Remote Fonts

Please motivate your choices.
TH.

 

I voted no, as it's something I've never considered (up until now).

 

Yes.

Also, pages are not allowed to use their own fonts either - I prefer the uniformity of my own selection.

(I do allow a specific few sites to use their own 'fonts' that contain glyphs or symbols)

 

Same

 

https://technet.microsoft.com/en-us/library/security/ms15-078.aspx

https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-remote-fonts

 

this...

 

I block remote fonts on every site by default, but enable it on sites I trust (like this one). I also disable large "media" largen than 50 KB by default. All done with uBlock Origin.

 

Apparently I have been for years, through NoScript:
https://hackademix.net/2010/03/24/why-noscript-blocks-web-fonts/

 

It 'also possible only with Chrome (no extension):

http://peter.sh/experiments/chromium-command-line-switches/

--disable-remote-fonts

and Firefox:

Open

about:config
Set "gfx.downloadable_fonts.enabled" to false.

 

HitmaPro.Alert is blocking "Untrusted fonts" in IE11 on my machines.

 

But this is global, right? You can manage remote fonts on a site-by-site basis with uBlock Origin

 

Yes.
But not everyone has installed uBO

 

hi
i can't vote
because i don't know how block prevent web fonts from being downloaded i use firefox ,chrome and opera

 

Block:




Allow (Ok for trusted websites):





same (about) for NoScript (Firefox).

 

hi Sampei Nihira
thanks a lot!!
by the way the fonts downloaded do go in the cache ,don't they?

 

I too block web fonts, however it is through uBlock Origin. And when the site is not properly rendered with out it, i enable fonts for the site.

They do. It is same as other resources such as script. They are dependent on the site configuration.

 

Microsoft Security Bulletin MS16-026 (About OpenType Font Parsing Vulnerability) contains workarounds to disable it systemwide:
https://technet.microsoft.com/en-us/library/security/ms16-026.aspx

 

These mentioned vulnerability is fixed now for several months.

EMET can also handle it + the better option to set to audit. I would not recommend to disable it globally because some problems may get troubles with it + it not blocks or restrict own MS fonts. So the 'best' would be to set it to audit and in uBlock block remote fronts.

 

True, but if you check the monthly security updates, font parsing vulnerabilities are a returning issue.

Yes, but unfortunately that's Win 10 only.

True, but some might prefer that, plus it also protects other applications that might use OpenType fonts such as Office.

 

I feel the same.

 

No.

 

I have had downloading of fonts in Firefox disabled for the past 5 days, around 40-50% of the sites I have visited were broken in some way or the other, menus, icons and so forth didn't look or work correctly. And also the uBlock Origin popup GUI is broken with this setting disabled in Firefox, so I have now enabled it again.