Hacker News Reader

Comment by MichaelCrawford | Hacker News Reader

That I find particularly creepy, so I blackhole many of the analytics servers with my /etc/hosts:

127.0.0.1 hosted-pixel.com 127.0.0.1 cdn.hosted-pixel.com

When web bugs first appeared, there was a huge public outcry. Now that they call it "analytics" or "big data" everyone seems cool with it.

However I can't block everything with hosts; some of the tracking scripts come from the same hosts as I actually use. I'm planning to write a firefox addon which will do stuff like remove the Facebook "Like" buttons. Even if I don't click the button, Facebook knows that it served me the script.

View on HN

You can use Policeman

https://addons.mozilla.org/en-US/firefox/addon/policeman/

Or on Github for a more bleeding-edge version

https://github.com/futpib/policeman/releases

I have always loved requestpolicy but for some reason something about RPContinued makes me nervous. Policeman would be a great alternative if Sync worked[^1]. I cant use policeman if it means I have to jump through the same hoops on every firefox installation in order to get things set up.

[^1]: https://github.com/futpib/policeman/issues/28 Plus issues 92 and 95.

Thanks to @JetSpiegel I just became aware of Policeman. And I am not sure why you are nervous about RPContinued.

So, I went ahead and created a wiki for this: https://github.com/UprootLabs/gngr/wiki/List-of-request-bloc...

If there are any known issues with RPContinued or there are other extensions that are not listed, please feel free to add them. Thanks.

What is the mysterious "switchboard" column?

The name for the concept comes from the name of the HTTP-SwitchBoard extension (predecessor to uMatrix). It's skeuomorphic.

The extensions which have a switchboard like interface enable the user to block requests based on the request's domain name, the primary frame's domain-name, and also the type of request.

In contrast, extensions like NoScript have a global switch. If I allow scripts from DontBeEvil.com, they are enabled on all domains. They don't prevent XSS attacks, for example.

If there's a better name for this concept, please do suggest one.

That's used by the phone company to patch you into the NSA.

Policeman is still "beta", despite being quite usable. It just need polish.

> Even if I don't click the button, Facebook knows that it served me the script.

You can stop a lot of trackers by minimizing referer leaks. Firefox has the config option network.http.sendRefererHeader which defaults to 2, "always send referer." 1=same FQDN, 0=never send. So by setting it to 0 or 1, a typical tracker that's gotten past your /etc/hosts entries, adblock, etc. will see you requesting their pixel image but never see the sites that initiated those HTTP GETs.

There are no silver bullets, just good tools, and reducing the referer footprint is one of them.

Ad block rules like this block content except on the home site:

    ||twitter.$domain=~twitter.com

Additional domains can be unblocked:

    ||twitter.$domain=~twitter.com|~another.com

Hey thanks - I owe you one.

Maybe EFF's Privacy Badger could help? I use it and like it, you can unblock individual scripts on a per page basis.

https://www.eff.org/privacybadger

> Now that they call it "analytics" or "big data" everyone seems cool with it.

It generates massive value that everybody benefits from. People appreciate that.

I wonder how much real value is actually generated from web bugs. A lot of interesting stuff can be generated from server logs; much more if you use analyzers.

I just wonder how much of the set of "analytics" that requires involving 3rd parties (web bugs and other referrer tricks) is actually useful and a value. The set that is a value "that everybody benefits from" is going to be even smaller.

I'm sure most people want this data, and see a lot of potential use. Usually, there is a big difference between "want" and "need", and I suspect a lot of the current attitude that throws analytics on everything is some experimentation, a limited amount of real value, and a whole lot of people joining in because they can (fad, bandwagon effect, it's what a tutorial said, etc).

I spend a lot of time analyzing my own logs. I get a lot of value from it.

I am completely cool with someone analyzing their own logs if I visit their site. What I'm not cool with, is them finding out what _other_ sites I visit.

I regard the current focus on analytics as unduly obsessive. How much do you need to know about your customer to flog your products? Just because you can measure something, it doesn't mean that it's going to do anyone any good to measure it.

I used to do direct mail; all we ever did was what today is known as A/B testing - we'd send "test drops" to different lists, with different prices, different wording in the offer letters and so on. It worked really well.

To clarify my previous post, I'm totally fine with server-logs. As the 2nd-party to the conversation, the server has to know who the request is from, and can log it. These logs can certainly provide a lot of value.

As you mention, I'm more concerned with tracking as a 3rd-party[1]. There is, obviously, at least some real benefit in these cases that would not be possible when only using server logs. It's probably a lot less than most people think. A lot of that data (or similar-enough data when measured in e.g. how much it benefits sales or makes marketing cheaper) can probably be found elsewhere.

If we knew what the core benefits (needs, not wants), we might (in an ideal world) even be able to have some sort of social negotiation where the data can be provided in some form (or an alternative, or by making sure the real social cost is covered properly).

[1] While the law currently doesn't work this way, involving a 3rd-party unauthorized should really be considered some new type of (criminal) wiretapping in states that require 2-party consent.

> A lot of that data (or similar-enough data when measured in e.g. how much it benefits sales or makes marketing cheaper) can probably be found elsewhere.

If you can find equivalent data somewhere else, you should go build a company around this. People built their products this way because it works. If you have a better idea then you should make it happen.

All the marketing people that I've worked with have used it to do things that you could never do before. Tracking the path people take through your website, which pages they land on, what they spend time reading and what they click through, who comes back tomorrow to buy something - it shows you what works and what doesn't on a level you can't otherwise get. Mapping that onto market segments lets you further narrow this down to just work on the things that are important to the people who buy your product, when most visitors to your site are random click-through traffic that will never buy anything, and feeds back useful information to your product design process.

The degree of focus that this permits is how startups and small companies can find and target their market quickly, where a large company could just market to everybody and see who responds. It's hard to tell how much of the tech startup boom has been driven by this, but after working for and with a few of them, third party analytics is critical because you usually don't have the time or money to find your market without it. Before we had analytics the strategy was "make a lucky guess and verify it before you run out of money". Now the default strategy is "measure who is interested and go directly to them".

I'll accept that large, successful companies don't really get much out of this sort of thing - they already know who buys their product, and have the scale and resources to target everybody. They probably do use analytics just because it's there, and not because they need to.

Reply on news.ycombinator.com