Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Vince – A self hosted alternative to Google Analytics

github.com

Post reply on HN
Print view View original

41–50 of 92 posts

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#41

Post by chrismorgan »

gizzlon wrote: post #37
chrismorgan wrote: post #35

Earlier quoted context omitted.

> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely…

hm.. are you saying they need scrypt or something similar?

The “PII” label is taint that is probably impossible to dispel completely/perfectly, and difficult to dispel sufficiently (and deanonymising is an arms race).

Lossless techniques do nothing to dilute that taint.

Lossy techniques are necessary to get anywhere, such as disregarding certain bits of the address, or Bloom filters.

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#42

Post by dewey »

just-tom wrote: post #10

The screenshot on your homepage looks very similar to plausible's https://plausible.io/ which is also open-source analytics software. Is it based on it? What are the differences? Edit: Just noticed the feature comparison in the readme.

Also Plausible is almost stock TailwindUI elements + including the default color, so many sites look like that.

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#43

Post by dewey »

carlosjobim wrote: post #31
pdyc wrote: post #23

Looks exactly like plausible, may be change the ui a bit to avoid legal issues.

I was going to say that it looks exactly like BeamAnalytics, and now I'm confused to who's copying who...

Because everyone is using: https://tailwindui.com/components#product-marketing

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#44

Post by chrismorgan »

kadoban wrote: post #38
chrismorgan wrote: post #35

Earlier quoted context omitted.

> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely…

If what they're doing is using a secure salt and then throwing the salt away once a day that _might_ be doing something.

What I understand they’re doing is storing the salt in one place, a set of hashed IP addresses in another place, then daily trashing the lot after counting the number of elements in the set and storing that.

Information-theory-wise, this is no different to just storing the actual IP addresses (and deleting them daily after tallying, as before). It does mean that you need to obtain two things instead of just one, but if you get access to it all, it’s straightforward to reverse the lot (though computationally a little expensive), and easy to check a single value for a match.

The technique may be considered reasonable effort at protecting against casual abuse, but it’s not technically effective of itself, and it doesn’t stop the data from being PII. The important aspect is that the PII is deleted within 24 hours. My personal opinion is that the hashing part should probably be considered snake oil and whitewash, at least for what they’re claiming—I don’t say it’s useless, but it definitely doesn’t do what they’re touting it for.

Unless they’re actually keeping the hashed values for some reason after one day, and associating them with other records? In which case, disregard part of what I say, it’s obviously better than persisting IP addresses long-term! But also it’s extremely dubious to call that anonymisation as they do, because you can so often tie things together, behavioural patterns and such, to deanonymise. It’s frighteningly effective.

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#45

Post by rasso »

diggan wrote: post #36
rasso wrote: post #34

Does this work on your average 10,-/month shared hosting server? If so, it might really be „for everyone“. Otherwise, we are stuck with matomo.

> Does this work on your average 10,-/month shared hosting server? Since they usually offer software via cPanel and alike, seems unlikely unless you give it lots of time for the project to first get popular enough to get on the "admin panels" mind, and secondly for them to integrate it. Besides, do people really pay 10 USD/month for shared hosting? Sounds really expensive when you can grab VPSes for half that price a…

I don‘t know… around here (Germany), that‘s pretty common. No need to manage anything, no usage-based cost, … my favourite is https://all-inkl.com. OG no-bs hosting for boring tech.

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#46

Post by tingletech »

chrismorgan wrote: post #44
kadoban wrote: post #38

Earlier quoted context omitted.

If what they're doing is using a secure salt and then throwing the salt away once a day that _might_ be doing something.

What I understand they’re doing is storing the salt in one place, a set of hashed IP addresses in another place, then daily trashing the lot after counting the number of elements in the set and storing that. Information-theory-wise, this is no different to just storing the actual IP addresses (and deleting them daily after tallying, as before). It does mean that you need to obtain two things instead of just one, but…

If you throw away the daily random salt (but keep the obscured IP address), how can you check a single value for a match the next day?

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#48

Post by TravisPeacock »

james-bcn wrote: post #30
zoidb wrote: post #26

My go-to self hosted GA alternative is goatcounter https://www.goatcounter.com . It would be interesting to know what advantages it has over it.

Oh I like that main dashboard. Very simple.

If you like that there is https://www.piratepx.com/ which is even more minimal (though less data), I also built something even MORE minimal (only API calls) https://github.com/teamcoltra/ninjapx but I'm certainly not recommending it. It is super simplistic (also the readme is embarrassing)

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#49

Post by jszymborski »

chrismorgan wrote: post #35
beeb wrote: post #27

Earlier quoted context omitted.

At least for Plausible, they state this ( https://plausible.io/blog/google-analytics-cookies ): > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippets and tracking cookies. Since IP addresses are considered personal data under GDPR, we anonymize them using a…

> Since IP addresses are considered personal data under GDPR, we anonymize them using a one-way cryptographic hash function. Um... hashing IPv4 addresses, even with salt, does literally nothing to anonymise (assuming the output space is at least ~32 bits, which I think is safe to assume): they’ll still be PII. IPv6 addresses I’m not so confident about; maybe it would be sufficient for some parts, but it’s definitely…

What matomo does is mask parts of the IP address (you choose how much).

Re: Show HN: Vince – A self hosted alternative to Google Analytics

#50

Post by [deleted] »

chrismorgan wrote: post #44
kadoban wrote: post #38

Earlier quoted context omitted.

If what they're doing is using a secure salt and then throwing the salt away once a day that _might_ be doing something.

What I understand they’re doing is storing the salt in one place, a set of hashed IP addresses in another place, then daily trashing the lot after counting the number of elements in the set and storing that. Information-theory-wise, this is no different to just storing the actual IP addresses (and deleting them daily after tallying, as before). It does mean that you need to obtain two things instead of just one, but…

[deleted]
Post reply on HN