Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
github.com/jinya-cms/jinya-fonts
Jinya Fonts is a simple dropin replacement for Google Fonts that doesn't track your users. The public instance of Jinya Fonts is available under fonts.jinya.de.
Jinya Fonts is a Go application that has two commands. The first command serves the font on port 8090. The second command syncs the fonts from Google Fonts to your hard drive.
The configuration options of Jinya Fonts are rather simple, this is the structure:
api_key: <api token>
font_file_folder: ./data
filter_by_name:
- <font name>
admin_password: <secure admin password>
serve_website: true
The api token
is has to be a valid Google Fonts API token, you can generate
one here.
The filter_by_name
option is optional and allows you to only sync the fonts you want.
The admin_password
option, should be a secure random token. This password can be used to login into the admin
dashboard. If you don't set it, the admin dashboard will be disabled.
If the serve_website
option is set to true the frontend of Jinya Fonts will be served.
To serve the Go application on port 8090, simply run the compiled Go binary with the command serve and the config file provided. This is how the command looks:
./jinya-fonts serve -config-file=./config.yaml
To sync the fonts from Google Fonts run the application with the command sync and the config file provided, this looks like follows:
./jinya-fonts sync -config-file=./config.yaml
The most convenient way to run Jinya Fonts is with our prebuilt docker images. Simple run the following command:
For serving the Jinya Fonts endpoints:
docker run -d -p 8090:8090 --name jinya-fonts -v /your/jinya/fonts/dir:/data jinyacms/jinya-fonts /app/jinya-fonts -config-file=/data/config.yaml serve
For syncing from Google Fonts:
docker run -d --name jinya-fonts-sync -v /your/jinya/fonts/dir:/data jinyacms/jinya-fonts /app/jinya-fonts -config-file=/data/config.yaml sync
Jinya Fonts is API compatible to Google Fonts. The advantage is, that you can simply choose your font set
from fonts.google.com. Then you replace host from fonts.googleapis.com
with your host. And
that is all. For example
https://fonts.googleapis.com/css2?family=Space+Mono:ital,wght@0,400;0,700;1,400;1,700&display=swap
Turns into:
https://fonts.jinya.de/css2?family=Space+Mono:ital,wght@0,400;0,700;1,400;1,700&display=swap
Jinya Fonts also has a web interface where you can grab filter for fonts and select the weights and styles you want. Just check fonts.jinya.de. If you host your own Jinya Fonts instance, point the browser to your own instance.
Adding custom fonts is rather simple, just access the admin dashboard under https://<jinya-fonts-instance>/admin and enter the admin password. After that you can create a new font and add font files to it.
Jinya Fonts doesn't track your users, and therefore you don't need to mention it in your data protection page. We also set no cookies or similar. Apart from that we also disabled
If you found a bug feel free to create an issue on Github or on my personal Taiga instance: https://taiga.imanuel.dev/project/jinya-fonts/
Jinya Fonts is licensed under the MIT License.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.