Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: It took me 5() months to build a Plausible alternative

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 54 posts

Re: Show HN: It took me 5() months to build a Plausible alternative

#31

Post by 3abiton »

bpfrh wrote: post #30

I would be very carefull with saying your are gdpr compliant without having talked to laywer. Your are basically replacing a unique identifying attribute(ip address) with a unique attribute and a maybe unique attribute, to generate a unique attribute. The problem is not the ip address, the problem with analytics is that your want to count unique visitors but are not allowed to track any properties of the visitor that…

It's definitely not gdpr compliant, because the identifier is still unique. Any data collected per session identifier for user interaction with the website are bound to user consent and not covered under gdpr legitimate interest.

Re: Show HN: It took me 5() months to build a Plausible alternative

#32

Post by dcanelhas »

geewee wrote: post #18

It's unclear to me based on your post, but you do realize that public IPs very much count as personally identifiable information under the GDPR, right?

Is this really the case? It's very uncommon for an IP to resolve to an actual user these days due to widespread use of Carrier-Grade Networks Address Translation (CGNAT).

Assuming you had the public IP of an actual user though, how would you link it to a person without asking the ISP?

Re: Show HN: It took me 5() months to build a Plausible alternative

#33

Post by me_bx »

io84 wrote: post #26
udev4096 wrote: post #22

Your excuse for not using plausible is foolish. It's selfhostable. The real excuse would be creating a lightweight version of it because plausible is very much resource intensive. Also the price point doesn't really make sense.

Resource intensive on the hoster or on the browser running the script?

From my experience, on the server side. Not so suitable if you're hosting a tiny site in a tiny server.

Re: Show HN: It took me 5() months to build a Plausible alternative

#34

Post by solardev »

rognjen wrote: post #9

While admirable, a one time payment for a service you host is fair neither to you (what if I use it for 10 years) nor me (what if you shutdown tomorrow). On the other hand, a one time fee for analytics I could deploy on my server a) makes financial sense for you and b) is an intriguing value proposition for me. Have a look at https://once.com/

> Have a look at https://once.com/

...from the company behind Basecamp and Hey.com, both subscriptions.

Re: Show HN: It took me 5() months to build a Plausible alternative

#35

Post by BartjeD »

dcanelhas wrote: post #32
geewee wrote: post #18

It's unclear to me based on your post, but you do realize that public IPs very much count as personally identifiable information under the GDPR, right?

Is this really the case? It's very uncommon for an IP to resolve to an actual user these days due to widespread use of Carrier-Grade Networks Address Translation (CGNAT). Assuming you had the public IP of an actual user though, how would you link it to a person without asking the ISP?

According to case law it is personal information; Because in realistic scenario's you can use it in combination with some other data, such as from the browser headers, to identity someone with a high degree of accuracy.

Ofcourse this evolves as the landscape changes. And it isn't always the case. But the comment is accurate.

Re: Show HN: It took me 5() months to build a Plausible alternative

#36

Post by mijoharas »

bpfrh wrote: post #30

I would be very carefull with saying your are gdpr compliant without having talked to laywer. Your are basically replacing a unique identifying attribute(ip address) with a unique attribute and a maybe unique attribute, to generate a unique attribute. The problem is not the ip address, the problem with analytics is that your want to count unique visitors but are not allowed to track any properties of the visitor that…

Also, specifically an IP address is considered personal information under the GDPR as far as I understand it, which the person says they're storing (for 24 hours)

Re: Show HN: It took me 5() months to build a Plausible alternative

#37

Post by solardev »

dcanelhas wrote: post #32
geewee wrote: post #18

It's unclear to me based on your post, but you do realize that public IPs very much count as personally identifiable information under the GDPR, right?

Is this really the case? It's very uncommon for an IP to resolve to an actual user these days due to widespread use of Carrier-Grade Networks Address Translation (CGNAT). Assuming you had the public IP of an actual user though, how would you link it to a person without asking the ISP?

Yes. See https://commission.europa.eu/law/law-topic/data-protection/r...

Re: Show HN: It took me 5() months to build a Plausible alternative

#38

Post by phartenfeller »

solardev wrote: post #34
rognjen wrote: post #9

While admirable, a one time payment for a service you host is fair neither to you (what if I use it for 10 years) nor me (what if you shutdown tomorrow). On the other hand, a one time fee for analytics I could deploy on my server a) makes financial sense for you and b) is an intriguing value proposition for me. Have a look at https://once.com/

> Have a look at https://once.com/ ...from the company behind Basecamp and Hey.com, both subscriptions.

...and campfire, a one time fee slack alternative. Are people allowed to change their views?

Re: Show HN: It took me 5() months to build a Plausible alternative

#39

Post by solardev »

Avfrosta wrote: post #8
georg-stone wrote: post #7

Earlier quoted context omitted.

I signed up for an account and it seems you are showing a code snippet with an API key for client-side code. How do you handle authorization? Can anybody use up my 50k events if they steal the key?

No, that key is verified against your domain connected to your user credentials. Meaning that if someone else uses you key on their website, their POST request to my server will be declined because their domain is not the domain you provided. But you're right, might be a good idea to change the name of the key or work it out completely, it does look like it could be a vulnerability from an outsiders persepctive.

OP, how does this scheme work? If the client is authoritative, that means anybody can just copy that network request and spam you with fake data for that domain. Indeed, if I copy that network request and curl it with changed headers, I still get a 200, which suggests that this is the case...

I'm also concerned about your claim for GDPR compliance. Keeping an IP address for a day and then incrementing against it is still storing personal information, even if it's not in a cookie. Using a server to do the tracking doesn't automatically exempt it from cookie notices.

Storing the IP address for a day doesn't automatically make it non-PII, either. At the very least you should be hashing it. See what Plausible does at https://plausible.io/data-policy or read up on the GDPR discussion at https://ec.europa.eu/justice/article-29/documentation/opinio...

Re: Show HN: It took me 5() months to build a Plausible alternative

#40

Post by solardev »

phartenfeller wrote: post #38
solardev wrote: post #34

Earlier quoted context omitted.

> Have a look at https://once.com/ ...from the company behind Basecamp and Hey.com, both subscriptions.

...and campfire, a one time fee slack alternative. Are people allowed to change their views?

It just doesn't have much weight when the overwhelming bulk of their revenue comes from subscription services. It's cool that they're experimenting with this, I guess, but it doesn't exactly instill faith that the pricing model is sustainable. It's like how Google can afford to offer a bunch of free services because of the bazillions of ad dollars subsidizing everything.
Post reply on HN