Free, Privacy-First Analytics for a Better Web | Hacker News Reader

Free, Privacy-First Analytics for a Better Web

blog.cloudflare.com

72 pointsjgrahamc32 comments

"Privacy-first", "For a Better Web" ... oh, the irony.

    blog.cloudfare.com external dependencies:

    cloudflare.com
    blog.cloudflare.com
    akamai.net
    akamaiedge.net
    bizible.com
    bizibly.com
    cloudflare.net
    disqus.com
    disqus.map.fastlylb.net
    disquscdn.com
    edgecastcdn.net
    facebook.net
    fastly.net
    google.com
    googleoptimize.com
    googletagmanager.com
    kappacdn.net
    lambdacdn.net
    linkedin.com
    marketo.com
    marketo.net
    mktoedge.com
    mktoresp.com
    storage.googleapi

Excellent, just excellent.

disqus is horrible, wish they replaced it with a discourse-based (community.cloudflare.com) comments system that some other have done[0,1].

0: https://blog.codinghorror.com/welcome-to-the-internet-of-com...

1: https://meta.discourse.org/t/embedding-discourse-comments-vi...

I thought about doing something similar but instead using Reddit or HN.

As far as the actual analytics product, is it provided via servers with specific domains? What would one look for if one wanted to block them?

The main product is powered by server logs from Cloudflare. You can't block them for any site using Cloudflare as a CDN/reverse proxy.

Ah good. So all I need to do is block Cloudflare /s Sigh.

This is no different than the server logs that any web host has. You can't block it unless you never make the request in the first place, but you can use a VPN and remove browser headers to limit your data.

I caught that, but I still appreciate your taking the time to explain.

The point I was actually at with that comment was about the ubiquity of a handful of companies on the internet.

That probably sounds like I'm need of an explanation about Cloudflare's reputation and what a ddos is. Please don't :)

> This is no different than the server logs that any web host has.

Ehh it's a bit different. I don't particularly care what (for example) some small time self hosted blog does with my IP address internally so long as it doesn't leak that data to third parties. In isolation, my IP address doesn't tell them anything about my _other_ traffic.

Cloudflare, on the other hand, hosts a significant number of websites and cross-origin assets. Their logs therefore have the potential to contain a great deal of metadata about my browsing history. Of course they'd obviously have this information either way, so I don't actually have any objection to them processing their logs in this manner.

(I do have serious concerns about the degree of centralization that has occurred, but that's a separate topic.)

> Their logs therefore have the potential to contain a great deal of metadata about my browsing history. Of course they'd obviously have this information either way, so I don't actually have any objection to them processing their logs in this manner.

Well, it's a bit better than that -- the blog post promises their analytics explicitly does not try to track you, just your visit. That is, they don't cross-correlate across visits.

The big kicker here is that they'll be providing these to those who don't use CF by adding JS to the page, almost exactly like Google Analytics (although I imagine you wouldn't get the accuracy of also having server/access log-based analytics due to ad blockers) by signing up on this page:

https://www.cloudflare.com/web-analytics/

offer something that is privacy-first analytics ought to be a pixel embed. Why would I trust an external js source that could change introduce security risk?

I'm not too familiar with the technique; doesn't pixel tracking still require JS to derive more info from the visitor beyond just their IP address?

The GET request will generally also include the User Agent, and any forwarded headers. This can include cookies.

Yes but that doesn't include things like screen size/ratio or some other key metrics that usability people rely on.

I can see the need for JS but it would be nice if they offered a pixel only version with less granularity for those of us who want the data but without JS.

Those things violate the privacy-first principles, do they not? Things like screen size/ratio are very strong fingerprints that can be used to de-anonymise users with ease.

Exactly! I think most people don't realize the problem of browsing web with JS turned on.

Their concept of "visit" hinges on seeing the Referer for the original request.

> Everyone with a website needs to know some basic facts about their website: ... What other sites sent traffic to my website?

No. If this product is capable of collecting that sort of data in the first place then it's not privacy first as far as I'm concerned.

> ... we don’t “fingerprint” individuals via their IP address ...

That _can't_ be true. How else would a single "visit" (their terminology) be tracked?

A self-hosted analytics solution (ex: https://github.com/mikecao/umami) would allow you to actually preserve user privacy if you wanted to.

> If this product is capable of collecting that sort of data in the first place

It's based solely on the http referer, which your browser sends.

The post specifies that the referrer is used for computing their "visit" metric (for which IP would also obviously be needed). It doesn't specify how their service is determining the site you came from. Since they don't say, my assumption is that they're correlating data obtained in some other way because that seems to be par for the course at this point.

Note that referrers are self reported, so there's an incentive for such a service to avoid relying on them. Each web site can set its own desired referrer policy, and users can further configure when, if, and how their browser sends referrers. (For example, Firefox has referer.XOriginPolicy and referer.spoofSource among other preferences.)

Referer includes the site you came from, what am I missing?

> Each web site can set its own desired referrer policy

Yes, and it won't be able to tell which site you come from if it's set to no-referer.

> Referer includes the site you came from, what am I missing?

I never claimed otherwise? There are two separate metrics in question here. One is the "visit" metric which the post specifies is based on the referrer. The other is quantifying which other sites sent traffic your way. The post conspicuously fails to define how that second metric is computed.

For that second metric, I noted that there is an obvious incentive to avoid using the referrer and that the current status quo is to rely on other methods. (In particular, fingerprinting combined with centralized analytics services that have vision into a vast amount of traffic. Note that Cloudflare easily qualifies here given the sheer number of assets and websites they host.)

If the entirety of this analytics service is based solely on referrers coupled with IP addresses then the author should unambiguously state that up front. Otherwise I'm going to assume the worst for the reasons given above.

I'm as skeptical as others here but they do define a visit...

"A visit is defined simply as a successful page view that has an HTTP referer that doesn’t match the hostname of the request. This tells you how many times people came to your website and clicked around before navigating away, but doesn’t require tracking individuals."

> and clicked around before navigating away

You can't get that part without using either the IP or a fingerprinting method. (For what it's worth, I don't mind IP based analysis so long as the data isn't shared with third parties. I also don't consider IP analysis to be "fingerprinting" since it seems analogous to a name to me. I was just calling out what seemed to be an obvious error in the post.)

Will Cloudflare customers on the free tier get non-JS Web Traffic Analytics? The blog post only mentions Pro+ tier accounts and non-Cloudflare customers.

Answer from Cloudflare CEO Matthew Prince: "Yes. There are more features with higher tiers, but every tier including free gets upgraded analytics."

https://twitter.com/eastdakota/status/1310958621136760832

love & respect cloudflare but calling this 'web analytics' blurs meaning and it's hardly a threat to google.

It's web traffic stats, hit data they have lying around from ops they're running anyways, packaged in a nice interface. Same as any web stats package from 2001.

Google Analytics spins it out more into like 'business analytics' where ('privacy' aside) you can see how users are using your site and how you can improve things for them and work to do things like make conversions for whatever your goal is, selling or otherwise. As far as designing for web and experience, that is useful.

Exactly. Recently complained about the same with other "analytics" packages pushed on HN. If you cannot get actionable results from an analytics package, it's only a 90ies visitor counter in disguise with some fancy graphics. Some of the stuff which is important for analytics can ONLY be tracked via JavaScript.

Truly privacy friendly, preferrably self hosted analytics, is possible, though.

Matomo finally is "there", though, with funnels, form analytics and the like, though of course, you can easily cross the line there, too, and then mainly gained decentralization, but not truly privacy.

I think self-hosting is the only way to avoid all the privacy issues created by centralized analytics.

Plug: I am currently working on https://www.usertrack.net to try to offer self-hosted actionable analytics, and I'm also developing a more lightweight and cheaper version for WordPress, as currently most WP analytics plugin are just fetching and sending data to Google Analytics.

I quite like the edge approach (i.e. doing this via server-side logs rather than by adding a script to the client). I already do this with my own website using an ELK stack to ingest and visualies the nginx logs, but I have been wondering if there's a better (and lighter ^1) solution that's specifically focussed on privacy-aware, server-side analytics.

1. I had to increase the RAM on my droplet just to get the ELK container to boot.

Actually privacy-first analytics: https://matomo.org/.

Reply on news.ycombinator.com