11 ms·

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ https://pla

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

marvinblum 6y ago
I would like to add https://pirsch.io/ https://pirsch.io/ :)
- bobm_kite9 6y ago
  This looks really nice, but what’s to stop it getting blocked like all the other trackers once apple/uBlock/etc. add it to their database?
  - marvinblum 6y ago
    You cannot stop that. You can get around it for a while by serving the script yourself and setting a CNAME record for your domain to point to us. That's why we recommend integrating Pirsch into your backend so that it can't be blocked: https://docs.pirsch.io/get-started/backend-integration/ https://docs.pirsch.io/get-started/backend-integration/
louhike 6y ago
Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.
- shuckles 6y ago
  Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.
  - owaislone 6y ago
    The backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.
    - MaurizioPz 6y ago
      part of the GDPR law is the intent of the information you are storing, not the method. Cookie is just a technology. If you track your users using a DB it still applies and you need consent if the tracking is not necessary
    - drcongo 6y ago
      I can't reply to the reply to this for some reason, but it's worth noting that GDPR and the cookie law are different, though related.
      - OJFord 6y ago
        For very recent comments, click on the timestamp to get the single comment view and be able to reply. (I had to do it here too.)
        drcongo 6y ago
        Oh! Useful tip, thanks!
        edoceo 6y ago
        You folks might just be time limited on the reply - HN puts some brakes on "too fast" commenting
        OJFord 6y ago
        See my profile if you want, that was my first comment in hours. I think it is that sort of brake, (prevents heated discussions veing quite so quick-fire) but it's not on the user, it's on everyone for <'5 [or something] minutes ago' comments; drcongo's happened to be '0 minutes ago' when I loaded the page, so I clicked on it to reply.
- asimops 6y ago
  To my understanding of the GDPR, as soon as you track any identifier that makes those data non-anonymous you still need consent for that. It is not about the cookies per se.
  - BlueTemplar 6y ago
    Would that mean that you need consent for storing IP addresses in logs?
    - kybernetikos 6y ago
      It depends on what you use them for, but I think you would need it documented that you do it and why.
  - M2Ys4U 6y ago
    There are six legal bases for processing personal data, consent is only one of those.
- coldpie 6y ago
  Or, don't do any tracking. I'm convinced that 99% of all analytics is discarded without ever being reviewed, analyzed, or acted upon.
  - scrollaway 6y ago
    Much like logging though, it's the 1 percent that isn't discarded that's important. I agree with you by the way, but ...
  - chipotle_coyote 6y ago
    This is probably correct. On my personal web sites I'm using GoAccess, which is basically a new spin on a very old idea -- just analyzing the server's web logs. https://goaccess.io https://goaccess.io That's not as accurate as throwing around cookies and JavaScript, but I rarely check the log pages anyway, and when I do I'm less interested in raw numbers than I am in the relative performance of various pages. (And that's mostly just idle curiosity, e.g., are there some old articles that keep getting steady traffic from somewhere?)
tuna-piano 6y ago
Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?
- colejohnson66 6y ago
  I’m guessing a cookie with an expiration of 24 hours, but I could be wrong
- marvinblum 6y ago
  Probably like we do it for pirsch.io, by calculating a hashed fingerprint and throwing away the individual page hits once per day: https://github.com/pirsch-analytics/pirsch https://github.com/pirsch-analytics/pirsch
  - tuna-piano 6y ago
    Seems like a good method and actually more accurate than they do... seems like they just do a hash of IP.
    - marvinblum 6y ago
      Hmm I think I've read something about it elsewhere and they also use more parameters than just the IP. Not sure.
  - YetAnotherNick 6y ago
    What's the privacy benefit over storing a tracking cookie with expiry of a day? If at all, random cookie seems better for privacy as in your case if someone really wants it, they can recover the IP if the user agent is not rare by searching for all IP(4 billion IPv4), User-Agent(100 for popular browsers), the date(1 day as date is stored separately), and a salt(known to server), easily within reach of anyone.
Wowfunhappy 6y ago
Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing stuff into the ether.
- dfreire 6y ago
  You can probably find some at https://github.com/onurakpolat/awesome-analytics https://github.com/onurakpolat/awesome-analytics
- MarekKnapek 6y ago
  Few years back I created some HelloWorld application on Google's AppEngine (requires Java, Python or Go) and was positively surprised about its statistics on theirs dashboard.
  - type0 6y ago
    I was also surprised but the number of different dumb bots that had tried to brute-force our app engine site on /wp-login.php and it wasn't even running on wordpress
    - neilparikh 6y ago
      I get requests to /wp-login.php (and the like) on my simple Haskell web app hosted on my university's servers. They're quite persistent and I'm not even sure how found the URL to my app in the first place (the format is something like universityname.com/~userid/projectname, and I haven't linked it anywhere).
- bbellini 6y ago
  I would recommend GoatCounter. https://www.goatcounter.com/ https://www.goatcounter.com/
madjam002 6y ago
IANAL, but my understanding is that you might still need a consent box even if you use Plausible. I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This is speculation though so I'd be interested to hear what others think. If it is critical to the operation of the website (functionality like storing saved items in a shopping cart, or security), then you wouldn't need consent. In reality though, Plausible looks great and using it is a huge improvement over Google Analytics for privacy.
- slowwriter 6y ago
  My understanding is that this kind of active consent that we see as popups everywhere on the web nowadays applies to cookies only. So I would assume that if you can track user activity without a cookie you wouldn't need it. It should probably be stated in the privacy policy though. I'm not an expert in this even though I'm a webdev from the EU, so I'm also interested in other people's input.
  - feanaro 6y ago
    GDPR doesn't care if you're accomplishing the tracking with a cookie or using a different mechanism. You're not allowed to do it either way, unless the user has consented.
    - slowwriter 6y ago
      Since I’m being downvoted: The EU directive that specifically obligates websites to collect informed and active consent for the use of cookies is not GDPR, it’s the ePrivacy Directive. I don’t believe that one should automatically conclude that just because a cookie requires active consent, any kind of ‘logging’ (local and temporary storage of IPs in order to track website usage) requires active consent. Those are two fundamentally different things. I’m not saying you should hide the fact that you’re doing it. I’m saying it should be stated in the privacy policy. Also remember that there is a big difference between ‘personally identifiable information’ and ‘sensitive information’ which are clearly separated concepts in GDPR. Not all collection of data requires active consent. I did read my EU state’s guideline on GDPR in full, but I’m not an expert. I would suggest reading up on the ePrivacy Directive though, which is still in effect.

marvinblum 6y ago

I would like to add https://pirsch.io/ https://pirsch.io/ :)

bobm_kite9 6y ago
This looks really nice, but what’s to stop it getting blocked like all the other trackers once apple/uBlock/etc. add it to their database?
- marvinblum 6y ago
  You cannot stop that. You can get around it for a while by serving the script yourself and setting a CNAME record for your domain to point to us. That's why we recommend integrating Pirsch into your backend so that it can't be blocked: https://docs.pirsch.io/get-started/backend-integration/ https://docs.pirsch.io/get-started/backend-integration/

louhike 6y ago

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

shuckles 6y ago
Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.
- owaislone 6y ago
  The backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.
  - MaurizioPz 6y ago
    part of the GDPR law is the intent of the information you are storing, not the method. Cookie is just a technology. If you track your users using a DB it still applies and you need consent if the tracking is not necessary
  - drcongo 6y ago
    I can't reply to the reply to this for some reason, but it's worth noting that GDPR and the cookie law are different, though related.
    - OJFord 6y ago
      For very recent comments, click on the timestamp to get the single comment view and be able to reply. (I had to do it here too.)
      - drcongo 6y ago
        Oh! Useful tip, thanks!
      - edoceo 6y ago
        You folks might just be time limited on the reply - HN puts some brakes on "too fast" commenting
        OJFord 6y ago
        See my profile if you want, that was my first comment in hours. I think it is that sort of brake, (prevents heated discussions veing quite so quick-fire) but it's not on the user, it's on everyone for <'5 [or something] minutes ago' comments; drcongo's happened to be '0 minutes ago' when I loaded the page, so I clicked on it to reply.
asimops 6y ago
To my understanding of the GDPR, as soon as you track any identifier that makes those data non-anonymous you still need consent for that. It is not about the cookies per se.
- BlueTemplar 6y ago
  Would that mean that you need consent for storing IP addresses in logs?
  - kybernetikos 6y ago
    It depends on what you use them for, but I think you would need it documented that you do it and why.
- M2Ys4U 6y ago
  There are six legal bases for processing personal data, consent is only one of those.
coldpie 6y ago
Or, don't do any tracking. I'm convinced that 99% of all analytics is discarded without ever being reviewed, analyzed, or acted upon.
- scrollaway 6y ago
  Much like logging though, it's the 1 percent that isn't discarded that's important. I agree with you by the way, but ...
- chipotle_coyote 6y ago
  This is probably correct. On my personal web sites I'm using GoAccess, which is basically a new spin on a very old idea -- just analyzing the server's web logs. https://goaccess.io https://goaccess.io That's not as accurate as throwing around cookies and JavaScript, but I rarely check the log pages anyway, and when I do I'm less interested in raw numbers than I am in the relative performance of various pages. (And that's mostly just idle curiosity, e.g., are there some old articles that keep getting steady traffic from somewhere?)

tuna-piano 6y ago

Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?

colejohnson66 6y ago
I’m guessing a cookie with an expiration of 24 hours, but I could be wrong
marvinblum 6y ago
Probably like we do it for pirsch.io, by calculating a hashed fingerprint and throwing away the individual page hits once per day: https://github.com/pirsch-analytics/pirsch https://github.com/pirsch-analytics/pirsch
- tuna-piano 6y ago
  Seems like a good method and actually more accurate than they do... seems like they just do a hash of IP.
  - marvinblum 6y ago
    Hmm I think I've read something about it elsewhere and they also use more parameters than just the IP. Not sure.
- YetAnotherNick 6y ago
  What's the privacy benefit over storing a tracking cookie with expiry of a day? If at all, random cookie seems better for privacy as in your case if someone really wants it, they can recover the IP if the user agent is not rare by searching for all IP(4 billion IPv4), User-Agent(100 for popular browsers), the date(1 day as date is stored separately), and a salt(known to server), easily within reach of anyone.

Wowfunhappy 6y ago

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing stuff into the ether.

dfreire 6y ago
You can probably find some at https://github.com/onurakpolat/awesome-analytics https://github.com/onurakpolat/awesome-analytics
MarekKnapek 6y ago
Few years back I created some HelloWorld application on Google's AppEngine (requires Java, Python or Go) and was positively surprised about its statistics on theirs dashboard.
- type0 6y ago
  I was also surprised but the number of different dumb bots that had tried to brute-force our app engine site on /wp-login.php and it wasn't even running on wordpress
  - neilparikh 6y ago
    I get requests to /wp-login.php (and the like) on my simple Haskell web app hosted on my university's servers. They're quite persistent and I'm not even sure how found the URL to my app in the first place (the format is something like universityname.com/~userid/projectname, and I haven't linked it anywhere).
bbellini 6y ago
I would recommend GoatCounter. https://www.goatcounter.com/ https://www.goatcounter.com/

madjam002 6y ago

IANAL, but my understanding is that you might still need a consent box even if you use Plausible. I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This is speculation though so I'd be interested to hear what others think. If it is critical to the operation of the website (functionality like storing saved items in a shopping cart, or security), then you wouldn't need consent. In reality though, Plausible looks great and using it is a huge improvement over Google Analytics for privacy.

slowwriter 6y ago
My understanding is that this kind of active consent that we see as popups everywhere on the web nowadays applies to cookies only. So I would assume that if you can track user activity without a cookie you wouldn't need it. It should probably be stated in the privacy policy though. I'm not an expert in this even though I'm a webdev from the EU, so I'm also interested in other people's input.
- feanaro 6y ago
  GDPR doesn't care if you're accomplishing the tracking with a cookie or using a different mechanism. You're not allowed to do it either way, unless the user has consented.
  - slowwriter 6y ago
    Since I’m being downvoted: The EU directive that specifically obligates websites to collect informed and active consent for the use of cookies is not GDPR, it’s the ePrivacy Directive. I don’t believe that one should automatically conclude that just because a cookie requires active consent, any kind of ‘logging’ (local and temporary storage of IPs in order to track website usage) requires active consent. Those are two fundamentally different things. I’m not saying you should hide the fact that you’re doing it. I’m saying it should be stated in the privacy policy. Also remember that there is a big difference between ‘personally identifiable information’ and ‘sensitive information’ which are clearly separated concepts in GDPR. Not all collection of data requires active consent. I did read my EU state’s guideline on GDPR in full, but I’m not an expert. I would suggest reading up on the ePrivacy Directive though, which is still in effect.