5 ms·
We are incredibly open to any ideas, comments or concerns on how we're doing this. This is a big step up from what we had previously, but there’s always room f
by pauljarvis 7y ago
We are incredibly open to any ideas, comments or concerns on how we're doing this. This is a big step up from what we had previously, but there’s always room for improvement. Happy to hear thoughts in the comments.
- abtestdev 7y agoHow do you guard against hash collision?
- JackWritesCode 7y agohttps://crypto.stackexchange.com/a/47810 https://crypto.stackexchange.com/a/47810
- abtestdev 7y agoBased on the blog - anyone who shares a IP address (such as inside a company network) would effectively look the same.
- proaralyst 7y agoAnd given most companies run managed browsers on managed systems, the user agent is going to collide too
- JackWritesCode 7y agoIndeed. This is one of the limitations to our approach. We're thinking of ways to workaround it. Please shout if you have any ideas ;)
- cameronbrown 7y agoIf/When IPv6 is widely used the problem should fade away.
- _-___________-_ 7y agoNot just inside a company network. CGNAT is pretty commonplace nowadays.
- lmkg 7y agoHi Paul, thanks for being open about this. I have a big, important question. ICO, the agency in charge of enforcing GDPR and related legislation in England, released guidance earlier this month on the topics of cookies. One of the most notable parts of this guidance is that "device fingerprinting" is treated the same as a cookie[1]. And also that website analytics requires consent to use cookies or similar technologies[2] ("similar technologies" including device fingerprinting). Now, the above guidance is related to PECR rather than GDPR, which is what your post is about. But, given the above, do you think that your software is compliant/exempt from PECR or do you think that organizations will still have to take extra steps to be compliant with privacy legislation? [1] https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-cookies-and-similar-technologies/#cookies5 https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... [2] https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-we-comply-with-the-cookie-rules/#comply15 https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...
- deleted 7y ago[deleted]
- orra 7y agoI think that's a fair question. AFAICT, v1 of PECR awkwardly applies whenever the cookie is not functionally directly necessary for the service that the user is using. PECR applies even if, like here, the cookie is just for counting unique numbers of visitors, and is not used for fingerprinting individuals. The draft v2 of PECR contains an exemption for first party analytics. I think this maybe strikes a nice balance: explicit consent would still be required for the more-harmful third party analytics. Not sure when v2 of PECR will happen. It is years overdue. Perhaps it is a priority for the newly elected European Parliament and the new Commission?
- krageon 7y agoWhat makes analytics first-party? When the first party serves them, or only if the data never leaves machines under the direct and exclusive control of the first party?
- atonse 7y agoI trust that there's enough questions and scrutiny about your anonymization, so I don't have any questions about that. Mine is more about implementation. If I want to integrate this with a single page app (like Ember or React), are there enough API hooks on how I can track click events and page load events, etc in the JS? We threw together Google Analytics for our launch just so we would have SOME data, but we want to move away from it ASAP for privacy reasons. Anymore about how it would compare to something like Piwik? (the product we're looking at).
- JackWritesCode 7y agoWe <3 EmberJS. Fathom's Dashboard is built using it. You'd want to built it into the Router and call fathom('trackPageview') to log it :)