LotusGuild/cinny
3
0
Fork 0
Code Issues 55 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Privacy: every page load contacts fonts.googleapis.com / fonts.gstatic.com for the VT323 font — self-host it #214

New Issue
Open
opened 2026-09-18 19:11:16 -04:00 by jared · 1 comment
jared commented 2026-09-18 19:11:16 -04:00
Owner
Copy Link
Copy Source

Found while verifying #186 (counting third-party hosts contacted on load): the only external hosts on a plain page load are fonts.googleapis.com and fonts.gstatic.com, from index.html:30-32:

<link rel="preconnect" href="https://fonts.googleapis.com" crossorigin />
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
<link href="https://fonts.googleapis.com/css2?family=VT323&display=swap" rel="stylesheet" />

That sends every visitor's IP + referrer to Google on every load (and is a GDPR problem in the EU per the 2022 Munich ruling), which sits badly next to the landing page's "No ads or tracking". VT323 is OFL-licensed: vendor the .woff2 into public/fonts/, declare it with @font-face in the TDS stylesheet, drop the three tags, and remove fonts.googleapis.com / fonts.gstatic.com from the prod CSP style-src / font-src (matrix repo nginx.conf) so a regression fails loudly. The desktop CSP (tauri.conf.json) likely lists them too.

Found while verifying #186 (counting third-party hosts contacted on load): the only external hosts on a plain page load are `fonts.googleapis.com` and `fonts.gstatic.com`, from `index.html:30-32`: ```html <link rel="preconnect" href="https://fonts.googleapis.com" crossorigin /> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin /> <link href="https://fonts.googleapis.com/css2?family=VT323&display=swap" rel="stylesheet" /> ``` That sends every visitor's IP + referrer to Google on every load (and is a GDPR problem in the EU per the 2022 Munich ruling), which sits badly next to the landing page's "No ads or tracking". VT323 is OFL-licensed: vendor the `.woff2` into `public/fonts/`, declare it with `@font-face` in the TDS stylesheet, drop the three tags, and remove `fonts.googleapis.com` / `fonts.gstatic.com` from the prod CSP `style-src` / `font-src` (matrix repo nginx.conf) so a regression fails loudly. The desktop CSP (`tauri.conf.json`) likely lists them too.
jared added this to the Features 2026-Q4 milestone 2026-09-18 19:11:16 -04:00
jared added the priority: mediumsecurityarea: appearance labels 2026-09-18 19:11:16 -04:00
jared commented 2026-09-19 13:17:30 -04:00
Author
Owner
Copy Link
Copy Source

Done across the three repos:

  • cinny 6f250353: VT323 (OFL) vendored as latin + latin-ext woff2 subsets in public/fonts/ with @font-face in the existing custom-fonts.css; the three Google tags removed from index.html. Also deleted three unreferenced JetBrainsMono-{400,600,700}.woff2 that turned out to be 1.6 kB Google 404 HTML pages, not fonts. Verified headless: no third-party host on a plain load (only the homeserver), document.fonts.load('16px VT323') resolves from /fonts/VT323-latin.woff2.
  • matrix c553c28: cinny/nginx.conf CSP drops fonts.googleapis.com from style-src and fonts.gstatic.com from font-src.
  • cinny-desktop 83c89b8: same two hosts dropped from the Tauri CSP.

⚠️ One manual step for you: per the matrix README the live web config is hand-maintained at /etc/nginx/sites-available/cinny on LXC 106 — apply the same two CSP edits there (after the cinny deploy lands, so the old bundle isn't briefly blocked from Google) and nginx -s reload. Leaving this open until that's done.

Done across the three repos: - **cinny `6f250353`**: VT323 (OFL) vendored as latin + latin-ext woff2 subsets in `public/fonts/` with `@font-face` in the existing `custom-fonts.css`; the three Google tags removed from `index.html`. Also deleted three unreferenced `JetBrainsMono-{400,600,700}.woff2` that turned out to be 1.6 kB Google **404 HTML pages**, not fonts. Verified headless: no third-party host on a plain load (only the homeserver), `document.fonts.load('16px VT323')` resolves from `/fonts/VT323-latin.woff2`. - **matrix `c553c28`**: `cinny/nginx.conf` CSP drops `fonts.googleapis.com` from `style-src` and `fonts.gstatic.com` from `font-src`. - **cinny-desktop `83c89b8`**: same two hosts dropped from the Tauri CSP. ⚠️ **One manual step for you:** per the matrix README the live web config is hand-maintained at `/etc/nginx/sites-available/cinny` on LXC 106 — apply the same two CSP edits there (after the cinny deploy lands, so the old bundle isn't briefly blocked from Google) and `nginx -s reload`. Leaving this open until that's done.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: appearance priority: medium security
Milestone
No items
No Milestone Features 2026-Q4
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#214