google might have better ways to track people. Fonts are also cached by CDNs and the local browser so I’m not sure if they provide good tracking data (they get loaded only for the first page visit for example and popular fonts like Open Sans are probably already in your cache when you open a page).

If you’re concerned about tracking as a website operator you can simply load the fonts from your own server, most of them can be found on Github and have liberal licenses (I think all fonts on fonts.google.com)

You can even install the fonts locally to your machine and your browser will favor the local copy. There are some tools like Skyfonts that let you install the top X from Google Fonts and it can be a fun way to speed up a lot of the web; with the tradeoff that not a lot of people have the top X installed for useful large versions of X and that becomes its own fingerprint for surveillance software (testing how long text takes to render in an off screen canvas, for instance).

It's been suggested that Browsers or Operating Systems choose a useful X value and install the top fonts everywhere like they used to install the classic "core web fonts".

Also there's a addon called "decentraleyes" that will cache fonts, amongst other things. It's one of 3 extensions I install in every browser I'm allowed to. The others are uBlock origin and https everywhere. All 3 have good privacy/security/performance benefits with effectively no breakage, in their default configurations.

Decentraleyes is an excellent add-on that improves browsing speed and privacy with no negative side effects. Currently, the only font cached by Decentraleyes is Noto Sans. It also caches Google's Web Font Loader script and many major JavaScript frameworks.

https://decentraleyes.org

https://git.synz.io/Synzvato/decentraleyes

Web developers who are concerned about privacy exposure from Google Fonts can use google-webfonts-helper to extract the font files and self-host them.

https://google-webfonts-helper.herokuapp.com/fonts

https://github.com/majodev/google-webfonts-helper

Correction: Decentraleyes doesn't actually cache any fonts. Noto Sans is just used for the add-on interface. Font caching would make an interesting feature if the add-on developer is willing to implement it, especially if it bypasses fingerprinting.

I stand corrected!

> You can even install the fonts locally to your machine and your browser will favor the local copy.

Note that some browsers are going in the opposite direction and actively hiding installed fonts from websites due to the potential for fingerprinting.

I am slightly concerned, yes. This is why I chose to host the fonts for my 20-things.com sideproject for as long as I can afford that luxury.

Delivery of fonts aren't what's used to track people. Rendering of fonts is.

Different machines render fonts in a unique way. Consider different GPUs (hardware differences), different drivers (kernel/driver differences), browsers (user-land differences), and sizes (user settings) can all contribute to a font being rendered differently per-user and increasing entropy of a particular unique font id.

I currently work on it as well, so happy to pitch in.

Does Google use this to fingerprint and track users across different websites?

The Google Font FAQ includes the question: What does using the Google Fonts API mean for the privacy of my users?

> "...your requests for fonts are separate from and do not contain any credentials you send to google.com while using other Google services that are authenticated, such as Gmail."

>"Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure."

https://developers.google.com/fonts/faq#what_does_using_the_...

So a lot of fluff and no actual reply. Users can be tracked without cookies being sent, while "access to the data is kept secure". Call me a cynic, but I lost my trust in google a long time ago.

Multiple people (I know as my upvote just now didn't even get you back in the black) downvoted you (and now me ;P), but you are absolutely correct that that quote didn't really have anything to do with the question.

To answer "track users across different websites", I think they pretty clearly say the opposite:

> The Google Fonts API is designed to limit the collection, storage, and use of end-user data to what is needed to serve fonts efficiently.

> When millions of websites all link to the same fonts, they are cached after visiting the first website and appear instantly on all other subsequently visited sites. [...] The result is that website visitors send very few requests to Google: We only see 1 CSS request per font family, per day, per browser.

I guess, what would you want to see that would assuage your concerns, beyond what is written in the FAQ?

They do not say the opposite.

Apparently they need to collect and store end-user data for serving fonts efficiently. Wonder what that could be...

And if that information happens to be enough for further tracking then it seems to be fair game!

Couldn’t it just be for edge server location determination?

Not a Google fan, but at their volume of traffic seems like it could be something they’ve optimized for.

Could be!

But they could have said so. And they could also have said that the information is not correlated with anything else.

All we know is that they have, very carefully, written something vague that they could do pretty much anything they wanted with.

And we are left with the question, why would they do that?

Probably to not have to consult the lawyers every single time someone creates a new analytics aggregation.

"Users can be tracked without cookies being sent"

How? Stylesheets can't use fingerprinting or Flash cookies or anything like that, only scripts can.

The Referer header will leak what page you were on and you probably already have connections to Google from the same client IP address. Even if you have Referer blocked, the particular font requested could indicate information about what page you are on when combined with other data.

Stylesheets can fingerprint with the help of a server to track what resources get loaded or skipped, and a few clever media size queries etc.

TLS Session resumption (tickets / caching)

Can you still be tracked if the fonts are delivered from your server?

No. A font file served from your own server is just like any other static asset. (I increasingly tend to do this for my sites, as I've found that using FontSquirrel to create WOFF/WOFF2 files that contain subsets of fonts and/or "collapse" font features -- e.g., stylistic alternates -- can make for very small, efficient files if the subsetting meets your needs.)

Any estimate when Inter can be expected?

https://github.com/google/fonts/issues/1455#event-2995287982

Thank you for your service!

Rust based font tools? Do you mean local font manipulation type scripts or some sort of web service?

Mostly local font manipulation tools, including a GUI editor, but I can imagine some of the work ultimately becoming useful inside web services.

Not font manipulation, but the Alacritty project has had an RFC [1] open for a while now to try and make font configuration better. It turns out I barely understand fontconfig every time I need to touch it. I'm just curious what (if any) your opinions about the de-facto Linux fontconfig framework are?

[1]: https://github.com/alacritty/alacritty/issues/957

I haven't dug too deep into it, but from what I've seen it seems complex, messy, and not up to solving real problems such as CJK Han unification. I wrote a bit about these difficulties in https://github.com/linebender/skribo/blob/master/docs/script... , and what I think was most disappointing is that I didn't get any actual feedback at the time. So it feels like about the same level of dysfunction as most Linux UI work.

Re: variable fonts.

What’s the rule of thumb on file size ... is 1 variable font smaller than 1 normal font? Or is it more like 1 variable font is smaller than 3 normal fonts combined (eg bold, italic, regular).

A coarse rule of thumb is that each axis doubles the font size. So one that has just a weight axis is twice a normal font. One with a weight and width axis is four times. So if you actually use multiple instances from the design space, it's a win.

This is only a rough guide, don't take it as gospel. I'm also researching ideas (radial basis function interpolation) to make it more sparse for larger numbers of dimensions.

For some anecdata, compare the file sizes in the latest Cantarell release tarball from the GNOME FTP server.

The compression ratio varies depending on how the variable font was made though. E.g. Noto Sans clocks in at 1.5 MB because it is made from 8 masters for two axes. Reducing it to 5 masters results in a 900 KB binary.

Reply on news.ycombinator.com