[AdriaanvRossum]

Love what you are doing here. A few points:

1. I would rename the pixel.png to something like image.png. Never call your script anything like tracking, analytics, or pixel when you don't want to be blocked by ad blockers. We use hello.js and hello.gif. [1]

> Log file parsing is an old-skool but effective way of measuring the traffic to your site.

2. By using a pixel image you can bypass caching. When using server logs without the image you only get the non cached requests. So an image like you use is a better approach.

3. Your image is being cached. So if somebody revisits your website your image will not be loaded and you will not find anything in your logs. Just disable your etag and add a expiry date of the past.

Awesome that more and more people are replacing Google Analytics with more simple tools. GA is overly complicated and has not the best privacy mindset. I built Simple Analytics [2] as a privacy friendly alternative.

[1] https://docs.simpleanalytics.com/script

[2] https://simpleanalytics.com

[xiaq]

> Never call your script anything like tracking, analytics, or pixel when you don't want to be blocked by ad blockers.

But this is a tracking script, no? If I were you I'd keep the name that way so that if people don't want to be tracked, they don't.

[harianus]

If your business is to track people, yes. If it's to gather statistics without tracking people (like page views), I think it perfectly fine to bypass ad blockers. We even have a dedicated feature for bypassing ad blockers [1] because we think page views are not privacy invasive. We drop IP addresses from every request so there is no personal data in our database or logs.

If you really want to block you can enable the Do Not Track setting. Although I think this should only be used when you are actually tracking people (we don't). So this feature might be removed in the future. It's already removed by Safari because it is another parameter to fingerprint a browser.

[1] https://docs.simpleanalytics.com/bypass-ad-blockers

[xiaq]

The privacy game is about power, not about who is doing what right now. People shun Google's data collection because of what Google can do with the data, not what it has done or is doing; it only takes a single case of data misuse to reveal the power dynamics even if nothing has happened to them personally.

You don't have to play the privacy game -- there is a lot of space between really respecting user's privacy and breaking privacy laws. But if you do, you should put the power back in the user's hand.

(Disclaimer: I work for Google.)

[kerng]

There have been countless cases for me personally where Googles tracking is creepy. Like Google Map recommendations, YouTube videos I should watch, misleading ads that send the user to malware bases on interest Google has about them etc, as well as exposure of unauthenticated Google+ APIs that allowed access to sensitive data to name a few.

I think saying nothing bad has happened is disingenuous. As soon as Google gets similar exposure as FB right now, internal whistleblowers might come forward also with more stories.

Also, couple of years ago Google was thoroughly compromised by at least one foreign government, ever wonder how much data was stolen?

[lioeters]

Thank you for that comment. It means a lot that such a thoughtful consideration of privacy is coming from someone working at Google, there is hope yet for a humane approach to analytics and data collection.

[la_barba]

I think it is fair to know exactly what data I'm giving up and what Google is doing with it, if I chose to exchange it for free services and goods. Hopefully someone with a spine comes to power and enacts some regulation allowing users to have a much clearer understanding of this. Also, people dislike Google for many things it has already done, not just because of an imagined future problem. Also.... nothing personal against you!

[harianus]

https://twitter.com/randfish/status/1126892446925848578?s=21

[notafraudster]

I don't think what you're doing is the end of the world, but answer this is extremely patronizing.

You've basically said you know some users block your stuff, but you think they probably shouldn't really want to block your stuff, so you devise an end run around them.

Then, finally, you conclude that if they really want to block your stuff, they should do something that you yourself admit won't block your stuff, but that's okay because they shouldn't want to block your stuff.

[jamiequint]

I'm fine with people being patronizing towards whiny, entitled users who think they have a right to use any website they want on their terms.

If you don't like someone running log analysis on their traffic then don't go to their website, nobody forced you to.

[nathan_long]

This example of tracking is tiny and harmless. But there's a wide spectrum of tracking behavior from sites.

> whiny, entitled users who think they have a right to use any website they want on their terms

Users do have a right to use any website they want to on their own terms. If I make an HTTP GET to your site, it's up to you to decide what HTML to return. Once you do, it's up to me whether to request the images, scripts, etc, and whether to read the sidebar, etc.

It's up to you to decide whether to show me any content of substance without first collecting payment. I can't demand that you publish content for free. I'm not entitled to that.

But it's up to me to decide what I consume. You can't demand that I view ads, send back tracking cookies, etc. You're not entitled to that.

If you don't like site visitors refusing to be tracked, then don't let them view your website. Nobody forced you to.

[jononor]

How exactly does one know which websites will do this and which wont, before going to the website?

[haney]

I’d make the assumption that any client/server connection has some sort of logging mechanism? I don’t think browser fingerprinting and large scale cross site tracking is good but it seems a hard to take issue with being counted when visiting someone else’s website.

[jamiequint]

How do you know what businesses have cameras to count visitors before going into the business?

[krupan]

I'd you are that concerned use a proxy, VPN, Tor, etc.

[dx034]

I completely agree. I don't think Do not Track was ever about knowing how many visitors you have or the browser they use. That's basic knowledge needed to improve the site. Tracking becomes an issue if it's shared across pages and where personal data is collected without consent to sell it to the highest bidder.

[judge2020]

The author said it himself, he could have just put Cloudfront in front of Pages and parsed the access logs there. The referrer and user-agent, which are sent by the browser, are in the request headers. There would be no need for JS or an image if the website owner just changed their setup.

How do you deal with this sort of tracking?

[harianus]

What do you mean? I think using CloudFront is not accurate enough if you use caching.

[judge2020]

I guess I mean overall "you can't stop owners from analyzing their access logs" and not just related to Cloudfront.

[ceejayoz]

They've got an enterprise logging tool that'll give you all the info needed for this sort of tracking. https://support.cloudflare.com/hc/en-us/articles/216672448-C...

[judge2020]

This is "Front", the Amazon offering, not "Flare" (side note: logging via Cloudflare Workers is cheap and possible)

[snlnspc]

I agree with this, but thankfully these posts have let us know to block hello.gif and hello.js by default now.

[qwertox]

> But this is a tracking script, no?

No. This is self-hosted analytics, no 3rd-party involved, the way it's supposed to be.

Tracking involves a 3rd-party. Be it Google Analytics or Cambridge Analytica UserTracking (TM).

[matz1]

The goal is to track. Allowing people to easily disable defeat the purpose.

[aembleton]

Correct. I wasn't loading pixel.png as it was blocked by the Easy Privacy List: https://easylist.to/easylist/easyprivacy.txt

[MuffinFlavored]

You don’t track user’s flow on site? like conversion for ecommerce, bounce rate, time on page, etc.?

[harianus]

Not at the moment. We will implement tracking user flow with in a privacy minded way. I asked Hacker News a while ago if they would think it was privacy friendly [1]

To be clear about the other thread about bypassing ad blockers. We will not have this feature when tracking user flow. People should have the right to block events if they want. But for basic info as in page views we keep offering the ad blocker bypass feature.

[1] https://news.ycombinator.com/item?id=19136044