Hacker News Reader

Comment by xiaq | Hacker News Reader

> Never call your script anything like tracking, analytics, or pixel when you don't want to be blocked by ad blockers.

But this is a tracking script, no? If I were you I'd keep the name that way so that if people don't want to be tracked, they don't.

View on HN

If your business is to track people, yes. If it's to gather statistics without tracking people (like page views), I think it perfectly fine to bypass ad blockers. We even have a dedicated feature for bypassing ad blockers [1] because we think page views are not privacy invasive. We drop IP addresses from every request so there is no personal data in our database or logs.

If you really want to block you can enable the Do Not Track setting. Although I think this should only be used when you are actually tracking people (we don't). So this feature might be removed in the future. It's already removed by Safari because it is another parameter to fingerprint a browser.

[1] https://docs.simpleanalytics.com/bypass-ad-blockers

The privacy game is about power, not about who is doing what right now. People shun Google's data collection because of what Google can do with the data, not what it has done or is doing; it only takes a single case of data misuse to reveal the power dynamics even if nothing has happened to them personally.

You don't have to play the privacy game -- there is a lot of space between really respecting user's privacy and breaking privacy laws. But if you do, you should put the power back in the user's hand.

(Disclaimer: I work for Google.)

Thank you for that comment. It means a lot that such a thoughtful consideration of privacy is coming from someone working at Google, there is hope yet for a humane approach to analytics and data collection.

I think it is fair to know exactly what data I'm giving up and what Google is doing with it, if I chose to exchange it for free services and goods. Hopefully someone with a spine comes to power and enacts some regulation allowing users to have a much clearer understanding of this. Also, people dislike Google for many things it has already done, not just because of an imagined future problem. Also.... nothing personal against you!

There have been countless cases for me personally where Googles tracking is creepy. Like Google Map recommendations, YouTube videos I should watch, misleading ads that send the user to malware bases on interest Google has about them etc, as well as exposure of unauthenticated Google+ APIs that allowed access to sensitive data to name a few.

I think saying nothing bad has happened is disingenuous. As soon as Google gets similar exposure as FB right now, internal whistleblowers might come forward also with more stories.

Also, couple of years ago Google was thoroughly compromised by at least one foreign government, ever wonder how much data was stolen?

https://twitter.com/randfish/status/1126892446925848578?s=21

I completely agree. I don't think Do not Track was ever about knowing how many visitors you have or the browser they use. That's basic knowledge needed to improve the site. Tracking becomes an issue if it's shared across pages and where personal data is collected without consent to sell it to the highest bidder.

I don't think what you're doing is the end of the world, but answer this is extremely patronizing.

You've basically said you know some users block your stuff, but you think they probably shouldn't really want to block your stuff, so you devise an end run around them.

Then, finally, you conclude that if they really want to block your stuff, they should do something that you yourself admit won't block your stuff, but that's okay because they shouldn't want to block your stuff.

I'm fine with people being patronizing towards whiny, entitled users who think they have a right to use any website they want on their terms.

If you don't like someone running log analysis on their traffic then don't go to their website, nobody forced you to.

How exactly does one know which websites will do this and which wont, before going to the website?

I'd you are that concerned use a proxy, VPN, Tor, etc.

How do you know what businesses have cameras to count visitors before going into the business?

Noone puts up cameras to count the visitors. They put them to monitor their activity.

Actually some people do, and a lot of people use their existing surveillance cameras for people-counting. see for example https://www.axis.com/en-us/products/axis-people-counter

How do I know what physical trackers are being used before entering a physical location? I use my eyes.

Business often count foot fall with IR or laser; it's generally on the door. How do I know that using a businesses with cameras claiming to only count traffic are not actually gathering a whole lot more information to use/sell/change their mind later?

I have no skin in this game but the original comment was more focused on "we've decided to bypass your adblocker because we feel that our interests outweigh yours"

I’d make the assumption that any client/server connection has some sort of logging mechanism? I don’t think browser fingerprinting and large scale cross site tracking is good but it seems a hard to take issue with being counted when visiting someone else’s website.

This example of tracking is tiny and harmless. But there's a wide spectrum of tracking behavior from sites.

> whiny, entitled users who think they have a right to use any website they want on their terms

Users do have a right to use any website they want to on their own terms. If I make an HTTP GET to your site, it's up to you to decide what HTML to return. Once you do, it's up to me whether to request the images, scripts, etc, and whether to read the sidebar, etc.

It's up to you to decide whether to show me any content of substance without first collecting payment. I can't demand that you publish content for free. I'm not entitled to that.

But it's up to me to decide what I consume. You can't demand that I view ads, send back tracking cookies, etc. You're not entitled to that.

If you don't like site visitors refusing to be tracked, then don't let them view your website. Nobody forced you to.

The author said it himself, he could have just put Cloudfront in front of Pages and parsed the access logs there. The referrer and user-agent, which are sent by the browser, are in the request headers. There would be no need for JS or an image if the website owner just changed their setup.

How do you deal with this sort of tracking?

What do you mean? I think using CloudFront is not accurate enough if you use caching.

They've got an enterprise logging tool that'll give you all the info needed for this sort of tracking. https://support.cloudflare.com/hc/en-us/articles/216672448-C...

This is "Front", the Amazon offering, not "Flare" (side note: logging via Cloudflare Workers is cheap and possible)

I guess I mean overall "you can't stop owners from analyzing their access logs" and not just related to Cloudfront.

I agree with this, but thankfully these posts have let us know to block hello.gif and hello.js by default now.

> But this is a tracking script, no?

No. This is self-hosted analytics, no 3rd-party involved, the way it's supposed to be.

Tracking involves a 3rd-party. Be it Google Analytics or Cambridge Analytica UserTracking (TM).

The goal is to track. Allowing people to easily disable defeat the purpose.

Reply on news.ycombinator.com