Linked List: November 3, 2022

Thursday, 3 November 2022

Substitute Web Fonts With StopTheMadness 

Jeff Johnson:

I got a feature request from John Gruber, famous for Daring Fireball, also famous for despising the Arial typeface.

Honestly, the most shocking thing about the Apple Developer Program License Agreement is that the PDF is entirely typeset in Arial. Clearly it should be San Francisco, but Helvetica would be acceptable. Arial should be a firing offense.

What you may not know about Gruber, though, is that as much as he despises Arial, he dislikes Courier New even more! If Arial demands firing, then I suppose that Courier New demands… the firing squad? Anyway, Gruber requested that my Safari extension StopTheMadness add font substitution rules in order to replace all instances of Arial on the web with Helvetica and all instances of Courier New with Courier.

I told Gruber that he didn’t need to wait for me to add the feature, because substituting fonts was already possible in StopTheMadness on both desktop and mobile by using a custom <style> element containing some @font-face rules.

My favorite response to a feature request is always “Actually, you can do that now...”.

It’s such a little thing, and I know most people can’t detect the differences between Helvetica and Arial and don’t care, but it makes me so happy every day never to see the cursed fonts Arial and Courier New.

Also, if you prefer, you can substitute the system font — San Francisco — for Arial with the following CSS on the appropriate lines in Johnson’s rules:

src: local("system-ui");

If you’re not using StopTheMadness, you’re missing out.

Update 21 November 2022: Font substitution is now a built-in feature, with no need for custom CSS rules. Even better!

Speed Running the Content Moderation Learning Curve 

Mike Masnick, Techdirt:

And because I do hope that Musk succeeds and Twitter remains viable, I wanted to see if we might help him (and anyone else) speed run the basics of the content moderation learning curve that most newbies run into. The order of the levels and the seriousness of each can change over time, and how it all fits together may be somewhat different, but, in the end, basically every major social media platform ends up in this same place eventually (the place Twitter was already at when Musk insisted he needed to tear things down and start again).

Keep that popcorn popping.

InAppBrowser.com: See What JavaScript Commands Get Injected Through an in-App Browser 

Felix Krause, back in September:

Last week I published a report on the risks of mobile apps using in-app browsers. Some apps, like Instagram and Facebook, inject JavaScript code into third party websites that cause potential security and privacy risks to the user.

I was so happy to see the article featured by major media outlets across the globe, like TheGuardian and The Register, generated a over a million impressions on Twitter, and was ranked #1 on HackerNews for more than 12 hours. After reading through the replies and DMs, I saw a common question across the community:

“How can I verify what apps do in their webviews?”

Introducing InAppBrowser.com, a simple tool to list the JavaScript commands executed by the iOS app rendering the page.

It’s pretty creepy that TikTok both injects a JavaScript keylogger and does not have a button to open the current page in Safari.

I understand why in-app browsers are a thing on iOS (and iPadOS) but not on MacOS, but when you really think about it, it’s quite strange, and a vestige of the past when multitasking on iOS was so much more limited. Whenever possible, open links in Safari (or whatever your default browser is).