Hacker News Reader

Comment by yessirwhatever | Hacker News Reader

I dislike Google and their products pretty much universally, but having this sort of thing done by a competitor is not just distasteful, I see it as verging on corporatism.

Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software.

All tracking is bad, from Google or not. I understand the "companies need to make informed decisions" argument but I disagree with it, mainly because tracking software is involuntary and it's in the interest of the tracking software maker and the company using it to make it as stealthy as possible.

PS: What adds salt to injury is that you're using Google Fonts on this website. If you were privacy-conscious, you'd self-host at least. Read here: https://developers.google.com/fonts/faq?hl=en#what_does_usin...

View on HN

> Make a better product and beat them,

It's going to be hard when your own hands are tied by legislation but your competitor just does as they see fit.

Also them having the resources to drag out any court ruling for years and years ensures there is no level playing field whatsoever.

So yeah, maybe companies should be called out for thinking they are above the law just because they can afford endless legal battles.

Google analytics is against the law because they are American which means that they have to give up any data the us government asks of them. That’s the only illegal thing they do, and they are not better just for being American. They are better because they are better.

There is so much wrong with this. There are legal processes for the US gov't to request that data legally. Any other means of obtaining that data is illegal even if it is done by an entity within the gov't. This isn't the CCP.

Google Analytics isn't better at anything other than their marketing has convinced everyone that it is a must have. If you believe 100% of the data from GA is accurate, then I have a bridge to sell you.

Some of those "legal processes" involve secret kangaroo "security courts". It's not really any different from CCP in that regard.

> There are legal processes for the US gov't to request that data legally.

Only legally for the US. Those processes aren't legal for the EU, so the transfer is illegal (for an EU web site).

Giving EU customer data to the US government is literally illegal for a company. There's not any process that somehow makes it legal without the collaboration of an EU member state.

The problem is that companies with a presence in the US can be forced to break the law of either the US or the EU. It's illegal to hand over the information to the US government, but it might also be illegal not to.

How does that work exactly if there is no international branch of a company in the EU? If a company is online with a presence large enough to attract European visitors, are they required to open an office in the EU? If not, are they supposed firewall visitors? That's assinine sounding.

They could not collect unnecessary personal data.

Who's stopping them?

I don't understand.

Do you mean, who's stopping them from not collecting personal data? No one, that's the point. If you're not collecting personal data none of this applies and you can serve whatever you want to people in the EU.

If you mean, who is stopping them from handing over data to the US government? That's exactly what this court case is about. They can't conduct commerce in the EU unless they have a mechanism to avoid that, and progressively more strict enforcement gets imposed by courts if they keep trying. (Eventually, presumably being detained if they try to enter an EU country, though I seriously doubt it would escalate that far in practice.)

It depends. Based on your description, it sounds like the company in question wouldn't actually be subject to the GDPR. Simply attracting European visitors isn't sufficient; you have to be clearly intending to offer goods or services to those visitors. What that constitutes isn't black and white, but stuff like providing EU contact details on your website or specifically advertising to EU subjects might count.

If you have no business in a country then its laws don't apply to you. Google & others specifically break EU law because they have offices and branches across EU yet wipe their asses with consumer/privacy protections.

> Any other means of obtaining that data is illegal

The government can always just ask. Very little data in the US is protected.

You can be American without having your company transfer all the personal information of people visiting your customers to America.

edit: but you can be required to by law. You're right.

No, you pretty much can't - not as an US-american company at least. That's what this problem is all about, and why the privacy shield deal between the US and the EU failed.

Oh, I see what you mean. Being American you can be required to bring that data back, no matter your preferred data processing setup. Right, apologies.

Google could trivially re-domicile to Ireland if they wanted to. Just do a reverse merger, and have the services within the US provided by Google LLC, which becomes a subsidiary of Google Ireland Limited.

> That’s the only illegal thing they do

What about the cookie popups, with the "accept" vs. "more info" choices? Is that legal, then?

Those are consent popups, not cookie popups, and no they’re probably not. (There needs to be a “Reject” option.) But the larger issues with bigger players get pursued first.

Not only there needs to be a reject option, but it must be the same size, weight and color so as not to influence the decision of the user. And be truthful, in most cases there should not be a banner at all: 99% of websites don't need cookies and when you do they're covered by other areas of GDPR (such as providing a requested service) which don't need explicit consent.

In all cases where you see a banner for accepting cookies, the company behind it is doing something nasty to the users. (i have yet to see a counter-example to that)

>PS: What adds salt to injury is that you're using Google Fonts on this website. If you were privacy-conscious, you'd self-host at least. Read here: https://developers.google.com/fonts/faq?hl=en#what_does_usin...

Thanks for pointing that. Don't know how many time have met privacy advocates, etc has made a such a strong point against google, and still embedded youtube video or google font on their site. Is there are github page where one can block all google or fb used domains or ips? Would be very useful!

> Is there are github page where one can block all google or fb used domains or ips?

Are you asking for a repo - for software? Or instructions? Or something to do with GitHub Pages? I may be able to help, but I don't quite follow.

I believe they are looking for something like PiHole, but a fully software solution. Not sure whether they are looking to go the open-router-firmware route or the route of some ublockOrigin config though.

Maybe just a hosts file? Though that only works for domain names, not IPs, and in my experience Chrome (-based browsers) bypasses it somehow.

Seems like you're looking for a browser extension. Something like uBlock, NoScript, etc will all do the blocking of the evils

You can use Privacy Badger by EFF https://addons.mozilla.org/en-US/firefox/addon/privacy-badge...

Edit: Please note that they seem to have removed the link to Google fonts from the website now.

Lots of different methods but for most the easiest is to just use something like NextDNS or a pihole. Pihole being potentially cheaper long term and NextDNS having the advantage that you can use it when off your home network.

If you want to get extra fancy you need to also worry about Doh and Dot (encrypted DNS) and hardcoded IP's (mainly for actual applications like mobile apps or smart devices). Encrypted DNS is a great thing but companies also use it to bypass things like pihole or NextDNS by hardcoding their DNS IP into an application and then sending all requests to that IP using Doh and Dot so that the end user has no control.

What you can then do is use any kind of edge router / firewall / networking equipment (virtual or physical) to block all the common DNS IP addresses directly and only allow addresses of your choice (such as NextDNS or other). This way when the application tries to make a connection using Doh or Dot to that specific IP address it ensures that it is blocked and everything must fall back to whatever DNS you have setup (which can also be running Doh or Dot for privacy / security). Some home routers have this functionality or you can setup a pfsense box relatively cheaply to achieve this. Unfortunately I have not yet found an easy / cheap solution for mobile devices if anyone has any suggestions.

LocalCDN blocks all Google Fonts by default, causes lots of sites to display default sans-serif system fonts instead though

It's even more ironic that you (and the owners of that website, and PiHole) would then rely on Microsoft's servers (GitHub) to store and work on that code and data !

LOL, for sure. Gitlab or gittee page then ;-)

> I dislike Google and their products pretty much universally, but having this sort of thing done by a competitor is not just distasteful, I see it as verging on corporatism.

Don't shoot the messenger? I think everyone should have the right to voice opinions and point out problems with products, competitors or not. As long as the claims are factual and not FUD and bullshit. (I'm reminded of fud campaigns made e.g. by big corporations against open source, backed by their own shady fudfactory studies)

If a company can -- without lying or twisting facts -- point out that their competitor's product is dangerous/illegal/unsuitable/{whatever is relevant to me}, I'm all open.

Of course, the line between a fud campaign and plain good old information is sometimes very thin.

This is a bad take. The problem with Google analytics is that it allows Google to surveil everyone's movements around the entire internet. This is enabled by the fact that for a long time, Google analytics was the best analytics product and it is free. I've been in the position myself with personal project websites of trying to decide whether I'm just not going to know anything about what my users are doing, whether I'm going to try to hook up some janky open source alternative, or whether I'm going to give in to the surveillance machine.

The competitor that put up this site appears to be a company that provides analytics that are not centrally collected and analyzed to serve ads across the internet. Their entire selling point seems to be that they do not engage in mass surveillance. Equating this to what Google analytics does (if this competitor's claims are accurate) is a false equivalency.

To me, this is no more objectionable than a foam insulation manufacturer capitalizing on asbestos bans.

Totally agree. I really don't have any objections to analytics that are run solely by the website provider, as long as those analytics are only used to investigate usage and issues on that website. I don't have any problem with coffeegrinders.com knowing all about how I use their site to find good coffee grinders, but I DON'T want that correlated with my choice of mildly NSFW Tumbler videos. It's pretty inherent to the way the web works in any case, where you're not just being broadcasted to but are having a back-and-forth conversation with the website.

The primary problem with surveillance capitalism is when your movement across the entire Internet is gobbled up, sliced, and aggregated for the largest bidder.

What about a social media service recommending you advertisements solely based off of analytics derived from your actions on that website?

I don't have objections to that, similar to how I don't have objections to a search engine showing me ads solely based on what I've typed in to the search engine.

Indeed, I really feel that Google and Facebook turned "evil" (whatever that means) when the huge amount of customer data available to them from their own sites was no longer enough, but they demanded on vacuuming up your actions on every single corner of the Internet to add to their already gargantuan piles of dough.

This kind of marketing is pretty common on HN. Provocative title and a blog post (written as if they're an independent observer) that presents a 'problem' and conveniently their product is perfect for solving it. The worst is these things get tons of upvotes.

The readers of HN are human after all, unless you're all bots and I'm the last human. Oh gawd, what if I'm not human either. Oh crap, now I'm going to be fretting over that all day.

If you see a title, you have no idea it is from a 1st party or 3rd party until you read the article. Or, you could just come to the comments an diatribe away. That's the internet way, and claiming to be morally better than the internet is the HN way.

> unless you're all bots and I'm the last human

Checks out - I'm a bot.

As they say, a sucker is born every minute

At least, unlike for the overwhelming majority of articles, the title is by the author himself.

> Make a better product and beat them

It's really hard to make that claim when Google is known for anticompetitive behaviour, including crippling GA competitors [1].

We should probably acknowledge that Google is in the terminal phase where only forced split and divesture will help, and in the meantime, every action from competitors is fair game.

[1]: https://forum.matomo.org/t/adwords-campaign-rejected-for-goo... https://matomo.org/faq/troubleshooting/antivirus-program-or-...

> Make a better product

Their product is open source and (assuming the say the truth) keeps the data on the server of the website owner. I would say this is better.

> Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software.

I love that you casually put not being illegal on the same level as a dashboard or a convenience feature.

Unless the message is misleading I don't understand why you would find it distasteful. As mentioned elsewhere in the thread, a competing product being illegal is an excellent selling point. Why would you withold that important information from your customers?

The thing is, that site is misleading, a product that is legal in pretty much the whole world (currently) but against the law in two countries, does not make the product illegal anywhere else, and it seems more likely that the fault would be on the companies implementing it in those countries, not in the global service that is being provided.

Then again, even though this is google, I'm not big on localized countries attempt to create laws that dictate the behavior of the internet as a whole, admittedly this is a different issue.

The website does not say Google analytics is illegal everywhere in the world. Only that it might be in parts of Europe. I don't think this is insignificant enough to be considered misleading.

Its 2 countries, based on the site (which honestly seems low) I would say its pretty insignificant to be anything but an ad.

It's against the law in many countries (any EU countries, and therefore also likely the UK) but only tested in court in two countries.

This whole post and the website is totally misleading. It's marketing disguised as a helpful tool.

It's clearly marketing. But marketing can be helpful. If GA does conflict with GDPR it is far from unlikely that more countries in the EU will ban or restrict it. This might be insignificant to an American company using GA but it certainly is not for a company operating in Europe.

If you can look at the domain, isgoogleanalyticsillegal.com and tell it's marketing, then good for you. I don't think it's very obvious. Posting it as a "Show HN" with its own domain name is purposely deceptive. Most of the "Show HN" posts are from individuals posting their own small projects. Sometimes a company will post one, but at least they link to their own domain.

After you click to the article, again there's no indication until you scroll to the bottom (after you've already read or skimmed the site). This is deceitful. Furthermore, it doesn't really follow the spirit of ShowHN, which is supposed to link to a tool that people can try out.

You're right that marketing can be helpful, but introducing your company through a bait and switch is a major red flag. This post could've easily been presented honestly: "Show HN: Host your own analytics data to comply with GDPR - posthog.com" or something along those lines.

I assume companies that try stuff like this don't even realize the negative feelings such a campaign can engender. They probably see thousands of new visitors to their bogus site and call it a success, all the while not even seeing the thousands of people who saw this deceptive tactic for what it was and have now filed "PostHog" in their mental file cabinet of dishonest companies.

Fair enough. I see your point. It's not material for ShowHN

Isn’t a legal product a better one than an illegal counterpart?

Nope. It's because the illegal product has lower cost (because complying to regulations costs money one way or the other).

It may not be cheaper when you have to deal with the repercussions of breaking the law though.

Those are usually just slaps on the wrist.

Sure, if the products and companies are identical in every other fashion, which is never true in real life.

Are you suggesting that legal products/services always win over illegal products in a capitalist market? Think again: Uber, AirBnb, etc.

No, you are the one claiming that illegal products are always cheaper. I am saying it is murky.

The question was about otherwise identical products.

Only if the user (in Google's case the product) would be the one liable.

To add, it might not even be illegal; the Netherlands quote is:

> The Dutch Data Protection Authority warns that the use of Google Analytics 'may soon no longer be allowed', after a ruling by the Austrian privacy regulator. A definitive conclusion is said to come at the beginning of 2022.

As for the Astria ruling, this is part of it:

> The fact that Google LLC argued that Google Analytics was allegedly provided by Google Ireland Ltd since April 2021 was not considered relevant, as the violation occurred in August 2020.

So it might be illegal to have used GA before April 2021, but it very well might now be legal given that GA is now provided by 'Google Ireland Ltd', which was a move explicitly done by Google to comply with GDPR.

> If you were privacy-conscious, you'd self-host at least. Read here:

That page explicitly notes that cookies aren't sent and these requests aren't used for the ad machine. Is using Google Fonts at all the issue just on the chance they're using IP address matching for ads/is them having your IP too much of a risk?

Interesting, I have always assumed that Google and FB would use any request sent to them for tracking and profile building. Probably a safe assumption to be honest.

Just dump all request logs in a giant Data Lake - seems like promotion material idea. (sarcasm).

> cookies aren't sent

Yes, it says this.

> aren't used for the ad machine

No, it doesn't say this.

Agreed. We've thought of trying out PostHog in our open source platform for Kubernetes and this is a bit of a turn off.

We'll probably try it anyway, to be honest, but I'm not crazy about this type of advertising.

There is so much room to beat Google Analytics on UX alone. Is this really necessary?

That your competitors product is illegal is an excellent point to showcase for potential users. We're not even talking real mudslinging, just pointing out reality. Being offended over this is baffling to me.

Yeah, fight with whatever tool you have including going negative.

I don’t for a second think Google would hold back if their own behemoth was in under mortal threat and their main competitor had been found guilty of illegal acts.

The invisible hand of the market (fwiw) relies on free flow of information. Educating the public about Google’s illegal acts is an act of service, though self serving.

Allowing yourself to engage in immoral/shady activity just because your competitor is doing it actually helps your competitor by legitimizing their methods, it's an endless cycle of "but they did it first".

How’s it immoral to make sure the public knows that a product they are planning to use has been declared illegal in a certain jurisdiction?

In fact, given the state of regulatory capture, it’s a public service to educate consumers locally about how a competitor’s actions are perceived abroad.

The title of this post is just the website url - there's no indication it's actually an advertisement. The whole thing is designed to trick people, and I'd say most people don't like being tricked by marketers

Nor is there any indication that whoever posted it here had anything to do with PostHog (which, to be clear, is apparently an open source project, not a paid service like everyone seems to have assumed).

PostHog is absolutely a paid service, with features only available in non-free tiers.

https://posthog.com/pricing

It's posted by the cofounder. Click on their username.

Doesn't matter. The entire website iandesigned to mislead and manipulate SEO, and the sponsor is only mentioned in a small blob on bottom.

Matomo makes the same case, but in a much more tasteful way: https://matomo.org/google-analytics-alternative/

Here's the comparison of Plausible Analytics: https://plausible.io/vs-google-analytics

Also well done.

How do you compete fairly with somebody that engages in monopoly abuse and anti-competitive behaviour?

It has been more than 3 and a half years since GDPR was implemented, yet it took concentrated efforts of non-profits and individuals to come to this extremely obvious interpretation that EU–US Privacy Shield is nonsense.

Maybe if EU and member countries actually made any enforcement efforts, a viable competitive space would emerge.

What is corporatism in the sense that this is verging on it?

> Make a better product and beat them, don't use the fact that a government is banning them to upsell your own tracking software.

Google Analytics is not a good product if it can't legally be used. The competitor in this case is offering a better product because it can legally be used.

Using Google Fonts on this is hilarious and bad, otherwise though this post makes no sense. Pointing out your competitors flaws is part of competition and, I’d guess, an important driver for fixing or eliminating those flaws market wide.

This will help you: https://google-webfonts-helper.herokuapp.com/fonts

How exactly you propose of doing that? I cannot convince frontend devs to not use Google fonts directly and upload it to their own CDN.

> don't use the fact that a government is banning them to upsell your own tracking software.

This isn't very convincing.

In industries that successfully self-regulate we find that good products that follow regulations out compete those that don't. In those cases politicians also tend to avoid adding regulations in order to not disrupt a working system.

In industries that don't successfully self-regulate we get politicians that force a regulation in order to have good product out compete bad ones. It is especially common with lemon markets where information asymmetry between buyers and sellers is a significant reason of good products being unable to fairly compete with bad ones.

The value of personal information is a notoriously lemon market where the buyer, ie users, are not aware of the actually cost to themselves or to whom they are selling their information. One of the first requirements in GDPR is fixing part of this by forcing companies to disclose to whom the information is sent to. Secondly it partially address the cost aspect by forcing companies to disclose how the information get used and thus what the real cost to the user is. A bit like how banks need to disclose what the interest of a loan actually will be before the consumer signs the contract.

What makes privacy issues an even bigger issue is that the cost is not carried by the party who decide and benefits from the choice of analytic software. This is similar to environmental issues where the cost of a decision is not carried by the company that made it, but rather by those around them. Environmental issues is a typical example where self-regulations do not seem to work, as the end consumer has no information if a certain clothing item is made from child labor or by a eco friendly operation. A regulations job there is to put down some minimum standards that everyone need to follow, including information disclosure so that end users can actually know what they are paying for and how much.

If it pushes all companies to be clear about their potential GDPR issues, I'm all for it. Let them compete on ease of compliance.

As it is, it's very difficult to tell if something you're using is gathering data that you don't intend to gather (e.g. your hosting provider logging IP addresses for your hand-coded blogging software). I don't want to have even the tiniest possibility of being on the receiving end of one of those theoretically huge GDPR fines just by self-publishing some code and putting it on the internet.

If their product does not violate the GDPR, their product is a better product.

It's just that website creators were defaulting to "just use Google Analytics" because it's convenient and they didn't care about their user's human right to privacy, and were thus externalizing human rights violations onto them.

The government is simply preventing externalization of harm, which even libertarians will agree if the governments job (of course agreeing on what level of spying is harmful is where the debate will be).

Even the quote on their homepage is made me roll my eyes

> PostHog is what I always wanted a Product Analytics SaaS to be. Private cloud option so GDPR becomes way more manageable, features built based on direct community feedback, focus on simplicity and usefulness over vanity features...Great job people!

Mmm I dream of [Private cloud options] to make [needlessly complicated government legislation] easy!

Yay privacy, I guess? Just add 3 more needlessly complicated middlemen.

> PS: What adds salt to injury is that you're using Google Fonts on this website. If you were privacy-conscious, you'd self-host at least.

I get what you're saying, but i feel like that's probably a sliding scale of how much people actually care about these things vs how much they want to just easily get things done.

For example, right now my personal website serves the following files, just to get Open Sans working:

  /fonts/open-sans-latin.woff2
  /fonts/open-sans-latin-ext.woff2
  /fonts/open-sans-latin-bold.woff2
  /fonts/open-sans-latin-ext-bold.woff2

What's the CSS for displaying just one of those fonts? It's the following:

    /* latin */
  @font-face {
    font-family: 'Open Sans';
    font-style: normal;
    font-weight: normal;
    font-display: swap;
    src: local('Open Sans'), url(/fonts/open-sans-latin.woff2) format('woff2');
    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
  }

Of course, depending on the browsers that you want to support and how efficient you want things to be, you might end up using more than just the WOFF2 format or just adding a TTF font and calling it a day, which will further inflate the amount of configuration that you need.

Furthermore, the characters that you'll want to show on your site will also make you write more code, just look at what Google does for Open Sans: https://fonts.googleapis.com/css2?family=Open+Sans&display=s...

Oh, and more styles? Well, be ready to add all of those as well, since most of the fonts out there won't necessarily be variable: https://fonts.google.com/specimen/Open+Sans#standard-styles

In comparison, Google Fonts just lets you choose what you want and copy something like the following:

  HTML:
  <link rel="preconnect" href="https://fonts.googleapis.com">
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&display=swap" rel="stylesheet"> 
  
  CSS:
  font-family: 'Open Sans', sans-serif;

While we're on the topic of fonts, it's a shame that we don't think more about how heavy the fonts we choose to use are, since right now serving my own fonts eats up around half of the bandwidth on my non-image-heavy site. The single article that i've found on the topic so far as been this, "Smallest (file size) Google Web Fonts": http://www.oxfordshireweb.com/smallest-file-size-google-web-...

In my opinion, those sizes should also be readily available in the web UI of Google Fonts, or most other sites that recommend fonts out there!

Reply on news.ycombinator.com