Analytics are business intelligence. Showing which of your content works well and which doesn’t.

The idea that there should be no issue sharing them is absurd. Yeah just publish the minutes from your marketing strategy meetings as well while you’re at it. Invite your competitors to go over your books with you and your accountant and then arrange meet and greets with your most profitable customers as dessert.

Sure, in the same way that code is intellectual property and should never be shared, and all ideas should all be patented in case they become worth something.

In all seriousness, I'm OK with that as long as people are honest about it. Just say "We track our users to collect business intelligence." and I'm happy.

The point is that even analytics that are 100% anonymous and aggregated, with no privacy concerns, are still pieces of business intelligence.

We all would love to know what Google page ranking algorithm is. Disclosing any business information whether it is in the form of code, analytics, financial information, customer data, etc. sometimes makes sense but more than often, doesn't.

> Disclosing any business information whether it is in the form of code, analytics, financial information, customer data, etc. sometimes makes sense but more than often, doesn't.

While I agree with the spirit of your comment, this is a very sweeping generalization. Many kinds of financial information are being shared regularly with the public and for publicly traded companies they're required by law. Many companies build their infrastructure on open source software, with proprietary glue being a small percent.

Knowing what you can or even should share (for marketing purposes) is crucial. Especially knowing that keeping information asymmetry forever is impossible.

> Many companies build their infrastructure on open source software, with proprietary glue being a small percent.

This too is a sweeping generalization ;), a good one though. We're pretty fortunate to have a lot of our building blocks made using open source software. Boost libraries to openssl, most of the stack is open source including the programming language. Although, the proprietary glue is the important bit.

An architect's work is more than just bricks and mortar.

I am not disagreeing with you, but imagine if all business were completely open about all those things. Yeah, maybe your particular business would fail, but the net result would be the truly most effective business to succeed. Which would be an overall win for society. It would also mean that small players would have more of a chance, because they'd be able to build on big players failures/successes more easily. I suppose counter argument would be that it would inhibit people from taking risks, because the gains would be shared, while the failures would not.

Big businesses will just find ways to circumvent it like starting meeting with a copyrighted poem and arguing that minutes can’t be shared on copyright grounds (or similarly absurd loopholes) which smaller businesses wouldn’t think of doing. Thus big businesses end up getting a greater competitive edge.

Basically whatever process you put in place to level the playing field, big businesses will find a way to game it to their advantage because they have the resources to do so and the deep pockets that allow them to take risks.

I’d actually argue that this would have detrimental effects. What’s stopping a company from visiting your site, seeing what’s popular, and stealing it all for themselves?

What do you mean by stealing? Other companies could offer the same products you offer already. If they know what people want they will spend resources trying to optimise things based on data, instead of guessing. Some other company may find a better/more efficient way to offer the popular products, which is better for everyone.

It's a way to level the playing field. The idea is that, if everyone has access to all the data, then there's more opportunity to make all business more efficient, whereas if some businesses hold information about the market and costumers for themselves, then they get to be sloppier in their implementation because they are already so far in the game.

This is a good point and I agree for most businesses, you wouldn't want to publish your bi. But slimsag makes an interesting & valid point: that if you are confident enough in the privacy policy of your analytics, you should be able post it publicly without alteration.

Well even if you know that nobody can be identified from your data alone, if everyone releases data, it will become easier and easier to cross-reference and still identify people.

How would you identify anyone by a delayed visitor number on articles?

If it's only that it would be pretty hard. Aggregated data would (probably?) be relatively safe.

Great, now you've made it possible for everyone that links to your site to track people by adding arbitrary UTM parameters which can be uniquely identified. POC: https://opendata.hexops.com/devlog.hexops.com?utm_campaign=p...

Instead of what solutions like Plausible are meant to do (only give a responsible well-defined party access to the data), now everyone can view your website users potentially PII.

Plausible literally provides a toggle to make it public in their UI: https://plausible.io/docs/visibility

Sure, someone could send out unique links to random `utm_campaign` IDs and see "did the person click it?" and I agree that's a bit nasty.

But even if you do convince someone to click _your_ link, what good does that do? We can see you yourself clicked that link from Germany on a mobile phone, and that's literally it. We can't get your IP address, or any PII - it's not stored.

You were able to verify what level of information my site is collecting *because* it is public. That is simply better than me spying and recording everything you do and you just having to "hope I never accidentally release it or sell it to someone" as is the case with modern tracking.

> Germany on a mobile phone, and that's literally it

Yes, and _that's it_! Just by getting someone to click on a site they find trustworthy, you are now able to extract country, device, browser, OS, time of access, and to some degree other pages visited on the website. This in itself may not be PII, but together with previously known data points may be enough to assemble PII.

> Plausible literally provides a toggle to make it public in their UI: https://plausible.io/docs/visibility

Yeah, and I don't think that's a good idea that they do without any warning of the implications. If they make it easy to expose data publicly, there should at least be some measures to ensure anonymity like e.g. differential privacy based querying.

For a product that markets themselves as GDPR compliant and without cross-site tracking (which this technique enables to a certain degree), that's not really a great look.

> You were able to verify what level of information my site is collecting because it is public.

I mean kinda, but not really. I have no assurance the "all the data you are showing me" == "all the data you have about me". In the end I still have to trust you that you don't collect more data and that you won't sell that data to someone else.

-----

All in all, I really appreciate what you are trying to do here in terms of transparency, and I'd like to see that spread. However I think there is still a lot of room for tools to improve to provide a similar level of transparency while also insuring users privacy.

> Yes, and _that's it_! Just by getting someone to click on a site they find trustworthy, you are now able to extract country, device, browser, OS, time of access

So you'd be using this as an overly complex IP geolocation lookup and UA header parser? All of this information is either already known to you when you trick someone to click on that link (because they are on your website so you get the same data) or can instead be obtained by tricking them into clicking on a link to your website instead of that one (if it's an email for example).

> because they are on your website so you get the same data

Or you provide the link via any social media website, or email, etc..

> or can instead be obtained by tricking them into clicking on a link to your website instead of that one

The target may feel much safer clicking a link to knowntrustedsite.abc than yourunknownphisysite.xyz

> The target may feel much safer clicking a link to knowntrustedsite.abc than yourunknownphisysite.xyz

Big doubt honestly, at least for the vast majority of people. Just set up some blog with some contest that interests them (can be copied from other blogs) and they're not gonna suspect a thing. People might notice if you pretend to be their bank but are actually a phishing site, but they don't notice if you pretend to be a blog and are actually a blog that harvests their data just like any other website.

I also use Plausible for OnlineOrNot (https://onlineornot.com) - but there's no way I'd make it public.

Content marketing is part of the secret sauce these days.

I literally did the same thing last night! A DO droplet hosting a statically-generated site composed of html generated from some markdown and sandwiched between some html headers, then served up by the Rocket[1] framework.

It's my first website, and I think the total size of the backend is something like 40 LoC. I've never had any kind of analytics (or needed them), but I thought it would be neat to see what was going on. It took me all of 20 minutes to sign up, add the single Plausible <script></script> line to my index files and headers, and there it was. As someone with literally no other web experience, I can't imagine it having been easier. The cost of my website is now a whole $12/mo instead of $6, and I agree that it feels kinda nice to support a service that seems to place value on privacy and openness.

[1] https://github.com/SergioBenitez/Rocket

> $6/mo on a droplet

I wonder how many extra dollars cumulatively DO makes from the $1 premium on getting a better Intel CPU or AMD CPU and/or NVMe up sell on the smallest droplets.

I pay the extra dollar as well. I doubt I actually see the difference for what I use it for. I feel no desire to pay a dollar less though, so they are making another 20% from me on that product than they would have.

I didn't pay the extra dollar, I got the $5 droplet - but the backups are $1/mo extra

Ah, interesting. Was it offered at the time and you didn't choose it, or is it an older droplet that didn't have the choice?

I've had a lot of different droplets of different sizes over the last 6-7 years. Recently when I created a new one for a new project, I noticed that option and chose it. I'm not sure I would if buying a larger droplet, or a lot of small ones (I've done that for certain projects), but $1/mo is the point where it feels like nothing.

Well, it's only $1/mo difference for the smallest droplet. As you go up in tiers: $2, $3, $4, $8, $16 dollar differences.

I think it's a little scummy that they go out of their way to hide it and make the more expensive options the default, though:

https://user-images.githubusercontent.com/3173176/115132649-...

DigitalOcean is going downhill fast after the layoffs, I'm not optimistic about them in the long term. I'd love to know what they burn on marketing, because their video ads on YouTube are crazy.

> I think it's a little scummy that they go out of their way to hide it and make the more expensive options the default

Eh, I wouldn't call that hiding it so much as making the current market default the one they default to. If you're looking for the lowest end droplet, then yeah, it makes sense you would want the lower end Intel without SSD, but if you're buying something more expensive at all, there's more of a choice to be made.

Also, I'm not going to fault them for putting forth the option that allows them to more easily decommission what are probably older hardware and disks for newer offerings, especially when the "hiding" is just a radio button above the droplets. It's not that hidden. I suspect eventually the newer gen Intel/AMD offerings will lower in price and replace the current default.

> I'd love to know what they burn on marketing, because their video ads on YouTube are crazy.

That's interesting. I remember seeing some like 6-12 months ago on youtube for the first time, but I haven't seen any for a long while. I must have just been flagged as not part of their target audience (or Google has determined I already use them).

A while ago I noticed they set the default droplet to a more expensive one and moved the $5 option off the screen to the left so you have to scroll to see it, but it all lines up so it looks like there’s no more options. Minor change but a sneaky one.

OK, I find it hilarious that your open analytics say zero hits for the past few weeks until 70+ hits from today because you linked your open analytics on an HN comment... :-D :-D

I only deployed it just earlier this morning. Cloudflare says ~15k unique visitors in the past few weeks FWIW.

Whenever I read these hyperbolic statements on Hackernews I always end up rolling my eyes.

Really? It’s spying now?

Don’t we call classified (not public) foreign analytics spying?

Analytics of what? Analytics of your own stuff is not spying.

Entertainingly https://cpcchina.chinadaily.com.cn/ uses Google Analytics, while http://english.www.gov.cn/ (yes, no https) uses Alexa metrics. You can't even access the Chinese Communist party website without being "spied on" by US-based metrics companies. I don't think this proves anything but it's amusing to contemplate.

I switched my professional website to Plausible, and I am very happy with it. It gives me enough data to make business decisions, without tracking my users across websites. I also prefer its interface, which quickly lets me combine filters by clicking on things (visited this URL + triggered this event + came from this source).

It was satisfying to remove the cookie notice, and to update the privacy policy with "we do not collect any personal data". That's much more in line with how I want to operate a website.

On my personal blog, I got rid of analytics altogether. I don't care to know who visits my website.

> privacy advocates still go for "I have this hidden treasure trove of analytics about my site that you cannot access"

That's .. private? Why is it surprising that privacy advocates would say that this is private?

I think he's looking at it from the user's perspective. Some privacy advocates may say that analytics have to be private not to make user's private data public. However, the point was that the only reason making the data public would violate user's privacy is that the data is already violating user's privacy, although only one party can access it.

I would imagine the main thing is not wanting people to or derive confidential company information, like how a certain marketing strategy is going or some other piece of data you can get from analytics.