skysight-inc/HackerNews huggingface dataset:
> A standard web font (e.g. Roboto) is ~1MB.

Currently on HN frontpage there is an article "How to avoid layout shifts caused by web fonts" [1]. It lists several techniques you can use to reduce font size. One of the examples shows how subsetting reduces Roboto Regular size to 11KB.

[1] https://simonhearne.com/2021/layout-shifts-webfonts/.
People who have other priorities and interests than technology.
> In fact, since in parallel to the question of your legal basis under GDPR, you also have to comply with the cookie provision from the e-Privacy Directive, where there is no "legitimate interest" exception to the requirement to ask for consent, you will have to ask for consent anyway (as Instagram embeds place cookies).

I don't think that's true. The cookie provision is misunderstood when you think you have to ask for consent for functional cookies. Follows from the GDPR, and there is no specific cookie law actually implemented in european countries. See also https://gdpr.eu/cookies/. Ah, but maybe I misunderstood and you are only talking about the cookie set by the embed?
Illiquidity is one possible reason, news and actions are other ones (e.g. Swiss Franc peg and removal of peg in 2010s, credit events etc.). No need for markets being closed or illiquid, just people figuring out a new state or straight jumping to it - and that expresses itself in a lack of liquidity sometimes, but it's not the cause.
This "very clear difference" is the center of many trials in Hollywood / Silicon Valley history so i wouldn't say it's that clearcut. I personally don't see copyright in any way as a mechanism to bring retribution to the creative minds (instead it serves to capture value into big corps and let the artists starve), but as long as we have to deal with it i'll keep publishing stuff as copyleft so that the capitalist vampires think twice before "borrowing" my code.
I don't think forcing each and every single website provider to implement their own consent forms is the right approach to regulating this. User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not). But requiring ever more complex, explicit and custom opt-in consent forms for various provider, third party and user jurisdiction combinations is just inane.
Market making, at least in stocks, is already very well-automated. They are extremely efficient businesses; they need to, because they take million-dollar risks just in hope to make a few hundred bucks each time, and pay a lot of that in costs.

By EMH there's no such thing as free lunch or true passive income. This is especially true in trading. Profit-seeking activities with low barrier-of-entry eventually become races to the bottom. If there's easy money to be made with passive AMM, people will jump into it en masse and eventually compete on cost-saving. Much like mining, where electricity costs and how quickly you can fix mining rigs with few resources could make and break a farm.
Why can’t Apple build a security team like NSO (in fact a much larger one), finding these vulnerabilities?

If others can, so does Apple.
If it’s based on resources, Apple is far ahead (even large governments don’t put so much resources into one application, let alone small companies).

In fact, Apple’s valuation is incomparable relative to NSO’s and Mossad’s.

And why don’t US politicians protect US citizens?

If there is something else at play, it’s good to highlight it at some point. But I doubt it will be acknowledged to public till decades later.
I'd say for requests that return dynamic data, a case could be made that there is technical merit for the client doing the request instead of the server proxying the request.
It seems pretty reasonable to me.

1. In Germany an IP address is considered PI under GDPR because it is easily associated to a natural person.

2. Google is open about the fact that they log IP address with Google Font request activity, which includes the page you are on.

3. GDPR requires justification by necessity to collect and/or send PI to a 3rd party without consent.

4. No consent was given.

5. It is not necessary in this case because it is possible to use Google Fonts in other ways that don't send PI to Google, without significant burden.

I'm not a lawyer but I am responsible for GDPR compliance at a German startup.

edit: typo
What about using e.g. Webflow? Can I leak the IP address of the customer if I don't know it myself?
IP Address is far from "extremely sensitive user data". Really.
I've got a man bun presently and find you can just cut the bundle where the hair tie goes. Got a stubble trimmer too that does the sticky out bits.
no. It didn't decide and so isn't responsible. Have you ever seen a gun in jail?
Just imagine how the hacker team must have felt when they saw this black magic actually working for the first time.
Juries are the ultimate arbiter of law application. For this very reason.
I try to block web fonts using Pihole. This makes me want to add an overly-broad rule blocking any occurrence of the word “font” in a domain. It’s yet another web technology that really has no need to exist. My computer already has multiple fonts. There’s way that I benefit by downloading them from a remote site.
Volunteer work would be one way. I teach ESL through my parish one night a week. I can't say I've made close friends, but I am on friendly terms with quite a few people. They include lawyers, teachers, bureaucrats (this is Washington, DC, after all), the occasional engineer.

Sports might be another. Pretty much anyone can learn to bat well enough for slow-pitch softball. And there are running groups that accommodate runners of all levels.

Or just walking around your neighborhood. Other people will be walking, too, and at some point you will talk to them.
The whole strategy with Google providing “services for everyone out of pure gratitude” is:

- With Google Fonts, to track the identity of users AND the real popularity of websites,

- With Google DNS 8.8.8.8, to track everyone’s DNS resolutions,

- With Google Analytics, to track who sees what, even if they only display masked IPs to the owner of the GA profile,

- Etc with Google Maps, emails, they don’t provide those services for free, they can track everyone’s profile, down to their obedience to Covid rules.

I wouldn’t be surprised if Germany bans more aspects of using Google’s free services.
> you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML

Am I? Maybe I am, because I have worked as a web developer, but most people don't really have this knowledge.

And even if they suddenly start having the knowledge, what is their choice? Stop using the web for good?
(Or break into your house)
Because they want to have a tighter control of user experience, which includes the choice of the font used to display text. So they list their preferred fonts first, with fallback fonts at the end.

It’s a fair reason with an appropriate CSS pattern.
(in reply to krehl) And in that specific case you should probably have a DPA ready. Big issue with anything Google-related (and probably CloudFlare) is that they may transfer the data outside of the EU[0].

[0] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
Sometimes you care a lot about the design of the website and that everything looks 100% OK in all browsers and screen-sizes. For example, think web agency landing pages, where you're supposed to sell your service to potential customers.

In those cases, using whatever font is usually not good enough, because many of them have different sizes (both length-wise, height-wise and line-height-wise), so if a user gets a different font loaded than what you have tested with, it could at best just have a different size (right-side of the text is now 3px away from the side rather than 6px for example) and at worst introduce line-breaks in your buttons that only expects one line of text, making everything look very fugly.
True. They assert it. I think as a brief, they doth protest enough to make you wonder how much is settled law and how much is looking for precedent.
I wonder if you can get penalized for sending users' IPs to CloudFlare..
I agree with everything you said except the last paragraph.

100€ was fine in my opinion, because a) it isn't that big of an infraction b) it probably was their first offense and c) this legal ruling is indeed setting some kind of precedence and therefore was unexpected given industry practices. If the ruling stands and other courts follow a similar reasoning I would expect higher fines in the future.
This kind of 'leakage' is key to personal profiling. If this ruling becomes widespread, profiling may prove much harder to do (which is a good thing).

Edit: clarification
> Absolutely - put your order in and pass it on to the next person to add their stuff. So much easier!

And hope the staff member has taken proper notes while dealing with everything else going on and not put the extra bacon on the vegan burger or the coleslaw in with the picky eater's meal?
> Also at least with european banking, if you wringly send money to another account, it is also gone forever.

It's not though? The money is still legally yours and can be recovered via the legal system. Only if it is moved out of Europe into less well regulated areas it becomes a problem.

This happens in every case though. If I give you cash and you take it to god knows where it can't be recovered either. If I give you money and let you leave with it then there is only so much any system can do.
Is it really better to tunnel your whole site through CloudFlare than embed a font from Google, from a privacy perspective?
It unquestionably leaks information, and it is why projects like Decentraleyes exist.

Whether it is "unnecessary" is the interesting question. For fonts, it's really hard to claim that you couldn't have created the website without Google's fonts CDN.
Of course, I am following the logic where it goes.

Now, why would website operators be considered data processors for providing a link to google fonts to website users ? The website is not leaking the IP, it doesn't need if to display fonts and it doesn't use visitor's IP to display fonts. Ultimately the user of the browser is using his IP to get the fonts and this user is the one responsible for leaking his IP.

The website has delivered an HTML document. It's up to the user to do what he wants with it and follow links or not.
It most definitely is a word irregardless of your feelings about it https://www.merriam-webster.com/dictionary/irregardless
What about "leaking" the IP to your server provider and all the networks between your user and site?
The end result is that the fact that you visited this website is passed to Google, and this can then be used for advertising purposes.
Apple has the resources very few states could justify spending tax dollars to match.
Don't forget the lasting effects of depleted Uranium munitions:

https://www.foreignpolicyjournal.com/2019/09/21/new-study-do...

that's a particularly nasty thing to be lobbing around. The shell that just keeps on shellin' long after the war is over.
Isn‘t that exactly like the status quo with banks?
Yes, I also think that.

From this site [0]:

"Virtually every business relies on third parties to process personal data. Whether it’s an email client, a cloud storage service, or website analytics software, you must have a data processing agreement with each of these services to achieve GDPR compliance."

[0]: https://gdpr.eu/what-is-data-processing-agreement/
The website owner decides what's asked to be done. The browser is still owned by the end-user can choose to make the request. This is why ad-blocking is fundamentally required.
...replying to myself here to possibly avoid being downvoted to oblivion: This is an example of sarcastic critique. The goal is to illustrate the entirely arbitrary nature of the green vs red labels given to various categories such as electricity consumption. Thank you for your time.
If you don't believe it, benchmark it.

On very small arrays bubble sort is faster than quicksort as quicksort has a large constant overhead.

Constant overheads are usually disregarded in complexity analysis but in practice, it can be significant.
Nah, it's charity, come on. /s
So, soon on top of all the cookie notices that are already there, we are also going to have to consent initially before anything loads to downloading the javascript from 3rd party to manage all the consents? Lol.... Just what the internet needs...
Man, life sure is better when you don't have to arm your own military.
None of the standard browsers share third-party cache across different domains. Made it too easy to leak data.
Why not make a phone which is secure by default?
In my country, $500 is more than an average HR employee earns in a month. A proposal to pay this much for a job posting would be laughed away.
first I don't agree with coining any group as stupid per se.

Second, if they are a target group, a website has no excuse but to deal with them.
A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”
Non-technical users that I’ve seen interacting with these prompts literally just look for the button with the most prominent colour and click it.

Frankly, I’ve even found myself doing this without thinking on occasion. The prompts are beyond useless.
It’s literally SQLite transpiled to Go using cznic’s C to Go program.
There's no difference between that popup and IP sharing consent. It's not about cookies, it's about tracking and tracking risk.

Smart websites would just host the font files on their own domains but I guess the dumber ones will just add Google Fonts and similar to their consent list, yes.
Who does make my browser request the resource? Clearly the website owner who can also decide to make the browser load a resource fully under their own control. The user could block it, certainly. But I don't want my browser to ask me for every single URL if it's okay to request a resource.
So to paraphrase.
Broken technology with serious bugs

Therefore anyone looking to do anything other than gain speculative wealth should stay well away.

Another one born every minute...
I'd go back further and say that the first wave - when Dogecoin and about 100 other cryptos popped up all running essentially Bitcoin networks - that was right when it went to shit. At that time you had to still know how to compile something to start your own blockchain, but if you did you'd be a billionaire now.

Ripple and other riders on the original blockchain would be the second wave of scams. That's when large scale investors started to get involved.

Ethereum is really the third wave scam where it got so easy that people who couldn't code were able to scale it out to people who couldn't even think. It was upscale retail selling to schmucks.

That would make NFTs and smart contracts the 4th wave of ponzi. The part where knockoffs of knockoffs become cheaper than a Louis Vuitton bag on Canal Street, and everyone's mother is buying crypto, and they're running ads for it on the home shopping network.
First time I hear about IMAP/POP3 provider being able to "undo" emails after being sent. What provider are you using and how does that work behind the scenes? And no, gmails fake "we don't actually send it until you close the tab/wait 30 seconds so you can undo it" doesn't count.
Browser can be configured not to send this data.

If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?
So would other Google resources like running Adsense ads also reveal IP addr or other private info? I think Google allows users to opt out of being tracked?
> Since then I honestly think there should be no profit in making weapons while a war is going.

Why should the weapons manufacturers be left out while oil companies, mercenary corps, and construction/logistics companies get all of the action? "Everybody" deserves their place at the feeding trough.
> a previous request to that cdn may have cached them in your browser already? Opt-In goes against the architecture of websites

Browsers partition their caches by origin and third-party origin (it's a bit more complex than that in reality) so common third-party resource e.g. fonts, used on one site won't be reused on another

Instead a fresh version of the font will will be fetched

Safari's done this since 2013 (?), and Chromium & Firefox adopting the same behaviour in 2020 (?)
Good grief, this is like machine language for money
Such stats are notoriously noisy. Ohloh only analyzes the most popular free software projects so there is a long, long tail of projects that is unaccounted for in the statistics. Furthermore, even if most commits are submitted during office hours (in what timezone?) how can we know that they are paid specifically for contributing? E.g. could be some bored developers commit to their own personal project.

Regardless, the amount of companies involved in free software could be evidence of the superiority of voluntarism over "workism" for complex human systems.
I mean pass the app on, I'm agreeing with OP.
Well, a font is not equal to "any content".

So perhaps the issue is whether it is necessary/sensible, just for providing a simple font, to contact Google/any cdn.

Spoiler, of course we all know it is not...
Ublock Origin in advanced mode can be set to block all third-party requests by default. I browse the internet that way, but it's definitely not for everyone.
> Sounds fair to me.

The part that is tricky, is where we offload additional burden of knowledge and responsibility to the website providers.

When it is on the user to figure out whether they are allowed to use a product – and that means in fact any product – that one of the biggest companies in the world is allowed to offer in my country legally, we are in trouble.

Law is complex. Tech is complicated. Most people are not law or tech experts. Getting sound advice on both is expensive, and the trend to increasingly need more of both is worrisome.

This seems neither fair nor reasonable to me. Or particularly democratic.
I'm really starting to question why aren't we using fonts that are standard part of browsers? Just have a reasonable sub-set supported by everyone. This would be great climate action too as we would not be wasting energy to redownload them billions if not trillions of time.
This is true. But the request containing that information is being sent by your own computer. It’s bit a “doing” of the website owner.
Sounds like a good way of inflating a bogus coin that will cause a rush on it...
That's part of what's frustrating me about this! Usually non-profit projects/protocols are extensible, like the web and the Internet. This, despite the fact that for-profit corps try to appropriate/destroy the free/extensible platforms just like Microsoft/AOL tried with the Internet in the 90s.

So here, we end up in a situation that because silicon valley moguls exploited an extensible protocol (by hijacking the standardizing committee to their profit) we adopt a self-defense reflex of making everything minimalist to reduce the attack surface.

I'm interested in low-tech/ecology in general. For me, the equivalent in the physical world would be if you're not happy with a house using too much resources/energy so you decide to live without walls or floor, with a simple ceiling over the head. Sure it does the job of protecting you from rainfall, but does it fit all the other functionalities we expect from a home? I'm much more interested in a clay-based (or other local materials) housing, personally.
Aka 95% of people out there.
What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?
That command runs fine. No errors.
It's exactly the same with banks, except "we" (normal plebs) cannot actually see when it happens, as compared to blockchains where all data is public. With banks it happens all the time, but no one knows, so it doesn't make the news. When it happens in blockchains (that one time), it's very obvious so it makes the news.
The data processing agreement with American companies is probably not enough because the USA doesn't sufficiently protect the users' privacy under the GDPR.

It's only possible to go this route if the country has the approval of the EU through the necessary legal frameworks. That's what Privacy Shield and its predecessor were, and both were deemed insufficient.

Your point about a data processing agreement is true, but I wouldn't rely on AWS/Cloudflare/Google until the EU and USA manage to get this stuff worked out.
Yes, but it's not actually a solution. It maintains the status quo and only prevents its consequences.

The problem, simplified: People are dumb.

The solution: Making people smarter.

Not a solution: Keeping people dumb and preventing them from making stupid mistakes.
What is on a plain cheese pizza? Not only cheese I hope? In the pictures it looks like there is tomato sauce but I have never particularly ordered a 'plain cheese pizza' in the US; I only ordered with toppings.
You're probably liable to pay the plaintiff 100 EUR for leaking their IP address to CloudFlare, as well as paying 100 EUR for leaking it to Azure/AWS/etc. /partially sarcasm
My reading is that nothing in the argument depends on the exact resource in question being a font, so I don’t see why it wouldn’t generalise to other resources.
GDPR works the other way around.

By default it should be <<opt-in>>, not <<opt-out>>.

You don't get to track me and then force me to tell you "don't track me", you should do nothing by default and ask me "may I track you?".

Companies don't do that because opt-out is sneaky and it means they can track, say, 95% of users.

With out-in, they get to track maybe 80% of users if they're allowed to use dark patterns (where they hide stuff or lie to the user what tracking actually does) and probably less than 10% if they're not allowed to do that.
I think the best monument to DR is the software billions of us use every day. Best thing we can do is make more people aware of his work.
Keep in mind that this project isn’t creating a new SQL database from scratch. It’s literally ingesting SQLite’s C source code and spitting out Go. cznic’s done an absolutely incredible amount of work here. It’s not ready for prod yet, but it works and passes all of SQLite’s tests.
The "annoying" popups is also how you end up with businesses like plausible analytics that provide analytics, but don't require the popup, because they dont store the information that causes the popup to be required.

So, working as intended I think.
Phone, for sure. These days - if they are too under-staffed to answer the phone, I don't want to order and then wait. And wait. And wait...

And usually from a little regional pizza chain - which has ~30 "Gourmet" options (popular combinations of sauce and 3-5 items, at a slight discount) to speed up deciding & ordering. Plus a Caller ID/Order History system, so I can tell a new employee "my usual".
It is not true that "functional" cookies are generally exempt from the consent requirement. What is concretely exempt are necessary cookies for a service that the user explicitly requested. This is not the case for cookies placed by Instagram embeds.

These are the guidelines on consent exemption by the Article 29 Working Party (the European Data Protection Board's predecessor) that explain it: https://ec.europa.eu/justice/article-29/documentation/opinio...
Spreading your data across the internet is the real nightmare
go-sqlite3 is not pure Go. It is a Go wrapper around the SQLite amalgamation.