Matomo: Open-source analytics platform • Hacker News Board

Re: Matomo: Open-source analytics platform

#111

Post by arp242 » Wed, Jan 06, 2021, 6:34 PM UTC

samjmck wrote: post #77

lightswitch05 wrote: post #70

Earlier quoted context omitted.

Its pretty disgusting to track people against their consent, even more so to circumvent their protections against tracking. I added your domain to my blocklist: https://github.com/lightswitch05/hosts/commit/bb2cd77c9ec028...

Ad blocking != block tracking. If you don’t want to get tracked, turn on Do Not Track in your browser. Matomo and most other privacy focused analytics scripts respect that setting.

Do-Not-Track is pointless and dead. Pretty much none of the trackers that actually matter pay one iota of attention to it.

Re: Matomo: Open-source analytics platform

#112

Post by hertzrat » Wed, Jan 06, 2021, 6:36 PM UTC

I used matomo once for a basic Wordpress blog (with cloudron) but for some reason it led to my site being flagged as distributing malware and I vanished from search engines. Apparently there is a Microsoft form you need to fill out to get unflagged where you explain what data your site is collecting but I just took the site offline because I was too busy to dig into it. Extremely annoying since the entire idea is to collect as little personal information as you can. It wasn’t matomo fault, its somebody’s dysfunctional web crawler bot auto generating reports

Re: Matomo: Open-source analytics platform

#113

Post by arp242 » Wed, Jan 06, 2021, 6:38 PM UTC

iamacyborg wrote: post #66

nagbava wrote: post #65

About data protection and GDPR, a good thing with Matomo is that, if configured properly, it can be used without requiring to collect the user's consent (since Matomo doesn't use the data for its own purpose). Of course there are less information collected but at least you don't have to display a form as soon as a user enters your website. The French data protection authority issued a piece of code (JS) which must be…

> it can be used without requiring to collect the user's consent (since Matomo doesn't use the data for its own purpose) This is not how the GDPR works. If you are collecting personal data, or if you are dropping analytics cookies on someone's device, you need consent. No ifs or buts.

This is not how the GDPR works. It lays out several legal basis for the collection of personal information, of which consent is one. There are others as well.

I'd have to re-read it to be sure about analytics cookies, but I don't think it says a whole lot about that off-hand. This the the ePrivacy directive.

Re: Matomo: Open-source analytics platform

#114

Post by hertzrat » Wed, Jan 06, 2021, 6:46 PM UTC

ddevault wrote: post #53

Open source does not make it okay. Do not spy on people. It's just that simple.

What do you use to track whether your site is growing or shrinking in popularity? Server logs? If so, I’m curious whether not being able to filter out bot visits is a problem

Re: Matomo: Open-source analytics platform

#115

Post by lmkg » Wed, Jan 06, 2021, 6:48 PM UTC

nagbava wrote: post #94

lmkg wrote: post #76

Earlier quoted context omitted.

GDPR does not require consent. If you use consent, then it must be freely-given, but can often use a different legal basis when processing personal data. The ePrivacy Directive requires consent for reading or writing from a terminal device. This includes anything with cookies, even if they're not personal data. While the ePD refers to GDPR for its definition of consent, it is a separate piece of legislation and many…

Sure, but when it comes to cookies, consent is almost always required on the GDPR basis (other legal basis are rarely working). You're right to point to e-privacy, to which consent is central. But the latest draft of its new version states that (art.8): 1.The use of processing and storage capabilities of terminal equipment and the collection of information from end-users’ terminal equipment, including about its softw…

> when it comes to cookies, consent is almost always required

We are in agreement. It seems I wasn't clear enough in my original post, but this is my overall point. GDPR doesn't require consent, but consent is required because of ePD.

> latest draft of its new version

> So Matomo can still do without the user consent

The new draft is not law yet. It's been 6 months away from passing for several years now. In the meantime, fines are still being issued under the existing law. Google got fined a hundred million euro last month in France, and that fine was very specifically ePD and not GDPR for a variety fo reasons.

Re: Matomo: Open-source analytics platform

#116

Post by zerkten » Wed, Jan 06, 2021, 6:52 PM UTC

y42 wrote: post #52

input_sh wrote: post #51

Earlier quoted context omitted.

Any cheap Hetzner dedicated (~30€/month) can handle tracking thousands of daily visits without breaking a sweat. If we're talking about 10s of thousands, you're gonna need to invest in some SSD (€50-70/month probably). If we're talking about dozens of sites, some of which have millions of yearly visitors (and a bunch of plugins and reports that need to be generated), then you're gonna encounter some issues and have t…

To add another level: To track millions of requests per day for a couple of sites, it will probably cost around 1k - 5k per month, hosting on AWS. It's advised to use not the cheapeast hoster here, because any little outage directly affects every site that implements your tracking technology.

> It's advised to use not the cheapest hoster here, because any little outage directly affects every site that implements your tracking technology.

I guess it depends on how essential your tracking is, and how you've implemented it. It shouldn't be added in a way that can take out your site unless there is some business critical reason to track.

Then I'd ask, just how critical is the tracking? If losing a few hours of data is going to throw off your product development, do you have enough data to be making decisions? My experience is that bugs and misconfiguration of experiments is common in most orgs, so even if the system is up to capture all data, product managers check an experiment a week later to find they have only 50% of the data.

Re: Matomo: Open-source analytics platform

#117

Post by Mediterraneo10 » Wed, Jan 06, 2021, 7:04 PM UTC

aorth wrote: post #92

lightswitch05 wrote: post #70

Earlier quoted context omitted.

Its pretty disgusting to track people against their consent, even more so to circumvent their protections against tracking. I added your domain to my blocklist: https://github.com/lightswitch05/hosts/commit/bb2cd77c9ec028...

It's your call really, but a website owner tracking you with their own software on their own Matomo instance is not the problem. This is essentially the same as monitoring website logs... that's not disgusting at all.

When the GDPR was entering into force, I remember some speculating that monitoring Apache logs could violate it, since the user has not consented to having their personal details (i.e. the IP address) processed. What was the final consensus reached on this?

Re: Matomo: Open-source analytics platform

#118

Post by [deleted] » Wed, Jan 06, 2021, 7:37 PM UTC

vntok wrote: post #75

lightswitch05 wrote: post #70

Earlier quoted context omitted.

Its pretty disgusting to track people against their consent, even more so to circumvent their protections against tracking. I added your domain to my blocklist: https://github.com/lightswitch05/hosts/commit/bb2cd77c9ec028...

It's pretty disgusting to access creators' content for free while blocking their attempts to monetize it.

[deleted]

Re: Matomo: Open-source analytics platform

#119

Post by necovek » Wed, Jan 06, 2021, 7:47 PM UTC

vntok wrote: post #75

lightswitch05 wrote: post #70

Earlier quoted context omitted.

Its pretty disgusting to track people against their consent, even more so to circumvent their protections against tracking. I added your domain to my blocklist: https://github.com/lightswitch05/hosts/commit/bb2cd77c9ec028...

It's pretty disgusting to access creators' content for free while blocking their attempts to monetize it.

Why not block access to the content then? You can't watch Netflix streams without paying for them, that's trivial to implement.

Ah, right, creators want their content to show up for my search keywords, Google won't let them have pages only visible to Google bots (though even that is changing with the rise of paywalled sites), and they want the money from that same Google showing ads from their ad network.

Google initially promised to deliver a search for the open web unencumbered. It has become a sort of paywall itself (accept our ads or our search results will be useless pointing you to pages that only work if you have ads enabled).

Sure, it would be fair if they haven't pushed out the competition acting entirely differently ("we have no ads", "our ads are clearly marked" to current "see if you can tell a difference between an ad and your search results").

Re: Matomo: Open-source analytics platform

#120

Post by lightswitch05 » Wed, Jan 06, 2021, 8:03 PM UTC

arp242 wrote: post #110

lightswitch05 wrote: post #104

Earlier quoted context omitted.

I think grouping server-side tracking with JavaScript based tracking is an oversimplification. JavaScript tracking is much more invasive and can access significantly more data. From something as straightforward as fingerprinting to potentially even more invasive data such as geo-location, battery status, webcam, microphone - you name it. Server access logs aren't going to track my eyes. I think we can all agree there…

Anyone can do all sorts of things. I can punch anyone I see on the street in the face. Doesn't mean they're actually doing it. Now, I have a vested interest in this as I work on one of those tracking tools, but it actually collects less data than those Apache access_logs that people have been keeping for 25 years. Plus, the JS is unminified and easily examinable if you want (as is the HTTP request), so you also have…

> I can punch anyone I see on the street in the face.

Yes, and then you would be charged with assault. It is great that you work on a tool that respects peoples privacy. I suppose I failed to put an emphasis on trust. With server side logs, less trust is required because there is less that can be done. Paired with VPN, I can have reasonable belief that server side logging is not logging anything unreasonable and it does not require trust that they are not fingerprinting me. As you say, just because someone can do something doesn't mean they will - but trust is required, especially if there are no repercussions if that trust is violated.