Re: [csswg-drafts] [css-fonts] limit local fonts to those selected by users in browser settings (or other browser chrome) (#4497)

General

It looks like either im using the wrong terminology here, or the terms have changed since I last read the specs.  (i'm betting the first).  Using the [terms as defined in Section 10](https://drafts.csswg.org/css-fonts-4/#font-taxonomy), the proposal would not affect web fonts or pre-installed fonts.  The proposal would only affect the user-installed fonts, and would require users tell the browser which user fonts to make accessible to the browser.

@litherum 

> What happens if a user doesn’t select any fonts? Does this mean that no text shows up anywhere on the entire web? 

If no fonts were selected, than the set of fonts available to websites would be only the pre-installed fonts, and the web fonts.  The only thing that user-selection affects is which user-installed fonts sites can access.

> …this proposal would make fingerprinting worse 

I do not believe this is not the case for the above reason.

> I'd like to invite you to attend the next call where we can discuss this…

Sure, that'd be great.  I'll email now.

@dbaron 

Yes, the proposal would require the browser to distinguish between system-installed fonts and user-installed fonts.  I agree its not trivial, but it sure seems like browsers and standards have solved more difficult problems in the past ;) If its really just this practical problem, and then figuring out how to standardize behavior, I am sure the WG and PING could work together to solve the problem.

> I'd be a little hesitant to put it in a spec until it had been demonstrated to be viable in the market 
and
> it should be entirely allowable for an implementation to do this if it wants

It seems like Safari has basically shown this to be viable, since their current shipping strategy is even more restrictive than whats proposed above.  

More broadly, the goal of the proposal isn't to give privacy-preserving parties a "this is standards compliant" stamp of approval; its to solve the collective action problem of "how to coordinate many  privacy-concerned parties (presumably everyone on this thread) to act in tandem to solve a webscale serious problem, without leaving one vendor / platform to hold the webcompat bag" :)



-- 
GitHub Notification of comment by snyderp
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/4497#issuecomment-564690999 using your GitHub account

Received on Wednesday, 11 December 2019 19:15:58 UTC