Hacker Newsnew | past | comments | ask | show | jobs | submit | krono's commentslogin

An example of something to keep in mind with this technique is that you might actually end up causing the browser to render a different font than either you or the user intended.

For a practical example:

Environment

  - Latest Firefox on Windows 10.
  - Manually installed fonts 'Cascadia Code' and 'JetBrains Mono NL'.
  - Firefox default 'monospace' font set to 'JetBrains Mono NL'.

Setting `font-family: monospace;` would end up rendering 'JetBrains Mono NL' - the user-configured default monospace font.

Setting `font-family: 'Cascadia Code', monospace;` would also render 'JetBrains Mono NL' - privacy features prevent pages from querying non-standard system fonts and this will also be reflected as a console warning message: 'Request for font "Cascadia Mono" blocked at visibility level 2 (requires 3)".'

Now, if you were to use he "Monospace Code" font stack listed on this page `font-family: ui-monospace, 'Cascadia Code', 'Source Code Pro', Menlo, Consolas, 'DejaVu Sans Mono', monospace;`, you will render... Yup, 'Consolas'!

  1. `ui-monospace` - remains unsupported by Firefox which is lame (would also render 'Consolas').

  2. `Cascadia Code` - see above, access denied because it isn't natively available on Windows 10 (also, coding ligatures... more like illigatures, amirite?).

  3. `Source Code Pro` - skipped due to unavailability.

  4. `Menlo` - skipped due to unavailability.

  5. `Consolas` - next option in line, this one is available and is the one that will be chosen.

  6. `DejaVu Sans Mono`  - skipped, font already determined.

  7. `monospace` - skipped, font already determined.

These modern font stacks suck. Please, if you want to render font and it has to be something specific, then use an actual web font and simply fall back to the default 'monospace' which is controlled by the user.

This is excellent analysis, but I think you've forgot to mention one particular detail in your environment description:

    - Firefox Browser Privacy Enhanced Tracking Protection setting changed to "Strict".
It is not default, and explicitly indicates this kind of outcome can potentially happen. But truly agree that the situation here is suboptimal in all aspects.

Also maybe worth noting that we can always force our (three) font faces everywhere simply by unchecking the "Allow pages to choose their own fonts" in settings. Yes, this is nuclear option, but I can attest that I use it time to time, and it is quite usable.

BTW, I have somewhat softer workaround that interestingly makes the (local) Cascadia on modernfontstacks work even in the Strict Tracking Protection mode: I have a "userstyle" [0] (more precisely userCSS in Stylus) that "remaps", among other things, "Consolas" to a @font-face of the same name but loading `src: local("Cascadia Mono")` instead. Not sure why exactly this circumvents that (I don't think that Stylus-injected styles have more privileges than page styles), but I am glad it works nonetheless.

[0] https://userstyles.world/style/23838


> Allow pages to choose their own fonts" in settings. Yes, this is nuclear option, but I can attest that I use it time to time, and it is quite usable.

Does this nuke icon fonts? I presume yes.


Good question! Actually (to my minor dismay): not completely. Disabling "font support" in Firefox surprisingly still has a hatch for "well-known" icon fonts, with intention to prevent "blind" icons in webpages. I believe it is driven by the pref

    browser.display.use_document_fonts.icon_font_allowlist
that contains "FontAwesome" and (Google) Material Icons and Symbols (many, presumably all, variants). So to truly disable all "non-preferred" fonts, we have to both wipe that pref and also change for the

    browser.display.use_document_fonts
to zero. But that's what the GUI checkbox controls, so no need to go to about:config for this one.

Icon fonts are bad for accessibility. Better to use SVG graphics and provide alt text for screen readers.

What’s bad for usability is using icons on their own. Using icons with visible labels is the best practice among people who actually want their software to be usable.

And of course “bad for usability” becomes absolutely catastrophic for a11y.

For those who prioritize aesthetics over usability and use icons alone though, there are at least a dozen methods to make assistive tech read the names of your icon buttons. Something as simple as aria-label is one way.


How so? aria-label= and role= attributes exist, this is not 1999.

IIRC, Safari has this limitation with rendering only system fonts and it cannot be disabled.

> Also maybe worth noting that we can always force our (three) font faces everywhere simply by unchecking the "Allow pages to choose their own fonts" in settings. Yes, this is nuclear option, but I can attest that I use it time to time, and it is quite usable.

Occasionally I deliberately trial major changes for a week or two. Sometimes I revert, other times I stay. I turned font selection off in this way in early 2020, and never went back, it made the web so much better.

Out of the box, Firefox still loads fonts with certain names, to avoid breaking icon fonts. After maybe six months I decided to nuke that with blocking all fonts in uBlock Origin, and although it made some things uglier, and Material Icons is ridiculously stupid in practice (frankly achieving almost the precise opposite of its stated intent for using ligation) it took until this year before I encountered an actual breakage (a couple of sites not realising document.fonts.load() can throw).

I encourage others to turn off font selection, though I wouldn’t encourage most to block web fonts altogether in the way I decided to.

I also urge developers to shun icon fonts: they were always a bad idea, a dodgy hack, and the time when they had meaningful justifying qualities is now long past.


I don't think web pages should stay away from font stacks just to handle people with changed esoteric browser prefs. If you as a user want to see different fonts everywhere, you'll need invasive tools that block font face etc. Or Firefox (where this message comes from) has a setting to "Allow pages to choose their own fonts, instead of your selections above"

These font stacks don't handle anything at all, they just throw a bunch of common typeface names at the wall and they can't even tell what sticks because it's so random. All the while, the user might have a prefered fallback font set that they prefer over any of the ones in the font stack - and even if that isn't the case, simply using 'monospace' as the only fallback will render the default monospace font anyway.

I disagree with the notion that common browser configuration options available for users to change through the main/general browser settings UI would in any way be esoteric. It is wholly irrelevant anyway.

The setting you mention has no effect in the case I outlined above - Even with "Allow pages to choose their own fonts, instead of your selections above." enabled, the same results are observed.


they just throw a bunch of common typeface names at the wall and they can't even tell what sticks because it's so random.

Anytime someone on HN doesn't understand CSS, they throw up their hands and call it random. Just because you don't understand what's happening doesn't mean it's random.

I don't understand the SAM76 programming language, but I don't pretend that

  !%ii,*,1,1,!%mu,*,%F,%su,*,1//////////=
is "random."

the user might have a prefered fallback font set that they prefer over any of the ones in the font stack

Great! Then the user gets his preferred font, as requested, instead of the one the page specified. Sounds like a win, so I'm not sure what you're complaining about. I expect you'd also complain if the web page overrode the user's choice.

I disagree with the notion that common browser configuration options available for users to change through the main/general browser settings UI would in any way be esoteric.

Of the six billion or so people on the web, the number of people manually overriding fonts isn't even a rounding error. It's not even a rounding error's rounding error. Get out of the tech bubble.


Accusing the person you are replying to of not understanding css after the knowledge built in to their argument doesn’t paint you in a good light. I don’t have horse in this race, but I’d encourage you to take a beat.

> the number of people manually overriding fonts isn't even a rounding error. It's not even a rounding error's rounding error

This is very obviously true. And given the fact that 100% of mainstream websites and 99.99% of non-mainstream ones use font declarations other than “serif”, “sans-serif”, or “monospace,” it is absolutely unsurprising that no one (but us super nerds) bothers to set this setting that every website will override.

And indeed, the near-universal usage of web fonts today has taken us even farther into the territory where a web property specifies the precise appearance, leaving no decisions to the user agent. If it weren’t for responsive layouts being standard, the Web would have more in common with a PDF than the early HTML web where users might have a reason to use user stylesheets and specify their preferred fonts.


Oh you flatterer!

My top level comment was not a complaint at all, but rather a heads-up regarding the potentially unexpected or often misunderstood effects of applying these font stacks, accompanied by a practical example, and a personal recommendation with my reasoning.

Now, please, don't be so hostile. It's nasty and makes you come across as a lot more stupid than I believe you really are.


> Great! Then the user gets his preferred font, as requested, instead of the one the page specified.

No. You've misread the main point. The user would have gotten his preferred font if the font stack was either just plain

    font-family: monospace;
or

    font-family: <list of fonts their system does *not* support or does *not* allow to be used>, monospace;
. But the case is that the suggested font stack contains some "unwanted" font that their system both supports and allows to be used, that precedes the generic `monospace` font family the user actually prefers, or, more precisely, have assigned their typeface to. Is it more clear now?

I agree it is not a huge "bug" on the first sight, and as it seems even this is somewhat solvable without disabling font support completely. But since it takes some effort and expertise on the user's side, it adds the "bug" some weight nonetheless.


Slightly off-topic question: is it still necessary to list monospace twice, the way it was years ago, to have monospace render at the correct size?

> esoteric browser prefs

That hurts. I see where you are standing, and can confirm you expressed opinion of the contemporary majority of browser users, but man, how sad it that. The attitude diverged by a light years, when "Setting preferred fonts for generic font families" is now "esoteric". (Web) browsers ("user agents") came to existence with these capabilities in mind, and even now are build around the principle of "preferences reconciliation" between defaults, author and user (as opposed to simple "display what author dictates"). And default font choice is probably the very first aspect it ever had to handle.

(Or were you referring to some other "pref"?)


Browsers have ceded way too much control to web designers. The user should be in control. When it comes to what fonts the computer uses, the text size, the color scheme, the user preference should be able to easily override the web site's code. Who's computer is it, anyway?

I'd be pretty over the moon if the browser supported the following preferences... especially given the number of electron or otherwise browser embedded UI options..

    system.font.primary
    system.font.header
    system.font.monospace
    system.colors.foreground
    system.colors.background
    system.colors.header
    system.colors.highlight
    system.colors.accent
It might be reasonable to have more than this, and the accent and highlight color may or may not be the same color... but it would go a long way towards matching the system defaults, with appropriate css variables injected as well.

The branding people have definitely won this war here. I agree with you, but the answer to your final question is, sadly these days, never the user or the supposed owner of the hardware. I think it’s pretty easy to argue today that when you boot a computer or phone, it belongs to Apple or Microsoft or Google. When you open a website or “app,“ the computer temporarily belongs to its developer. The fact that even browsers don’t have a built-in, simple-to-configure option to toggle persistent cookies on or off per website, opt-in, of course, is all the evidence you need of that for the web. None of this is OK with me, but it’s the world we have now.

The problem is that most fonts don’t support basic OpenType features. I make heavy use of small caps on my websites (they are IMO criminally underrated). If I were not using a custom font, most users would get hideous “synthetic” small caps.

The esoteric part is the combination of "Setting preferred fonts for generic font families" AND the security adjustments necessary to trigger "Request for font XYZ blocked at visibility level 2"

Sure if you want to set browser prefs for fonts, go for it. It'll make the OG sites with almost no stylesheet a little more readable (looking at you, wiki.c2.com). But you should not expect or ask web page authors to not use their preferred fonts. If you want to override web page fonts, use a more invasive or pervasive tool.

Font/page size preferences, on the other hand, web page authors should respect and do a better job with.


It's mixed bag... the designer of a given website has an intended look/feel and style... if you override that you can do as you like, but it's not like the author's intent should always simply be dismissed.

Beyond this, not every web developer expressly wants to burden a browser to a specific web font payload when they have a close/suitable match where this modern font stack is good enough in terms of design intent.

Third, if all else fails, the user sees their own selected default... I'm not sure that I understand the objection here... As long as appropriate semantic markup and the font is one that actually scales to appropriate px/pt then it should be fine. If the selected font/typeface doesn't, then it's on the user to select a better default/fallback.


> it's not like the author's intent should always simply be dismissed.

Yes it is. The designer should always understand that the user is ultimately in control of a web page, and that their (the designer's) vision is not what matters at the end of the day.


If you choose to use w3m or lynx you get what you get. Same for disabling fonts or JS... most people don't have time to cater to 0.05% of users who go way off the norm.

> If you as a user want to see different fonts everywhere, you'll need invasive tools that block font face etc.

You have it backwards. These tools allow you to see the same fonts everywhere.

Just because the page author thinks lowercase f should look out of place doesn't mean I should have to see them like that. :p


Maybe it’s because I’m already familiar with how fonts are chosen in the browser, but - how does your example of using Monospaced Code demonstrate “render a different font than either or the user intended?” It looks to me like the font renders exactly as intended - the rules are applied, the series of options are considered in turn until the first one qualifies and that one is used.

How else would one expect a series of fallbacks like this to work?


> 1. `ui-monospace` - remains unsupported by Firefox which is lame (would also render 'Consolas').

Nothing but Apple operating systems even has a concept matching ui-monospace/ui-sans-serif/ui-serif/ui-rounded. And no one but Apple has implemented them in their browsers. I don’t believe they should be included in any standard: the very concept is not, in practice, cross-platform.

Even system-ui is super dodgy to use. In practice people have been using it as a proxy for a possibly-prettier sans-serif, but that’s just not what it is. The vast majority of its usage is inappropriate.


Your example is instructive, but I fail to see what the problem is. This is working as intended, no?

It already works as intended. If the intent is to render a default system font, then let the system handle that by simply applying 'monospace'.

That is clearly not the intention, else there would be no reason to bother with font stacks. The intention is to list a set of ranked preferences, implemented as fallbacks, that best express the designer’s vision for the site, while avoiding font downloading. In your example, presumably the designer thinks that Consolas works better than JetBrains Mono NL.

Yes, I see what you mean, but if that's really the intent, then having only this font-family rule isn't sufficient. For that argument/reasoning to hold up, it would have to be accompanied by metrics adjustments to compensate for the massive differences between some of the listed fonts in these stacks.

Absolutely true. In fact (and thank you for getting me to think about this), font stacks without metric adjustments don’t really make much sense, do they? (Unless confined to a list of fonts that are very close metrically, which they never are.)

It's exactly what the manual specifies: https://github.com/system-fonts/modern-font-stacks?tab=readm...

Windows 11+ -> Cascadia Code Windows 7+ -> Consolas


I tend to add Inconsolata (open Consolas-like typeface) as well as a fallback... since it's closer to what I'm intending if going for the Cascadia Code as a default... in case it's installed in non-windows or otherwise those fonts aren't present.

> Please, if you want to render font and it has to be something specific

Is that what this article is trying to achieve? I really like my car, but it's not what I'd reach for to haul a load of 4'x8' plywood home.


I don't understand your comment.

If you don't want to render a specific font from a given list, the font stack is redundant. If you do want to render a specific font from a given list, the font stack does not work (for the reasons given).


Interesting.

"privacy features prevent pages from querying non-standard system fonts"

Do you know if and where it is documented which fonts various browsers consider "standard" on which platform? I am afraid I know the answer but one can hope.


Microsoft publishes this, I don't know about others.

https://learn.microsoft.com/en-us/typography/fonts/windows_1...


How do I make sure my browser doesn't "protect" me in such a way?

I'm not sure why would you put "protect" in scare quotes here. This protection against fingerprinting is very real. Having any installed fonts that didn't come with the OS (and that includes fonts that are installed by other programs), makes your computer a lot more easy to fingerprint and track. Not everybody is interested in this protection, but this protection is very real.

It also doesn't seem to be enabled by default, since it tends to break some sites, as explained above. If you want to disable prevent Firefox from doing that, just don't set "Enhanced Tracking Protection" to Strict. You can even go for full Custom mode and enable "Protection from Suspected Fingerprinters" (which blocks some fonts as described by GP) only for private windows.


Just found this[0] implementation roadmap on Mozilla's wiki, recently updated too! At least it's actively being worked on.

Not going to lie, this makes me happy.

[0]: https://wiki.mozilla.org/WebDriver/RemoteProtocol/WebDriver_...


I think it's highly disingenuous of you to claim that the regulators in question are acting without any plan or purpose even if those might not be immediately clear. "If you don't like how the table is set, turn over the table."


There is chrome://geckoview/content/config.xhtml but many options shown there are nonfunctional. The relevant option is listed but I'm not sure if setting it to false has any effect.

Edit: Just found out that on that link above, you can set general.aboutConfig.enable to true to enable about.config.

It looks like the xml page and the about.config one are the same, as the modifications I made are synced.


Thank you so much for that! I was missing the ability to configure a very important option for me in Stable (layout.css.prefers-color-scheme.content-override), but couldn't keep using Nightly because of its instability... You're a lifesaver!


That still doesn't disable all telemetry from being sent. There's a whole slue of settings that you need to change in about:config and then there's still no guarantee.

Even if you follow those steps you listed there and uncheck all those boxes you're shown in the standard settings pages, then Firefox will just continue to send out 'pings' when you interact with certain elements in the browser interface. And that's just the tip of the iceberg.

Mozilla is like one of those politicians that just won't stop yapping about traditional conservative family values, who is later found to have several extramarital children and numerous affairs with same-sex partners themselves.


Could you tell us what other settings you need to change please?


You wouldn't know if they're doing a good enough job of it, that's the point of censorship.


Thinkpads come with that, an unspoofable indicator that will tell you with 100% certainty that your image is not being recorded or even recordable unless the physical operator of the machine allows it. Can't beat a physical cover if you really want to be sure!


Now make a cover for the microphone :)


Good point, I did conveniently gloss over that one didn't I!

A switch to break the physical wire connection is about the only thing I can come up with out of hand right now. I believe the PinePhones come with physical switches for their antenna's so there's that.


Framework laptops have physical power switches for camera and microphone. The devices completely disappears from the OS when the switch is moved.


What feels like a self-inflicted issue though is that the switches are fail-open, not fail-closed.

To allow for swappable bezels, the switches (on the plastic bezel) in fact just introduce obstructions in optocouplers (on the camera board screwed to the metal lid), which—I don’t know what they do due to Framework’s refusal to release the schematics, but I guess just cut the power line of the camera resp. the signal of the microphone using a couple of MOSFETs.

The problem is, the camera and the microphone are live if the obstruction is absent and disconnected if it’s present, not the other way around. So all it takes a hypothetical evil maid to make the switches ineffective is to pick up the edge of the bezel with a nail (it’s not glued down, this being a Framework) and snip two teensy bits of plastic off to make the switches nonfunctional while feeling normal. This is not completely invisible, mind you—the camera light will still function, you’ll still see the camera in the device list if you look—and probably not very important. But I can’t help feeling that doing it the other way around would be better.

I vaguely remember another vendor (HP?) selling laptops with a physical camera switch, but given the distance between the switch (on the side near the ports) and the camera (on the top of the display), I’m less than hopeful about it being a hardware one.


Say you tell me you want a red sphere. Taken at face value, you show a prejudice for red sphere's and discriminate against all other coloured shapes.

We've all had to dance that dance with ChatGPT by now, where you ask for something perfectly ordinary, but receive a response telling you off for even daring to think like that, until eventually you manage to formulate the prompt in a way that it likes with just the right context and winner vocabulary + grammar, and finally the damned thing gives you the info you want without so much as any gaslighting or snarky insults hiding in the answer!

It doesn't understand racism, it simply evaluates certain combinations of things according to how it was set up to do.


I believe you are vastly underestimating the capabilities of parrots or similarly intelligent birds.

At least when my pet parrot manages to fool me into whatever it is he wants to get out of me that time, he does it for his own primal benefit and not because it was programmed to adhere to some strict set of ethic and moral boundaries set by legal requirements and someone else's idea of how people should think and behave.


I don't think that following the primal benefit would be a good estimation for intelligence, despite the fact that such behavior is common for most species.

What makes human specie special is the ability of some individuals to create new things that didn't exist before. That's a loose criteria of course, because most individuals just follow educated social constructs for their entire life.


Oh yes I agree on that. I should have specified that I was arguing their ability to reason - which from my own experience these birds do most definitely possess to a surprising extend. They are smart, and they have all day to figure out which buttons to press to get you to do something specific they find funny or other such things.


The smart behaviour of parrots and their speech synthesis are two different phenomenon.

Parrots are definitely smart, and parrots can definitely speak, but they can't learn to speak beyond what they are trained to do. It's not like a parrot has ever spontaneously put together a coherent sentence independently.

LLMs aren't even that smart. Not even close.


Absolutely, I also replied to the OP's response below that I failed to specify that I was arguing parrots' ability to reason which I do believe exists to a great extend.

Regardless, speech is just another means of communication. In the end it doesn't really matter if I use perfectly articulated Swahili or just scream "aaar" at you for a few seconds as long as I get the cheeseburger with extra cheese I want from you. These parrots, much like children, just push your buttons and are quite good at finding (or negotiating) the right pattern of things to do and sounds to make to get to a certain outcome.


If you're familiar with the sandbox mmo EVE Online you might like Empires of EVE. They're very well put together and very thorough historical accounts of some massive and long term player driven content/conflicts throughout the history of the game. It was so much fun to read about why my side's leadership made certain decisions and about the other sides' perspectives of some of the space wars I was part of when I still played.

https://www.empiresofeve.com/


Oh man, I'd really like a copy of that and I see they have a sale on ($40 for both hardcover volumes), but then... $50 for international shipping is a bit steep.


Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: