14 ms·

We moved our servers to Iceland

241 points by soheilpro 8y ago

Semiapies 8y ago
It's a little sad to watch someone jump through hoops to try to please the people behind EasyList, when I sure don't see anything about country-of-hosting in EasyList's policies. Especially when almost nobody actually cares about the other members of the Five Eyes or the Enemies of the Internet in these discussions, but just knee-jerks about US hosting.
- dylz 8y ago
  Yes. Easylist/EasyPrivacy here is intended to block ANY third party tracker. This is a tracker. I use this adblock list and I don't care what country you're hosted in, simpleanalytics is a third party tracker and should be blocked. > " EasyPrivacy [...] including web bugs, tracking scripts and information collectors" Simpleanalytics is all of the above. There is no arguing this.
  - skrebbel 8y ago
    > There is no arguing this. Yes there is. SimpleAnalytics claim that they "don’t track visitors of our customers’ websites". Are they lying? If not, how is it a tracking script?
    - satori99 8y ago
      I guess they mean that they aggregate data? rather than storing it for individuals users? Otherwise, why do they need your browser to make a request in the first place? FWIW I agree with dylz. It is crazy to suggest that any company doing analytics has any sort of right to make my software connect to its servers. If Easylist did not block all unnecessary requests, I would find a list that did.
      - dagenix 8y ago
        > It is crazy to suggest that any company doing analytics has any sort of right to make my software connect to its servers. No analytics company has a right to make you connect to its servers. But, that isn't the case at all: You visit some website. The operator of that website has contracted with the analytics company. You ask the website for some information and it replies with that information as well as a request to ping the analytics company that the website contracted with. It's apparently "crazy" to comply with that request, all while still consuming the information that you asked for and received. Ad-blockers wouldn't be controversial if they worked by navigating away from any site that displayed ads or included a tracker. Of course, that would be inconvenient for the user, so, they don't do that. The whole point of an ad-blocker is to allow a user to consume a service in a manner that the entity running and paying for the service didn't intend. We could at least acknowledge that. Your position, however, seems to be that doing what the service you are using is asking you to do in exchange for its information is "crazy" - and that is straight up ridiculous.
        satori99 8y ago
        I understand your viewpoint, but I consider all script tags that a server provides to be merely suggestions. A browser is, after all, a user-agent. The web was designed this way for a reason. Would I be breaking some sort of inferred agreement if I browsed with no Javascript enabled at all? In any case, a site server logs should provide ample information for analytics, unless they are measuring mouse movements or scrolling etc.
        crankylinuxuser 8y ago
        Just wait until that official DRM crap is used for adtech and preventing you from modifying the HTML the server sends. This is a war; a never-ending war of users VS adtech. I realize how much defense I have to run to protect mtself even moderately, and I'm still losing.
        TelmoMenezes 8y ago
        > The whole point of an ad-blocker is to allow a user to consume a service in a manner that the entity running and paying for the service didn't intend. We could at least acknowledge that. It's kind of funny that that was, originally, the very definition of "hacking", and we are in a site called "hacker news". But moving on... The adtech industry got in its head that it can just arrive in a place that already existed (the Internet) and start inventing implicit contracts. It reminds me of the "nice guy" that does some nice gesture for a woman he likes and then gets outraged when the "implicit contract" for sex is not honored. Hosting is not even that expensive. You know what's expensive? "SEO", buying traffic, in short polluting the very environment where you exist. That is the sort of thing many companies will do with their ad money. They do what they can to place themselves between me and the stuff I want to talk/read about, and then act all outraged when I take counter-measures against their spying and manipulation attempts. That's rich. I hope EasyList continues to do its job of acting on behalf of the users and does not get swayed by bullshit.
    - tylerl 8y ago
      They can both be right. "Tracking" has never been very well defined. It just means something like, "collecting data we don't think you should collect." If you want something more specific, lots of conflicting definitions do exist, but nothing that people can agree on.
    - auslander 8y ago
      It is a 3rd party collecting data about my browsing history. Give me one reason why I should not block it, please.
    - tinus_hn 8y ago
      They don’t track customers, and they respect ‘do not track’. One of these must be wrong.
  - dagenix 8y ago
    I know very little about SimpleanAlytics. However, they do claim to not be a tracker: https://simpleanalytics.io/no-tracking https://simpleanalytics.io/no-tracking. So, they at the least, would argue one of your claims - do you have evidence that what they are saying incorrect?
    - dylz 8y ago
      By definition, loading it will send your (regardless of whether or not they save this or associate it permanently on their end) coarse location via IP, OS, CPU architecture, browser and via user agent, referrer, execute code on your machine, pages you visit. In their page they say (w/r/t Google Analytics) "you maybe use the anonymization feature. This is a step in the right direction, but the sad reality is Google can still collect all the information" -- you would have to trust them too [Simple Analytics] to not collect, save, or delete-accordingly all the information sent to them. It is a third party information collector, period. It tracks visits, it tracks pageviews, at minimum. I am not against them as a company or product, but I believe that easyprivacy is 100% correct in blocking their domain.
      - dagenix 8y ago
        I think its a big mistake to lump this type of "tracking" in with more involved "tracking" where particular users are followed around from site to site to serve up ads based on what the user has looked at recently. These are massively different things. Maybe you are opposed to both types of tracking - I dunno. Personally, I have no issue with a website keeping track of the things that they claim to keep track of (https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect). However, when tracking means that a user does a search for something like "maternity" on one site and then starts getting ads for baby diapers on another - that feels like something that I understand why someone would want to avoid.
        dylz 8y ago
        Sure - I see nothing wrong with separating out the categories. There are different types and different levels. End of the day, at least in my opinion, it is acceptable to be added to blocklists, and it is acceptable to not use those blocklists and hit the beacon.
  - VoxPelli 8y ago
    I think it would be useful to differentiate between “user trackers” and something like a “site tracker”. A “user tracker” sets cookies and follows a user around, knowing what the user have or have not done before. A “site tracker” (bad wording I know) follows what happens to a site, what device types accesses it etc. Sure, making direct requests to the analytics servers exposes IP and possibility to somewhat track the user. Tracking based on IP is pretty inefficient though, due to shared IP-addresses, IP-address changes when jumping between networks, VPN:s. Ideally SimpleAnalytics would provide a tiny proxy/washing script that one can host on ones own server and which one includes on ones site rather than including it directly from SimpleAnalytics servers. That way one can guarantee ones users that no IP-address is leaked to a third party (which would also make a Data Processing Agreement completely unnecessary from a GDPR perspective)
- abc-xyz 8y ago
  I think it's unfair to assume he's jumping through hoops to try to please EasyList when you could just as well assume that someone from EasyList highlighted an issue worth dealing with, even if he knew that there was 0% chance SimpleAnalytics would ever be whitelisted.
teddyh 8y ago
> That’s right, we need to enter the key when the server boots. Wait, but what happens with a power failure? Are all requests with page views to your server failing after a reboot? > Then we found Dropbear, a very small SSH program, that you can run via the initial ramdisk (initramfs). This means we are able to allow external connections via SSH. We don’t have to fly to Iceland to boot our server, yeah! Or you can use Mandos to be able to sleep through a reboot: https://www.recompile.se/mandos https://www.recompile.se/mandos Disclosure: I am the co-author of Mandos.
- kitotik 8y ago
  On first glance this looks great and solves a real problem. Not sure how I’ve missed this. Is there much of a plug-in ecosystem for this to support various auth backends? *edit grammar
  - teddyh 8y ago
    I’m not sure what you mean by “auth backend”. By default, the client merely has to prove that it possesses the correct key to be given the secret encrypted password from the Mandos server. This can be changed by configuring the server not to automatically “approve” clients, which makes the whole procedure controllable over D-Bus, opening the way for any process you like to do whatever it needs to do in order to authenticate a client before the secret encrypted password is sent.
- kbenson 8y ago
  Was fairly leery of how useful I thought this would be, but you reference the FAQ[1] early in what I assume is an attempt to head this off, and it delivers adequately. Despite being predisposed going in thinking it was probably not worth the janky stuff you would have to do to get it working, the level of detail and thorough covering of some fairly complex attack vectors leaves me thinking that while not as secure as no automatic boot method for encrypted disks (obviously), it would definitely be a step up over not encrypting and something I would recommend without worrying that I was increasing the burden of managing the systems to a level an organization would be unprepared to deal with. Not that I'm some professional security researcher or anything, but congratulations, color me impressed. 1: https://www.recompile.se/mandos/man/intro.8mandos https://www.recompile.se/mandos/man/intro.8mandos
caprese 8y ago
and all of this had zero effect on revenue and customer retention, congratulations you played yourself also the FBI has merely made suggestions to Reykjavik Police to infiltrate servers and they did > After the initial revelation of the server's location in a data center in Reykjavik, Iceland, the filing explains that Reykjavik police accessed and secretly copied the server's data. As agents of a foreign government, the prosecution argues, they weren't required to seek a warrant from any US authority. The owner of those servers is in US prison right now serving a double life sentence Iceland's domestic laws didn't help here, and the lack of a formal arrangement with cross-sharing intelligence communities didn't help here So you are either implementing a zero-knowledge service to begin with, or wasting your time
- mirimir 8y ago
  Where are you getting that quote from? I don't see it in TFA, and you don't provide any reference. If the server uses full-disk encryption, and if it's well locked down, it would be nontrivial to secretly access and copy the server's data. I mean, adversaries could attach a keyboard and monitor, but they couldn't log in. And you can even delete the root password, and allow only key-based login via SSH.
  - caprese 8y ago
    source of quote: https://www.wired.com/2014/09/the-fbi-finally-says-how-it-legally-pinpointed-silk-roads-server/ https://www.wired.com/2014/09/the-fbi-finally-says-how-it-le... additional: https://nakedsecurity.sophos.com/2014/10/10/fbis-warrantless-hack-of-silk-road-was-legal-prosecutors-claim/ https://nakedsecurity.sophos.com/2014/10/10/fbis-warrantless... > If the server uses full-disk encryption, and if it's well locked down, it would be nontrivial to secretly access and copy the server's data. OP's article mentions this, part of the reason they move out of the US is because RAM can be trivially read even if full disk encryption is used. Reading RAM still works in Iceland.
    - mirimir 8y ago
      Thanks. > RAM can be trivially read even if full disk encryption is used I wouldn't say "trivially", but yes, it can be. But if you're that paranoid, you can embed key parts of the motherboard in alumina-filled epoxy. Its thermal conductivity is good, and you can add fins and fans as needed. You can even embed trip wires in the epoxy, to trigger system shutdown if tampered with.
auslander 8y ago
> ..embed scripts .. hosted via the CDN of CloudFlare I'm browsing to med.com/somedisease and now CF links my browser to the URL from Referer header.
- gruez 8y ago
  This can be mitigated by https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
  - harianus 8y ago
    This seems to work for links, but does it work for when you embed a script? > [...] by using the referrerpolicy attribute on <a>, <area>, <img>, <iframe>, or <link> elements Hm, seems not to work for scripts.
whoisjuan 8y ago
I applaud the intention but I doubt this is going to make a difference when it comes to signing or keeping users. If the service keeps growing they will quickly realize that latency and availability matters. Uptime would be now a major concern. If something blows up in whatever facility it's used for these servers they will be fucked. No way to shift traffic to another server. And let's not even talk about computing needs. At scale, that matters. Having managed services also matters and helps reduce operational cost (a lot). Having a bare server in someone's garage in Reykjavik is the opposite of scaling. It's literally a recipe to deprive yourself from the technologies that can make you successful and definitely a way to slow down your progress. If SimpleAnalytics' goal is to stay small, then maybe this could make sense, but that for me makes this business pointless and it doesn't sound like the vision the founder has either. Or maybe this is just an MVP until they can have their own on-prem infrastructure with fully encrypted hardware. Idk, maybe the founder's vision go as far as that, and I can't see beyond the downsides of a such a random move.
- mattrp 8y ago
  No you’re right - very little if anything was accomplished here. The other side of the cables connecting Iceland land in five eyes territory and cost like n times more for capacity (and are old etc).
dagenix 8y ago
> If you draw a straight line from San Francisco to Amsterdam you will cross Iceland. Simple Analytics has most customers from the US and Europe, so it makes sense to pick this geographical location. 1. I would be interested to find out if being geographically between San Francisco and Amsterdam is actually good for latency. 2. I think the usual solution to having customers in the US and Europe and wanting to keep latency down, is to setup servers in the US and Europe. So, this strikes me as an odd justification of the decision.
- maxnoe 8y ago
  On which map projection?
  - taffer 8y ago
    Probably great-circle distance.
- cbg0 8y ago
  Pings to 1984.is: From Palo Alto : round-trip min/avg/max/stddev = 183.514/184.035/184.898/0.466 ms From Amsterdam : round-trip min/avg/max = 36/37/39 ms From London : round-trip min/avg/max = 48/48/50 ms Obviously this can vary quite a bit depending on what peering you have at your disposal. For reference, from Palo Alto to London: round-trip min/avg/max/stddev = 156.236/156.921/158.271/0.834 ms For latency, I would choose NY/NJ or similar if you really want one location to serve both EU and US; Though this isn't ideal, it does lower the latency to West Coast US quite a bit. From San Jose to Newark : min/avg/max/stddev = 73.462/73.547/73.660/0.078 ms From London to Newark : min/avg/max/stddev = 72.836/74.323/75.600/1.200 ms
  - toast0 8y ago
    From your pings, it seems pretty likely that traffic from your Palo Alto location is going through europe to get to iceland, most likely through London. The submarine cable map shows one cable going west to greenland and then Canada, one that goes to northern England, and two to Denmark. The Canadian landing isn't very close to any other transatlantic cables, so it may not be very well connected (land connectivity is much harder to map though). Anyway, making location decisions based on assuming internet distance is similar to physical distance is kind of silly. There are many physically adjacent countries that don't have direct interconnects, it's pretty common for traffic to exchange through somewhere much farther away than the ultimate destination: many south american countries exchange traffic in Miami.
idlewords 8y ago
This reasoning is backwards. Host a service in the US and it is at least protected from arbitrary monitoring by the NSA by US law. Host it abroad and you have no such protection.
- AdriaanvRossum 8y ago
  I think protection by the NSA is a though sell nowadays.
  - tptacek 8y ago
    I don't think that's really the sell. The sell is that hosting within the US is the only protection you can have from NSA, since they have a total, unencumbered free hand when it comes to services hosted outside the US, without even a legal formalism to stop them. Like all national SIGINT agencies, breaking into everything outside their own borders is literally their chartered job.
  - idlewords 8y ago
    This is protection against the NSA. My point is that within the United States, there are at least some legal and procedural protections (however flimsy you think they are) which do not apply to a service hosted abroad.
- deleted 8y ago
  [deleted]
- derpherpsson 8y ago
  You are missing the point. The customers and users that are outside of the USA is being wiretapped by the NSA. And the NSA cooperates with GCHQ etc (the five eyes) to monitor us citizen. Or maybe you didn't read the article before you replied with some isolationist 'merica-standpoint
  - tptacek 8y ago
    The guidelines ask you not to make arguments like that. You should especially refrain from them when you don't understand the argument you're attempting to rebut.
chvid 8y ago
I appreciate what simpleanalytics.io and 1984 is trying to do but I really think they risk going on a hyperbole and thus lose the broad appeal of their cause. The important thing here is rightful skepticism of companies which gives away valuable complex software (a web analytics tool) for free in return for access to your customers behavioural data which then is sold or used in other parts of their business (ie. Google Analytics/Google Adwords). Making this a thing about the mass surveillance of the five eyes and thus having to avoid hosting companies such as Digital Ocean and AWS just looses a lot of us and frankly is a bit too paranoid/silly.
- harianus 8y ago
  A little note on hosting companies. In Europe at least there are corporations that only host data in Europe and don't use any hosting companies from the US. This is a question which we repeatedly get at Simple Analytics. So avoiding those companies has advantages business wise.
  - chvid 8y ago
    What exactly is the problem in using digital ocean and select a server placed in Europe?
    - deleted 8y ago
      [deleted]
    - detaro 8y ago
      The concern is that the US government will ask/force US companies to hand over data or give access even it's stored outside the US. E.g. see the "CLOUD act".
    - pdimitar 8y ago
      US law enforcement agencies have the right to come to your office, demand and collect all your data and force you to keep silent about it. You guys in USA might not hear a lot about it but this is a business concern in a no small amount of countries around the world. Especially Europe (or I might think so because I'm there; selection and confirmation bias are always a possibility).
jkaljundi 8y ago
How did you choose between Iceland and Estonia, what were the pros and cons?
- harianus 8y ago
  Iceland has 100% green energy and their location is slightly better. Maybe the biggest plus is their laws.
  - dmitripopov 8y ago
    And also it's a very cool place to visit :)
Siira 8y ago
Isn’t the key on the VPS’s memory? What’s the use of this full-disk encryption?
- sneak 8y ago
  In practice, it is harder to dump the memory of a bare metal server than it is to simply yank out a hard drive. (It is, of course, possible - the technique is beyond many hosting companies and local police, and the effectiveness depends on the temperature.) In theory, the hosting provider, having physical access, has both the key (in RAM) and the cyphertext on disk, so logically there is little point. It’s worth noting that my hosted bare metal boxes have encrypted data partitions with keys I provide over ssh each boot. Of course, if it is a VM, anyone with root on the hypervisor (i.e. the hosting company) can trivially dump the memory and encryption keys.
- jimktrains2 8y ago
  Encryption at rest. So, if a hard disk (including a turned-off laptop) is stolen, mishandled, or not destroyed properly. Someone physically attacking a running computer is a different, and much harder, threat model. This is why companies employing fde will also require laptops to be shutdown before being moved.
fuuuga 8y ago
Lol. Who really believe these tracking companies, they are fake like Google
- galorepus 8y ago
  It's surprising how many companies get helping money from bigger mainstream companies to push certain agenda
guaka 8y ago
Matomo is analytics for folks who really care about privacy (or folks who want to simply have more control over their users analytics data). Install https://matomo.org/ https://matomo.org/ and run it in the same location as the project you're already running. Your own instance of Matomo is not going to be on EasyList any time soon.
- edp 8y ago
  Matomo is blocked by many ad blockers by default, not based on the domain name or URL but based on the name of the js files downloaded by the browser.
  - r3bl 8y ago
    ...and those could be easily avoided by referencing "js/" instead of "piwik.js"[0], or by running Matomo's log analytics tool[1]. Which leads back to the following quote from the author: > But what happens if we block alternatives even if those alternatives are taking the privacy of the user very serious. I care about the privacy of the individual. I don't collect any personal information (I don't even store IP's). Even if you have your Do Not Track-setting turned on in the browser I do not collect any information (see our script). [0] https://ericmathison.com/blog/bypass-ad-blockers-and-track-your-visitors-with-piwik/ https://ericmathison.com/blog/bypass-ad-blockers-and-track-y... [1] https://matomo.org/docs/log-analytics-tool-how-to/ https://matomo.org/docs/log-analytics-tool-how-to/
derpherpsson 8y ago
I really liked this :) Thank you for existing.
- harianus 8y ago
  <3
BillinghamJ 8y ago
> We also delete the credit card and email from Stripe (our payment provider). The email isn't actually deleted - Stripe's logs will permanently hold that data. If you don't want to retain the email address, you'll need to send receipts etc yourself.
- harianus 8y ago
  Ah, good point. We already do so it's just a matter of not sending the email address to Stripe. Thank you for the suggestion. Added this to our roadmap: https://simpleanalytics.io/roadmap#109207 https://simpleanalytics.io/roadmap#109207
dmitripopov 8y ago
Just for the notice: you keep using "we" through the article, yet your home page tells that you run it solo.
- derpherpsson 8y ago
  The royal we. Also makes it easier to hire people if you don't have to update any texts ;)
  - dmitripopov 8y ago
    Yep. But it's important to be consistent even for a royal person.
LifeLiverTransp 8y ago
Why not have them on a boat, so you can ship them wherever its cheapest to run them or they are needed? Also ocena provides free cooling water.
meowface 8y ago
I appreciate the intent, but I think this is folly. The FBI has imaged Icelandic servers, like Silk Road's, with the cooperation of Iceland's law enforcement. Iceland's ISPs are also not neutral and have been pressured by other countries to block access to websites like Pirate Bay, which would be beyond the pale for US ISPs. There is no country on Earth that will meet your requirements for hosting. For example, if you host in Russia, you probably can evade the US government's prying eyes, but then you have to deal with the Russian government's prying eyes. I strongly doubt Digital Ocean would give customer data to anyone without a warrant from a judge. And there could be some scenarios I'm not thinking about, but I also doubt a judge would ever grant a warrant to collect bulk analytics data. And I think it would be unlikely that law enforcement would want to request a warrant just for some narrow analytics collected on a few specific individuals. Also, as others have pointed out, you actually make yourself totally fair game for US intelligence agencies by being in a non-FVEY country, and even more so because Iceland's ISPs peer with ones in FVEY countries. But way more importantly than all of that, the threat model is wrong. You're likely at far greater risk from cybercriminals and regular blackhats than you are from any government. Digital Ocean (very much unlike Linode and some other big providers) has never had a (known) breach, and probably invests way more into security than the Icelandic provider you switched to does. DO likely has many world class security engineers employed; maybe your Icelandic provider does, too, but it's less likely. And this isn't even going into the added management and latency issues. I feel like you're kind of handicapping yourself without any significant privacy gain or increase in customer acquisition. You're getting feedback from very suspicious people who want to block all use of your, and others', services. You should take feedback from such a group with a heavy grain of salt. This also does nothing to actually get the domain removed from the block list - there is probably nothing you can do there, other than gray hat stuff like constantly rotating domains and IPs, or pivoting and changing your entire business model and company.
- shoes_for_thee 8y ago
  > I strongly doubt Digital Ocean would give customer data to anyone without a warrant from a judge A subpeona from a grand jury or an NSL would be more than sufficient.
perilunar 8y ago
> We are thinking of setting up a very simple CDN with encrypted servers, which only serve our JavaScript and store the page views temporarily before sending it to our main server in Iceland. For the JavaScript, just encourage your clients to copy the script and serve it from their own server with the rest of their files.

241 points by soheilpro 8y ago

It's a little sad to watch someone jump through hoops to try to please the people behind EasyList, when I sure don't see anything about country-of-hosting in EasyList's policies. Especially when almost nobody actually cares about the other members of the Five Eyes or the Enemies of the Internet in these discussions, but just knee-jerks about US hosting.

dylz 8y ago
Yes. Easylist/EasyPrivacy here is intended to block ANY third party tracker. This is a tracker. I use this adblock list and I don't care what country you're hosted in, simpleanalytics is a third party tracker and should be blocked. > " EasyPrivacy [...] including web bugs, tracking scripts and information collectors" Simpleanalytics is all of the above. There is no arguing this.
- skrebbel 8y ago
  > There is no arguing this. Yes there is. SimpleAnalytics claim that they "don’t track visitors of our customers’ websites". Are they lying? If not, how is it a tracking script?
  - satori99 8y ago
    I guess they mean that they aggregate data? rather than storing it for individuals users? Otherwise, why do they need your browser to make a request in the first place? FWIW I agree with dylz. It is crazy to suggest that any company doing analytics has any sort of right to make my software connect to its servers. If Easylist did not block all unnecessary requests, I would find a list that did.
    - dagenix 8y ago
      > It is crazy to suggest that any company doing analytics has any sort of right to make my software connect to its servers. No analytics company has a right to make you connect to its servers. But, that isn't the case at all: You visit some website. The operator of that website has contracted with the analytics company. You ask the website for some information and it replies with that information as well as a request to ping the analytics company that the website contracted with. It's apparently "crazy" to comply with that request, all while still consuming the information that you asked for and received. Ad-blockers wouldn't be controversial if they worked by navigating away from any site that displayed ads or included a tracker. Of course, that would be inconvenient for the user, so, they don't do that. The whole point of an ad-blocker is to allow a user to consume a service in a manner that the entity running and paying for the service didn't intend. We could at least acknowledge that. Your position, however, seems to be that doing what the service you are using is asking you to do in exchange for its information is "crazy" - and that is straight up ridiculous.
      - satori99 8y ago
        I understand your viewpoint, but I consider all script tags that a server provides to be merely suggestions. A browser is, after all, a user-agent. The web was designed this way for a reason. Would I be breaking some sort of inferred agreement if I browsed with no Javascript enabled at all? In any case, a site server logs should provide ample information for analytics, unless they are measuring mouse movements or scrolling etc.
        crankylinuxuser 8y ago
        Just wait until that official DRM crap is used for adtech and preventing you from modifying the HTML the server sends. This is a war; a never-ending war of users VS adtech. I realize how much defense I have to run to protect mtself even moderately, and I'm still losing.
      - TelmoMenezes 8y ago
        > The whole point of an ad-blocker is to allow a user to consume a service in a manner that the entity running and paying for the service didn't intend. We could at least acknowledge that. It's kind of funny that that was, originally, the very definition of "hacking", and we are in a site called "hacker news". But moving on... The adtech industry got in its head that it can just arrive in a place that already existed (the Internet) and start inventing implicit contracts. It reminds me of the "nice guy" that does some nice gesture for a woman he likes and then gets outraged when the "implicit contract" for sex is not honored. Hosting is not even that expensive. You know what's expensive? "SEO", buying traffic, in short polluting the very environment where you exist. That is the sort of thing many companies will do with their ad money. They do what they can to place themselves between me and the stuff I want to talk/read about, and then act all outraged when I take counter-measures against their spying and manipulation attempts. That's rich. I hope EasyList continues to do its job of acting on behalf of the users and does not get swayed by bullshit.
  - tylerl 8y ago
    They can both be right. "Tracking" has never been very well defined. It just means something like, "collecting data we don't think you should collect." If you want something more specific, lots of conflicting definitions do exist, but nothing that people can agree on.
  - auslander 8y ago
    It is a 3rd party collecting data about my browsing history. Give me one reason why I should not block it, please.
  - tinus_hn 8y ago
    They don’t track customers, and they respect ‘do not track’. One of these must be wrong.
- dagenix 8y ago
  I know very little about SimpleanAlytics. However, they do claim to not be a tracker: https://simpleanalytics.io/no-tracking https://simpleanalytics.io/no-tracking. So, they at the least, would argue one of your claims - do you have evidence that what they are saying incorrect?
  - dylz 8y ago
    By definition, loading it will send your (regardless of whether or not they save this or associate it permanently on their end) coarse location via IP, OS, CPU architecture, browser and via user agent, referrer, execute code on your machine, pages you visit. In their page they say (w/r/t Google Analytics) "you maybe use the anonymization feature. This is a step in the right direction, but the sad reality is Google can still collect all the information" -- you would have to trust them too [Simple Analytics] to not collect, save, or delete-accordingly all the information sent to them. It is a third party information collector, period. It tracks visits, it tracks pageviews, at minimum. I am not against them as a company or product, but I believe that easyprivacy is 100% correct in blocking their domain.
    - dagenix 8y ago
      I think its a big mistake to lump this type of "tracking" in with more involved "tracking" where particular users are followed around from site to site to serve up ads based on what the user has looked at recently. These are massively different things. Maybe you are opposed to both types of tracking - I dunno. Personally, I have no issue with a website keeping track of the things that they claim to keep track of (https://simpleanalytics.io/what-we-collect https://simpleanalytics.io/what-we-collect). However, when tracking means that a user does a search for something like "maternity" on one site and then starts getting ads for baby diapers on another - that feels like something that I understand why someone would want to avoid.
      - dylz 8y ago
        Sure - I see nothing wrong with separating out the categories. There are different types and different levels. End of the day, at least in my opinion, it is acceptable to be added to blocklists, and it is acceptable to not use those blocklists and hit the beacon.
- VoxPelli 8y ago
  I think it would be useful to differentiate between “user trackers” and something like a “site tracker”. A “user tracker” sets cookies and follows a user around, knowing what the user have or have not done before. A “site tracker” (bad wording I know) follows what happens to a site, what device types accesses it etc. Sure, making direct requests to the analytics servers exposes IP and possibility to somewhat track the user. Tracking based on IP is pretty inefficient though, due to shared IP-addresses, IP-address changes when jumping between networks, VPN:s. Ideally SimpleAnalytics would provide a tiny proxy/washing script that one can host on ones own server and which one includes on ones site rather than including it directly from SimpleAnalytics servers. That way one can guarantee ones users that no IP-address is leaked to a third party (which would also make a Data Processing Agreement completely unnecessary from a GDPR perspective)
abc-xyz 8y ago
I think it's unfair to assume he's jumping through hoops to try to please EasyList when you could just as well assume that someone from EasyList highlighted an issue worth dealing with, even if he knew that there was 0% chance SimpleAnalytics would ever be whitelisted.

teddyh 8y ago

> That’s right, we need to enter the key when the server boots. Wait, but what happens with a power failure? Are all requests with page views to your server failing after a reboot? > Then we found Dropbear, a very small SSH program, that you can run via the initial ramdisk (initramfs). This means we are able to allow external connections via SSH. We don’t have to fly to Iceland to boot our server, yeah! Or you can use Mandos to be able to sleep through a reboot: https://www.recompile.se/mandos https://www.recompile.se/mandos Disclosure: I am the co-author of Mandos.

kitotik 8y ago
On first glance this looks great and solves a real problem. Not sure how I’ve missed this. Is there much of a plug-in ecosystem for this to support various auth backends? *edit grammar
- teddyh 8y ago
  I’m not sure what you mean by “auth backend”. By default, the client merely has to prove that it possesses the correct key to be given the secret encrypted password from the Mandos server. This can be changed by configuring the server not to automatically “approve” clients, which makes the whole procedure controllable over D-Bus, opening the way for any process you like to do whatever it needs to do in order to authenticate a client before the secret encrypted password is sent.
kbenson 8y ago
Was fairly leery of how useful I thought this would be, but you reference the FAQ[1] early in what I assume is an attempt to head this off, and it delivers adequately. Despite being predisposed going in thinking it was probably not worth the janky stuff you would have to do to get it working, the level of detail and thorough covering of some fairly complex attack vectors leaves me thinking that while not as secure as no automatic boot method for encrypted disks (obviously), it would definitely be a step up over not encrypting and something I would recommend without worrying that I was increasing the burden of managing the systems to a level an organization would be unprepared to deal with. Not that I'm some professional security researcher or anything, but congratulations, color me impressed. 1: https://www.recompile.se/mandos/man/intro.8mandos https://www.recompile.se/mandos/man/intro.8mandos

caprese 8y ago

and all of this had zero effect on revenue and customer retention, congratulations you played yourself also the FBI has merely made suggestions to Reykjavik Police to infiltrate servers and they did > After the initial revelation of the server's location in a data center in Reykjavik, Iceland, the filing explains that Reykjavik police accessed and secretly copied the server's data. As agents of a foreign government, the prosecution argues, they weren't required to seek a warrant from any US authority. The owner of those servers is in US prison right now serving a double life sentence Iceland's domestic laws didn't help here, and the lack of a formal arrangement with cross-sharing intelligence communities didn't help here So you are either implementing a zero-knowledge service to begin with, or wasting your time

mirimir 8y ago
Where are you getting that quote from? I don't see it in TFA, and you don't provide any reference. If the server uses full-disk encryption, and if it's well locked down, it would be nontrivial to secretly access and copy the server's data. I mean, adversaries could attach a keyboard and monitor, but they couldn't log in. And you can even delete the root password, and allow only key-based login via SSH.
- caprese 8y ago
  source of quote: https://www.wired.com/2014/09/the-fbi-finally-says-how-it-legally-pinpointed-silk-roads-server/ https://www.wired.com/2014/09/the-fbi-finally-says-how-it-le... additional: https://nakedsecurity.sophos.com/2014/10/10/fbis-warrantless-hack-of-silk-road-was-legal-prosecutors-claim/ https://nakedsecurity.sophos.com/2014/10/10/fbis-warrantless... > If the server uses full-disk encryption, and if it's well locked down, it would be nontrivial to secretly access and copy the server's data. OP's article mentions this, part of the reason they move out of the US is because RAM can be trivially read even if full disk encryption is used. Reading RAM still works in Iceland.
  - mirimir 8y ago
    Thanks. > RAM can be trivially read even if full disk encryption is used I wouldn't say "trivially", but yes, it can be. But if you're that paranoid, you can embed key parts of the motherboard in alumina-filled epoxy. Its thermal conductivity is good, and you can add fins and fans as needed. You can even embed trip wires in the epoxy, to trigger system shutdown if tampered with.

auslander 8y ago

> ..embed scripts .. hosted via the CDN of CloudFlare I'm browsing to med.com/somedisease and now CF links my browser to the URL from Referer header.

gruez 8y ago
This can be mitigated by https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
- harianus 8y ago
  This seems to work for links, but does it work for when you embed a script? > [...] by using the referrerpolicy attribute on <a>, <area>, <img>, <iframe>, or <link> elements Hm, seems not to work for scripts.

whoisjuan 8y ago

I applaud the intention but I doubt this is going to make a difference when it comes to signing or keeping users. If the service keeps growing they will quickly realize that latency and availability matters. Uptime would be now a major concern. If something blows up in whatever facility it's used for these servers they will be fucked. No way to shift traffic to another server. And let's not even talk about computing needs. At scale, that matters. Having managed services also matters and helps reduce operational cost (a lot). Having a bare server in someone's garage in Reykjavik is the opposite of scaling. It's literally a recipe to deprive yourself from the technologies that can make you successful and definitely a way to slow down your progress. If SimpleAnalytics' goal is to stay small, then maybe this could make sense, but that for me makes this business pointless and it doesn't sound like the vision the founder has either. Or maybe this is just an MVP until they can have their own on-prem infrastructure with fully encrypted hardware. Idk, maybe the founder's vision go as far as that, and I can't see beyond the downsides of a such a random move.

mattrp 8y ago
No you’re right - very little if anything was accomplished here. The other side of the cables connecting Iceland land in five eyes territory and cost like n times more for capacity (and are old etc).

dagenix 8y ago

> If you draw a straight line from San Francisco to Amsterdam you will cross Iceland. Simple Analytics has most customers from the US and Europe, so it makes sense to pick this geographical location. 1. I would be interested to find out if being geographically between San Francisco and Amsterdam is actually good for latency. 2. I think the usual solution to having customers in the US and Europe and wanting to keep latency down, is to setup servers in the US and Europe. So, this strikes me as an odd justification of the decision.

maxnoe 8y ago
On which map projection?
- taffer 8y ago
  Probably great-circle distance.
cbg0 8y ago
Pings to 1984.is: From Palo Alto : round-trip min/avg/max/stddev = 183.514/184.035/184.898/0.466 ms From Amsterdam : round-trip min/avg/max = 36/37/39 ms From London : round-trip min/avg/max = 48/48/50 ms Obviously this can vary quite a bit depending on what peering you have at your disposal. For reference, from Palo Alto to London: round-trip min/avg/max/stddev = 156.236/156.921/158.271/0.834 ms For latency, I would choose NY/NJ or similar if you really want one location to serve both EU and US; Though this isn't ideal, it does lower the latency to West Coast US quite a bit. From San Jose to Newark : min/avg/max/stddev = 73.462/73.547/73.660/0.078 ms From London to Newark : min/avg/max/stddev = 72.836/74.323/75.600/1.200 ms
- toast0 8y ago
  From your pings, it seems pretty likely that traffic from your Palo Alto location is going through europe to get to iceland, most likely through London. The submarine cable map shows one cable going west to greenland and then Canada, one that goes to northern England, and two to Denmark. The Canadian landing isn't very close to any other transatlantic cables, so it may not be very well connected (land connectivity is much harder to map though). Anyway, making location decisions based on assuming internet distance is similar to physical distance is kind of silly. There are many physically adjacent countries that don't have direct interconnects, it's pretty common for traffic to exchange through somewhere much farther away than the ultimate destination: many south american countries exchange traffic in Miami.

idlewords 8y ago

This reasoning is backwards. Host a service in the US and it is at least protected from arbitrary monitoring by the NSA by US law. Host it abroad and you have no such protection.

AdriaanvRossum 8y ago
I think protection by the NSA is a though sell nowadays.
- tptacek 8y ago
  I don't think that's really the sell. The sell is that hosting within the US is the only protection you can have from NSA, since they have a total, unencumbered free hand when it comes to services hosted outside the US, without even a legal formalism to stop them. Like all national SIGINT agencies, breaking into everything outside their own borders is literally their chartered job.
- idlewords 8y ago
  This is protection against the NSA. My point is that within the United States, there are at least some legal and procedural protections (however flimsy you think they are) which do not apply to a service hosted abroad.
deleted 8y ago
[deleted]
derpherpsson 8y ago
You are missing the point. The customers and users that are outside of the USA is being wiretapped by the NSA. And the NSA cooperates with GCHQ etc (the five eyes) to monitor us citizen. Or maybe you didn't read the article before you replied with some isolationist 'merica-standpoint
- tptacek 8y ago
  The guidelines ask you not to make arguments like that. You should especially refrain from them when you don't understand the argument you're attempting to rebut.

chvid 8y ago

I appreciate what simpleanalytics.io and 1984 is trying to do but I really think they risk going on a hyperbole and thus lose the broad appeal of their cause. The important thing here is rightful skepticism of companies which gives away valuable complex software (a web analytics tool) for free in return for access to your customers behavioural data which then is sold or used in other parts of their business (ie. Google Analytics/Google Adwords). Making this a thing about the mass surveillance of the five eyes and thus having to avoid hosting companies such as Digital Ocean and AWS just looses a lot of us and frankly is a bit too paranoid/silly.

harianus 8y ago
A little note on hosting companies. In Europe at least there are corporations that only host data in Europe and don't use any hosting companies from the US. This is a question which we repeatedly get at Simple Analytics. So avoiding those companies has advantages business wise.
- chvid 8y ago
  What exactly is the problem in using digital ocean and select a server placed in Europe?
  - deleted 8y ago
    [deleted]
  - detaro 8y ago
    The concern is that the US government will ask/force US companies to hand over data or give access even it's stored outside the US. E.g. see the "CLOUD act".
  - pdimitar 8y ago
    US law enforcement agencies have the right to come to your office, demand and collect all your data and force you to keep silent about it. You guys in USA might not hear a lot about it but this is a business concern in a no small amount of countries around the world. Especially Europe (or I might think so because I'm there; selection and confirmation bias are always a possibility).

jkaljundi 8y ago

How did you choose between Iceland and Estonia, what were the pros and cons?

harianus 8y ago
Iceland has 100% green energy and their location is slightly better. Maybe the biggest plus is their laws.
- dmitripopov 8y ago
  And also it's a very cool place to visit :)

Siira 8y ago

Isn’t the key on the VPS’s memory? What’s the use of this full-disk encryption?

sneak 8y ago
In practice, it is harder to dump the memory of a bare metal server than it is to simply yank out a hard drive. (It is, of course, possible - the technique is beyond many hosting companies and local police, and the effectiveness depends on the temperature.) In theory, the hosting provider, having physical access, has both the key (in RAM) and the cyphertext on disk, so logically there is little point. It’s worth noting that my hosted bare metal boxes have encrypted data partitions with keys I provide over ssh each boot. Of course, if it is a VM, anyone with root on the hypervisor (i.e. the hosting company) can trivially dump the memory and encryption keys.
jimktrains2 8y ago
Encryption at rest. So, if a hard disk (including a turned-off laptop) is stolen, mishandled, or not destroyed properly. Someone physically attacking a running computer is a different, and much harder, threat model. This is why companies employing fde will also require laptops to be shutdown before being moved.

fuuuga 8y ago

Lol. Who really believe these tracking companies, they are fake like Google

galorepus 8y ago
It's surprising how many companies get helping money from bigger mainstream companies to push certain agenda

guaka 8y ago

Matomo is analytics for folks who really care about privacy (or folks who want to simply have more control over their users analytics data). Install https://matomo.org/ https://matomo.org/ and run it in the same location as the project you're already running. Your own instance of Matomo is not going to be on EasyList any time soon.

edp 8y ago
Matomo is blocked by many ad blockers by default, not based on the domain name or URL but based on the name of the js files downloaded by the browser.
- r3bl 8y ago
  ...and those could be easily avoided by referencing "js/" instead of "piwik.js"[0], or by running Matomo's log analytics tool[1]. Which leads back to the following quote from the author: > But what happens if we block alternatives even if those alternatives are taking the privacy of the user very serious. I care about the privacy of the individual. I don't collect any personal information (I don't even store IP's). Even if you have your Do Not Track-setting turned on in the browser I do not collect any information (see our script). [0] https://ericmathison.com/blog/bypass-ad-blockers-and-track-your-visitors-with-piwik/ https://ericmathison.com/blog/bypass-ad-blockers-and-track-y... [1] https://matomo.org/docs/log-analytics-tool-how-to/ https://matomo.org/docs/log-analytics-tool-how-to/

derpherpsson 8y ago

I really liked this :) Thank you for existing.

harianus 8y ago
<3

BillinghamJ 8y ago

> We also delete the credit card and email from Stripe (our payment provider). The email isn't actually deleted - Stripe's logs will permanently hold that data. If you don't want to retain the email address, you'll need to send receipts etc yourself.

harianus 8y ago
Ah, good point. We already do so it's just a matter of not sending the email address to Stripe. Thank you for the suggestion. Added this to our roadmap: https://simpleanalytics.io/roadmap#109207 https://simpleanalytics.io/roadmap#109207

dmitripopov 8y ago

Just for the notice: you keep using "we" through the article, yet your home page tells that you run it solo.

derpherpsson 8y ago
The royal we. Also makes it easier to hire people if you don't have to update any texts ;)
- dmitripopov 8y ago
  Yep. But it's important to be consistent even for a royal person.

LifeLiverTransp 8y ago

Why not have them on a boat, so you can ship them wherever its cheapest to run them or they are needed? Also ocena provides free cooling water.

meowface 8y ago

I appreciate the intent, but I think this is folly. The FBI has imaged Icelandic servers, like Silk Road's, with the cooperation of Iceland's law enforcement. Iceland's ISPs are also not neutral and have been pressured by other countries to block access to websites like Pirate Bay, which would be beyond the pale for US ISPs. There is no country on Earth that will meet your requirements for hosting. For example, if you host in Russia, you probably can evade the US government's prying eyes, but then you have to deal with the Russian government's prying eyes. I strongly doubt Digital Ocean would give customer data to anyone without a warrant from a judge. And there could be some scenarios I'm not thinking about, but I also doubt a judge would ever grant a warrant to collect bulk analytics data. And I think it would be unlikely that law enforcement would want to request a warrant just for some narrow analytics collected on a few specific individuals. Also, as others have pointed out, you actually make yourself totally fair game for US intelligence agencies by being in a non-FVEY country, and even more so because Iceland's ISPs peer with ones in FVEY countries. But way more importantly than all of that, the threat model is wrong. You're likely at far greater risk from cybercriminals and regular blackhats than you are from any government. Digital Ocean (very much unlike Linode and some other big providers) has never had a (known) breach, and probably invests way more into security than the Icelandic provider you switched to does. DO likely has many world class security engineers employed; maybe your Icelandic provider does, too, but it's less likely. And this isn't even going into the added management and latency issues. I feel like you're kind of handicapping yourself without any significant privacy gain or increase in customer acquisition. You're getting feedback from very suspicious people who want to block all use of your, and others', services. You should take feedback from such a group with a heavy grain of salt. This also does nothing to actually get the domain removed from the block list - there is probably nothing you can do there, other than gray hat stuff like constantly rotating domains and IPs, or pivoting and changing your entire business model and company.

shoes_for_thee 8y ago
> I strongly doubt Digital Ocean would give customer data to anyone without a warrant from a judge A subpeona from a grand jury or an NSL would be more than sufficient.

perilunar 8y ago

> We are thinking of setting up a very simple CDN with encrypted servers, which only serve our JavaScript and store the page views temporarily before sending it to our main server in Iceland. For the JavaScript, just encourage your clients to copy the script and serve it from their own server with the rest of their files.