News for hackers. Stuff that matters.

A comment on We ditched Google Analytics. Parent comment

Re:We ditched Google Analytics by rplnt on Tuesday December 08, 2015 @11:13AM (#10697230)
Aren't there self-hosted analytics anyway? Piwik[1] comes to mind first, but I'm sure there are many.

1. https://piwik.org/

[ Parent | on HN ]
Re:We ditched Google Analytics by billmalarky on Tuesday December 08, 2015 @11:28AM (#10697351)
Piwik is incredible. But it should be noted that it does provide a scaling challenge for high traffic use cases (> hundred million actions per month), and hosting your own analytics is expensive.

I bring this up because people had been slamming moot for using GA on 4chan instead of piwik without understanding why.

[ Parent | on HN ]
Re:We ditched Google Analytics by bjelkeman-again on Tuesday December 08, 2015 @12:41PM (#10697957)
We have much lower traffic than that and our Piwik servers, with paid support from the Piwik team, often struggles to generate reports etc. Not convinced Piwik is that easy to scale.
[ Parent | on HN ]
Re:We ditched Google Analytics by billmalarky on Tuesday December 08, 2015 @04:53PM (#10699860)
People have scaled it to over a billion actions per month. No clue how much of that includes customizations though... It sounds way past the out of box limit.

Look at the comments from sandfox and afterlastangel in this thread. afterlastangel is pushing a billion, sandfox is around 300 MM per month.

http://forum.piwik.org/t/high-traffic-piwik-servers-database...

[ Parent | on HN ]
Re:We ditched Google Analytics by brettz on Tuesday December 08, 2015 @09:39PM (#10701559)
I'm looking into replacing GA Premium ever since Easylist blocked GA tracking for Adblocked users and self-hosted Piwik seems like the best solution. I'd be well into the billions.
[ Parent | on HN ]
Re:We ditched Google Analytics by billmalarky on Thursday December 10, 2015 @12:12PM (#10711762)
With that kind of traffic hopefully you have the resources to pull it off. Good luck!
[ Parent | on HN ]
Re:We ditched Google Analytics by wishinghand on Tuesday December 08, 2015 @11:54AM (#10697584)
Do any of the Google Analytics alternatives scale to that size?
[ Parent | on HN ]
Re:We ditched Google Analytics by rbinv on Tuesday December 08, 2015 @12:00PM (#10697630)
Free alternatives? Not really. Paid? Yes, SiteCatalyst and Webtrekk come to mind.

People seem to ignore that the tracking JavaScript is not what you're paying for. It's the backend + servers.

[ Parent | on HN ]
Re:We ditched Google Analytics by billmalarky on Tuesday December 08, 2015 @04:55PM (#10699876)
People have taken piwik to 300MM up to over 1 billion actions per month. But it certainly isn't "set it and forget it."

http://forum.piwik.org/t/high-traffic-piwik-servers-database...

[ Parent | on HN ]
Re:We ditched Google Analytics by sarciszewski on Tuesday December 08, 2015 @12:02PM (#10697662)
See https://news.ycombinator.com/item?id=10697045

Piwik is still using (unsalted) MD5 for passwords in 2015, and probably will still be using unsalted MD5 in 2016.

[ Parent | on HN ]
Re:We ditched Google Analytics by etjossem on Tuesday December 08, 2015 @12:25PM (#10697836)
This is pretty bad. Piwik could be a high value target depending on the nature of the site it is used to analyze.

I can't believe unsalted MD5 is "by design" (https://github.com/piwik/piwik/issues/8753).

[ Parent | on HN ]
Re:We ditched Google Analytics by sarciszewski on Tuesday December 08, 2015 @12:28PM (#10697855)
https://theintercept.com/2014/02/18/snowden-docs-reveal-cove...

Considering Piwik is used by the GCHQ, I find it hilarious.

[ Parent | on HN ]
Re:We ditched Google Analytics by Someone1234 on Tuesday December 08, 2015 @01:00PM (#10698094)
They're using an open source analytics software package to analyse the very data it was designed to analyse.

I don't find it using poorly implemented hashing in the administrative interface to be at all relevant to what they're doing, or why they shouldn't be using it.

[ Parent | on HN ]
Re:We ditched Google Analytics by etjossem on Tuesday December 08, 2015 @01:42PM (#10698388)
Information on who visits WikiLeaks - and what they read and upload - is an incredibly high value target. I don't see how you can argue otherwise, when Britain's top intel agency has an expensive line item in their budget just to get at that info.

Given these known security flaws, it's not a stretch to assume anyone who can see the GCHQ's Piwik server can have that data too, regardless of whether they are authorized.

See below for a small preview of what an attacker could exfiltrate (dissident IPs redacted for a reason):

https://firstlook.org/wp-uploads/sites/1/2014/02/piwik2.png

While we're talking about poor security practices: the privileged username in the screenshot is apparently still the default ("admin"), so I hope the password isn't still "changeMe" ... http://piwik.org/faq/how-to/faq_191/

[ Parent | on HN ]
Re:We ditched Google Analytics by Albright on Tuesday December 08, 2015 @11:20AM (#10697291)
Unsurprisingly, Wikipedia has a list: https://en.wikipedia.org/wiki/List_of_web_analytics_software
[ Parent | on HN ]
Re:We ditched Google Analytics by tux3 on Tuesday December 08, 2015 @12:52PM (#10698027)
Wikipedia's love of lists is absolutely amazing: https://en.wikipedia.org/wiki/List_of_lists_of_lists
[ Parent | on HN ]
Re:We ditched Google Analytics by rqebmm on Tuesday December 08, 2015 @02:20PM (#10698678)
https://en.wikipedia.org/wiki/List_of_list_of_lists_of_lists
[ Parent | on HN ]
Re:We ditched Google Analytics by Someone1234 on Tuesday December 08, 2015 @01:04PM (#10698124)
Strangely Microsoft's one is missing: Application Insights.

Pretty much works like Google Analytics but utilises both client JavaScript and embedded runtime code to generate a richer picture of what is going on.

Too bad the interface on the Azure Portal is terrible. They spent too much time making it look fancy, and not enough time getting the 101s of usability right (which is a criticism I'd lay at the feed of the new Azure portal in general).

[ Parent | on HN ]
Re:We ditched Google Analytics by nateguchi on Tuesday December 08, 2015 @12:12PM (#10697721)
Who makes these lists?!
[ Parent | on HN ]
Re:We ditched Google Analytics by blowski on Tuesday December 08, 2015 @01:07PM (#10698145)
Well you can see the list of users here:

https://en.wikipedia.org/w/index.php?title=List_of_web_analy...

[ Parent | on HN ]
Re:We ditched Google Analytics by bencollier49 on Tuesday December 08, 2015 @12:23PM (#10697819)
Good question!

Probably the vendors of the software concerned. Perhaps it started out as a list of three with a major bias towards a particular product. And then the competitors responded, moderators did their things and eventually an accurate list was evolved.

[ Parent | on HN ]
Re:We ditched Google Analytics by vermontdevil on Tuesday December 08, 2015 @11:30AM (#10697363)
Does the adblock/ublock etc block this as well?

Am looking to use this in lieu of Google Analytics.

[ Parent | on HN ]
Re:We ditched Google Analytics by jdmichal on Tuesday December 08, 2015 @11:49AM (#10697538)
Self-hosted means that it will be served from your own servers, and thereby your own domain. So unless your domain is on a block list, it will be loaded.

EDIT: Sorry, I've been dealing with uBlock Matrix for too long, and forgot how advanced the other blockers pattern matching is. See the many responses to this for better information.

[ Parent | on HN ]
Re:We ditched Google Analytics by pdkl95 on Tuesday December 08, 2015 @12:08PM (#10697702)
(my apologies for the tone - I have edited the post to try to keep it purely fact based)

From EasyPrivacy[1]

    /piwik-$domain=~piwik.org
    /piwik.$script,domain=~piwik.org
    /piwik.php
    /piwik/js/*$domain=~piwik.org
    /piwik1.
    /piwik2.js
    /piwik_
    /piwikapi.js
    /piwikC_
    /piwikTracker.
This doesn't include any renamed versions, nor does it include the numerous domain-specific variations.

[1] https://easylist-downloads.adblockplus.org/easyprivacy.txt

[ Parent | on HN ]
Re:We ditched Google Analytics by jdmichal on Tuesday December 08, 2015 @12:15PM (#10697751)
Slow down there guy, it was a simple mistake. I've been using uBlock Matrix for too long is all.
[ Parent | on HN ]
Re:We ditched Google Analytics by jrgv on Tuesday December 08, 2015 @11:58AM (#10697620)
The EasyPrivacy block list contains an entry that will block the piwik.js file. Of course, when you're self-hosting, it's trivial to serve that file with a non-default name.
[ Parent | on HN ]
Re:We ditched Google Analytics by jdmichal on Tuesday December 08, 2015 @12:07PM (#10697701)
That's an interesting choice. I mean, it's not like you can hide from the web server that you are making the request. But then again, I'm assuming -- by the sheer necessity of having a JS file -- that they are collecting some additional metrics not available to the server in the request.
[ Parent | on HN ]
Re:We ditched Google Analytics by Paul-ish on Tuesday December 08, 2015 @02:10PM (#10698604)
Those filters could be in place to block the Piwik cloud service: https://piwik.pro/cloud/?pk_source=Piwik.org&pk_medium=Cloud...
[ Parent | on HN ]
Re:We ditched Google Analytics by username223 on Tuesday December 08, 2015 @12:02PM (#10697657)
It will probably take awhile, but trackers will move to aggregating log files, and blockers will move to TOR. And the arms race continues...
[ Parent | on HN ]
Re:We ditched Google Analytics by mattab on Wednesday December 16, 2015 @05:09PM (#10747732)
Piwik for example already can import log files: http://piwik.org/log-analytics/ as an alternative to JavaScript tracking
[ Parent | on HN ]
Re:We ditched Google Analytics by modoc on Tuesday December 08, 2015 @11:56AM (#10697602)
No it parses web server logs, however as mentioned above it doesn't work well for very high traffic sites.
[ Parent | on HN ]
Re:We ditched Google Analytics by rbinv on Tuesday December 08, 2015 @12:02PM (#10697651)
Piwik relies on client-side JavaScript for tracking, not log analysis.
[ Parent | on HN ]
Re:We ditched Google Analytics by modoc on Tuesday December 08, 2015 @12:30PM (#10697872)
http://piwik.org/log-analytics/
[ Parent | on HN ]
Re:We ditched Google Analytics by Flammy on Tuesday December 08, 2015 @02:21PM (#10698687)
They have both, most users use the client side javascript. I'm not familiar with how well the log analysis works.
[ Parent | on HN ]
Re:We ditched Google Analytics by rbinv on Tuesday December 08, 2015 @12:59PM (#10698083)
Sorry, I was not aware of that feature.
[ Parent | on HN ]