Hacker News Reader

Comment by neilv | Hacker News Reader

`https://trackthis.link/` requests `https://www.google-analytics.com/analytics.js` on page load.

Which, besides being a bad idea for privacy on any site, makes much of this particular site's ostensible purpose even easier to defeat.

View on HN

See https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

Mozilla has a contract which prohibits Google from using data from Mozilla websites for the things people usually object to.

Two problems with that, both of which sound funny:

1. Trusting that supposed assurance.

2. Going to so much contortions to rationalize a third-party surveillance facility that you didn't need to use.

>2. Going to so much contortions to rationalize a third-party surveillance facility that you didn't need to use.

That does seem rather strange to me too. Is GA that critical to Mozilla that it justified crafted a special agreement with Google to keep using it? Why not re-implement the key functionalities themselves, surely they have the internal resources to do something like that. It seems like a weird decision, especially now that they're getting very aggressive with the "we respect your privacy (unlike Google)" angle.

Because building, deploying and maintaining your own (of anything) comes at a significant cost and a tailor made contract for preserving privacy seems like a great alternative.

This is a seriously BS argument to be made for Mozilla which developed its own programming language to build the browser. Even for anyone else who is developing a serious enough business, owning your own traffic metric data is important to build this in-house. Today's open-source tech and public clouds make this really easy - it's 2-4 people full-time job to run a very large scale traffic analysis system that can rival whatever functionality you can get from GA (without being fully self-serve and multi-tenant, which is a ton of work you can avoid).

You have open sourced google analytics like tools. eg Piwik.

Also just analyzing server logs should be enough in most use cases.

> Also just analyzing server logs should be enough in most use cases.

That sounds like a fantastic way to play GDPR roulette.

Did the guy you hire to spec and build the server log analyzer follow the law, or did he just wing it?

Contrast that to just using a SAAS offering, where you have someone to sue...

> Did the guy you hire to spec and build the server log analyzer follow the law, or did he just wing it?

Nginx, haproxy, and others log all requests by default. If you are behind a CDN, requests are already anonymized as you get the CDN IPs. Not sure why you'll need a guy to set things up.

Logging isn't the hard part.

Turning raw logs into metrics and action items is what requires you to pay that engineer, and what may get you get you in trouble with the GDPR, if they do it wrong.

You have open sourced tools for that. GoAccess for example. If the logs already contain the real IPs, you are already infringing GDPR. And that's all websites.

Absolutely worth it, if your selling point is privacy, and your vendor the best and most pervasive tracker in the world.

Also, does this script even load with tracking protection enabled, which is now the default in Firefox for new users? It probably shouldn't? Which would mean GA and by extension Mozilla will catch less and less users here compared to first-party analytics.

What incentive did Google have to agree to such a contract?

Maybe they knew it would undermine any anti-Google privacy stance Mozilla would later take when people noticed GA's inclusion in various Mozilla pages

Being paid money they otherwise wouldn't be paid?

They get money and there's no way anyone could ever find out if they continue to log people regardless. Free money getting to track all firefox users is a pretty great incentive.

How is that contract audited?

> our GA premium account

Flexing a lot for a non-profit.

Some people don't believe Google at all and would prefer to not having their data handed over in any way, regardless of what Google promises.

Then block it with an extension? Mozilla has a specific contract against this. It's not just a "promise", it's a legal document. Why would Google care to violate that contract and risk a big shitstorm just to use the data from one company?

It's not just intentional data misuse that you have to watch out for. There's also accidental data misuse and data theft. Users are safest when they aren't being tracked at all. As privacy advocates, I think Mozilla should take this into account.

For many reasons. First, because they can, and nobody will ever have a chance to know about it. It's not like people are going to whistleblow: from the comments of many Googlers here I understood they (or a reasonably large number of them) really don't see tracking as ethically wrong. That's of course very good for their mental health, but less so for the privacy of most Internet users.

You're telling someone to add a browser extension to block some privacy invasion that a privacy-touting browser vendor is willfully doing? What about the interests of the users who don't even know they have to do that silliness?

Also, threat of poo-storm is not always sufficient incentive to respect privacy or even agreements with governments (after you're caught brazenly violating privacy): https://www.telegraph.co.uk/technology/google/9432518/Google...

Correct. At some point if you can't trust any companies, especially when in a contract like this one then you may as well use NoScript because it's unavoidable in this current state :/

There's a big difference between first- and third-party trackers though. Google Analytics belongs to the former category and does by default not collect any personally identifying information. Third-party trackers, however, usually set a unique identificator for each user and use this identificator for all subsequent requests, and as such (invisibly) track users across the web. In general, it's the third-party trackers and their cookies that you should be wary of as they are most often used for extensive tracking across different websites.

Google is a third party when it is about you (first party) using a Mozilla service (second party).

Mozilla exposes all its visitors to Google, it tells Google what they looked at and when, and more. This is horribly inappropriate if Mozilla touts itself as privacy protecting.

> Google is a third party when it is about you (first party) using a Mozilla service (second party).

Sure, but that is not the distinction I was making though. Google Analytics is a first-party tracker in the sense that it sets a cookie on the same domain that the script is loaded on. Contrast this to a third-party tracker which sets a cookie on its own domain, and as such the same cookie will be reused for all websites using this third-party tracker.

> it tells Google what they looked at and when

As far as I know only Mozilla has access to the data collected through their Google Analytics account. Third-party trackers, however, often aggregate collected data across a wide range of websites, and might sell augmented, highly profiled user data to advertisers. I have not seen any reports of Google using Google Analytics in such a way, but the data is nonetheless stored on their servers, so you will have to trust that they won't abuse their power.

EDIT: As mentioned by throwaway9d0291, it seems like there are settings for enabling or disabling the sharing of Google Analytics data with Google. Not sure if this is opt-in or opt-out though, but this means that it possible to use the service without Google using the collected data.

Could you please tell me what you think the concepts of "first party" and "third party" mean?

By first-party tracker I mean a tracker that sets a cookie on the domain that it was loaded from (e.g. website.com). A third-party tracker sets a cookie on its own domain (e.g. sketchytracker.com), thus allowing for cross-website tracking.

> Google Analytics belongs to the former category and does by default not collect any personally identifying information.

IP addresses, timestamps, and webpages viewed over time is absolutely personally identifiable information.

It tracks IP addresses, though you can set it to remove the last byte.

I agree that it's dumb and it shows how the de-facto standards of the web are rotten to the core, however I don't think it completely defeats the purpose of the website.

For one thing it won't let other advertisers besides Google's partners know what you're doing anyway and ever for Google it probably won't do much good unless they explicitly decide to handle that website specifically. Which they might do I suppose if it becomes popular enough.

I think one of the most enlightening consequences of the GDPR for me was to see that ridiculously long list of "partners" many websites had. Hundreds of companies trying to track me on most websites. I knew this was happening before but I couldn't imagine how bad this was.

For people living outside of Europe who might not have seen this before, here's what it looks like on TechCrunch (I chose the site randomly, it's by no means exceptional): https://svkt.org/~simias/up/20190626-122149_partners.png

Note the size of the scrollbar. There are 173 entries in that list.

That didn't happen for me (safari here).

That's plain stupid. If Mozilla really was interested in the stats, they could have easily set up Matomo, Countly or something similar rather than hand our data over to Google.

An absurd suggestion because it assumes software developers know how to use computers.

Reply on news.ycombinator.com