Hacker News Reader

Comment by bhouston | Hacker News Reader

Blocking standard analytics on small websites who do not server ads is being dick. Now I do not know who is using my website. I can not optimize it for longer user sessions, I can not figure out which are the most popular pages, I can not record client-side errors, I can not track caching and page load time.

Basically this screws over those want to create good website experiences. Blinding us in this way is pretty useless.

This type of stuff should be opt-in. Most people install uBlock to remove Ads. But now we are making them invisible to websites at the same time, which is not what most people signed up for.

View on HN

I think a fair portion of the people who are consciously blocking GA might think that beaming back a ton of information to the Google mothership is also "being dick," because they don't want ad-tracking profiles to be built for them based on their browsing habits across millions of websites.

If you want to balance the desires of your privacy-savvy users and your craving for analytics, why not use Piwik and self-host it on your own domain? No external requests, and no information back to Google.

It block self-hosted Piwik by default too!

Thanks. Knowing that, I'll probably go out of my way to whitelist 'piwik.js', etc. I'd be willing to trade some personal information to any host wanting to use a self-hosted Piwik instance over a big analytics platform.

this is unfortunate. i think anything that's same domain should be allowed through, even 2nd-level might be okay. it's third-party tracking that should be disabled because of cross-domain tracking capability.

it's completely unreasonable to expect websites not to do something as simple as tallying unique visitors or recognizing returning customers via cookies/fingerprinting on their own properties.

To be fair, "recognizing returning customers via cookies/fingerprinting" by itself doesn't require JavaScript. It's the tracking of the user's activity once the page has loaded which does.

That seems pretty unreasonable. I can see providing an option for it, but blocking it by default is bordering on paranoid.

Well, take it to the easyprivacy guys, µBlock only has their list enabled by default.

It shouldn't be enabled by default -- that is the problem. It should be opt-in to start blocking non-ad related things.

The Piwik block comes from the AdBlock ruleset.

It blocks the piwik.js. When you check the statistics and hover the red filter symbol for the Piwik line you will see which rule blocked it.

I think it's a mistake to think that people who visit your site somehow 'owe you' and should permit third-party tracking code from your site to run in their browser. I understand your points about wanting metrics to learn from, but when you bring in a third party all bets are off and individual visitors (like me) will choose not to run that tracking code.

Don't forget there are other ways of achieving what you want too - you can use something simple like GoAccess[0] or even run a Piwik install off your server logs[1] for a nice pretty GUI experience if you prefer.

As more and more people become privacy-conscious I hope you will see this as an opportunity to learn how to do more yourself and outsource less to Google. They don't even give you all the data they collect from site visitors, you are giving them free data for little in return!

[0] http://goaccess.io/ [1] http://piwik.org/log-analytics/

Apparently Piwik is blocked too. I think that's a shame, as in my opinion self-hosted tracking solutions should be acceptable.

The Piwik use-case I was referring to is to run it from your imported logs, not the default JS tracking. Because the visitors can't circumvent server logging, you get analytics and also boost page speed.

Once upon a time people and web hosting companies knew how to parse access logs into beautiful analytics systems with software like JAWStats (http://www.jawstats.com/).

It's really a shame that Google Analytics has become the only way to handle traffic analysis.

Parsing access logs in 2015? Really? You mean those logs that are cluttered with bot traffic and that only have IP addresses instead of real user sessions, and do not contain valuable information about for instance exit pages, banner clicks, page load times, and so on?

Your knowledge of what can be extracted from server logs is a little bit out of date.

Also, server logs are the only tracking system that can't be disabled by visitors.

nope, there are number of ways to track visitors even when everything is blocked (like ga.js or whatever) and all cookies disabled.

With user-agent header, ip address, etc. you can uniquely identify a user because there is enough entropy, see https://www.eff.org/deeplinks/2010/01/primer-information-the...

and that basically allows you to emulate a session id without cookies and without appending it to the URL

You can also use the cache to know if the user already visited some content or not, explained here http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...

And finally, you can use CSS custom styles to know if the user already visited some web sites or not, see spyjax http://davidwalsh.name/ajax-evil-spyjax

granted, the user can disable JS, change the user-agent, but I would argue they are still trackable

There isn't always enough entropy to uniquely identify a user - you can't rely on that to provide accurate tracking. If people are coming from a corporate environment using terminal servers then every single browser will identify as one user by that method.

Most browsers are now taking steps to stop the CSS custom styles hack working - for example this doesn't work in Chrome anymore. The website can show you which websites you've visited with the change in colour for the link state however it can no lonqer query it.

it would be as accurate as the server logs, the only difference is I don't need to analyse those logs I can keep using google analytics.

that's my whole point: "yadda yadda yadda ublock or adblock or whatever block ga.js on the client side haha you can not track the visitors anymore"

nope I can still track them and I don't need to even bother analysing the server logs

server side:

  1. I can detect if there is a _ga cookie
  2. if not, I can generate a UUID based on the user-agent and IP
  3. and I send my pageview from the server side

it is not perfect, I would certainly not use that UUID to identify a login session but it does work without me having to stop using google analytics.

> "There isn't always enough entropy to uniquely identify a user"

there is, read the EFF link it explains all that nicely

TL;DR

  - you can not send tracking client side anymore
  - OK, I can send tracking server side, go ahead try to ublock that

Sure you can. All you need to manage your site's performance is in your server's log file. There are many free tools for analyzing those logs. If you're getting client-side errors, run a site analyzer to check your site for dead links and such.

You don't need Google for any of this.

I suppose I could do this:

https://www.google.co.uk/search?client=ubuntu&channel=fs&q=l...

with bing:

http://www.bing.com/search?q=log+analyzer&qs=AS&sk=AS4&pq=lo...

or with duckduckgo:

https://duckduckgo.com/?q=log+analyzer

Sure you can. Quit using Google. You think they are the only with a tool that provides these answers? Also, I think you are wrong: If people understood how FB, Twitter and Google can track your moves across websites, then I believe most WOULD want this.

I've used ad blockers since ad started to appears on the web because ads are annoying sure but the real reason is that it is a severe privacy intrusion. This is exactly why I installed µBlock as soon as I heard about it, because contrary to ad blockers it states clearly that it is about privacy and shows that the author actually gets it.

I could not care less about stupid justification for spying on me and sending all this data about me to google, either use piwik or learn to apply analytics to your web server logs.

Anyways I was already invisible to you because I have js disabled by default, and a few extension dedicated to blocking trackers and google spefically, with fanboy's lists to block trackers.

Can't you simply use your server logs?

I don't think this is such a big issue. Only a small minority of people use uBlock. Whatever data you measure on the 90% of your visitors that don't block GA can, most likely, be extrapolated to the remaining 10% as well.

I'm a lot more concerned about the revenue I am losing due to the decrease in ad views/clicks than I am about a slight decrease in GA hits...

>> Whatever data you measure on the 90% of your visitors that don't block GA can, most likely, be extrapolated to the remaining 10% as well.

Agreed.

I think we as tech people tend to assume everybody is as tech savy as we are - when in fact, it's not even close. Also, when you talk about an aging baby boomer population who didn't grow up with Facebook and Instagram, they could care less about being tracked.

Most small adverticers see it the opposite way. We don't want to pay you money to show the ads to someone that is not interested in our products anyway and never will click the link. Or even worse, click the link just to support you, stealing money from us instead. There are always two sides to a coin.

> I can not optimize it for longer user sessions, I can not figure out which are the most popular pages, I can not record client-side errors, I can not track caching and page load time.

Sure you can. You can do all of those things still.

Nothing stops you from doing analysis yourself.

uBlock might stop you. It's certainly consistent with their philosophy to block all analytics, even homegrown and not shared across sites.

I think the parent comment is referring to the idea that the web server, by necessity, is aware of a client connection. Webserver logs reveal a lot of information.

That might be useful for fingerprinting visitors but, perhaps ironically, it's much worse than javascript & cookies for actually seeing big picture trends on your site. There are many, many bots that request files off your server but only a relative handful execute javascript.

How many of the bots that don't execute JavaScript bother to download the URLs referenced in <script> tags? You can filter all the others easily.

If I like a site, and they don't show obnoxious ads I often white-list it. It's up to you convince me.

Reply on news.ycombinator.com