6 ms·

I would posit that almost any remotely hosted analytics system (privacy oriented or not) is eventually a target for privacy centric browsers. If not now, then i

I would posit that almost any remotely hosted analytics system (privacy oriented or not) is eventually a target for privacy centric browsers. If not now, then in the future. I mean, let's be honest - the days are fast coming when anything that looks like remotely hosted javascript is going to be blocked, no matter how benign it is. So could it be that the future is home grown analytics subsystems that reside in your own stack? That way people who need deeper types of tracking can do it, while those that need shallow analytics can do it too. It certainly seems to be heading in that direction.

paulgb 6y ago
One neat thing about Plausible is that you can point a CNAME of your domain to their servers and serve the analytics request that way. To the browser, it looks the same as if you hosted it yourself.
- StevePlea 6y ago
  Except Pihole has CNAME blocking by default so that will still not work.
  - Eikon 6y ago
    Not if you are proxying.
    - jefftk 6y ago
      You can proxy on your regular domain; we're talking about using a CNAME.
- overscore 6y ago
  The same is true for server-side Google Analytics, but that's already been blocked by ad/analytics blockers.
mhitza 6y ago
I just set up Plausible analytics on my blog a couple of days ago and can confirm the at least uBlock Origin blocks it by default.
markosaric 6y ago
We're hoping to start a conversation with browsers such as Brave and Firefox and blocklist maintainers about this. One way to incentivize even more sites to move from GA et al would be to create some kind of privacy criteria and whitelist those analytics that fulfill it (open source, minimal data, no personal data, no cookies/persistent identifiers, no cross-site/device tracking, no connection to adtech etc). Site owners want analytics. We offer self-hosted service but most sites don't want to deal with managing analytics server as it is not an easy job. So by blocking every analytics tool (good or bad) the incentive for site owners is more on trying to avoid being blocked rather than on moving to something more privacy-friendly. (I'm the Plausible co-founder)
- eric4smith 6y ago
  I think that’s a great idea and I’m firmly on your side. However, we’re still on that slippery slope as described I think. At some point Firefox, Chrome and Safari is going to start blocking almost everything by default - or at best severely restrict them. The question is, how can we move to some kind of embedded analytics? It’s already kind of there in most of the larger platforms.
- Daho0n 6y ago
  I doubt that would end up well with users (and Plausible is already blocked in blocklists). It is like the whole "VPN for privacy" debacle all over again. There's no way that a tracking company can prove to me that the tracking is not logging things it shouldn't (today or in five years), no matter how open source it is. As long as you can't prove it it isn't trustworthy, just like VPNs that have proven to be a privacy nightmare where you have lots of companies pretending to not log but in reality often do. IMO all this will do is end up with yet more lists for adblockers and not only do we already have a huge mess with those we are also seeing them being strangled by API changes like in Chromium. Personally I'd much rather visit a site that use GA (because I know I can block it) than go in and "hope for the best" like it is with ad blocklists. Whitelists would either have to be bulletproof (IE. back to the proven privacy problem) or they would be like cookie pop-ups where most have no idea which to use and trust. I most definitely do not trust someone who builds a Chromium derivative to decide what to whitelist. Whitelists belongs in the users hands where they already are, not some remote company that is bleeding money. We have seen how that works out with a certain adblocker already. I'm a site owner for a small business with zero tracking scripts and zero external connections from the site so I know for a fact that tracking is unnecessary even in areas with lots of online competition. Sure I could do a lot of tracking to make more money for the business but that is the rub isn't? Tracking is about greed. Webservers already tell us enough otherwise. Edit: I'll also just add that anyone who is in the tracking business and use CNAME fiddling is per definition not trustworthy.
capableweb 6y ago
> I mean, let's be honest - the days are fast coming when anything that looks like remotely hosted javascript is going to be blocked, no matter how benign it is. I'm sorry but what? Remotely hosted JS seems to always be growing in popularity, at least in the SaaS business and related area. Can I ask what industry you're in where you see more and more people blocking _all_ JS, not just analytics/tracking? (The HN bubble doesn't count as a "industry") I have a really hard time as seeing your statement as "the truth". People today seem even more likely to accept arbitrary JS running in their browser, than how it used to be.
- eric4smith 6y ago
  I run a Saas platform for many years that hosts for a few thousand customers that are definitely not the HN crowd. Individuals are not blocking. It’s the browsers that are heading in that direction. I’m just reading the tea leaves brah.
  - capableweb 6y ago
    And you're seeing less and less people having JS enabled at all? Are you actively steering people to use Lynx or something?
    - wongarsu 6y ago
      We see browsers restricting cross-origin everything more and more, take for example Firefox's recent efforts to segment cookies, or how browser caches are now segmented instead of global. I agree with GP, I can certainly see a future where browsers make a move to block cross-origin JavaScript files.
      - Silhouette 6y ago
        I agree that browsers are getting more and more aggressive about blocking external content. I am all for good privacy protections and I understand the reasons why they are doing it. But as a user, I am starting to get frustrated by how often I visit "normal" sites that just don't work in certain browsers because of all this blocking. There are plenty of legitimate reasons for people to load external content on websites, and it's important not to throw the baby out with the bath water here. I am also concerned that certain big tech companies, notably including Google though it is hardly the only one, have a tendency to shoot first and not even ask questions later in terms of collateral damage when they deem something to be the appropriate course of action. Chrome has historically had no problem with killing off major functionality that some useful sites required, and other browsers have often followed. Apple has a tendency to do the same (or to achieve the same result by refusing to support functionality in the first place) particularly on iOS. It's always done in the name of improving privacy or security or reliability or some other worthy cause, but it still effectively removes useful content from the Web based on the decision of a handful of people who work on browsers. We should be very wary of that kind of power, particularly when it is wielded by people with little accountability or oversight.
justapassenger 6y ago
Why homegrown? Pretty obvious solutions for big players to it is to run small servers on your infra, that will proxy all the communication. Given that by putting remote js, you already give 3rd parties access to your data, it’s not that really opening you to that much extra risk. It’s shortsighted IMO to fight with remotely hosted JavaScript. It makes things more complex, but doesn’t really help with privacy that much for longer term.
ampdepolymerase 6y ago
I think the solution is to integrate it at the build tool level. A Webpack plugin. They are much harder to block without having to actively rewrite the JavaScript codepaths. The requests should also be proxied back through your own middleware to side step DNS level blocks. I can see a model where a third party analytics platform can offer support for the most popular web frameworks.
dvfjsdhgfv 6y ago
Yes, I would think that one of the selling points of a solution such as Plausible is that they can be hosted on the same domain. A huge step in the right direction if you ask me.

paulgb 6y ago

One neat thing about Plausible is that you can point a CNAME of your domain to their servers and serve the analytics request that way. To the browser, it looks the same as if you hosted it yourself.

StevePlea 6y ago
Except Pihole has CNAME blocking by default so that will still not work.
- Eikon 6y ago
  Not if you are proxying.
  - jefftk 6y ago
    You can proxy on your regular domain; we're talking about using a CNAME.
overscore 6y ago
The same is true for server-side Google Analytics, but that's already been blocked by ad/analytics blockers.

mhitza 6y ago

I just set up Plausible analytics on my blog a couple of days ago and can confirm the at least uBlock Origin blocks it by default.

markosaric 6y ago

We're hoping to start a conversation with browsers such as Brave and Firefox and blocklist maintainers about this. One way to incentivize even more sites to move from GA et al would be to create some kind of privacy criteria and whitelist those analytics that fulfill it (open source, minimal data, no personal data, no cookies/persistent identifiers, no cross-site/device tracking, no connection to adtech etc). Site owners want analytics. We offer self-hosted service but most sites don't want to deal with managing analytics server as it is not an easy job. So by blocking every analytics tool (good or bad) the incentive for site owners is more on trying to avoid being blocked rather than on moving to something more privacy-friendly. (I'm the Plausible co-founder)

eric4smith 6y ago
I think that’s a great idea and I’m firmly on your side. However, we’re still on that slippery slope as described I think. At some point Firefox, Chrome and Safari is going to start blocking almost everything by default - or at best severely restrict them. The question is, how can we move to some kind of embedded analytics? It’s already kind of there in most of the larger platforms.
Daho0n 6y ago
I doubt that would end up well with users (and Plausible is already blocked in blocklists). It is like the whole "VPN for privacy" debacle all over again. There's no way that a tracking company can prove to me that the tracking is not logging things it shouldn't (today or in five years), no matter how open source it is. As long as you can't prove it it isn't trustworthy, just like VPNs that have proven to be a privacy nightmare where you have lots of companies pretending to not log but in reality often do. IMO all this will do is end up with yet more lists for adblockers and not only do we already have a huge mess with those we are also seeing them being strangled by API changes like in Chromium. Personally I'd much rather visit a site that use GA (because I know I can block it) than go in and "hope for the best" like it is with ad blocklists. Whitelists would either have to be bulletproof (IE. back to the proven privacy problem) or they would be like cookie pop-ups where most have no idea which to use and trust. I most definitely do not trust someone who builds a Chromium derivative to decide what to whitelist. Whitelists belongs in the users hands where they already are, not some remote company that is bleeding money. We have seen how that works out with a certain adblocker already. I'm a site owner for a small business with zero tracking scripts and zero external connections from the site so I know for a fact that tracking is unnecessary even in areas with lots of online competition. Sure I could do a lot of tracking to make more money for the business but that is the rub isn't? Tracking is about greed. Webservers already tell us enough otherwise. Edit: I'll also just add that anyone who is in the tracking business and use CNAME fiddling is per definition not trustworthy.

capableweb 6y ago

> I mean, let's be honest - the days are fast coming when anything that looks like remotely hosted javascript is going to be blocked, no matter how benign it is. I'm sorry but what? Remotely hosted JS seems to always be growing in popularity, at least in the SaaS business and related area. Can I ask what industry you're in where you see more and more people blocking _all_ JS, not just analytics/tracking? (The HN bubble doesn't count as a "industry") I have a really hard time as seeing your statement as "the truth". People today seem even more likely to accept arbitrary JS running in their browser, than how it used to be.

eric4smith 6y ago
I run a Saas platform for many years that hosts for a few thousand customers that are definitely not the HN crowd. Individuals are not blocking. It’s the browsers that are heading in that direction. I’m just reading the tea leaves brah.
- capableweb 6y ago
  And you're seeing less and less people having JS enabled at all? Are you actively steering people to use Lynx or something?
  - wongarsu 6y ago
    We see browsers restricting cross-origin everything more and more, take for example Firefox's recent efforts to segment cookies, or how browser caches are now segmented instead of global. I agree with GP, I can certainly see a future where browsers make a move to block cross-origin JavaScript files.
    - Silhouette 6y ago
      I agree that browsers are getting more and more aggressive about blocking external content. I am all for good privacy protections and I understand the reasons why they are doing it. But as a user, I am starting to get frustrated by how often I visit "normal" sites that just don't work in certain browsers because of all this blocking. There are plenty of legitimate reasons for people to load external content on websites, and it's important not to throw the baby out with the bath water here. I am also concerned that certain big tech companies, notably including Google though it is hardly the only one, have a tendency to shoot first and not even ask questions later in terms of collateral damage when they deem something to be the appropriate course of action. Chrome has historically had no problem with killing off major functionality that some useful sites required, and other browsers have often followed. Apple has a tendency to do the same (or to achieve the same result by refusing to support functionality in the first place) particularly on iOS. It's always done in the name of improving privacy or security or reliability or some other worthy cause, but it still effectively removes useful content from the Web based on the decision of a handful of people who work on browsers. We should be very wary of that kind of power, particularly when it is wielded by people with little accountability or oversight.

justapassenger 6y ago

Why homegrown? Pretty obvious solutions for big players to it is to run small servers on your infra, that will proxy all the communication. Given that by putting remote js, you already give 3rd parties access to your data, it’s not that really opening you to that much extra risk. It’s shortsighted IMO to fight with remotely hosted JavaScript. It makes things more complex, but doesn’t really help with privacy that much for longer term.

ampdepolymerase 6y ago

I think the solution is to integrate it at the build tool level. A Webpack plugin. They are much harder to block without having to actively rewrite the JavaScript codepaths. The requests should also be proxied back through your own middleware to side step DNS level blocks. I can see a model where a third party analytics platform can offer support for the most popular web frameworks.

dvfjsdhgfv 6y ago

Yes, I would think that one of the selling points of a solution such as Plausible is that they can be hosted on the same domain. A huge step in the right direction if you ask me.