Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Third Party Requests to Google Fonts #5883

Closed
samuel-p opened this issue Nov 27, 2020 · 3 comments
Closed

Third Party Requests to Google Fonts #5883

samuel-p opened this issue Nov 27, 2020 · 3 comments
Labels
frontend The React app and the infrastructure that supports it needs-discussion A consensus is needed to move forward self-hosting Discussion, problems, features, and documentation related to self-hosting Shields

Comments

@samuel-p
Copy link

馃搵 Description

At the moment shields does third party requests to Google. CDNs are bad from a privacy and security perspective. So please replace them completely with self-hosted files or at least provide an option to disable it for self-hosted instances. You can download the fonts from google-webfonts-helper if you want to self-host it.

Bildschirmfoto von 2020-11-28 00-16-20

https://webbkoll.dataskydd.net/en/results?url=http%3A%2F%2Fshields.io%2F#requests
@calebcartwright
Copy link
Member

Relevant discussion in #4864 and #3026

@calebcartwright calebcartwright added frontend The React app and the infrastructure that supports it needs-discussion A consensus is needed to move forward self-hosting Discussion, problems, features, and documentation related to self-hosting Shields labels Nov 28, 2020
SISheogorath added a commit to SISheogorath/shields that referenced this issue Mar 16, 2021
@SISheogorath
Use NPM packages to provide fonts instead of Google Fonts
a53bd35 
This patch uses the fontsource libraries instead of using Google Fonts
in order to provide the fonts in the frontend. This way the web frontend
becomes more private, since it no longer shared visitors IPs with Google
and might even loads faster since modern web browsers isolate site
caches from each other and can re-use connections with HTTP/2 instead of
setting up a new connection to Google.[1]

It's basically the next iteration of my previous PR[2], that no longer
relies on a tool to download the fonts separately, but uses a library
instead. It also relates to issues that have been opened before[3] and
should be easily handled and upgraded by the regular NPM package
tooling[4], solving all related problems to that.

[1]: https://csswizardry.com/2019/05/self-host-your-static-assets/
[2]: badges#4864
[3]: badges#5883
[4]: https://github.com/badges/shields/labels/dependencies
@SISheogorath SISheogorath mentioned this issue Mar 16, 2021
Merged
SISheogorath added a commit to SISheogorath/shields that referenced this issue Mar 16, 2021
@SISheogorath
Use NPM packages to provide fonts instead of Google Fonts
4aad35b 
This patch uses the fontsource libraries instead of using Google Fonts
in order to provide the fonts in the frontend. This way the web frontend
becomes more private, since it no longer shared visitors IPs with Google
and might even loads faster since modern web browsers isolate site
caches from each other and can re-use connections with HTTP/2 instead of
setting up a new connection to Google.[1]

It's basically the next iteration of my previous PR[2], that no longer
relies on a tool to download the fonts separately, but uses a library
instead. It also relates to issues that have been opened before[3] and
should be easily handled and upgraded by the regular NPM package
tooling[4], solving all related problems to that.

[1]: https://csswizardry.com/2019/05/self-host-your-static-assets/
[2]: badges#4864
[3]: badges#5883
[4]: https://github.com/badges/shields/labels/dependencies
@SISheogorath
Copy link
Contributor

I just added a new version of my previous PR that resolves the fonts using NPM packages instead of manually maintaining the fonts inside the project.

I hope this will help to resolve the situation.

PyvesB pushed a commit that referenced this issue Mar 16, 2021
@SISheogorath
Use NPM packages to provide fonts instead of Google Fonts (#6274)
99fc7c1 
This patch uses the fontsource libraries instead of using Google Fonts
in order to provide the fonts in the frontend. This way the web frontend
becomes more private, since it no longer shared visitors IPs with Google
and might even loads faster since modern web browsers isolate site
caches from each other and can re-use connections with HTTP/2 instead of
setting up a new connection to Google.[1]

It's basically the next iteration of my previous PR[2], that no longer
relies on a tool to download the fonts separately, but uses a library
instead. It also relates to issues that have been opened before[3] and
should be easily handled and upgraded by the regular NPM package
tooling[4], solving all related problems to that.

[1]: https://csswizardry.com/2019/05/self-host-your-static-assets/
[2]: #4864
[3]: #5883
[4]: https://github.com/badges/shields/labels/dependencies
@PyvesB
Copy link
Member

PyvesB commented Mar 16, 2021

Aforementioned pull request is now live on our servers, thanks again @SISheogorath for the contribution and @samuel-p for raising the issue. Do let us know if you have any further concerns by opening a new issue, for now I'll close this one. 馃槈

@PyvesB PyvesB closed this as completed Mar 16, 2021
@snyk-bot snyk-bot mentioned this issue Jul 10, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
frontend The React app and the infrastructure that supports it needs-discussion A consensus is needed to move forward self-hosting Discussion, problems, features, and documentation related to self-hosting Shields
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@samuel-p @SISheogorath @PyvesB @calebcartwright