Live data from Hacker News

Show HN: I made a privacy-first minimalist Google Analytics

simpleanalytics.io

81–90 of 272 posts

Re: Show HN: I made a privacy-first minimalist Google Analytics

#81

Creator here. As a developer, I install analytics for clients, but I never feel comfortable installing Google Analytics because Google creates profiles for their visitors, and uses their information for apps (like AdWords). As we all know, big corporations unnecessarily track users without their consent. I want to change that. So I built Simple Analytics. To ensure that it's fast, secure, and stable, I built it entir…

[deleted]

Re: Show HN: I made a privacy-first minimalist Google Analytics

#83
post #11

Creator here. As a developer, I install analytics for clients, but I never feel comfortable installing Google Analytics because Google creates profiles for their visitors, and uses their information for apps (like AdWords). As we all know, big corporations unnecessarily track users without their consent. I want to change that. So I built Simple Analytics. To ensure that it's fast, secure, and stable, I built it entir…

nice job! i like the direction you are taking with this project. it's still young, so we don't know X) you might get bitten too lol anyways, wish you the best luck with your endeavor. btw you might want to fix links above.

Thank you! Fixed the links.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#84

Earlier quoted context omitted.

I see what you mean https://simpleanalytics.io/adriaan.io

Some people are taking advantage of this to leave messages for us: https://simpleanalytics.io/simpleanalytics.io Edit: It seems to have been filtered now, but people were using spoofed referer headers to leave offensive messages for HN users.

Yeah, I saw that too. Someone tested for XSS in the referer too ( tag) but luckily it was escaped

Re: Show HN: I made a privacy-first minimalist Google Analytics

#85
post #61

This is a great idea and I love the design. It looks like anyone can see the stats for any domain using the service without any authentication. I added the tracking code to my domain and was able to hit https://simpleanalytics.io/[mydomain.co.uk] without signing up or logging in. I was also able to see the stats for your personal site. Is that intentional? If it is, it seems like an odd choice for a privacy-first ser…

Part of the offering is transparent (public) analytics

Re: Show HN: I made a privacy-first minimalist Google Analytics

#87
post #85
post #61

This is a great idea and I love the design. It looks like anyone can see the stats for any domain using the service without any authentication. I added the tracking code to my domain and was able to hit https://simpleanalytics.io/[mydomain.co.uk] without signing up or logging in. I was also able to see the stats for your personal site. Is that intentional? If it is, it seems like an odd choice for a privacy-first ser…

Part of the offering is transparent (public) analytics

It says there's the ability to make them public, but it doesn't mention that they'll be public by default. Maybe it's different if you sign up first before adding the tracking code, but it's odd that I can use the tracking code without signing up for the trial.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#88

Creator here. As a developer, I install analytics for clients, but I never feel comfortable installing Google Analytics because Google creates profiles for their visitors, and uses their information for apps (like AdWords). As we all know, big corporations unnecessarily track users without their consent. I want to change that. So I built Simple Analytics. To ensure that it's fast, secure, and stable, I built it entir…

> unnecessarily track users without their consent

Regardless of your intentions, you are collecting enough data to track users.

> I am transparent about what I collect ([URL])

That page doesn't mention that you are also collecting (and make no claim about storing) the globally-visible IP address (and any other data in the IP and TCP headers). This can be uniquely identifying; even when it isn't unique you usually only need a few bits of additional entropy to reconstruct[1] a unique tracking ID.

In my case, you're collecting and storing more than enough additional entropy to make a decent fingerprint because [window.innerWidth, window.innerHeight] == [847, 836]. Even if I resized the window, you could follow those changes simply by watching analytics events from the same IP that are temporally nearby (you are collecting and storing timestamps).

[1] An older comment where I discussed how this could be done (and why GA's supposed "anonymization" feature (aip=1) is a blatant lie): https://news.ycombinator.com/item?id=17170468

Re: Show HN: I made a privacy-first minimalist Google Analytics

#89
To everyone complaining about the price point for this service.

You are part of The Problem.

This is a solo dev's venture, that has a relatively pure and straightforward goal. If you can't afford it, don't use it and pick one of the others.

Do NOT compare this with a B2C offering that has nothing to do with analytics.

Do NOT compare this with a B2B offering that's free and feeds your user's data into the parent corporation's advertising revenue stream.

Do NOT compare this with a B2B offering that is open-source, with a team of a dozen core contributors that has had a decade of development under its belt.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#90
post #17

I've moved away from using any kind of script embedded in my webpages for tracking and instead just use Goaccess ( https://goaccess.io/ ) to analyze my logs. Though there are obvious caveats with this, you need to install it, configure the server logging to match it and so on. But personally the benefits outweighs the cons, it all runs on the server, you are the sole owner off all the data and this tracking doesn't r…

Isn't there a problem with GDPR compliance if you want to serve European pages? You are allowed to log IP addresses for security reasons. However, as far as I understand the situation, you need the agreement of the users if you use their personal data, which includes IP addresses, for anything else. Has somebody figured out how to resolve this situation with log files?

You can use goaccess to create a log every day to json, excluding IP while retaining stats for geolocation.

For this you can logrotate daily and run goaccess before rotation. I believe you can keep the server logs for a week for debugging while respecting GDPR.

For today's "realtime" data you can use goaccess on today's log on demand and use a cache.

You can write your custom stat viewers or use goaccess to view time range data from multiple json files.

Post reply on HN