Show HN: Mirrorshades – Simple web analytics | Hacker News Reader

Show HN: Mirrorshades – Simple web analytics

getmirrorshades.com

66 pointsaparks51746 comments

For such simple metrics (visitor count and referral), wouldn't it be possible to use server-side tracking, e.g. by parsing an Apache access log? Are there any packages out there to do simple analytics without requiring client-side tracking?

Webalizer, awstats, goaccess.

Goaccess is interesting in that it has both a live, terminal, curses interface as well as HTML output. https://goaccess.io

I've actually writing a post these days about this exact thing: Analytics alternatives to Google Analytics that are more private, more accurate and faster. It's a very interesting topic, GoAccess is my software of choice but it has some odd UX that is currently being worked on by the maintainer.

Wow, `goaccess` is beautiful! Thank you for sharing.

I recently started a small project similar to goaccess, which brings up some quick statistics from nginx access logs, though nothing as polished as that!

https://github.com/purrcat259/peek/

Analog also has an ad hoc reporting interface: http://www.c-amie.co.uk/analog/

Good point, but there are quite a few sites nowadays that are hosted on platforms with no immediate access to raw Apache logs, especially if your site is served by a CDN.

> http://getmirrorshades.com/view.html?siteKey=[SECRET_SITE_KE...

someone sniffing the network traffic can see the SECRET_SITE_KEY .. isn't it a security concern? or am i missing anything?

Thanks. HTTPS is now live. :)

But you've got the secret site key in your server logs as it's in all the GET statements. Don't use third-party log analysis would be the suggestion I suppose.

i didn't even think about that angle (being careful from third party logs for http GETs with sensitive info in the url). thanks

i think it's not enough:

one of the comments of the question here: http://stackoverflow.com/questions/499591/are-https-urls-enc...

says: "It's probably a bad idea to put confidential data in the URL anyway. It will be displayed in the browser's address bad too, remember? People don't like it if their password is visible to anyone who happens to glance at the screen"

you can just display a form with an input field for the secret key, which will be HTTP POSTed and only THEN you should display the account's data (while the url doesn't disclose the secret key)

Out of interest is this just a permanent side project that's almost completed, or something you're hoping to grow and monetise?

Also, what stack are you using? I'm interested as I've been slowly designing my own mini project (with SaaS aspirations, SaaSpirations?) that does very similar metrics.

I think I'm in love.

I just recently switch from GA to Gauges, because the referral spam and bloat was annoying me.

I'm definitely going to use this on my next project. Simple and beautiful.

Thanks for sharing!

I'm still running google analytics but I don't look at it anymore, the spam is unbearable and I don't have time to figure out how to create filters. Its not my problem to figure out either. I'm really excited for Mirrorshades. Keep it simple.

I'm developing a simple web analytics also (it's strange to see Mirrorshades here since I started developing something like it some weeks ago) and I want to know about referral spam: Mirrorshades per se doesn't have any better spam filtering than Google Analytics, right? The gain from switching to it is just because spammers still don't know how to spam Mirrorshades, or am I wrong?

Spammers are already doing what they do. I have rudimentary measures in place, but additional data will enable a more sophisticated response. I use the service myself and find spam to be crazy-making. So... ;)

How are they doing what they do? How could a spammer get to know Mirrorshades protocol to send a false referrer report (which is not the Referer header) in an AJAX request?

At least some of them appear to use a more general-purpose method than that. They actually load pages and execute scripts with document.referrer and the Referrer header faked-up. Though it's presumably more resource-intensive, it has the benefit of working for a wide variety of analytics setups, both hosted and server-side.

Oh, right, they just got document.referrer, I had forgotten about that.

What if the analytics server actually parsed the referring page to see if there's a real link there and only confirm the referrer after that? Isn't there a third party service that checks these things?

If I send a manual PATCH of {"source":"referral-spam-here.com"}, obviously it makes it in to my metrics.

It seems like someone could just scan for sites with a site ID matching your format, then a quick burst of 100 PATCH requests and you're now experiencing the same stuff that makes Google Analytics so painful to use.

Do you have any plans to combat stuff like this? This is typically my biggest gripe with analytics platforms, the spam can make them unusable and is hard to protect against.

Do you have a suggestion?

Yes. I have basic measures already in place and a good idea of additional steps I would like to take.

I can't get https://getmirrorshades.com/agent.js!

Oh! Sorry about that. Should be fixed shortly.

http://getmirrorshades.com/agent.js

Does look nice and clean - but I would love to see a license, not just a copyright notice. I am unsure if such a short snippet really is copyrightable? It is tempting to just change the post url and whip up something simple for self-hosting... but tricky to do and redistribute as long as there is no license on the file. For such short snippets I would recommend cc0 - or perhaps bsd.

Try HTTP [0].

It seems to be small enough to not even link it but paste in the HTML (836 bytes uglified, supposedly golfable even further).

[0] http://getmirrorshades.com/agent.js

The simplicity of this is pretty compelling. I use GA a lot and it can definitely be a time-sink. Mirror Shades may be a good alternative for beginners who are overwhelmed by GA or for simple landing sites that don't need the full GA suite right away. For my next landing page test, I'll try Mirror Shades out.

I really love the simplicity, I think I will use it for one of my side projects! (also here at Show HN)

Quick question, why did you choose to use a PATCH request and get involved with CORS issues, instead of injecting an image element with a tracking pixel (web beacon)?

Ask HN: Is there any services that take my Google Analytics report and produce a simple report like this one? I may not need the full-blown report of GA right now but I guess I'll need it as some point in the future.

look at Google's data studio https://datastudio.google.com/

You can reproduce it within GA using a custom report, something like this: http://imgur.com/a/DDzdc

I have successfully used https://briefmetrics.com/ before with clients who couldn't be bothered to learn the GA dashboard and wanted reporting. I have also used the "email dashboard on a schedule" and made a simple dashboard but briefmetrics has a better experience.

Neat! agent.js initially failed on my site, as it wasn't the last script on the page and siteId was set to null (line 14):

  var siteId = scriptElements[scriptElements.length - 1].getAttribute('data-siteId');

Maybe that could be better documented?

Alternatively a change in the way that the script element (and the siteId) is detected could be helpful (instead of lines 13, 14):

  var siteId = document.querySelector('script[data-siteId]').getAttribute('data-siteId');

Thank you! This was very helpful feedback. I added the async attribute to the script tag late in the game and didn't think about how it would interact with this. I've updated the agent script with a more robust method of finding the site ID and am deploying it now.

Awesome! I was just having problems opening a GA account and then I fount this Show HN. This is exactly what I was looking for - fast and easy setup, updates instantly, simple and exactly the two metrics I am interested in.

I've already started using it and I'll send feedbacks along the way.

Good luck!

Minimal and cool. Nice.

Some kind of top pages or top bounce rate stats would also be good. Usually I'm using analytics to figure out either a) what's working or b) what's broken.

I'm eager to keep that stats page small, but at the same time I'd like it to have what people need to see. So this feedback is particularly valuable to me and I've made a note of it. Thanks!

Neat. How can I send custom data from here: `// Data to send var payload = JSON.stringify({ source: source, ip: 'trying_ip' }); `?

Looks interesting, awesome to see more Michiganders too!

Benefits over ga? Honest curiosity

Seems obvious: simplicity, no setup required apart from pasting one line of code.

Isn't GA just one line of code too?

The only benefit I see is that Google doesn't have the data.

Well, it's multiple lines of data, but yes, it's just a simple copy/paste.

What are the benefits over Google Analytics or Piwik or Countly?

It's explained at the link, if only you could read.

Reply on news.ycombinator.com