6 ms·

Love what you are doing here. A few points: 1. I would rename the pixel.png to something like image.png. Never call your script anything like tracking, analyti

Love what you are doing here. A few points: 1. I would rename the pixel.png to something like image.png. Never call your script anything like tracking, analytics, or pixel when you don't want to be blocked by ad blockers. We use hello.js and hello.gif. [1] > Log file parsing is an old-skool but effective way of measuring the traffic to your site. 2. By using a pixel image you can bypass caching. When using server logs without the image you only get the non cached requests. So an image like you use is a better approach. 3. Your image is being cached. So if somebody revisits your website your image will not be loaded and you will not find anything in your logs. Just disable your etag and add a expiry date of the past. Awesome that more and more people are replacing Google Analytics with more simple tools. GA is overly complicated and has not the best privacy mindset. I built Simple Analytics [2] as a privacy friendly alternative. [1] https://docs.simpleanalytics.com/script https://docs.simpleanalytics.com/script [2] https://simpleanalytics.com https://simpleanalytics.com

xiaq 7y ago
> Never call your script anything like tracking, analytics, or pixel when you don't want to be blocked by ad blockers. But this is a tracking script, no? If I were you I'd keep the name that way so that if people don't want to be tracked, they don't.
- harianus 7y ago
  If your business is to track people, yes. If it's to gather statistics without tracking people (like page views), I think it perfectly fine to bypass ad blockers. We even have a dedicated feature for bypassing ad blockers [1] because we think page views are not privacy invasive. We drop IP addresses from every request so there is no personal data in our database or logs. If you really want to block you can enable the Do Not Track setting. Although I think this should only be used when you are actually tracking people (we don't). So this feature might be removed in the future. It's already removed by Safari because it is another parameter to fingerprint a browser. [1] https://docs.simpleanalytics.com/bypass-ad-blockers https://docs.simpleanalytics.com/bypass-ad-blockers
  - xiaq 7y ago
    The privacy game is about power, not about who is doing what right now. People shun Google's data collection because of what Google can do with the data, not what it has done or is doing; it only takes a single case of data misuse to reveal the power dynamics even if nothing has happened to them personally. You don't have to play the privacy game -- there is a lot of space between really respecting user's privacy and breaking privacy laws. But if you do, you should put the power back in the user's hand. (Disclaimer: I work for Google.)
    - lioeters 7y ago
      Thank you for that comment. It means a lot that such a thoughtful consideration of privacy is coming from someone working at Google, there is hope yet for a humane approach to analytics and data collection.
    - la_barba 7y ago
      I think it is fair to know exactly what data I'm giving up and what Google is doing with it, if I chose to exchange it for free services and goods. Hopefully someone with a spine comes to power and enacts some regulation allowing users to have a much clearer understanding of this. Also, people dislike Google for many things it has already done, not just because of an imagined future problem. Also.... nothing personal against you!
    - kerng 7y ago
      There have been countless cases for me personally where Googles tracking is creepy. Like Google Map recommendations, YouTube videos I should watch, misleading ads that send the user to malware bases on interest Google has about them etc, as well as exposure of unauthenticated Google+ APIs that allowed access to sensitive data to name a few. I think saying nothing bad has happened is disingenuous. As soon as Google gets similar exposure as FB right now, internal whistleblowers might come forward also with more stories. Also, couple of years ago Google was thoroughly compromised by at least one foreign government, ever wonder how much data was stolen?
    - harianus 7y ago
- judge2020 7y ago
  The author said it himself, he could have just put Cloudfront in front of Pages and parsed the access logs there. The referrer and user-agent, which are sent by the browser, are in the request headers. There would be no need for JS or an image if the website owner just changed their setup. How do you deal with this sort of tracking?
  - harianus 7y ago
    What do you mean? I think using CloudFront is not accurate enough if you use caching.
    - ceejayoz 7y ago
      They've got an enterprise logging tool that'll give you all the info needed for this sort of tracking. https://support.cloudflare.com/hc/en-us/articles/216672448-Cloudflare-Logs-formerly-ELS- https://support.cloudflare.com/hc/en-us/articles/216672448-C...
      - judge2020 7y ago
        This is "Front", the Amazon offering, not "Flare" (side note: logging via Cloudflare Workers is cheap and possible)
    - judge2020 7y ago
      I guess I mean overall "you can't stop owners from analyzing their access logs" and not just related to Cloudfront.
- matz1 7y ago
  The goal is to track. Allowing people to easily disable defeat the purpose.
- snlnspc 7y ago
  I agree with this, but thankfully these posts have let us know to block hello.gif and hello.js by default now.
- qwertox 7y ago
  > But this is a tracking script, no? No. This is self-hosted analytics, no 3rd-party involved, the way it's supposed to be. Tracking involves a 3rd-party. Be it Google Analytics or Cambridge Analytica UserTracking (TM).
MuffinFlavored 7y ago
You don’t track user’s flow on site? like conversion for ecommerce, bounce rate, time on page, etc.?
- harianus 7y ago
  Not at the moment. We will implement tracking user flow with in a privacy minded way. I asked Hacker News a while ago if they would think it was privacy friendly [1] To be clear about the other thread about bypassing ad blockers. We will not have this feature when tracking user flow. People should have the right to block events if they want. But for basic info as in page views we keep offering the ad blocker bypass feature. [1] https://news.ycombinator.com/item?id=19136044 https://news.ycombinator.com/item?id=19136044
aembleton 7y ago
Correct. I wasn't loading pixel.png as it was blocked by the Easy Privacy List: https://easylist.to/easylist/easyprivacy.txt https://easylist.to/easylist/easyprivacy.txt

xiaq 7y ago

> Never call your script anything like tracking, analytics, or pixel when you don't want to be blocked by ad blockers. But this is a tracking script, no? If I were you I'd keep the name that way so that if people don't want to be tracked, they don't.

harianus 7y ago
If your business is to track people, yes. If it's to gather statistics without tracking people (like page views), I think it perfectly fine to bypass ad blockers. We even have a dedicated feature for bypassing ad blockers [1] because we think page views are not privacy invasive. We drop IP addresses from every request so there is no personal data in our database or logs. If you really want to block you can enable the Do Not Track setting. Although I think this should only be used when you are actually tracking people (we don't). So this feature might be removed in the future. It's already removed by Safari because it is another parameter to fingerprint a browser. [1] https://docs.simpleanalytics.com/bypass-ad-blockers https://docs.simpleanalytics.com/bypass-ad-blockers
- xiaq 7y ago
  The privacy game is about power, not about who is doing what right now. People shun Google's data collection because of what Google can do with the data, not what it has done or is doing; it only takes a single case of data misuse to reveal the power dynamics even if nothing has happened to them personally. You don't have to play the privacy game -- there is a lot of space between really respecting user's privacy and breaking privacy laws. But if you do, you should put the power back in the user's hand. (Disclaimer: I work for Google.)
  - lioeters 7y ago
    Thank you for that comment. It means a lot that such a thoughtful consideration of privacy is coming from someone working at Google, there is hope yet for a humane approach to analytics and data collection.
  - la_barba 7y ago
    I think it is fair to know exactly what data I'm giving up and what Google is doing with it, if I chose to exchange it for free services and goods. Hopefully someone with a spine comes to power and enacts some regulation allowing users to have a much clearer understanding of this. Also, people dislike Google for many things it has already done, not just because of an imagined future problem. Also.... nothing personal against you!
  - kerng 7y ago
    There have been countless cases for me personally where Googles tracking is creepy. Like Google Map recommendations, YouTube videos I should watch, misleading ads that send the user to malware bases on interest Google has about them etc, as well as exposure of unauthenticated Google+ APIs that allowed access to sensitive data to name a few. I think saying nothing bad has happened is disingenuous. As soon as Google gets similar exposure as FB right now, internal whistleblowers might come forward also with more stories. Also, couple of years ago Google was thoroughly compromised by at least one foreign government, ever wonder how much data was stolen?
  - harianus 7y ago
judge2020 7y ago
The author said it himself, he could have just put Cloudfront in front of Pages and parsed the access logs there. The referrer and user-agent, which are sent by the browser, are in the request headers. There would be no need for JS or an image if the website owner just changed their setup. How do you deal with this sort of tracking?
- harianus 7y ago
  What do you mean? I think using CloudFront is not accurate enough if you use caching.
  - ceejayoz 7y ago
    They've got an enterprise logging tool that'll give you all the info needed for this sort of tracking. https://support.cloudflare.com/hc/en-us/articles/216672448-Cloudflare-Logs-formerly-ELS- https://support.cloudflare.com/hc/en-us/articles/216672448-C...
    - judge2020 7y ago
      This is "Front", the Amazon offering, not "Flare" (side note: logging via Cloudflare Workers is cheap and possible)
  - judge2020 7y ago
    I guess I mean overall "you can't stop owners from analyzing their access logs" and not just related to Cloudfront.
matz1 7y ago
The goal is to track. Allowing people to easily disable defeat the purpose.
snlnspc 7y ago
I agree with this, but thankfully these posts have let us know to block hello.gif and hello.js by default now.
qwertox 7y ago
> But this is a tracking script, no? No. This is self-hosted analytics, no 3rd-party involved, the way it's supposed to be. Tracking involves a 3rd-party. Be it Google Analytics or Cambridge Analytica UserTracking (TM).

MuffinFlavored 7y ago

You don’t track user’s flow on site? like conversion for ecommerce, bounce rate, time on page, etc.?

harianus 7y ago
Not at the moment. We will implement tracking user flow with in a privacy minded way. I asked Hacker News a while ago if they would think it was privacy friendly [1] To be clear about the other thread about bypassing ad blockers. We will not have this feature when tracking user flow. People should have the right to block events if they want. But for basic info as in page views we keep offering the ad blocker bypass feature. [1] https://news.ycombinator.com/item?id=19136044 https://news.ycombinator.com/item?id=19136044

aembleton 7y ago

Correct. I wasn't loading pixel.png as it was blocked by the Easy Privacy List: https://easylist.to/easylist/easyprivacy.txt https://easylist.to/easylist/easyprivacy.txt