4 ms·

FYI: if you start on an endeavour like this in order to get around uBlock Origin blocking your existing analytics platform, you will probably end up disappointe

FYI: if you start on an endeavour like this in order to get around uBlock Origin blocking your existing analytics platform, you will probably end up disappointed; if you do it just for your one site, you may well get away with it, but if you share it with others or if your site is popular, it will be added to popular blocking lists before long. In fact, if writing such a thing myself I would be strongly inclined to deliberately style my URLs so that they matched an existing rule in EasyList or similar. I have nothing but scorn for the likes of https://github.com/plausible/analytics/discussions/387 https://github.com/plausible/analytics/discussions/387 where site owners are saying “oh no! our tracking script has been blocked! how can we work around the visibly-expressed intent of the end users and give them something that does not serve them and which they have demonstrated they don’t want?” Same deal with tricks like CNAME cloaking. (Related: https://plausible.io/docs/proxy/introduction https://plausible.io/docs/proxy/introduction.) Yes, your tracker may behave better than Google Analytics, but something that’s still better behaved is “nothing”. :-) (That you may assess where I sit on this spectrum, and how seriously or otherwise to take me: I have more than the default set of lists enabled in uBlock Origin, and I block JavaScript by default with uMatrix in normal windows, mostly briefly opening Private Browsing windows, where I have uMatrix disabled, if I want to use something that depends on JavaScript. But I do all this far more out of concern for performance than privacy.)

jmmv 5y ago
Author here. Yeah, I'm aware that this can/will happen, but as I hinted in the opening of the post: "wanted the warning from uBlock to go away if at all possible" (note the "if possible" part). In other words, if it does happen in the end, well, it's understandable, but at least I know what I'm doing in detail.
davidmurdoch 5y ago
Analytics helps authors understand their visitor demographics and if what they are creating is right or wrong (not in the moral sense). I don't publish free content for myself. If you want to anonymously consume others' work for free use Tor. Site visitors are saying "how can we work around the visibly-expressed intent of the site authors and avoid giving them the data which they have visibly demonstrated they need". I totally understand blocking trackers and ads, but the "holier than though" attitude you demonstrate above only helps to solidify the hold the incumbents already have. By all means block all the trackers from the demonstrably evil corps with motives that serve to exploit you... but asking small blog authors to act guilty so you can block their analytics while consuming their content for free is entitlist and exploitive on your part. That said, I'm aware this is a slippery slope and I am glad people like you exist and push for privacy, even if I think it's a bit extreme sometimes.
WalterGR 5y ago
if you share it with others or if your site is popular, it will be added to popular blocking lists before long Are the block lists sophisticated enough to block it if the Javacript part of the analytics is - say - shared as ‘host-it-on-your-server’ with an arbitrary file name? I suppose the block lists would just be amended to block the outgoing connections that that JavaScript makes? But if the JavaScript were obfuscated and routed the collected data through a first-party server that simply forwarded it on to ‘the analytics server’, is there anything uBlock etc. could do to counter that?
- julianwachholz 5y ago
  Most lists that include analytics services will block it in a way that will capture the most possible instances. My privately hosted Plausible instance is blocked because the filename is still "plausible.js" even if it's a on a first party domain.
jklinger410 5y ago
> oh no! our tracking script has been blocked! how can we work around the visibly-expressed intent of the end users and give them something that does not serve them and which they have demonstrated they don’t want? This idea that website owners are not allowed to see what people are doing on their website, as if it's some egregious invasion of privacy, is so tiresome. It's akin to having security cameras, or matching inventory and transaction details to credit card/member information, which happens every time you purchase anything at a store in real life. Yet this piece of javascript that turns your web session into an anonymized set of numbers is some kind of breaking point? When will the internet nerd community grow out of this phase?
- nebulous_two 5y ago
  Cameras don't have to be hooked up to my person in order to work. Transaction and card details are only exchanged when an actual transaction is processed, which I must do knowingly and thus consent to (pick up item, bring to counter, pay) In contrast, the "virtual camera" equivalent involves using my computer's resources, and every move I make on the website is considered a transaction even if no purchase is made. All this data is collected and used most often without the user's knowledge! The real life equivalent is more like a strip search before entering the store, and a pat down every time you enter a new store department along with a paragraph from you about your intents in this area of the store, and your signature on the bottom. I'd say that's pretty tiresome for the user.
  - bllguo 5y ago
    > The real life equivalent is more like a strip search before entering the store, and a pat down every time you enter a new store department along with a paragraph from you about your intents in this area of the store, and your signature on the bottom. how is it like this at all? You claim the data is collected without user knowledge, so how could it be compared to such invasive procedures? The camera metaphor is far more apt, other than the resource usage (which is negligible in most cases, let's be real)
fleddr 5y ago
A visibly expressed intent means nothing at all. I have an intent to get paid without doing work, but it's not working so far. The intent is a signal, and unless it's one where a site owner needs to legally comply with it, it's nothing more but a wish. And if we were to grant the wishes of the typical entitled internet user, nothing would be sustainable. Analytics are a primary tool for site owners, not some far-fetched optional thing. They are needed to run any non-trivial website. Analytics don't even require any consent at all in the strict GDPR legislation, so even they acknowledge it is essential.

jmmv 5y ago

Author here. Yeah, I'm aware that this can/will happen, but as I hinted in the opening of the post: "wanted the warning from uBlock to go away if at all possible" (note the "if possible" part). In other words, if it does happen in the end, well, it's understandable, but at least I know what I'm doing in detail.

davidmurdoch 5y ago

Analytics helps authors understand their visitor demographics and if what they are creating is right or wrong (not in the moral sense). I don't publish free content for myself. If you want to anonymously consume others' work for free use Tor. Site visitors are saying "how can we work around the visibly-expressed intent of the site authors and avoid giving them the data which they have visibly demonstrated they need". I totally understand blocking trackers and ads, but the "holier than though" attitude you demonstrate above only helps to solidify the hold the incumbents already have. By all means block all the trackers from the demonstrably evil corps with motives that serve to exploit you... but asking small blog authors to act guilty so you can block their analytics while consuming their content for free is entitlist and exploitive on your part. That said, I'm aware this is a slippery slope and I am glad people like you exist and push for privacy, even if I think it's a bit extreme sometimes.

WalterGR 5y ago

if you share it with others or if your site is popular, it will be added to popular blocking lists before long Are the block lists sophisticated enough to block it if the Javacript part of the analytics is - say - shared as ‘host-it-on-your-server’ with an arbitrary file name? I suppose the block lists would just be amended to block the outgoing connections that that JavaScript makes? But if the JavaScript were obfuscated and routed the collected data through a first-party server that simply forwarded it on to ‘the analytics server’, is there anything uBlock etc. could do to counter that?

julianwachholz 5y ago
Most lists that include analytics services will block it in a way that will capture the most possible instances. My privately hosted Plausible instance is blocked because the filename is still "plausible.js" even if it's a on a first party domain.

jklinger410 5y ago

> oh no! our tracking script has been blocked! how can we work around the visibly-expressed intent of the end users and give them something that does not serve them and which they have demonstrated they don’t want? This idea that website owners are not allowed to see what people are doing on their website, as if it's some egregious invasion of privacy, is so tiresome. It's akin to having security cameras, or matching inventory and transaction details to credit card/member information, which happens every time you purchase anything at a store in real life. Yet this piece of javascript that turns your web session into an anonymized set of numbers is some kind of breaking point? When will the internet nerd community grow out of this phase?

nebulous_two 5y ago
Cameras don't have to be hooked up to my person in order to work. Transaction and card details are only exchanged when an actual transaction is processed, which I must do knowingly and thus consent to (pick up item, bring to counter, pay) In contrast, the "virtual camera" equivalent involves using my computer's resources, and every move I make on the website is considered a transaction even if no purchase is made. All this data is collected and used most often without the user's knowledge! The real life equivalent is more like a strip search before entering the store, and a pat down every time you enter a new store department along with a paragraph from you about your intents in this area of the store, and your signature on the bottom. I'd say that's pretty tiresome for the user.
- bllguo 5y ago
  > The real life equivalent is more like a strip search before entering the store, and a pat down every time you enter a new store department along with a paragraph from you about your intents in this area of the store, and your signature on the bottom. how is it like this at all? You claim the data is collected without user knowledge, so how could it be compared to such invasive procedures? The camera metaphor is far more apt, other than the resource usage (which is negligible in most cases, let's be real)

fleddr 5y ago

A visibly expressed intent means nothing at all. I have an intent to get paid without doing work, but it's not working so far. The intent is a signal, and unless it's one where a site owner needs to legally comply with it, it's nothing more but a wish. And if we were to grant the wishes of the typical entitled internet user, nothing would be sustainable. Analytics are a primary tool for site owners, not some far-fetched optional thing. They are needed to run any non-trivial website. Analytics don't even require any consent at all in the strict GDPR legislation, so even they acknowledge it is essential.