Show HN: I made a privacy-first minimalist Google Analytics • Hacker News Board

Re: Show HN: I made a privacy-first minimalist Google Analytics

#181

Post by r1ch » Wed, Sep 19, 2018, 9:14 PM UTC

Are there any plans to support SRI? It's a pretty big security risk to incorporate 3rd party JS onto all pages - if someone compromises your CDN account then they have full control over every site that's using this code.

This is one of the top ways that credit card breaches are happening lately - e-commerce sites include tons of 3rd party tracking / analytics / remarketing / etc code on their checkout pages, one of them gets hacked and the modified JS posts the credit card form to some compromised server.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#182

Post by ficklepickle » Wed, Sep 19, 2018, 9:16 PM UTC

cbnotfromthere wrote: post #105

pierrefar wrote: post #62

Looks good! I'm the founder of a similar service (Blockmetry). Obviously non-tracking web analytics is the future! I'm curious why you chose to host the data yourself instead of giving customers the data immediately at the point of collection. That's the path we chose for Blockmetry as it genuinely required to be a non-tracking web analytics service and makes it impossible to profile users. Any service that hosts its…

Similar service???? Simple Analytics is a real service. Blockmetry is a 90's-looking page with a "contact sales" button and not even a demo (nevermind a real product).

I like to give people the benefit of the doubt. If criticism is necessary, then might as well make it constructive.

Sure, the blockmetry site has some issues. The menu is unusable on my mobile (android) and there are no screenshots or explanation of how it actually works (server/client side, self/cloud hosted?). There are some style choices that I don't agree with, like the binary background pattern.

But I like to assume good faith unless I have some solid evidence otherwise. Do you know for a fact that there is no product? If so, please share :)

It is, however, poor form to plug your competing product in a Show HN. It's a fine line between mentioning and plugging, but I think offering a discount falls on to the wrong side of the line.

All these things can be pointed out politely.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#183

Post by vassilyk » Wed, Sep 19, 2018, 9:20 PM UTC

I think everyone starts like that.

Then, clients that help keeping lights on start asking for this and that.

And suddenly you end up providing a service with user level insights, cross-device tracking and advanced behavioral segments powered by ML because why not.

GA was simple, before.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#184

Post by ficklepickle » Wed, Sep 19, 2018, 9:21 PM UTC

dwild wrote: post #70

danielbln wrote: post #51

Earlier quoted context omitted.

You could argue that if it is very early stage, then it's maybe not the right time to charge $12/month.

Or maybe it's the right time to charge $12/month? Usually too early you don't want many low paying customer which would imply too much support while you iterate quickly. A low number of high paying customer is much better. It's also easier to lower the cost later than increasing it. It's hard early on to find the right price point. If he doesn't sale as much as he want, he will adapt.

Amen.

If he had offered it for free initially, haters would say the author must think it is worthless.

This place is the last bastion of civility on the internet. Let's keep it constructive. Pretty please?

Re: Show HN: I made a privacy-first minimalist Google Analytics

#185

Post by pdkl95 » Wed, Sep 19, 2018, 9:22 PM UTC

harianus wrote: post #101

pdkl95 wrote: post #88

Earlier quoted context omitted.

> unnecessarily track users without their consent Regardless of your intentions, you are collecting enough data to track users. > I am transparent about what I collect ([URL]) That page doesn't mention that you are also collecting (and make no claim about storing) the globally-visible IP address (and any other data in the IP and TCP headers). This can be uniquely identifying; even when it isn't unique you usually onl…

Good comment! I only store the window.innerWidth metric. I updated the what we collect page ( https://simpleanalytics.io/what-we-collect ) to reflect the IP handling. We don't store them. And fingerprinting is something that would be definitely tracking, not on my watch!

> We don't collect and store IPs.

First, "IPs" might be confusing; "IP addresses" would be more accurate.

More importantly, you have to collect IP addresses (or any other value in the packet headers[1][2]) - even if you don't store it - if you want to receive any packets from the rest of the internet. Storage of those values is separate issue entirely, and it's good to hear that you are intending to NOT store IP addresses (and updating the documenting)!

Also, I strongly recommend using Drdrdrq's suggestion to lower the precision of the collected window dimensions, which should be done on the client i.e. "Math.floor(window.innerWidth/50)*50". This kind of bit-reduction makes fingerprinting a lot harder.

[1] https://en.wikipedia.org/wiki/IPv4#Header

[2] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...

Re: Show HN: I made a privacy-first minimalist Google Analytics

#186

Post by wongarsu » Wed, Sep 19, 2018, 9:26 PM UTC

nickdandakis wrote: post #180

wongarsu wrote: post #166

Earlier quoted context omitted.

Incrementing counters for pageviews, visited page, referer and page width, and putting that into chartjs is something I can put together myself in two hours. It wouldn't be nearly as polished, but it would be 90% there and good enough. Plus I would have a much better idea how well it scales, and generally have less unknowns and risks. The goal is great, the design is sleek, but at the current price point (which is al…

I made an argument about this offering vs other offerings, not this offering vs rolling your own, which is a whole different issue. It's incredible how many developers undervalue their own time, effort, and liability. I believe you're mistaken if you think this'll only take two hours of your time. Even if that's true, I believe you're mistaken that your two hours of time is cheaper than $9/mo. I'm also certain that b…

> I made an argument about this offering vs other offerings

No you didn't. You argued what it shouldn't be compared to, so I compared it to something else.

> I'm also certain that being responsible for analytics sets you up for liabilities

Outsourcing analytics opens me to the same or worse legal liabilities.

> Even if that's true, I believe you're mistaken that your two hours of time is cheaper than $9/mo.

I don't live in Silicon Valley, so $9/mo pays for two hours within a few months. Sure, there's hosting and an uncertain maintenance burden, but on the other hand buying a service has its own uncertain overheads.

What happens if the service is down, what if it fails to scale, what if it gets hacked? What if it just disappears because there weren't enough customers? Most of these are much easier to answer and take up less time with a self-built service.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#187

Post by artur_makly » Wed, Sep 19, 2018, 9:27 PM UTC

i love the personal video on a privacy-first site. its a really nice touch. (no sarcasm) It's really refreshing.

We will consider it. Thanks for making this. hopefully more companies will follow suit.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#188

Post by amichal » Wed, Sep 19, 2018, 9:29 PM UTC

eli wrote: post #92

I think there are a lot of misconceptions about how Google Analytics tracking works. I'm pretty sure a vanilla GA setup does not, in fact, create profiles that track you across the web. For one thing, all the cookies it creates are first-party (on your domain). I still get objecting to Google products on principle, but their privacy policy for GA seems pretty reasonable to me: https://support.google.com/analytics/ans…

Also:

> When a customer of Analytics requests IP address anonymization, Analytics anonymizes the address as soon as technically feasible at the earliest possible stage of the collection network. The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to the Analytics Collection Network. The full IP address is never written to disk in this case.

https://support.google.com/analytics/answer/2763052?hl=en

Re: Show HN: I made a privacy-first minimalist Google Analytics

#189

Post by dotancohen » Wed, Sep 19, 2018, 9:36 PM UTC

sharcerer wrote: post #122

LyndsySimon wrote: post #104

Earlier quoted context omitted.

I think there's value in at least distributing the data that's collected. I may not like that the analytics provider has my data, but it seems like a lesser evil if that provider isn't also the world's largest ad company and they aren't using it to build profiles behind the scenes to track my every move across a significant part of the Internet. Given the choice between a lot of data about me given to a small provide…

Thats no a good way to make a decision. Big,small doesn't matter. What matters is who is providing better security? When 2 parties big,small are collecting data ,then the party which can act on security vulnerabilities quickly and has great security engineers and dedicated teams like Project Zero- is the much better choice. People nowadays assume that a small,indie developer is a good guy. I am just pointing out that…

> When 2 parties big,small are collecting data ,then the party which can act on security vulnerabilities quickly and has great security engineers and dedicated teams

This cannot be stressed enough. At my day job I write reasonably secure software on a team for big clients, then at home I write reasonably secure software independently for small clients.

Come new security issue, the big clients at day job get first priority. Not because they are big and not because they are paying more, but rather because as a team we can reallocate resources and work on issues in parallel. At home, there is only one Dotan to work on each independent client in series.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#190

Post by wongarsu » Wed, Sep 19, 2018, 9:36 PM UTC

highace wrote: post #175

wongarsu wrote: post #166

Earlier quoted context omitted.

Incrementing counters for pageviews, visited page, referer and page width, and putting that into chartjs is something I can put together myself in two hours. It wouldn't be nearly as polished, but it would be 90% there and good enough. Plus I would have a much better idea how well it scales, and generally have less unknowns and risks. The goal is great, the design is sleek, but at the current price point (which is al…

There's always one. https://news.ycombinator.com/item?id=9224

Dropbox is a glorified FTP client, Slack is IRC with a nice skin and inline pictures, Spotify is bittorrent without the hassle of downloads (and more legal, but that hasn't stopped people). Convinience matters, and convinience sells. But it is only one of many factors that play into the decision to purchase. Dropbox for example wouldn't sell all that great without the free tier.