Looks exactly like plausible, may be change the ui a bit to avoid legal issues.
I was going to say that it looks exactly like BeamAnalytics, and now I'm confused to who's copying who...
Show HN: Vince – A self hosted alternative to Google Analytics
31–40 of 92 posts
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#32Earlier quoted context omitted.
It uses Pebble, the key-value store that backs CockroachDB.
Just saw this notice: > WARNING: Pebble may silently corrupt data or behave incorrectly if used with a RocksDB database that uses a feature Pebble doesn't support. Caveat emptor! Slightly worrying for now running this in prod if there is a risk for silent data corruption, but hopefully in a few years Vince would have drivers for Postgres / Clickhouse.
Reread the sentence, it says if you mix it with RocksDB (another database that has compatible file formats)
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#33If you don't have plans to offer saas, what are you trying to achieve from it? I mean, it is quite nice to have binary installation hosted on a single VPS, but will you support it?
FOSS lives!
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#34Does this work on your average 10,-/month shared hosting server? If so, it might really be „for everyone“. Otherwise, we are stuck with matomo.
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#35It says GDPR compliant and no cookies on the project page. How are unique visitors calculated? And I'm assuming it can't link conversions to campaigns without some cookie-alternative?
At least for Plausible, they state this ( https://plausible.io/blog/google-analytics-cookies ): > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippets and tracking cookies. Since IP addresses are considered personal data under GDPR, we anonymize them using a…
> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function.
Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely inadequate for some concerns.
(For IPv4, enumerating all four billion inputs is so completely practical that “one-way” is nonsense.)
I’m almost certain this is legal theatre.
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#36Does this work on your average 10,-/month shared hosting server? If so, it might really be „for everyone“. Otherwise, we are stuck with matomo.
> Does this work on your average 10,-/month shared hosting server?
Since they usually offer software via cPanel and alike, seems unlikely unless you give it lots of time for the project to first get popular enough to get on the "admin panels" mind, and secondly for them to integrate it.
Besides, do people really pay 10 USD/month for shared hosting? Sounds really expensive when you can grab VPSes for half that price and run whatever software you want, not just what they've packaged for you. I guess ongoing maintainace is included in that price, but still sounds kind of expensive for what you get.
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#37Earlier quoted context omitted.
At least for Plausible, they state this ( https://plausible.io/blog/google-analytics-cookies ): > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippets and tracking cookies. Since IP addresses are considered personal data under GDPR, we anonymize them using a…
> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely…
hm.. are you saying they need scrypt or something similar?
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#38Earlier quoted context omitted.
At least for Plausible, they state this ( https://plausible.io/blog/google-analytics-cookies ): > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippets and tracking cookies. Since IP addresses are considered personal data under GDPR, we anonymize them using a…
> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely…
If what they're doing is using a secure salt and then throwing the salt away once a day that _might_ be doing something.
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#39Earlier quoted context omitted.
At least for Plausible, they state this ( https://plausible.io/blog/google-analytics-cookies ): > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippets and tracking cookies. Since IP addresses are considered personal data under GDPR, we anonymize them using a…
> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely…
One way if you have a salt? Enumerating won’t help, you need to know the salt, which gets deleted.
That said, the whole IP thing is weird to me. Not only are we allowed to log IPs directly for security reasons, we even *have* to log IPs in certain cases (newsletter subscriptions).
Re: Show HN: Vince – A self hosted alternative to Google Analytics
#40Earlier quoted context omitted.
> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely…
hm.. are you saying they need scrypt or something similar?
The problem, in general with hashing IP addresses (especially ipv4) is that there's not that many of them.
If I tell you the value is either 1 or 2, but I hashed it with sha256 to make it secure, that's bullshit, right? You can just hash both and see which it is.
Same concept applies regardless of the hash algo, and still applies if you have more than 2 possible values, 4 billion or so possible ipv4 addresses is _not_ that many values to a computer.
Other common places this problem occurs is with any other restricted set of values, eg phone numbers and email addresses (most are at like 5 domains and are easy to guess/know).