Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I made a privacy-first minimalist Google Analytics

simpleanalytics.io

Post reply on HN
Print view View original

231–240 of 272 posts

Re: Show HN: I made a privacy-first minimalist Google Analytics

#231

Post by zaarn »

ucarion wrote: post #123
AdriaanvRossum wrote: post #2

Creator here. As a developer, I install analytics for clients, but I never feel comfortable installing Google Analytics because Google creates profiles for their visitors, and uses their information for apps (like AdWords). As we all know, big corporations unnecessarily track users without their consent. I want to change that. So I built Simple Analytics. To ensure that it's fast, secure, and stable, I built it entir…

First off: hats off for making a product that takes the rights of the end user seriously! However, I am a bit confused as to who would want this product. The sort of questions this product answers seem quite limited: 1. What URLs are getting lots of hits? 2. What referrers are generating lots of hits? 3. What screen sizes are those hits coming from? What decisions can be drawn from those questions? This seems useful…

Hi,

I might be able to help because I wrote an analytics tool a while back that tracks these three properties and some other stuff

1. Knowing which URLs are being visited allows me to see if a particular campaign or blog site is popular

2. The referrer tells me where a user came from, this is helpful to know if I'm being linked to reddit and should allocate more CPU cores from my host to the VMs responsible for a particular service

3. The screen size allows me to know what aspect ratios and sizes I should optimize for. My general rule is that any screen shape that can fit a 640x480 VGA screen without clipping should allow my website to be fully readable and usable.

4. I also track a trimmed down user agent; "Firefox", "Chrome", "IE", "Edge", "Safari" and other. All will include "(recent)" or "(old)" to indicate version and other will include the full user agent. This allows me to track what browsers people use and if people use outdated browsers ("(old)" usually means 1 year out of date, I try to adjust it regularly to keep the interval shorter)

5. Page Load Speed and Connection. This is a number in 10ms steps and a string that's either "Mobile" or "Wired", which uses a quick and dirty heuristic to evaluate based on if a connection is determined to be throttled, slow and a few other factors. Mobile means people use my website with devices that can't or shouldn't be drawing much bandwidth, Wired means I could go nuts. This allows me to adjust the size of my webpage to fit my userbase.

6. GeoIP: This is either "NAm", "SAm", "Eur", "Asi", "Chin", "OcA", "NAf", "SAf", "Ant" or "Other". I don't need to know more than the continent my users live on, it's good enough data. I track Chinese visitors separately since it interests me.

Overall the tool is fairly accurate and high performance + low bandwidth (a full analytics run takes 4KB of bandwidth including the script and POST request to the server). It doesn't collect any personal data and doesn't allow accurate tracking of any individual.

If I want to track high interest users, I collate some attributes together (Ie, Screen Size, User Agent, Continent) which gets me a rough enough picture of high interest stuff for what I care. You don't need to track specific user sessions, that stuff is covered under the GDPR and not necessary.

Before anyone asks if they could have this tool; nope. It's proprietary and mine. The code I've written for it isn't hard, very minimal and fast. I wrote all this over a weekend and I use influx + grafana for the output. You can do that too.

Both mine and the product of the HN post are likely not in the scope of the GDPR since no data is collected that can specifically identify a user.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#232

Post by zaarn »

ucarion wrote: post #214
boernard wrote: post #157

Earlier quoted context omitted.

Since the creator points out that he doesn't store any IP addresses, he doesn't store any data that allows identifying an individual. For the GDPR to be applicable you need to store data that allows you to identify an individual. Thus when you use this, you don't have to think about GDPR.

I'm not so sure. By putting this service's code on your website, you transmit personal data (IP addresses) to this third party. That appears to make the GDPR applicable here? Transmission is considered "data processing" under the GDPR. Really, the central point that should be clear is that this is a question for lawyers. The GDPR is incredibly far-reaching.

The IP necessary for the connection itself is covered under necessary data, you can process it for the purpose of a request without needing consent at all. Same applies to shopping cart cookies or anything else that is essential to running a website and isn't being used for secondary purposes like data mining.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#233

Post by enriquto »

harianus wrote: post #19
lucideer wrote: post #13

Earlier quoted context omitted.

This look great—have bookmarked it for future projects. I would however a little more skeptical with tools claiming to be privacy-first than I would be with GA (who I presume are not privacy-first). On that note, some quick questions: - Any plans to open source? I've used Piwik/Matomo in the past, and while I'm not a massive fan of the code-quality of that project, it's at least auditable (and editable). - You say yo…

- No plans to go open source with the backend, but I do show the code that is run in the browser. The visualisation of the data is not super important I think. - I don't save IP's, not even in the logs. - I don't have unique pageviews at the moment. I will in the future. If the referrer is the same as the current page, I will measure that as a non-unique. What do you think?

> No plans to go open source with the backend

You say that you do not store IP addresses, but why should anybody believe it?

Modern security is based on proof, not on trust.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#234

Post by marichards »

seandougall wrote: post #222
tagawa wrote: post #220

Earlier quoted context omitted.

Even if a user trusts Google, because the data is digital and therefore permanent, there's no guarantee it will remain internal forever, whether that's because of a hack, a rogue employee, police/government pressure, or a change of ownership.

It seems to me that, with the exception of a rogue employee, all of those examples are at a greater risk of occurring with a small, independent provider. Google almost certainly has more security resources, more legal resources and political clout, and isn’t likely to be acquired any time soon. I can’t say I love having Google track me, but I don’t feel any better about someone else doing it either.

If the marketplace was full of independent trackers (which I'm not suggesting is a good idea, because third party trackers are bad in the first place), then as they get compromised, only a small subset of data is lost... The chance of losing everything or enough data to pair to your real identity is a lot lower. It's like IDs in physical activity. If you visit your bank they track you by a different id to the library, your medical record, etc, each might be lost individually and be upsetting, but do they reveal data about all the others? No.

Why is Google security better than anyone else? Monopolies often have more resource, but lack motive, because they are a monopoly. Without transparency we have no idea how secure Google's systems are, but we do know Google has been hacked before.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#235

Post by whylo »

harianus wrote: post #198
tzury wrote: post #117

So this is open to everyone? I mean, can I just see stats of a site that uses the service? e.g. https://simpleanalytics.io/simpleanalytics.io

No, only if you make it public.

I was able to add the tracking code to my site without signing up and could see the stats without any authentication (see my other comment: https://news.ycombinator.com/item?id=18024886). Is that by design?

Re: Show HN: I made a privacy-first minimalist Google Analytics

#236

Post by mikekchar »

zaarn wrote: post #232
ucarion wrote: post #214

Earlier quoted context omitted.

I'm not so sure. By putting this service's code on your website, you transmit personal data (IP addresses) to this third party. That appears to make the GDPR applicable here? Transmission is considered "data processing" under the GDPR. Really, the central point that should be clear is that this is a question for lawyers. The GDPR is incredibly far-reaching.

The IP necessary for the connection itself is covered under necessary data, you can process it for the purpose of a request without needing consent at all. Same applies to shopping cart cookies or anything else that is essential to running a website and isn't being used for secondary purposes like data mining.

The key is to determine under which lawful basis you are processing that data. "Necessary data" is not a get out of jail free card. Because the analytics are not necessary to perform the contract (in any way that I can imagine), you can't claim contract lawful basis. Probably you are stuck with legitimate interest.

So I think you would have to notify the user that you are sending their IP address to the processor under legitimate interest and have a way for them to "object" to that use (i.e. turn off analytics). For legitimate interest, the objection can be after the fact, so having a configuration screen that stores a cookie that allows them to turn off analytics when they are on the site would probably do it.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#237

Post by marichards »

amichal wrote: post #188
eli wrote: post #92

I think there are a lot of misconceptions about how Google Analytics tracking works. I'm pretty sure a vanilla GA setup does not, in fact, create profiles that track you across the web. For one thing, all the cookies it creates are first-party (on your domain). I still get objecting to Google products on principle, but their privacy policy for GA seems pretty reasonable to me: https://support.google.com/analytics/ans…

Also: > When a customer of Analytics requests IP address anonymization, Analytics anonymizes the address as soon as technically feasible at the earliest possible stage of the collection network. The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to the Analytics Collection Network. The full IP addre…

Why do we trust this statement? It's coming from a company that plays loose with the law and has had some of the biggest fines ever thrown at it. Sorry, but with no way to validate this claim, it is meaningless.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#238

Post by zaarn »

mikekchar wrote: post #236
zaarn wrote: post #232

Earlier quoted context omitted.

The IP necessary for the connection itself is covered under necessary data, you can process it for the purpose of a request without needing consent at all. Same applies to shopping cart cookies or anything else that is essential to running a website and isn't being used for secondary purposes like data mining.

The key is to determine under which lawful basis you are processing that data. "Necessary data" is not a get out of jail free card. Because the analytics are not necessary to perform the contract (in any way that I can imagine), you can't claim contract lawful basis. Probably you are stuck with legitimate interest. So I think you would have to notify the user that you are sending their IP address to the processor und…

Since in my case, the processor is me, there is no data being sent elsewhere. I don't have a notification since all data collected is either heavily anonymized in client if possible or on the server side or simply not identifying. Since the data I collect is used to optimize the website experience, I think it's a good enough legitimate interest with no privacy impact.

Re: Show HN: I made a privacy-first minimalist Google Analytics

#239

Post by vincentkriek »

dymk wrote: post #225
wongarsu wrote: post #190

Earlier quoted context omitted.

Dropbox is a glorified FTP client, Slack is IRC with a nice skin and inline pictures, Spotify is bittorrent without the hassle of downloads (and more legal, but that hasn't stopped people). Convinience matters, and convinience sells. But it is only one of many factors that play into the decision to purchase. Dropbox for example wouldn't sell all that great without the free tier.

If you honestly think that Dropbox is just glorified FTP, or Slack is just IRC with pictures, or Spotify is JUST bittorrent (or Napster even), I question if you've ever actually used any of those services . They provide so much more than the alternatives you listed.

The Dropbox and Spotify examples are ridiculous. They offer a lot more and a lot more usability than the comparison.

But Slack basically is just IRC with pictures right? What extra value does slack give me other than a decent web client?

Re: Show HN: I made a privacy-first minimalist Google Analytics

#240

Post by etatoby »

AdriaanvRossum wrote: post #2

Creator here. As a developer, I install analytics for clients, but I never feel comfortable installing Google Analytics because Google creates profiles for their visitors, and uses their information for apps (like AdWords). As we all know, big corporations unnecessarily track users without their consent. I want to change that. So I built Simple Analytics. To ensure that it's fast, secure, and stable, I built it entir…

Good Sir, props to you for including a noscript/image tag in the default code. Google Analytics didn't do it for the longest time, and in fact may still not do it.

Whether on purpose or by accident (or simply by mental bias) they seriously misrepresent the amount of people for whom JavaScript is blocked, not loading, disabled by default for unknown websites (me) or not available for any other reason.

Website owners and creators should at least have that information as a reliable metric to base their development choices on.

Post reply on HN