12 ms·

I just deployed Plausible.io[1] for my blog $6/mo on a droplet, it's self-hosted and 100% open source. It seems very privacy focused, and provides basically the

I just deployed Plausible.io[1] for my blog $6/mo on a droplet, it's self-hosted and 100% open source. It seems very privacy focused, and provides basically the same minimalist data described in this article. I always find it weird though that privacy advocates still go for "I have this hidden treasure trove of analytics about my site that you cannot access" Analytics should always be 100% anonymous and aggregated. And if you've met those two bars, making them open and public should be a non-issue. If you can't make your analytics public, that's called spying. There should be no issue making your analytics public. Mine are[2] [1] https://plausible.io/docs/self-hosting https://plausible.io/docs/self-hosting [2] https://devlog.hexops.com/about#open-analytics-data https://devlog.hexops.com/about#open-analytics-data

kbenson 6y ago
> $6/mo on a droplet I wonder how many extra dollars cumulatively DO makes from the $1 premium on getting a better Intel CPU or AMD CPU and/or NVMe up sell on the smallest droplets. I pay the extra dollar as well. I doubt I actually see the difference for what I use it for. I feel no desire to pay a dollar less though, so they are making another 20% from me on that product than they would have.
- slimsag 6y ago
  I didn't pay the extra dollar, I got the $5 droplet - but the backups are $1/mo extra
  - kbenson 6y ago
    Ah, interesting. Was it offered at the time and you didn't choose it, or is it an older droplet that didn't have the choice? I've had a lot of different droplets of different sizes over the last 6-7 years. Recently when I created a new one for a new project, I noticed that option and chose it. I'm not sure I would if buying a larger droplet, or a lot of small ones (I've done that for certain projects), but $1/mo is the point where it feels like nothing.
    - slimsag 6y ago
      Well, it's only $1/mo difference for the smallest droplet. As you go up in tiers: $2, $3, $4, $8, $16 dollar differences. I think it's a little scummy that they go out of their way to hide it and make the more expensive options the default, though: https://user-images.githubusercontent.com/3173176/115132649-e5036000-9fb6-11eb-93ee-69ce89415d9e.png https://user-images.githubusercontent.com/3173176/115132649-... DigitalOcean is going downhill fast after the layoffs, I'm not optimistic about them in the long term. I'd love to know what they burn on marketing, because their video ads on YouTube are crazy.
      - nojs 6y ago
        A while ago I noticed they set the default droplet to a more expensive one and moved the $5 option off the screen to the left so you have to scroll to see it, but it all lines up so it looks like there’s no more options. Minor change but a sneaky one.
      - kbenson 6y ago
        > I think it's a little scummy that they go out of their way to hide it and make the more expensive options the default Eh, I wouldn't call that hiding it so much as making the current market default the one they default to. If you're looking for the lowest end droplet, then yeah, it makes sense you would want the lower end Intel without SSD, but if you're buying something more expensive at all, there's more of a choice to be made. Also, I'm not going to fault them for putting forth the option that allows them to more easily decommission what are probably older hardware and disks for newer offerings, especially when the "hiding" is just a radio button above the droplets. It's not that hidden. I suspect eventually the newer gen Intel/AMD offerings will lower in price and replace the current default. > I'd love to know what they burn on marketing, because their video ads on YouTube are crazy. That's interesting. I remember seeing some like 6-12 months ago on youtube for the first time, but I haven't seen any for a long while. I must have just been flagged as not part of their target audience (or Google has determined I already use them).
hk1337 6y ago
I would imagine the main thing is not wanting people to or derive confidential company information, like how a certain marketing strategy is going or some other piece of data you can get from analytics.
ccvannorman 6y ago
OK, I find it hilarious that your open analytics say zero hits for the past few weeks until 70+ hits from today because you linked your open analytics on an HN comment... :-D :-D
- slimsag 6y ago
  I only deployed it just earlier this morning. Cloudflare says ~15k unique visitors in the past few weeks FWIW.
deleted 6y ago
[deleted]
qchris 6y ago
I literally did the same thing last night! A DO droplet hosting a statically-generated site composed of html generated from some markdown and sandwiched between some html headers, then served up by the Rocket[1] framework. It's my first website, and I think the total size of the backend is something like 40 LoC. I've never had any kind of analytics (or needed them), but I thought it would be neat to see what was going on. It took me all of 20 minutes to sign up, add the single Plausible <script></script> line to my index files and headers, and there it was. As someone with literally no other web experience, I can't imagine it having been easier. The cost of my website is now a whole $12/mo instead of $6, and I agree that it feels kinda nice to support a service that seems to place value on privacy and openness. [1] https://github.com/SergioBenitez/Rocket https://github.com/SergioBenitez/Rocket
austhrow743 6y ago
Analytics are business intelligence. Showing which of your content works well and which doesn’t. The idea that there should be no issue sharing them is absurd. Yeah just publish the minutes from your marketing strategy meetings as well while you’re at it. Invite your competitors to go over your books with you and your accountant and then arrange meet and greets with your most profitable customers as dessert.
- slimsag 6y ago
  Sure, in the same way that code is intellectual property and should never be shared, and all ideas should all be patented in case they become worth something. In all seriousness, I'm OK with that as long as people are honest about it. Just say "We track our users to collect business intelligence." and I'm happy.
  - varenc 6y ago
    The point is that even analytics that are 100% anonymous and aggregated, with no privacy concerns, are still pieces of business intelligence.
  - systemvoltage 6y ago
    We all would love to know what Google page ranking algorithm is. Disclosing any business information whether it is in the form of code, analytics, financial information, customer data, etc. sometimes makes sense but more than often, doesn't.
    - dvfjsdhgfv 6y ago
      > Disclosing any business information whether it is in the form of code, analytics, financial information, customer data, etc. sometimes makes sense but more than often, doesn't. While I agree with the spirit of your comment, this is a very sweeping generalization. Many kinds of financial information are being shared regularly with the public and for publicly traded companies they're required by law. Many companies build their infrastructure on open source software, with proprietary glue being a small percent. Knowing what you can or even should share (for marketing purposes) is crucial. Especially knowing that keeping information asymmetry forever is impossible.
rozenmd 6y ago
I also use Plausible for OnlineOrNot (https://onlineornot.com https://onlineornot.com) - but there's no way I'd make it public. Content marketing is part of the secret sauce these days.
literallyWTF 6y ago
Whenever I read these hyperbolic statements on Hackernews I always end up rolling my eyes. Really? It’s spying now?
- hervature 6y ago
  Don’t we call classified (not public) foreign analytics spying?
  - pjc50 6y ago
    Analytics of what? Analytics of your own stuff is not spying. Entertainingly https://cpcchina.chinadaily.com.cn/ https://cpcchina.chinadaily.com.cn/ uses Google Analytics, while http://english.www.gov.cn/ http://english.www.gov.cn/ (yes, no https) uses Alexa metrics. You can't even access the Chinese Communist party website without being "spied on" by US-based metrics companies. I don't think this proves anything but it's amusing to contemplate.
hobofan 6y ago
Great, now you've made it possible for everyone that links to your site to track people by adding arbitrary UTM parameters which can be uniquely identified. POC: https://opendata.hexops.com/devlog.hexops.com?utm_campaign=public_tracking https://opendata.hexops.com/devlog.hexops.com?utm_campaign=p... Instead of what solutions like Plausible are meant to do (only give a responsible well-defined party access to the data), now everyone can view your website users potentially PII.
- slimsag 6y ago
  Plausible literally provides a toggle to make it public in their UI: https://plausible.io/docs/visibility https://plausible.io/docs/visibility Sure, someone could send out unique links to random `utm_campaign` IDs and see "did the person click it?" and I agree that's a bit nasty. But even if you do convince someone to click _your_ link, what good does that do? We can see you yourself clicked that link from Germany on a mobile phone, and that's literally it. We can't get your IP address, or any PII - it's not stored. You were able to verify what level of information my site is collecting *because* it is public. That is simply better than me spying and recording everything you do and you just having to "hope I never accidentally release it or sell it to someone" as is the case with modern tracking.
  - hobofan 6y ago
    > Germany on a mobile phone, and that's literally it Yes, and _that's it_! Just by getting someone to click on a site they find trustworthy, you are now able to extract country, device, browser, OS, time of access, and to some degree other pages visited on the website. This in itself may not be PII, but together with previously known data points may be enough to assemble PII. > Plausible literally provides a toggle to make it public in their UI: https://plausible.io/docs/visibility https://plausible.io/docs/visibility Yeah, and I don't think that's a good idea that they do without any warning of the implications. If they make it easy to expose data publicly, there should at least be some measures to ensure anonymity like e.g. differential privacy based querying. For a product that markets themselves as GDPR compliant and without cross-site tracking (which this technique enables to a certain degree), that's not really a great look. > You were able to verify what level of information my site is collecting because it is public. I mean kinda, but not really. I have no assurance the "all the data you are showing me" == "all the data you have about me". In the end I still have to trust you that you don't collect more data and that you won't sell that data to someone else. ----- All in all, I really appreciate what you are trying to do here in terms of transparency, and I'd like to see that spread. However I think there is still a lot of room for tools to improve to provide a similar level of transparency while also insuring users privacy.
nicbou 6y ago
I switched my professional website to Plausible, and I am very happy with it. It gives me enough data to make business decisions, without tracking my users across websites. I also prefer its interface, which quickly lets me combine filters by clicking on things (visited this URL + triggered this event + came from this source). It was satisfying to remove the cookie notice, and to update the privacy policy with "we do not collect any personal data". That's much more in line with how I want to operate a website. On my personal blog, I got rid of analytics altogether. I don't care to know who visits my website.
pjc50 6y ago
> privacy advocates still go for "I have this hidden treasure trove of analytics about my site that you cannot access" That's .. private? Why is it surprising that privacy advocates would say that this is private?
- aflag 6y ago
  I think he's looking at it from the user's perspective. Some privacy advocates may say that analytics have to be private not to make user's private data public. However, the point was that the only reason making the data public would violate user's privacy is that the data is already violating user's privacy, although only one party can access it.

kbenson 6y ago

> $6/mo on a droplet I wonder how many extra dollars cumulatively DO makes from the $1 premium on getting a better Intel CPU or AMD CPU and/or NVMe up sell on the smallest droplets. I pay the extra dollar as well. I doubt I actually see the difference for what I use it for. I feel no desire to pay a dollar less though, so they are making another 20% from me on that product than they would have.

slimsag 6y ago
I didn't pay the extra dollar, I got the $5 droplet - but the backups are $1/mo extra
- kbenson 6y ago
  Ah, interesting. Was it offered at the time and you didn't choose it, or is it an older droplet that didn't have the choice? I've had a lot of different droplets of different sizes over the last 6-7 years. Recently when I created a new one for a new project, I noticed that option and chose it. I'm not sure I would if buying a larger droplet, or a lot of small ones (I've done that for certain projects), but $1/mo is the point where it feels like nothing.
  - slimsag 6y ago
    Well, it's only $1/mo difference for the smallest droplet. As you go up in tiers: $2, $3, $4, $8, $16 dollar differences. I think it's a little scummy that they go out of their way to hide it and make the more expensive options the default, though: https://user-images.githubusercontent.com/3173176/115132649-e5036000-9fb6-11eb-93ee-69ce89415d9e.png https://user-images.githubusercontent.com/3173176/115132649-... DigitalOcean is going downhill fast after the layoffs, I'm not optimistic about them in the long term. I'd love to know what they burn on marketing, because their video ads on YouTube are crazy.
    - nojs 6y ago
      A while ago I noticed they set the default droplet to a more expensive one and moved the $5 option off the screen to the left so you have to scroll to see it, but it all lines up so it looks like there’s no more options. Minor change but a sneaky one.
    - kbenson 6y ago
      > I think it's a little scummy that they go out of their way to hide it and make the more expensive options the default Eh, I wouldn't call that hiding it so much as making the current market default the one they default to. If you're looking for the lowest end droplet, then yeah, it makes sense you would want the lower end Intel without SSD, but if you're buying something more expensive at all, there's more of a choice to be made. Also, I'm not going to fault them for putting forth the option that allows them to more easily decommission what are probably older hardware and disks for newer offerings, especially when the "hiding" is just a radio button above the droplets. It's not that hidden. I suspect eventually the newer gen Intel/AMD offerings will lower in price and replace the current default. > I'd love to know what they burn on marketing, because their video ads on YouTube are crazy. That's interesting. I remember seeing some like 6-12 months ago on youtube for the first time, but I haven't seen any for a long while. I must have just been flagged as not part of their target audience (or Google has determined I already use them).

hk1337 6y ago

I would imagine the main thing is not wanting people to or derive confidential company information, like how a certain marketing strategy is going or some other piece of data you can get from analytics.

ccvannorman 6y ago

OK, I find it hilarious that your open analytics say zero hits for the past few weeks until 70+ hits from today because you linked your open analytics on an HN comment... :-D :-D

slimsag 6y ago
I only deployed it just earlier this morning. Cloudflare says ~15k unique visitors in the past few weeks FWIW.

deleted 6y ago

[deleted]

qchris 6y ago

I literally did the same thing last night! A DO droplet hosting a statically-generated site composed of html generated from some markdown and sandwiched between some html headers, then served up by the Rocket[1] framework. It's my first website, and I think the total size of the backend is something like 40 LoC. I've never had any kind of analytics (or needed them), but I thought it would be neat to see what was going on. It took me all of 20 minutes to sign up, add the single Plausible <script></script> line to my index files and headers, and there it was. As someone with literally no other web experience, I can't imagine it having been easier. The cost of my website is now a whole $12/mo instead of $6, and I agree that it feels kinda nice to support a service that seems to place value on privacy and openness. [1] https://github.com/SergioBenitez/Rocket https://github.com/SergioBenitez/Rocket

austhrow743 6y ago

Analytics are business intelligence. Showing which of your content works well and which doesn’t. The idea that there should be no issue sharing them is absurd. Yeah just publish the minutes from your marketing strategy meetings as well while you’re at it. Invite your competitors to go over your books with you and your accountant and then arrange meet and greets with your most profitable customers as dessert.

slimsag 6y ago
Sure, in the same way that code is intellectual property and should never be shared, and all ideas should all be patented in case they become worth something. In all seriousness, I'm OK with that as long as people are honest about it. Just say "We track our users to collect business intelligence." and I'm happy.
- varenc 6y ago
  The point is that even analytics that are 100% anonymous and aggregated, with no privacy concerns, are still pieces of business intelligence.
- systemvoltage 6y ago
  We all would love to know what Google page ranking algorithm is. Disclosing any business information whether it is in the form of code, analytics, financial information, customer data, etc. sometimes makes sense but more than often, doesn't.
  - dvfjsdhgfv 6y ago
    > Disclosing any business information whether it is in the form of code, analytics, financial information, customer data, etc. sometimes makes sense but more than often, doesn't. While I agree with the spirit of your comment, this is a very sweeping generalization. Many kinds of financial information are being shared regularly with the public and for publicly traded companies they're required by law. Many companies build their infrastructure on open source software, with proprietary glue being a small percent. Knowing what you can or even should share (for marketing purposes) is crucial. Especially knowing that keeping information asymmetry forever is impossible.

rozenmd 6y ago

I also use Plausible for OnlineOrNot (https://onlineornot.com https://onlineornot.com) - but there's no way I'd make it public. Content marketing is part of the secret sauce these days.

literallyWTF 6y ago

Whenever I read these hyperbolic statements on Hackernews I always end up rolling my eyes. Really? It’s spying now?

hervature 6y ago
Don’t we call classified (not public) foreign analytics spying?
- pjc50 6y ago
  Analytics of what? Analytics of your own stuff is not spying. Entertainingly https://cpcchina.chinadaily.com.cn/ https://cpcchina.chinadaily.com.cn/ uses Google Analytics, while http://english.www.gov.cn/ http://english.www.gov.cn/ (yes, no https) uses Alexa metrics. You can't even access the Chinese Communist party website without being "spied on" by US-based metrics companies. I don't think this proves anything but it's amusing to contemplate.

hobofan 6y ago

Great, now you've made it possible for everyone that links to your site to track people by adding arbitrary UTM parameters which can be uniquely identified. POC: https://opendata.hexops.com/devlog.hexops.com?utm_campaign=public_tracking https://opendata.hexops.com/devlog.hexops.com?utm_campaign=p... Instead of what solutions like Plausible are meant to do (only give a responsible well-defined party access to the data), now everyone can view your website users potentially PII.

slimsag 6y ago
Plausible literally provides a toggle to make it public in their UI: https://plausible.io/docs/visibility https://plausible.io/docs/visibility Sure, someone could send out unique links to random `utm_campaign` IDs and see "did the person click it?" and I agree that's a bit nasty. But even if you do convince someone to click _your_ link, what good does that do? We can see you yourself clicked that link from Germany on a mobile phone, and that's literally it. We can't get your IP address, or any PII - it's not stored. You were able to verify what level of information my site is collecting *because* it is public. That is simply better than me spying and recording everything you do and you just having to "hope I never accidentally release it or sell it to someone" as is the case with modern tracking.
- hobofan 6y ago
  > Germany on a mobile phone, and that's literally it Yes, and _that's it_! Just by getting someone to click on a site they find trustworthy, you are now able to extract country, device, browser, OS, time of access, and to some degree other pages visited on the website. This in itself may not be PII, but together with previously known data points may be enough to assemble PII. > Plausible literally provides a toggle to make it public in their UI: https://plausible.io/docs/visibility https://plausible.io/docs/visibility Yeah, and I don't think that's a good idea that they do without any warning of the implications. If they make it easy to expose data publicly, there should at least be some measures to ensure anonymity like e.g. differential privacy based querying. For a product that markets themselves as GDPR compliant and without cross-site tracking (which this technique enables to a certain degree), that's not really a great look. > You were able to verify what level of information my site is collecting because it is public. I mean kinda, but not really. I have no assurance the "all the data you are showing me" == "all the data you have about me". In the end I still have to trust you that you don't collect more data and that you won't sell that data to someone else. ----- All in all, I really appreciate what you are trying to do here in terms of transparency, and I'd like to see that spread. However I think there is still a lot of room for tools to improve to provide a similar level of transparency while also insuring users privacy.

nicbou 6y ago

I switched my professional website to Plausible, and I am very happy with it. It gives me enough data to make business decisions, without tracking my users across websites. I also prefer its interface, which quickly lets me combine filters by clicking on things (visited this URL + triggered this event + came from this source). It was satisfying to remove the cookie notice, and to update the privacy policy with "we do not collect any personal data". That's much more in line with how I want to operate a website. On my personal blog, I got rid of analytics altogether. I don't care to know who visits my website.

pjc50 6y ago

> privacy advocates still go for "I have this hidden treasure trove of analytics about my site that you cannot access" That's .. private? Why is it surprising that privacy advocates would say that this is private?

aflag 6y ago
I think he's looking at it from the user's perspective. Some privacy advocates may say that analytics have to be private not to make user's private data public. However, the point was that the only reason making the data public would violate user's privacy is that the data is already violating user's privacy, although only one party can access it.