Re:Show HN: I made a privacy-first minimalist Google Analytics
by aembleton on Wednesday September 19, 2018 @11:55AM
(#18025116)
I see what you mean https://simpleanalytics.io/adriaan.io
Re:Show HN: I made a privacy-first minimalist Google Analytics
by donaltroddyn on Wednesday September 19, 2018 @12:01PM
(#18025158)
Some people are taking advantage of this to leave messages for us: https://simpleanalytics.io/simpleanalytics.io
Edit: It seems to have been filtered now, but people were using spoofed referer headers to leave offensive messages for HN users.
Re:Show HN: I made a privacy-first minimalist Google Analytics
by whylo on Wednesday September 19, 2018 @12:06PM
(#18025202)
Yeah, I saw that too. Someone tested for XSS in the referer too (<script> tag) but luckily it was escaped
Re:Show HN: I made a privacy-first minimalist Google Analytics
by HugoDF on Wednesday September 19, 2018 @12:07PM
(#18025206)
Part of the offering is transparent (public) analytics
Re:Show HN: I made a privacy-first minimalist Google Analytics
by whylo on Wednesday September 19, 2018 @12:12PM
(#18025256)
It says there's the ability to make them public, but it doesn't mention that they'll be public by default. Maybe it's different if you sign up first before adding the tracking code, but it's odd that I can use the tracking code without signing up for the trial.
It looks like anyone can see the stats for any domain using the service without any authentication. I added the tracking code to my domain and was able to hit https://simpleanalytics.io/[mydomain.co.uk] without signing up or logging in. I was also able to see the stats for your personal site.
Is that intentional? If it is, it seems like an odd choice for a privacy-first service. If not, it seems like quite a worrying oversight in a paid-for product.