1861270 - Latest snap no longer displays fonts in /usr/local/share/fonts

Status: UNCONFIRMED

(Core :: Layout: Text and Fonts, defect)

Description

[Basil Crow]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0

Steps to reproduce:

Install Firefox 119 (snap) on Ubuntu 22.04.3 LTS x86_64. Place custom fonts in /usr/local/share/fonts and refresh the cache with fc-cache fv. Verify the new fonts are available in fc-list. Then open a web page that uses one of those fonts.

Actual results:

Any fonts in /usr/local/share/fonts are not usable; instead, the default font is shown. However, fonts in /usr/share/fonts are usable.

Expected results:

The fonts in /usr/local/share/fonts should be usable. This was working with previous versions of the snap prior to the most recent upgrade to version 119.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Layout: Text and Fonts' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[:gerard-majax]

Attachment: Capture d’écran du 2023-11-06 19-40-28.png

I dont reproduce. Please share snap info firefox; snap info snapd as well as snap connections firefox

Comment 3

[:gerard-majax]

Also maybe journalctl -fxe

Comment 4

[:gerard-majax]

Just to make sure, do you reproduce only with snap package or also with deb/targz ? If you were provided older builds, do you think you could try and pinpoint a range of regression ?

Comment 5

[Basil Crow]

I tracked down the problem to this entry in the release notes:

The visibility of fonts to websites has been restricted to system fonts and language pack fonts in Enhanced Tracking Protection strict mode to mitigate font fingerprinting.

After unchecking "Suspected Fingerprinters" fonts work again. That feature seems overly restrictive. I think there should be a way to add exceptions for a handful of my favorite fonts.

Comment 6

[:gerard-majax]

I'll defer to people knowledgeable about fonts

Johnathan, do you know ?

Comment 7

[Thinker Li [:sinker]]

Firefox has hard coded lists of font families for various Linux distros.
For example, ubuntu and fedora has their lists of font families.
It will prevent a web page from detecting what fonts have been installed on a device in order to compute a fingerprinter.

My concerns is they are hard coded and supporting only Ubuntu and Fedora. [1] To support this feature, other distros have to change the source or apply a patch. And, users can not adjust it as well.

I would suggest to add a preference to add additional font families to the list of base installation.

[1] https://searchfox.org/firefox-main/rev/3aebb6379edcbff17a326efe55a49aedeb54f9b8/gfx/thebes/gfxFcPlatformFontList.cpp#1814

Comment 8

[Nathan Teodosio :nteodosio]

I would suggest to add a preference to add additional font families to the list of base installation.

Wouldn't that weaken the fingerprinting protection?

I'd argue that the only possible problem here is the lack of indication as to its reason. The strict and custom modes of protection do have a warning that web-sites can misbehave.

Reporter: It would be useful to know if the console or the stderr has any clue as to this issue, as a test with a local file, as it certainly won't be classified as a potential fingerprinter, will not detect the issue.

Comment 9

[Thinker Li [:sinker]]

(In reply to Nathan Teodosio :nteodosio from comment #8)

I'd argue that the only possible problem here is the lack of indication as to its reason. The strict and custom modes of protection do have a warning that web-sites can misbehave.

That is true. However, for unsupported distros, the visibility of every family is Unknown if I read the code correctly. That mean all fonts are exposed to the content. With a preference, package has a chance to set it properly.

And, it is a user's choice to expose one or a few fonts to content. We definitely not want the user to expose everything in his device.

Comment 10

[BugBot [:suhaib / :marco]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:jfkthame, since the bug has recent activity, could you have a look please?

For more information, please visit BugBot documentation.

Comment 11

[Jonathan Kew [:jfkthame]]

Seems like a few questions arise here:

• should we do something (more than we currently do: I think we have a web console warning already) to alert users when fonts are blocked, potentially affecting site content?

• should we provide a way for users to expose individual additional fonts (thus weakening their fingerprinting protection) short of disabling the protection altogether?

• what to do about font-fingerprinting protection on arbitrary Linux distros?

ni? to Tom for any relevant thoughts.

Comment 12

[Tom Ritter [:tjr]]

should we do something (more than we currently do: I think we have a web console warning already) to alert users when fonts are blocked, potentially affecting site content?

I'm open to ideas, but I think anything is going to have a high bar due to both implementation complexity and priority. We obviously get a small trickle of these types of bugs, so it is tripping users up, but is it more important to address that, than say, adding new fingerprinting protections? And what would it look like? As a straw-man, if we detect a website using a font we block we could animate the shield icon. Would that draw enough attention? And if we do that, have we burned the opportunity to animate the shield icon for something else, like detected/blocked fingerprinting and tracking attempts (and the goal of surfacing felt privacy.)

should we provide a way for users to expose individual additional fonts (thus weakening their fingerprinting protection) short of disabling the protection altogether?

IMO; no. That lever is just too granular for 99.9999% of people. Technically the font allowlist (whitelist in the code) is still around, so you could set up your own font allowlist if you really want to.

what to do about font-fingerprinting protection on arbitrary Linux distros?

From our data collection, we learned that we cover about 50% of Linux users with the font allowlists we have today. That's not great - but it's also really annoying trying to build (and maintain) a font list for a system.

From the data collection we also learned that linux users typically have a more unique canvas fingerprint, which works against them. We also had profiled three font fingerprinters and of those three none of them queried fonts that were in any of our Ubuntu/Fedora font lists, meaning for Linux users, everyone who had a font list presented the same font fingerprint to those fingerprinters - so that's good!

The data collection we did was intentionally limited to not collect things we thought were too expansive: so we have no answer to the question "What percentage of Linux users without a font allowlist have a font that is queried by a fingerprinter" - but perhaps we can investigate that in the next round...

So I would posit that for now we do the following:

1. Support distros in putting in their own fontlists. Arch, for example carries local patches to Firefox. If an Arch dev showed up here saying they wanted to have a list of fonts for Arch, I would land code that makes it extremely simple for them to carry their own local patch containing just the fonts - and then it's up to them to maintain the font list in accordance with their default fonts. Anyone can point their distros developers at this comment for them to consider the feature for themselves.
2. When we run another round of data collection, we will look at font fingerprinters and font fingerprinting better. If this leads us to conclude that non-supported distros have an outsized fingerprinting risk, we can go from there. Of course if a distro disables telemetry for all their users, we won't learn anything at all about them, so they'll be on their own.

Comment 13

[Basil Crow]

Technically the font allowlist (whitelist in the code) is still around, so you could set up your own font allowlist if you really want to.

Sorry if I missed something, but is there a way for me to set a user option to allow a handful of my preferred fonts? If so, can you please point me to the documentation? If not, then I think there needs to be a way for users to do this.

Comment 14

[Tom Ritter [:tjr]]

(In reply to Basil Crow from comment #13)

Technically the font allowlist (whitelist in the code) is still around, so you could set up your own font allowlist if you really want to.

Sorry if I missed something, but is there a way for me to set a user option to allow a handful of my preferred fonts? If so, can you please point me to the documentation? If not, then I think there needs to be a way for users to do this.

There is the font.system.whitelist preference. Here is the most relevant code for it - my understanding is that listing fonts in this pref will only allow those fonts on the system to be used. (Web-provided fonts would still be used also.) I would note that this is an unsupported feature, so we don't intend to expand its functionality, but if you encounter issues using it, I could make a custom build that adds logging to this function so you can debug your problem matching fonts. (Just file a new bug and needinfo? me.)