36 ms·

We ditched Google Analytics

490 points by felipebueno 11y ago

c0achmcguirk 11y ago
Spideroak user here. I stopped using Dropbox and started using Spideroak about a 18 months ago. I really like the product. It's not as good as Dropbox in some ways (like automatically syncing photos from my phone) but it really is easy to use. I still have a mobile client on Android and I can keep my files in sync across multiple computers. I pay for the larger storage size and I'm not even close to using it all. It syncs fast too. Just thought I'd share my experience with people.
nateberkopec 11y ago
An open-source, self-hostable solution providing 80% of common Google Analytics functionality seems doable to me. Is there anything out there in this realm? If not, why not?
- davidroetzel 11y ago
  Have a look at piwik: http://piwik.org/ http://piwik.org/
  - sarciszewski 11y ago
    I don't recommend Piwik. Using MD5 for passwords in 2015 is beyond irresponsible. https://github.com/piwik/piwik/blob/7f375924db9328f20a0b7cb1e41397f2309b60a7/core/Auth.php#L100 https://github.com/piwik/piwik/blob/7f375924db9328f20a0b7cb1... https://github.com/piwik/piwik/blob/6846145992278b52a2a35a8f040c39c3fb558b04/plugins/Login/Auth.php#L158 https://github.com/piwik/piwik/blob/6846145992278b52a2a35a8f...
    - Karunamon 11y ago
      Eh. The analytics data is pretty low value as far as hacker targets, and this can be mostly mitigated anyways by sane segregation of the admin backend from the publicly accessible site. There's an open ticket for it, but it looks like it hasn't been addressed in a while since they don't want to break all existing passwords. https://github.com/piwik/piwik/issues/5728 https://github.com/piwik/piwik/issues/5728
      - sarciszewski 11y ago
        This is a solved problem. http://security.stackexchange.com/a/31439/43688 http://security.stackexchange.com/a/31439/43688 https://www.reddit.com/r/PHP/comments/3lwxlw/hash_and_verify_passwords_in_php_the_right_way/cva6y6p https://www.reddit.com/r/PHP/comments/3lwxlw/hash_and_verify...
      - ascorbic 11y ago
        A low value target maybe, but having a critical security ticket open for seven years is unforgivable. If they don't want to break compatibility it's pretty simple: use something like PHPass and upgrade the hash when the user next logs in. i.e. what every halfway sensible web app did at least five years ago.
      - jacquesm 11y ago
        It does not have to break all existing passwords. Just add an envelope for the old passwords.
    - deleted 11y ago
      [deleted]
    - ascorbic 11y ago
      Unbelievable. Unsalted MD5, no less. There's an issue to fix this that's been open for seven years! https://github.com/piwik/piwik/issues/5728 https://github.com/piwik/piwik/issues/5728
    - onion2k 11y ago
      There's a $555 bounty if you can demonstrate a security vulnerability in Piwik because of that.
      - sarciszewski 11y ago
        I'm not interesting in further dehumanizing myself with participation in a bug bounty program. I'll write an exploit for it (the general case, not just Piwik in particular) and drop it on OSS Sec some day, but here's a theoretical attack: 1. Guess a username somehow. Maybe "admin"? Whatever, we're interested in the security of the hash function. Let's assume we have the username for our target. 2. Calculate a bunch of guess passwords, such that we have one hash output for each possible value for the first N hexits. e.g. substr(md5($string), 0, 2) === "00" substr(md5($string), 0, 2) === "01" substr(md5($string), 0, 2) === "02" // ... substr(md5($string), 0, 2) === "ff" 3. Send these guess passwords repeatedly and use timing information to get an educated guess on the first valid MD5 hash. 4. Iterate steps 2 and 3 until you have the first N bytes of the MD5 hash for the password. 5. Use offline methods to generate password guesses against a partial hash. The end result: A timing attack that consequently allows an optimized offline guess. So even if their entire codebase is immune to SQL injection, you can still launch a semi-blind cracking attempt against them.
        sarciszewski 11y ago
        By the way, if anyone else wants to try to claim the $555 from Piwik based on the above theoretical attack, feel free.
        frik 11y ago
        How to protect from timing attacks - It's All About Time: http://blog.ircmaxell.com/2014/11/its-all-about-time.html http://blog.ircmaxell.com/2014/11/its-all-about-time.html
        sarciszewski 11y ago
        password_verify() compares hashes in constant-time, so, yeah...
- hendi_ 11y ago
  Yes, there is: www.piwik.org
- dataewan 11y ago
  http://snowplowanalytics.com/ http://snowplowanalytics.com/ is worth considering if you have larger volumes of traffic
  - marrone12 11y ago
    Snowplow is great. Super scalable and they have instructions on how to host everything on your own AWS infrastructure.
  - pg1 11y ago
    + 1 for snowplow. We been using it for more than a year now with high traffic sites and it's working great.
  - nkuttler 11y ago
    Why not for low volume sites?
    - pg1 11y ago
      Well it takes lots of time to setup + needs a few extra server like event collector, log cleanup and enrich, data loading and database server.
  - zachh 11y ago
    What do you use as a front-end?
- kordless 11y ago
  Self hosted analytics is still centralizing behavioral data on the users. It's not really any better from a privacy standpoint than GA.
  - jon-wood 11y ago
    Its nowhere near as centralized as Google Analytics though - at least if you're self hosting that data is confined to the silo which is your own analytics, rather than Google being able to aggregate that with their behaviour on every other site they visit as well.
    - kordless 11y ago
      That silo is still aggregating data. Trying to argue its "less" centralized by using quantification of the amount of centralization is still akin to dissonance. Clearly people here don't agree with this, but that's to be expected when the topic is so polarizing. Traffic analytics must be important, so we rationalize our actions, or inactions around how we collect them. Any centralized solution, at any scale, can possibly violate someone's privacy. Period. If we want to really fix things, we should stop circle jerking ourselves and do something about it.
    - deleted 11y ago
      [deleted]
  - gpvos 11y ago
    Not at all. The entire point is that Google is able to track one person across many, many sites. That is simply not possible if each site had its own self-hosted analytics.
lukeqsee 11y ago
> Like lots of other companies with high traffic websites, we are a technology company; one with a deep team of software developer expertise. It took us only a few weeks to write our home-brew analytics package. I'm a little curious why they decided to go this route instead of using one of the open-source solutions. Aren't there good solutions to this problem already?
- BinaryIdiot 11y ago
  I was curious as well and just assumed the usual NIH (not invented here) syndrome. Web analytics was so mature before Google bought Urchin and turned it into Google analytics. Since that time countless open source projects have sprung up (pwik was the first that came to mind). Google for open source alternatives brings up thousands of pages of projects. Writing your own is easy for the basic stuff. When you want to move beyond the basics, as Spider Oak will find, it becomes much more difficult.
buro9 11y ago
Why not move to push GA data server-side? Trivial to set-up, immune to adblockers affecting the completeness of data, prevents the write of tracking cookies, leaves data and utility of the GA dashboard mostly complete (loss of user client capabilities and some session-based metrics). This is the route I'm preferring to take (being applied this Christmas via https://pypi.python.org/pypi/pyga https://pypi.python.org/pypi/pyga ). One may argue that Google will still be aware of page views, but the argument presented in the article is constructed around the use of the tracking cookie and that would no longer apply. I'm shifting to server-push to restore completeness, I'm presently estimating that client-side GA represents barely 25% of my page views (according to a quick analysis of server logs for a 24hr period). I'm looking to get the insight of how my site is used rather than capabilities of the client, so this works for what I want.
- JupiterMoon 11y ago
  People don't care about the cookie or any of the details of the implementation. They care about being tracked across the whole internet. If you are still contributing to that then you are disrespecting your customers. I hope that I am not one of them.
  - buro9 11y ago
    Did you read my comment? You will have no GA cookie from any of my sites, I am not recording client identifying things or capabilities. It is a server-side push of GA and avoids all client-side interactions. It is merely, "A page has been viewed, this one: /foo/bar?bash". There's nothing in there that is tracking you. I'm not even embracing the session management aspect. I get to use the tool that is best-in-class, in a way that lacks capability to track you.
    - huhtenberg 11y ago
      Without any "client identifying things" how would GA be able to chain several page hits into a session then? That is, do basic visits vs. hits split. If you are in fact anonymizing everything about a client as you claim you do, then it won't be able to. Unless, of course, you are feeding GA some opaque client ID that you then internally map to and from actual clients that hit your server. However something tells me that you aren't doing that, or you would've mentioned it already. (edit) I re-read your comment. You aren't apparently interested in session counts. But what's good the GA summary then if you can't tell 10 bounced visitors from one visitor with 10 hits? This makes no sense. If you want to look at just page hit numbers, there are dramatically simpler ways to do that.
sparkzilla 11y ago
Yet they are still listed on Google search [http://bit.ly/1ICwud0 http://bit.ly/1ICwud0]. I guess it's easy to have principles when it doesn't cost you money.
- AdmiralAsshat 11y ago
  How exactly would they stop themselves from being listed on Google? A right to be forgotten request? Their decision was to ditch Google Analytics, not to disappear from the web.
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - sparkzilla 11y ago
    Robots.txt. I think it's interesting that you say that removing yourself from Google is the same as "disappearing from the web" implying that the web is Google. It's not. Perhaps they should use alternative forms of outreach, something I am considering with my company.
    - AdmiralAsshat 11y ago
      Google is not the web, you are correct; but for all intents and purposes, it's the web's phonebook. You remove yourself from the phonebook, you make it very difficult for people to find you, or your business.
      - sparkzilla 11y ago
        There are other ways to promote a business outside of search engines. The point is you can't say you have "ditched Google" while still being part of their systems that collect user data.
eljimmy 11y ago
Is it just me or is this a click-bait title with hollow content?
- sparkzilla 11y ago
  It is. It's no big deal to stop using Google Analytics. It is, however, a big deal not to use Google Search, something I am considering for my company.
  - deleted 11y ago
    [deleted]
- mort96 11y ago
  Well, the title says they stopped using Google analytics, and the article explained that they stopped using Google analytics, why they did it, and what they're doing instead. You may not find it interesting, but the title clearly reflects the content, so I'm not sure how it's click bait.
trebor 11y ago
To any of the SpiderOak team: thank you. It's more than just the tracking cookie, though. It's also about Google aggregating all its website data into a unified profile. The data they have on everyone is frightening—all because of free services like GA.
- tajen 11y ago
  Yes, thank you SpiderOak, even though I don't use you: High profile companies quitting GA means we get aware of alternative solution. Today, I've learnt about http://piwik.org http://piwik.org .
kordless 11y ago
> Sadly, we didn’t like the answer to that question. “Yes, by using Google Analytics, we are furthering the erosion of privacy on the web.” The only thing "wrong" with using an analytics service to better understand your customers is that it places all knowledge of visits, including ones that wished to be private, in a centralized location. This can be useful in providing correlation data across all visitors in aggregate, such as which browser you should make sure your site supports most of the time. In other words, there exists some data in aggregate that is valuable to all of us, but the cost is a loss of privacy for smaller sets of personal data. If individuals don't want certain behaviors analyzed by others, then they shouldn't use centralized services which exist outside their realm of control. These individuals would be better off using a "website" that is hosted by themselves, inside their own four walls, running on their own equipment. A simple way for SpiderOak to address this is to put their website on IPFS or something similar. I appreciate the fact that SpiderOak is thinking about these things. It's important!
gvb 11y ago
The irony for me is that I am mostly invisible to Google Analytics, and thus the companies that rely on GA, because I mostly browse with JavaScript disabled. (When I need JavaScript, I usually crank up an incognito instance of Chrome and close it immediately when done, so I'm mostly anonymous to GA even then.) When they go "old fashioned" and datamine their web server logs, they uncloak me. :-/
rogeryu 11y ago
I'm doing my part. I'm moving to DuckDuckGo for searching more and more. It's a process. Google does have better results. For work I still rely on Google, for private stuff I use https://duckduckgo.com/ https://duckduckgo.com/ And for the sake of ducks, I'm eating less meat as well. No more chicken - too much antibiotics, and as little meat as possible, only when it's worth it, so great taste and good quality.
- Xavez 11y ago
  You can also try https://search.disconnect.me https://search.disconnect.me.
- Albright 11y ago
  I'm a big DDG fan too. I don't really notice their results being "worse" than Google's (but maybe that's just because I haven't used Google for so long). The Bang feature is also very handy once you get in the habit of remembering to use it. https://duckduckgo.com/bang https://duckduckgo.com/bang
- theandrewbailey 11y ago
  More and more, if I'm not satisfied with DDG, I will Google that term, only to get the same stuff.
- gerty 11y ago
  Do you also experience slower response times at DDG? Here in Europe 'ping -c 5' gives an average of about 10ms for google.com and 30ms for duckduckgo.com. Since search is such a fundamental part of browsing, this is very noticeable.
_lce0 11y ago
Kudos for this!! it's interesting that still there's meta, probably leftover <meta name="google-site-verification" content="pPH9-SNGQ9Ne6q-h4StA3twBSknzvtP9kfEB88Qwl0w"> EDIT: wow, thanks for your answers guys!! so nice to see Cunningham's law in action ;)
- veeti 11y ago
  That is for webmaster tools, not analytics.
- chainsaw10 11y ago
  IIRC that meta tag is also used for verification for Google Webmaster Tools
- artursapek 11y ago
  That's for Google's webmaster tools, which is another service Google offers (although in this case, you get to peer into their data)
- stonedge 11y ago
  This could just be for Google Webmasters which gives them information on their search presence.
- stanleydrew 11y ago
  Surprised that they don't use the DNS verification option. Bloating your HTML for every request is unnecessary.
cm2187 11y ago
The other thing is that google analytics is on many adblockers lists, precisely for that reason. As adblockers are getting widespread, the analytics is going blind.
- Albright 11y ago
  I've been running a blocker to block GA and other junk on my PC, but I imagine I'm in a statistically insignificant minority. And I still can't block them on my iPhone unless I disable JavaScript entirely (though I'm running iOS 9, I'm not able to install a blocker for some reason; I guess Apple arbitrarily doesn't support them on my older iPhone model).
  - djrogers 11y ago
    >I guess Apple arbitrarily doesn't support them on my older iPhone It's not arbitrary - it requires a 64 bit CPU (of which Apple has now shipped 3 generations of).
    - Albright 11y ago
      Ah, is that the differentiator? I see. Still strikes me as somewhat arbitrary, though - is content blocking such a strenuous task that it requires a 64-bit CPU? Wouldn't using a blocker cause the CPU to do less work in most cases since it doesn't have to download so many ad media files or execute as much JavaScript? Yeah, I guess it's just time to get a friggin' new phone already, but this one ain't broke yet, ya know?
  - Kristine1975 11y ago
    If your device is jailbroken (not sure if there's a jailbreak for iOS 9), you could add entries for GA to its hosts file. I use these on my desktop PC: 127.0.0.1 www.google-analytics.com 127.0.0.1 google-analytics.com 127.0.0.1 ssl.google-analytics.com AFAIK ad blockers are only supported on iOS devices with 64 bit CPUs.
  - cm2187 11y ago
    I could install an adblocker on iOS9, and you can customize the block list. I don't think you are a minority. I understand adblocking usage is around 20%-ish now. What I don't understand is people who use adblockers but still login to their google account on chrome. It sorts of defeat the purpose...
eponeponepon 11y ago
It took us only a few weeks to write our home-brew analytics package. Nothing super fancy yet now we have an internal dashboard that shows the entire company much of what we used analytics for anyway - and with some nice integration with some of our other systems too. I never quite grasp how the above isn't just a matter of intuition to anyone working in the tech sector. Google Analytics thrives on developers' laziness in my opinion. And to echo other posters: SpiderOak deserve thanks. If I find myself with any need for a service like theirs, I know I'll be looking at them.
- chimeracoder 11y ago
  > I never quite grasp how the above isn't just a matter of intuition to anyone working in the tech sector. Google Analytics thrives on developers' laziness in my opinion. Unless I'm mistaken, one big difference is that not using Google Analytics means you don't know which Google search pages people used to access your website. That can be a really important difference for some websites.
  - cgag 11y ago
    I think you can get that info with webmaster tools without using analytics.
  - aargh_aargh 11y ago
    Can't you find out from the Referer header anymore? It's been years since I tried, so it may have changed.
    - kalleboo 11y ago
      Only if your site is HTTPS
- splatcollision 11y ago
  Looking for a good npm / express middleware module that does this. Combines privacy concerns + developer laziness!
oneJob 11y ago
How about open-sourcing your product before worrying about improving other products? SpiderOak has been "investigating a number of licensing options, and do expect to make the SpiderOak client code open source in the not-distant future" for a very, very long time now. It's no trivial thing to have a closed source client for a "zero knowledge" service. https://spideroak.com/faq/why-isnt-spideroak-open-source-yet-when-will-it-be https://spideroak.com/faq/why-isnt-spideroak-open-source-yet... EDIT: I'd welcome discussion, in addition to your up/down votes
- gerty 11y ago
  I am also concerned with that. That message has been there unchanged for some time now. To be fair, there's a lot of stuff on the Github page, including the Android client under Apache license. Although as far as I can tell, desktop client is not there yet.
- prajjwal 11y ago
  I came here for this exact thing. They said they were going to go open source in 2014 IIRC, and failed to deliver. I have stopped using SpiderOak - how am I supposed to trust them with my most private files when I can't verify that they're not doing anything shady on my machine? The opening line of this post is amusing. They ought to give thought to fixing their core product first.
Veratyr 11y ago
Not strictly on topic so I apologise if this is unwanted but I thought I'd share my experience with SpiderOak in case anyone here was thinking of purchasing one of their plans. In February SpiderOak dropped its pricing to $12/month for 1TB of data. Having several hundred gigabytes of photos to backup I took advantage and bought a year long subscription ($129). I had access to a symmetric gigabit fibre connection so I connected, set up the SpiderOak client and started uploading. However I noticed something odd. According to my Mac's activity monitor, SpiderOak was only uploading in short bursts [0] of ~2MB/s. I did some test uploads to other services (Google Drive, Amazon) to verify that things were fine with my connection (they were) and then contacted support (Feb 10). What followed was nearly __6 months__ of "support", first claiming that it might be a server side issue and moving me "to a new host" (Feb 17) then when that didn't resolve my issue, they ignored me for a couple of months then handed me over to an engineer (Apr 28) who told me: "we may have your uploads running at the maximum speed we can offer you at the moment. Additional changes to storage network configuration will not improve the situation much. There is an overhead limitation when the client encrypts, deduplicates, and compresses the files you are uploading" At this point I ran a basic test (cat /dev/urandom | gzip -c | openssl enc -aes-256-cbc -pass pass:spideroak | pv | shasum -a 256 > /dev/zero) that showed my laptop was easily capable of hashing and encrypting the data much faster than SpiderOak was handling it (Apr 30) after which I was simply ignored for a full month until I opened another ticket asking for a refund (Jul 9). I really love the idea of secure, private storage but SpiderOak's client is barely functional and their customer support is rather bad. [0]: http://i.imgur.com/XEvhIop.png http://i.imgur.com/XEvhIop.png
- Someone1234 11y ago
  Many of these types of services seem to intentionally cap upload speeds to reduce their potential storage liability (since they're likely over-selling storage to be able to offer 1 TB for $12 with the level of redundancy, staffing costs, etc, needed). I wonder if that is happening in this specific case? Although if it were the case the vendor should still be honest about it. Just saying they limit uploads to 2 Mbps is better than giving the run-around.
  - 11y ago
pmoriarty 11y ago
Now if they could also just ditch Facebook, Microsoft, and Apple, they'd be getting somewhere.
gramakri 11y ago
At Cloudron, our vision is to allow companies to host their own apps easily. We dogfood and don't use Google. We don't use analytics on our website (a conscious decision). Our emails are based on IMAP servers and we use thunderbird. We selfhost everything other than email (which is on gandi). We just entered private beta yesterday - https://cloudron.io/blog/2015-12-07-private-beta.html https://cloudron.io/blog/2015-12-07-private-beta.html
- dschep 11y ago
  How's this compare to Sandstorm[0]? It seems like a Closed/SaaS equivalent. [0] https://sandstorm.io/ https://sandstorm.io/
  - gramakri 11y ago
    Cloudron and sandstorm are similar projects. I think the main difference is the user experience (also how we handle domains, how apps are packaged etc). You can see a demo of the cloudron here - https://my-demo.cloudron.me/ https://my-demo.cloudron.me/ (username: cloudron password: cloudron). All apps use same credentials (because of single sign on)
qihqi 11y ago
Random fact: GA cookie is distinct from adwords(google.com) cookie, and it is illegal for Google to join those (not sure if it is even technically feasible).
sghiassy 11y ago
I don't get it. SpiderOak states that they dropped GA because it furthers "the erosion of privacy on the web.”, but then they just started tracking in house. How is tracking in house more private than GA? The user is still being tracked.
- softyeti 11y ago
  I believe their point was that they want to track their traffic, but when they use a third party like Google, Google provides tracking services for SpiderOak, Google also tracks you as well, which SpiderOak has no control over.
- stonemetal 11y ago
  With it in house it is under their control: they can anonymize it, not collect certain information, they can't cross index it with your traffic from other sites, etc.
- distances 11y ago
  Google likely (or at least theoretically) has the capability to track the user across all the sites that use GA. In-house tracking doesn't allow this.
api 11y ago
Instead of rolling your own look at Piwik. It works very well and is basically a GA clone. I actually like it better than GA in some ways. It's easy to set up and you can run it on your own site so you're not contributing to a global tracking fabric.
rwbt 11y ago
I've had good experience with Statcounter (http://www.statcounter.com http://www.statcounter.com)
rbinv 11y ago
> It took us only a few weeks to write our home-brew analytics package. Unfortunately, there's no way to replicate what Google Analytics currently offers (for free!) within a couple of weeks (or even months). Not with big data sets. Yes, GA does enforce sampling if you don't pay for GA Premium, but the free edition is still one of hell of a deal (if you don't care about privacy). If you only use Google Analytics as a hit counter, sure, you can do that yourself within a couple of minutes. The advanced features are way more complicated, though (think segmentation and custom reports). This also begs the question: why not use Piwik?
- ssharp 11y ago
  I suspect most of the people saying "you don't need Google Analytics! Do it yourself!" have never used GA for anything that meaningful. As you begin to really familiarize yourself with your website traffic and understand how to look at your clickstream data in a more investigative an analytical way, you'll start to see how nice GA is and how easy it is to answer your questions. You also underestimate how ubiquitous GA is because it's free and extremely popular. I'd consider myself an intermediate to advanced user of GA, but for people less experienced, I can easily share stuff with them for complicated tasks or they know how to do a lot of the basics themselves. In hiring digital marketing people, GA is pretty much on par with Word in terms of familiarity. It's something a lot of people have a basic competence with.
  - rbinv 11y ago
    I agree completely. GA has become very, very capable in the last five years or so. Combined with their current APIs, you can do pretty much anything you want.
zachh 11y ago
Is there any analytics solution that allows for on-prem data storage? Only one I know of is Adobe Analytics (formerly Omniture).
- mattab 11y ago
  Yes, check out Piwik.org / Piwik.pro
deleted 11y ago
[deleted]
patrick123456 11y ago
https://www.youtube.com/watch?v=tPyx-mLSgpU https://www.youtube.com/watch?v=tPyx-mLSgpU norton tech support phone number 1.800.610.5648 http://www.techsupportusa247.com/ http://www.techsupportusa247.com/ @norton support phone number australia norton support phone number india norton support phone number ireland norton customer phone number norton product support phone number norton ghost support phone number comcast norton support phone number norton technical support phone number canada www.techsupportusa247.com/support-for-norton.html norton 360
electriclove 11y ago
Why not just use Piwik?
justinkramp 11y ago
It should also be noted that SpiderOak has opensourced many components of their product stack, including Crypton, which is the encryption framework underpinning many of their clients. The source is at https://github.com/SpiderOak https://github.com/SpiderOak
cpncrunch 11y ago
>why does Google and their advertisers need to know about it I would ask Google is pretty clear about this. The only reason they track you is for advertising, and there isn't any evidence of them using the info for anything else. In fact there is a lot of evidence pointing the other way, such as their insistence on encryption data flowing between their datacenters. This is Google we are talking about, not Kazakhstan, China or Russia.
- Paul-ish 11y ago
  Google could eventually use this information to determine your eligibility for a home loan. They have already dipped their toes in this area [1]. With all this data, we have to ensure that it is used fairly (or not at all). There is enough concern about digital redlining that a 2014 report to the white house reports on this [2]. As we know machine learning is quite capable inferring sensitive attributes [3]. This inference doesn't even need to be intentional, machine learning is capable of accidentally picking up on latent variables. Even if your neighborhood (the original redlining) isn't a feature in the original variable, it could be inferred from the other variables. TL;DR: Your surfing behavior could be used to deny you a home loan one day. [1] http://techcrunch.com/2015/11/23/google-launches-mortgage-shopping-tool-in-california-more-states-coming-soon/ http://techcrunch.com/2015/11/23/google-launches-mortgage-sh... [2] https://www.whitehouse.gov/sites/default/files/docs/big_data_privacy_report_may_1_2014.pdf https://www.whitehouse.gov/sites/default/files/docs/big_data... [3] http://www.pnas.org/content/110/15/5802.abstract http://www.pnas.org/content/110/15/5802.abstract
  - cpncrunch 11y ago
    Lots of speculation about what they might do. You could also say that the US government could use all of your data to spy on people who criticise the government, so they shouldn't have any of that data either.
- adrianlmm 11y ago
  Still, Google is a corporation whos only porpose is proffit, trust them blindly is foolish.
iamleppert 11y ago
I'd hate to be the intern or the guy in charge of keeping that thing running.
deleted 11y ago
[deleted]
TheAndruu 11y ago
Make your custom analytics library into a separate product in its own right and sell it or open-source it!
patrickfl 11y ago
For anyone here looking for a really good, free,self-hosted, hackable, open source alternative to Google Analytics that's been around for a long time, please consider Piwik.org. I've been using it for prob 8-10 years and it has never missed a beat. I use it on all my personal / business sites as well as some client websites that are super high traffic.
binaryapparatus 11y ago
Analytics, fonts, css. We include it everywhere by default. Then I realized hey we are all giving away too much. My sites now happily run self-hosted piwik, for the last six or so months. I won't be surprised if in the coming years we hear much more about using google fonts being base to count site access, if there is no analytics in place.
Something1234 11y ago
What about awstats or goaccess? Both are great log analyzers, although I like goacess better. http://goaccess.io/ http://goaccess.io/ http://www.awstats.org/ http://www.awstats.org/
- X-Istence 11y ago
  The look and feel of awstats hasn't changed since I last used it back in 2004...
  - mattab 11y ago
    Piwik is the new AWStats, check out http://piwik.org/log-analytics/ http://piwik.org/log-analytics/
kevin_thibedeau 11y ago
I haven't checked my GA in months since it became clear that Google won't bother doing anything to fix the referer spam problem that makes the stats useless if you don't have a high-volume site. It's not like these abusers are hard to track down but I'll be damned if I'm going to manually add filters to get rid of them every time they come in from a new domain.
- emilburzo 11y ago
  Admin -> select account -> select property -> View Settings (on the view you want) there's a checkbox: Exclude all hits from known bots and spiders
jliptzin 11y ago
Usually I start with Google Analytics but continue to add to our own in-house analytics solution targeting the specific metrics we're interested in tracking. GA often doesn't provide us with the real insights we're looking for, but it's good for the vanity stats.
ksec 11y ago
To me, it is the cost that matters. Most other Analytics cost $30 - $50 / 1 Million Pageview / Datapoint. To me this expensive. Even when you scale to 100M it will still cost ~$20/Million. Piwik doesn't scale. At least it doesn't scale unless you spend lots of resources to tinker with it. Its Cloud Edition is even more expensive then GoSquared which i consider to be a much better product. What we basically need is a simple, effective, and cheap enough alternative to GA. And so far there are simply none.

490 points by felipebueno 11y ago

Spideroak user here. I stopped using Dropbox and started using Spideroak about a 18 months ago. I really like the product. It's not as good as Dropbox in some ways (like automatically syncing photos from my phone) but it really is easy to use. I still have a mobile client on Android and I can keep my files in sync across multiple computers. I pay for the larger storage size and I'm not even close to using it all. It syncs fast too. Just thought I'd share my experience with people.

nateberkopec 11y ago

An open-source, self-hostable solution providing 80% of common Google Analytics functionality seems doable to me. Is there anything out there in this realm? If not, why not?

davidroetzel 11y ago
Have a look at piwik: http://piwik.org/ http://piwik.org/
- sarciszewski 11y ago
  I don't recommend Piwik. Using MD5 for passwords in 2015 is beyond irresponsible. https://github.com/piwik/piwik/blob/7f375924db9328f20a0b7cb1e41397f2309b60a7/core/Auth.php#L100 https://github.com/piwik/piwik/blob/7f375924db9328f20a0b7cb1... https://github.com/piwik/piwik/blob/6846145992278b52a2a35a8f040c39c3fb558b04/plugins/Login/Auth.php#L158 https://github.com/piwik/piwik/blob/6846145992278b52a2a35a8f...
  - Karunamon 11y ago
    Eh. The analytics data is pretty low value as far as hacker targets, and this can be mostly mitigated anyways by sane segregation of the admin backend from the publicly accessible site. There's an open ticket for it, but it looks like it hasn't been addressed in a while since they don't want to break all existing passwords. https://github.com/piwik/piwik/issues/5728 https://github.com/piwik/piwik/issues/5728
    - sarciszewski 11y ago
      This is a solved problem. http://security.stackexchange.com/a/31439/43688 http://security.stackexchange.com/a/31439/43688 https://www.reddit.com/r/PHP/comments/3lwxlw/hash_and_verify_passwords_in_php_the_right_way/cva6y6p https://www.reddit.com/r/PHP/comments/3lwxlw/hash_and_verify...
    - ascorbic 11y ago
      A low value target maybe, but having a critical security ticket open for seven years is unforgivable. If they don't want to break compatibility it's pretty simple: use something like PHPass and upgrade the hash when the user next logs in. i.e. what every halfway sensible web app did at least five years ago.
    - jacquesm 11y ago
      It does not have to break all existing passwords. Just add an envelope for the old passwords.
  - deleted 11y ago
    [deleted]
  - ascorbic 11y ago
    Unbelievable. Unsalted MD5, no less. There's an issue to fix this that's been open for seven years! https://github.com/piwik/piwik/issues/5728 https://github.com/piwik/piwik/issues/5728
  - onion2k 11y ago
    There's a $555 bounty if you can demonstrate a security vulnerability in Piwik because of that.
    - sarciszewski 11y ago
      I'm not interesting in further dehumanizing myself with participation in a bug bounty program. I'll write an exploit for it (the general case, not just Piwik in particular) and drop it on OSS Sec some day, but here's a theoretical attack: 1. Guess a username somehow. Maybe "admin"? Whatever, we're interested in the security of the hash function. Let's assume we have the username for our target. 2. Calculate a bunch of guess passwords, such that we have one hash output for each possible value for the first N hexits. e.g. substr(md5($string), 0, 2) === "00" substr(md5($string), 0, 2) === "01" substr(md5($string), 0, 2) === "02" // ... substr(md5($string), 0, 2) === "ff" 3. Send these guess passwords repeatedly and use timing information to get an educated guess on the first valid MD5 hash. 4. Iterate steps 2 and 3 until you have the first N bytes of the MD5 hash for the password. 5. Use offline methods to generate password guesses against a partial hash. The end result: A timing attack that consequently allows an optimized offline guess. So even if their entire codebase is immune to SQL injection, you can still launch a semi-blind cracking attempt against them.
      - sarciszewski 11y ago
        By the way, if anyone else wants to try to claim the $555 from Piwik based on the above theoretical attack, feel free.
      - frik 11y ago
        How to protect from timing attacks - It's All About Time: http://blog.ircmaxell.com/2014/11/its-all-about-time.html http://blog.ircmaxell.com/2014/11/its-all-about-time.html
        sarciszewski 11y ago
        password_verify() compares hashes in constant-time, so, yeah...
hendi_ 11y ago
Yes, there is: www.piwik.org
dataewan 11y ago
http://snowplowanalytics.com/ http://snowplowanalytics.com/ is worth considering if you have larger volumes of traffic
- marrone12 11y ago
  Snowplow is great. Super scalable and they have instructions on how to host everything on your own AWS infrastructure.
- pg1 11y ago
  + 1 for snowplow. We been using it for more than a year now with high traffic sites and it's working great.
- nkuttler 11y ago
  Why not for low volume sites?
  - pg1 11y ago
    Well it takes lots of time to setup + needs a few extra server like event collector, log cleanup and enrich, data loading and database server.
- zachh 11y ago
  What do you use as a front-end?
kordless 11y ago
Self hosted analytics is still centralizing behavioral data on the users. It's not really any better from a privacy standpoint than GA.
- jon-wood 11y ago
  Its nowhere near as centralized as Google Analytics though - at least if you're self hosting that data is confined to the silo which is your own analytics, rather than Google being able to aggregate that with their behaviour on every other site they visit as well.
  - kordless 11y ago
    That silo is still aggregating data. Trying to argue its "less" centralized by using quantification of the amount of centralization is still akin to dissonance. Clearly people here don't agree with this, but that's to be expected when the topic is so polarizing. Traffic analytics must be important, so we rationalize our actions, or inactions around how we collect them. Any centralized solution, at any scale, can possibly violate someone's privacy. Period. If we want to really fix things, we should stop circle jerking ourselves and do something about it.
  - deleted 11y ago
    [deleted]
- gpvos 11y ago
  Not at all. The entire point is that Google is able to track one person across many, many sites. That is simply not possible if each site had its own self-hosted analytics.

lukeqsee 11y ago

> Like lots of other companies with high traffic websites, we are a technology company; one with a deep team of software developer expertise. It took us only a few weeks to write our home-brew analytics package. I'm a little curious why they decided to go this route instead of using one of the open-source solutions. Aren't there good solutions to this problem already?

BinaryIdiot 11y ago
I was curious as well and just assumed the usual NIH (not invented here) syndrome. Web analytics was so mature before Google bought Urchin and turned it into Google analytics. Since that time countless open source projects have sprung up (pwik was the first that came to mind). Google for open source alternatives brings up thousands of pages of projects. Writing your own is easy for the basic stuff. When you want to move beyond the basics, as Spider Oak will find, it becomes much more difficult.

buro9 11y ago

Why not move to push GA data server-side? Trivial to set-up, immune to adblockers affecting the completeness of data, prevents the write of tracking cookies, leaves data and utility of the GA dashboard mostly complete (loss of user client capabilities and some session-based metrics). This is the route I'm preferring to take (being applied this Christmas via https://pypi.python.org/pypi/pyga https://pypi.python.org/pypi/pyga ). One may argue that Google will still be aware of page views, but the argument presented in the article is constructed around the use of the tracking cookie and that would no longer apply. I'm shifting to server-push to restore completeness, I'm presently estimating that client-side GA represents barely 25% of my page views (according to a quick analysis of server logs for a 24hr period). I'm looking to get the insight of how my site is used rather than capabilities of the client, so this works for what I want.

JupiterMoon 11y ago
People don't care about the cookie or any of the details of the implementation. They care about being tracked across the whole internet. If you are still contributing to that then you are disrespecting your customers. I hope that I am not one of them.
- buro9 11y ago
  Did you read my comment? You will have no GA cookie from any of my sites, I am not recording client identifying things or capabilities. It is a server-side push of GA and avoids all client-side interactions. It is merely, "A page has been viewed, this one: /foo/bar?bash". There's nothing in there that is tracking you. I'm not even embracing the session management aspect. I get to use the tool that is best-in-class, in a way that lacks capability to track you.
  - huhtenberg 11y ago
    Without any "client identifying things" how would GA be able to chain several page hits into a session then? That is, do basic visits vs. hits split. If you are in fact anonymizing everything about a client as you claim you do, then it won't be able to. Unless, of course, you are feeding GA some opaque client ID that you then internally map to and from actual clients that hit your server. However something tells me that you aren't doing that, or you would've mentioned it already. (edit) I re-read your comment. You aren't apparently interested in session counts. But what's good the GA summary then if you can't tell 10 bounced visitors from one visitor with 10 hits? This makes no sense. If you want to look at just page hit numbers, there are dramatically simpler ways to do that.

sparkzilla 11y ago

Yet they are still listed on Google search [http://bit.ly/1ICwud0 http://bit.ly/1ICwud0]. I guess it's easy to have principles when it doesn't cost you money.

AdmiralAsshat 11y ago
How exactly would they stop themselves from being listed on Google? A right to be forgotten request? Their decision was to ditch Google Analytics, not to disappear from the web.
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- sparkzilla 11y ago
  Robots.txt. I think it's interesting that you say that removing yourself from Google is the same as "disappearing from the web" implying that the web is Google. It's not. Perhaps they should use alternative forms of outreach, something I am considering with my company.
  - AdmiralAsshat 11y ago
    Google is not the web, you are correct; but for all intents and purposes, it's the web's phonebook. You remove yourself from the phonebook, you make it very difficult for people to find you, or your business.
    - sparkzilla 11y ago
      There are other ways to promote a business outside of search engines. The point is you can't say you have "ditched Google" while still being part of their systems that collect user data.

eljimmy 11y ago

Is it just me or is this a click-bait title with hollow content?

sparkzilla 11y ago
It is. It's no big deal to stop using Google Analytics. It is, however, a big deal not to use Google Search, something I am considering for my company.
- deleted 11y ago
  [deleted]
mort96 11y ago
Well, the title says they stopped using Google analytics, and the article explained that they stopped using Google analytics, why they did it, and what they're doing instead. You may not find it interesting, but the title clearly reflects the content, so I'm not sure how it's click bait.

trebor 11y ago

To any of the SpiderOak team: thank you. It's more than just the tracking cookie, though. It's also about Google aggregating all its website data into a unified profile. The data they have on everyone is frightening—all because of free services like GA.

tajen 11y ago
Yes, thank you SpiderOak, even though I don't use you: High profile companies quitting GA means we get aware of alternative solution. Today, I've learnt about http://piwik.org http://piwik.org .

kordless 11y ago

> Sadly, we didn’t like the answer to that question. “Yes, by using Google Analytics, we are furthering the erosion of privacy on the web.” The only thing "wrong" with using an analytics service to better understand your customers is that it places all knowledge of visits, including ones that wished to be private, in a centralized location. This can be useful in providing correlation data across all visitors in aggregate, such as which browser you should make sure your site supports most of the time. In other words, there exists some data in aggregate that is valuable to all of us, but the cost is a loss of privacy for smaller sets of personal data. If individuals don't want certain behaviors analyzed by others, then they shouldn't use centralized services which exist outside their realm of control. These individuals would be better off using a "website" that is hosted by themselves, inside their own four walls, running on their own equipment. A simple way for SpiderOak to address this is to put their website on IPFS or something similar. I appreciate the fact that SpiderOak is thinking about these things. It's important!

gvb 11y ago

The irony for me is that I am mostly invisible to Google Analytics, and thus the companies that rely on GA, because I mostly browse with JavaScript disabled. (When I need JavaScript, I usually crank up an incognito instance of Chrome and close it immediately when done, so I'm mostly anonymous to GA even then.) When they go "old fashioned" and datamine their web server logs, they uncloak me. :-/

rogeryu 11y ago

I'm doing my part. I'm moving to DuckDuckGo for searching more and more. It's a process. Google does have better results. For work I still rely on Google, for private stuff I use https://duckduckgo.com/ https://duckduckgo.com/ And for the sake of ducks, I'm eating less meat as well. No more chicken - too much antibiotics, and as little meat as possible, only when it's worth it, so great taste and good quality.

Xavez 11y ago
You can also try https://search.disconnect.me https://search.disconnect.me.
Albright 11y ago
I'm a big DDG fan too. I don't really notice their results being "worse" than Google's (but maybe that's just because I haven't used Google for so long). The Bang feature is also very handy once you get in the habit of remembering to use it. https://duckduckgo.com/bang https://duckduckgo.com/bang
theandrewbailey 11y ago
More and more, if I'm not satisfied with DDG, I will Google that term, only to get the same stuff.
gerty 11y ago
Do you also experience slower response times at DDG? Here in Europe 'ping -c 5' gives an average of about 10ms for google.com and 30ms for duckduckgo.com. Since search is such a fundamental part of browsing, this is very noticeable.

_lce0 11y ago

Kudos for this!! it's interesting that still there's meta, probably leftover <meta name="google-site-verification" content="pPH9-SNGQ9Ne6q-h4StA3twBSknzvtP9kfEB88Qwl0w"> EDIT: wow, thanks for your answers guys!! so nice to see Cunningham's law in action ;)

veeti 11y ago
That is for webmaster tools, not analytics.
chainsaw10 11y ago
IIRC that meta tag is also used for verification for Google Webmaster Tools
artursapek 11y ago
That's for Google's webmaster tools, which is another service Google offers (although in this case, you get to peer into their data)
stonedge 11y ago
This could just be for Google Webmasters which gives them information on their search presence.
stanleydrew 11y ago
Surprised that they don't use the DNS verification option. Bloating your HTML for every request is unnecessary.

cm2187 11y ago

The other thing is that google analytics is on many adblockers lists, precisely for that reason. As adblockers are getting widespread, the analytics is going blind.

Albright 11y ago
I've been running a blocker to block GA and other junk on my PC, but I imagine I'm in a statistically insignificant minority. And I still can't block them on my iPhone unless I disable JavaScript entirely (though I'm running iOS 9, I'm not able to install a blocker for some reason; I guess Apple arbitrarily doesn't support them on my older iPhone model).
- djrogers 11y ago
  >I guess Apple arbitrarily doesn't support them on my older iPhone It's not arbitrary - it requires a 64 bit CPU (of which Apple has now shipped 3 generations of).
  - Albright 11y ago
    Ah, is that the differentiator? I see. Still strikes me as somewhat arbitrary, though - is content blocking such a strenuous task that it requires a 64-bit CPU? Wouldn't using a blocker cause the CPU to do less work in most cases since it doesn't have to download so many ad media files or execute as much JavaScript? Yeah, I guess it's just time to get a friggin' new phone already, but this one ain't broke yet, ya know?
- Kristine1975 11y ago
  If your device is jailbroken (not sure if there's a jailbreak for iOS 9), you could add entries for GA to its hosts file. I use these on my desktop PC: 127.0.0.1 www.google-analytics.com 127.0.0.1 google-analytics.com 127.0.0.1 ssl.google-analytics.com AFAIK ad blockers are only supported on iOS devices with 64 bit CPUs.
- cm2187 11y ago
  I could install an adblocker on iOS9, and you can customize the block list. I don't think you are a minority. I understand adblocking usage is around 20%-ish now. What I don't understand is people who use adblockers but still login to their google account on chrome. It sorts of defeat the purpose...

eponeponepon 11y ago

It took us only a few weeks to write our home-brew analytics package. Nothing super fancy yet now we have an internal dashboard that shows the entire company much of what we used analytics for anyway - and with some nice integration with some of our other systems too. I never quite grasp how the above isn't just a matter of intuition to anyone working in the tech sector. Google Analytics thrives on developers' laziness in my opinion. And to echo other posters: SpiderOak deserve thanks. If I find myself with any need for a service like theirs, I know I'll be looking at them.

chimeracoder 11y ago
> I never quite grasp how the above isn't just a matter of intuition to anyone working in the tech sector. Google Analytics thrives on developers' laziness in my opinion. Unless I'm mistaken, one big difference is that not using Google Analytics means you don't know which Google search pages people used to access your website. That can be a really important difference for some websites.
- cgag 11y ago
  I think you can get that info with webmaster tools without using analytics.
- aargh_aargh 11y ago
  Can't you find out from the Referer header anymore? It's been years since I tried, so it may have changed.
  - kalleboo 11y ago
    Only if your site is HTTPS
splatcollision 11y ago
Looking for a good npm / express middleware module that does this. Combines privacy concerns + developer laziness!

oneJob 11y ago

How about open-sourcing your product before worrying about improving other products? SpiderOak has been "investigating a number of licensing options, and do expect to make the SpiderOak client code open source in the not-distant future" for a very, very long time now. It's no trivial thing to have a closed source client for a "zero knowledge" service. https://spideroak.com/faq/why-isnt-spideroak-open-source-yet-when-will-it-be https://spideroak.com/faq/why-isnt-spideroak-open-source-yet... EDIT: I'd welcome discussion, in addition to your up/down votes

gerty 11y ago
I am also concerned with that. That message has been there unchanged for some time now. To be fair, there's a lot of stuff on the Github page, including the Android client under Apache license. Although as far as I can tell, desktop client is not there yet.
prajjwal 11y ago
I came here for this exact thing. They said they were going to go open source in 2014 IIRC, and failed to deliver. I have stopped using SpiderOak - how am I supposed to trust them with my most private files when I can't verify that they're not doing anything shady on my machine? The opening line of this post is amusing. They ought to give thought to fixing their core product first.

Veratyr 11y ago

Not strictly on topic so I apologise if this is unwanted but I thought I'd share my experience with SpiderOak in case anyone here was thinking of purchasing one of their plans. In February SpiderOak dropped its pricing to $12/month for 1TB of data. Having several hundred gigabytes of photos to backup I took advantage and bought a year long subscription ($129). I had access to a symmetric gigabit fibre connection so I connected, set up the SpiderOak client and started uploading. However I noticed something odd. According to my Mac's activity monitor, SpiderOak was only uploading in short bursts [0] of ~2MB/s. I did some test uploads to other services (Google Drive, Amazon) to verify that things were fine with my connection (they were) and then contacted support (Feb 10). What followed was nearly __6 months__ of "support", first claiming that it might be a server side issue and moving me "to a new host" (Feb 17) then when that didn't resolve my issue, they ignored me for a couple of months then handed me over to an engineer (Apr 28) who told me: "we may have your uploads running at the maximum speed we can offer you at the moment. Additional changes to storage network configuration will not improve the situation much. There is an overhead limitation when the client encrypts, deduplicates, and compresses the files you are uploading" At this point I ran a basic test (cat /dev/urandom | gzip -c | openssl enc -aes-256-cbc -pass pass:spideroak | pv | shasum -a 256 > /dev/zero) that showed my laptop was easily capable of hashing and encrypting the data much faster than SpiderOak was handling it (Apr 30) after which I was simply ignored for a full month until I opened another ticket asking for a refund (Jul 9). I really love the idea of secure, private storage but SpiderOak's client is barely functional and their customer support is rather bad. [0]: http://i.imgur.com/XEvhIop.png http://i.imgur.com/XEvhIop.png

Someone1234 11y ago
Many of these types of services seem to intentionally cap upload speeds to reduce their potential storage liability (since they're likely over-selling storage to be able to offer 1 TB for $12 with the level of redundancy, staffing costs, etc, needed). I wonder if that is happening in this specific case? Although if it were the case the vendor should still be honest about it. Just saying they limit uploads to 2 Mbps is better than giving the run-around.
- 11y ago

pmoriarty 11y ago

Now if they could also just ditch Facebook, Microsoft, and Apple, they'd be getting somewhere.

gramakri 11y ago

At Cloudron, our vision is to allow companies to host their own apps easily. We dogfood and don't use Google. We don't use analytics on our website (a conscious decision). Our emails are based on IMAP servers and we use thunderbird. We selfhost everything other than email (which is on gandi). We just entered private beta yesterday - https://cloudron.io/blog/2015-12-07-private-beta.html https://cloudron.io/blog/2015-12-07-private-beta.html

dschep 11y ago
How's this compare to Sandstorm[0]? It seems like a Closed/SaaS equivalent. [0] https://sandstorm.io/ https://sandstorm.io/
- gramakri 11y ago
  Cloudron and sandstorm are similar projects. I think the main difference is the user experience (also how we handle domains, how apps are packaged etc). You can see a demo of the cloudron here - https://my-demo.cloudron.me/ https://my-demo.cloudron.me/ (username: cloudron password: cloudron). All apps use same credentials (because of single sign on)

qihqi 11y ago

Random fact: GA cookie is distinct from adwords(google.com) cookie, and it is illegal for Google to join those (not sure if it is even technically feasible).

sghiassy 11y ago

I don't get it. SpiderOak states that they dropped GA because it furthers "the erosion of privacy on the web.”, but then they just started tracking in house. How is tracking in house more private than GA? The user is still being tracked.

softyeti 11y ago
I believe their point was that they want to track their traffic, but when they use a third party like Google, Google provides tracking services for SpiderOak, Google also tracks you as well, which SpiderOak has no control over.
stonemetal 11y ago
With it in house it is under their control: they can anonymize it, not collect certain information, they can't cross index it with your traffic from other sites, etc.
distances 11y ago
Google likely (or at least theoretically) has the capability to track the user across all the sites that use GA. In-house tracking doesn't allow this.

api 11y ago

Instead of rolling your own look at Piwik. It works very well and is basically a GA clone. I actually like it better than GA in some ways. It's easy to set up and you can run it on your own site so you're not contributing to a global tracking fabric.

rwbt 11y ago

I've had good experience with Statcounter (http://www.statcounter.com http://www.statcounter.com)

rbinv 11y ago

> It took us only a few weeks to write our home-brew analytics package. Unfortunately, there's no way to replicate what Google Analytics currently offers (for free!) within a couple of weeks (or even months). Not with big data sets. Yes, GA does enforce sampling if you don't pay for GA Premium, but the free edition is still one of hell of a deal (if you don't care about privacy). If you only use Google Analytics as a hit counter, sure, you can do that yourself within a couple of minutes. The advanced features are way more complicated, though (think segmentation and custom reports). This also begs the question: why not use Piwik?

ssharp 11y ago
I suspect most of the people saying "you don't need Google Analytics! Do it yourself!" have never used GA for anything that meaningful. As you begin to really familiarize yourself with your website traffic and understand how to look at your clickstream data in a more investigative an analytical way, you'll start to see how nice GA is and how easy it is to answer your questions. You also underestimate how ubiquitous GA is because it's free and extremely popular. I'd consider myself an intermediate to advanced user of GA, but for people less experienced, I can easily share stuff with them for complicated tasks or they know how to do a lot of the basics themselves. In hiring digital marketing people, GA is pretty much on par with Word in terms of familiarity. It's something a lot of people have a basic competence with.
- rbinv 11y ago
  I agree completely. GA has become very, very capable in the last five years or so. Combined with their current APIs, you can do pretty much anything you want.

zachh 11y ago

Is there any analytics solution that allows for on-prem data storage? Only one I know of is Adobe Analytics (formerly Omniture).

mattab 11y ago
Yes, check out Piwik.org / Piwik.pro

deleted 11y ago

[deleted]

patrick123456 11y ago

https://www.youtube.com/watch?v=tPyx-mLSgpU https://www.youtube.com/watch?v=tPyx-mLSgpU norton tech support phone number 1.800.610.5648 http://www.techsupportusa247.com/ http://www.techsupportusa247.com/ @norton support phone number australia norton support phone number india norton support phone number ireland norton customer phone number norton product support phone number norton ghost support phone number comcast norton support phone number norton technical support phone number canada www.techsupportusa247.com/support-for-norton.html norton 360

electriclove 11y ago

Why not just use Piwik?

justinkramp 11y ago

It should also be noted that SpiderOak has opensourced many components of their product stack, including Crypton, which is the encryption framework underpinning many of their clients. The source is at https://github.com/SpiderOak https://github.com/SpiderOak

cpncrunch 11y ago

>why does Google and their advertisers need to know about it I would ask Google is pretty clear about this. The only reason they track you is for advertising, and there isn't any evidence of them using the info for anything else. In fact there is a lot of evidence pointing the other way, such as their insistence on encryption data flowing between their datacenters. This is Google we are talking about, not Kazakhstan, China or Russia.

Paul-ish 11y ago
Google could eventually use this information to determine your eligibility for a home loan. They have already dipped their toes in this area [1]. With all this data, we have to ensure that it is used fairly (or not at all). There is enough concern about digital redlining that a 2014 report to the white house reports on this [2]. As we know machine learning is quite capable inferring sensitive attributes [3]. This inference doesn't even need to be intentional, machine learning is capable of accidentally picking up on latent variables. Even if your neighborhood (the original redlining) isn't a feature in the original variable, it could be inferred from the other variables. TL;DR: Your surfing behavior could be used to deny you a home loan one day. [1] http://techcrunch.com/2015/11/23/google-launches-mortgage-shopping-tool-in-california-more-states-coming-soon/ http://techcrunch.com/2015/11/23/google-launches-mortgage-sh... [2] https://www.whitehouse.gov/sites/default/files/docs/big_data_privacy_report_may_1_2014.pdf https://www.whitehouse.gov/sites/default/files/docs/big_data... [3] http://www.pnas.org/content/110/15/5802.abstract http://www.pnas.org/content/110/15/5802.abstract
- cpncrunch 11y ago
  Lots of speculation about what they might do. You could also say that the US government could use all of your data to spy on people who criticise the government, so they shouldn't have any of that data either.
adrianlmm 11y ago
Still, Google is a corporation whos only porpose is proffit, trust them blindly is foolish.

iamleppert 11y ago

I'd hate to be the intern or the guy in charge of keeping that thing running.

deleted 11y ago

[deleted]

TheAndruu 11y ago

Make your custom analytics library into a separate product in its own right and sell it or open-source it!

patrickfl 11y ago

For anyone here looking for a really good, free,self-hosted, hackable, open source alternative to Google Analytics that's been around for a long time, please consider Piwik.org. I've been using it for prob 8-10 years and it has never missed a beat. I use it on all my personal / business sites as well as some client websites that are super high traffic.

binaryapparatus 11y ago

Analytics, fonts, css. We include it everywhere by default. Then I realized hey we are all giving away too much. My sites now happily run self-hosted piwik, for the last six or so months. I won't be surprised if in the coming years we hear much more about using google fonts being base to count site access, if there is no analytics in place.

Something1234 11y ago

What about awstats or goaccess? Both are great log analyzers, although I like goacess better. http://goaccess.io/ http://goaccess.io/ http://www.awstats.org/ http://www.awstats.org/

X-Istence 11y ago
The look and feel of awstats hasn't changed since I last used it back in 2004...
- mattab 11y ago
  Piwik is the new AWStats, check out http://piwik.org/log-analytics/ http://piwik.org/log-analytics/

kevin_thibedeau 11y ago

I haven't checked my GA in months since it became clear that Google won't bother doing anything to fix the referer spam problem that makes the stats useless if you don't have a high-volume site. It's not like these abusers are hard to track down but I'll be damned if I'm going to manually add filters to get rid of them every time they come in from a new domain.

emilburzo 11y ago
Admin -> select account -> select property -> View Settings (on the view you want) there's a checkbox: Exclude all hits from known bots and spiders

jliptzin 11y ago

Usually I start with Google Analytics but continue to add to our own in-house analytics solution targeting the specific metrics we're interested in tracking. GA often doesn't provide us with the real insights we're looking for, but it's good for the vanity stats.

ksec 11y ago

To me, it is the cost that matters. Most other Analytics cost $30 - $50 / 1 Million Pageview / Datapoint. To me this expensive. Even when you scale to 100M it will still cost ~$20/Million. Piwik doesn't scale. At least it doesn't scale unless you spend lots of resources to tinker with it. Its Cloud Edition is even more expensive then GoSquared which i consider to be a much better product. What we basically need is a simple, effective, and cheap enough alternative to GA. And so far there are simply none.