An alternative to using Google Analytics on your website - <AUTHOR> https://plausible.io/blog/remove-google-analytics <comment><USER2> It sounds like a nice product, but sadly it's not exactly why GA is so popular (being a 'nice' product, that is). It is popular, because it's free, relatively easy to implement on any website, requires no self-hosting and powerful, once running. I've checked your website for pricing, but not only there's no word about free tiers, but there isn't even anything on the pricing at all. So, when it comes to majority of GA users, it's not a competitive solution.

<comment><USER3> > _It is popular, because it 's free, relatively easy to implement on any > website, requires no self-hosting and powerful, once running_

Tbh, I disagree. While a lot of the above is true, it's largely popular because it's a recognisable brand, and because the majority of frontend devs are already familiar with it and haven't felt the need to explore an alternative (network effect).

While an alternative does really need to be free and easy to implement, it also needs to address the above two hurdles, which is a tough ask.

<comment><USER4> Photoshop is the defacto-standard in image editing, yet clones which are free and copy the photoshop UI are rapidly catching up for a segment of the userbase, eg. photopea.com

If someone set up a Scroogle Analoytics which had a simple code snippet, was free, and had near-identical looking dashboard, I'd use it.

<comment><USER5> In general, you should be very careful about what third parties you allow on your page because you're delegating to them the ability to do anything that can be done from JS. I trust Google to take this seriously and not open me up to XSS, but I would be much more skeptical about Scroogle Analoytics.

(Disclosure: I work for Google, and have run Google Analytics on my site since before I joined)

<comment><USER6> As someone who runs one of those 3rd-party analytics: the JS you add to your site is small, readable, and can be downloaded and included from your own CDN. Hell, you don't even need the script, you can just write your own (not very hard actually). I took a look at Plausible a while ago, and I think the same applies here as well.

With GA, I can do none of that; it's just a massive unreadable blob I can only load from the GA servers. I just have to trust Google doesn't do anything I don't want (including XSS, but also other issues). It's not even easy to figure out what information _exactly_ it collects last time. It's very untransparent and un-auditable and the website equivalent of loading binary kernel blobs.

</comment></comment></comment></comment></comment><comment><USER7> Plausible, Fathom [1] and Simple Analytics [2] are very similar in features. While self hosting is not supported, plausible is Open Source [3] running on Elixir and Postgre. It is also the most affordable out of three, starting at $6 only.

I am not sure why HN are so negative about this post, when two years ago everyone were cheering for GA alternatives.

Although I do agree it needs to add "Pricing" in the Navigation section.

[1] [https://usefathom.com](https://usefathom.com)

[2] [https://simpleanalytics.com](https://simpleanalytics.com)

[3] [https://github.com/plausible- insights/plausible](https://github.com/plausible-insights/plausible)

<comment><USER8> I think everyone is so negative on the post because the post is a sleazy ad in disguise. If it had opened with "these are the reasons that we are unsatisfied with analytics which led us to launch our own alternate service, plausible" or even just "why we made plausible.io" then we would know up front that it's an ad but maybe still a worthwhile read. This hides the fact that they want you to maybe try plausible to the last section and the last bullet of the table of contents. Its nothing about the product and everything about the underhanded advertising.

<comment><USER9> Where's the sleaze? GA does shady shit, Plausible has a competitor product and they're making the pitch on their company blog. What am I missing?

<comment><USER10> They used a clickbaity title and deeply buried the lede by disclosing that this is an advertisement for a competing (paid, non-self-hosted, proprietary) product only at the very bottom of a long list. I would bet 95% of readers did not realize this was an advertisement until getting to the bottom.

</comment></comment></comment></comment><comment><USER11> Some open source alternatives:

\- [https://ackee.electerious.com/](https://ackee.electerious.com/) (Node.js based)

\- [https://github.com/zgoat/goatcounter](https://github.com/zgoat/goatcounter) (Golang) (Commercial Licensed)

\- [https://snowplowanalytics.com](https://snowplowanalytics.com) (Core-ware)

\- [https://count.ly](https://count.ly) (Core-ware)

[https://www.visitor-analytics.io](https://www.visitor-analytics.io) is also a great GDPR compliant alternative (Not open source).

<comment><USER12> Shout-out to GoatCounter which was both free and easy for me to set up for my blog.

<comment><USER13> Another happy GoatCounter user here!

</comment></comment></comment><comment><USER14> Some pricing feedback:

The limitation of *K views per month only serves to introduce confusion into the buying process for me:

\- I don't know how many thousand views per month my website gets, to begin with. This is not something I have ever had to be concerned about but with this product, suddenly I need to keep an eye on this?

\- The first question that comes to mind is that what happens when I go over? I see you have a FAQ answer dedicated to this. (A lot of people won't bother to read the FAQ)

\- According to the FAQ, a one time "spike" is OK, but if it happens two months in a row someone will contact me? This seems murky and introduces uncertainty. And not sure I want to sign up for a $6/mo. product where a vendor is going to be contacting me to "discuss upgrade options".

\- That said, I don't know what "discuss upgrade options" means. Does this mean you'll contact me to force me to upgrade? Or is it just a suggestion? Is there a time frame in which I'd have to do it or will you cut off the service if a decision isn't made in a timely fashion?

\- Your highest plan allows 1M pageviews per month. What happens if I go over that? Is there a higher, unlisted plan that I would be asked to upgrade to?

A lot of the above may seem silly but I'm trying to illustrate the kind of murkiness that might cause a user to think, "I don't know exactly what I'm signing up for" and move on to other solutions.

</comment><comment><USER15> I have a hobby blog that I'm trying to run for <$5/month. I run it on Github Pages because it's a static site and GH takes care of just about everything. The only thing I don't get is analytics or server logs, I'm planning to build that myself with standard AWS components. I considered other options, but I didn't want to use GA (for many of the reasons mentioned in the blog), other tools like Plausible were outside of my budget, and the open source tools looked like more hassle to self-host than reinventing the wheel myself:

Browser (~3 lines of JS) -> API Gateway -> SQS Queue -> Lambda (ETLs queue into) -> Athena.

I was originally just going to use Postgres, but RDS/Aurora are expensive and running Postgres in EC2 is going to be at least as much work (configuring SSH, process management, backups, monitoring, logging, image building, networking, etc).

My custom plan is ~$3/month all-in provided I stay below ~1M requests per month, and even then it scales very cheaply. Also, this design is highly scalable, although I doubt I'll ever take advantage of it; it's mostly just icing on the cake. The main motivation is that these components are available on the free plan ("forever", not just the first 12 months) and/or the pricing model makes the charges negligible for my super-low-volume use case.

Note that this doesn't give me pretty dashboards; the interface is SQL. Fortunately, there are other analysis tools that I have at my disposal which can plug in to SQL.

Lastly, of course my $5 budget doesn't do justice to the actual value of my time; it's more of a fun challenge. If I really just wanted web analytics, I should shell out the $6/month for plausible or similar.

<comment> munk-a Your choice is, of course, your choice, but I'd strongly suggest GA for this use case. I understand and agree that Google is in fact evil and we should avoid feeding the beast, but a hobby website using GA is too minor to care about for any of the privacy reasons the author states and if it's fully static pages then ideally the performance will already be light enough that the bloat of GA isn't going to make a difference.

<comment><USER16> I have a blog hosted on GitHub pages, and I only want to know what pages are viewed the most. Before using GA, I have considered multiple alternative. For self-hosted alternatives, I don't bother to use it because I don't want to maintain a server just for my blog. As for other paid hosted alternative, I avoid them because I want it to be as cheap as possible. So I eventually choose GA, but in a different fashion, because I do care about its bloat. I simply write a short JavaScript using Measurement Protocol[1] to only send pageview to GA, which works very well for me.

[1]: [https://developers.google.com/analytics/devguides/collection...](https://developers.google.com/analytics/devguides/collection/protocol/v1)

<comment><USER13> I was in the same situation and ended up using GoatCounter (see one of the top level comments in this thread).

</comment></comment></comment></comment><comment><USER17> Yes! I've just removed GA from one of my pet projects (shameless plug [https://golang.cafe](https://golang.cafe)) - And started using Cloudflare NS [https://www.cloudflare.com/dns/](https://www.cloudflare.com/dns/). Now I get users/analytics reports at DNS level. No bloated JS trackers, no privacy policies and weird stuff and I can track visits even when adblockers are enabled. This would definitely be overestimated as bots would be counted in but it seems pretty accurate so far! It also has unique users count (although this is overestimated)

<comment><USER18> I assume you mean you are running the whole site through the cloudflare proxy, not just DNS. You cannot get that advanced of DNS metrics by just using them for DNS.

<comment><USER17> I use cloudflare as nameserver that effectively takes over all DNS queries for my domain

<comment><USER18> I get that, but you don't get more information than number of DNS queries - nothing about users

</comment></comment></comment></comment><comment><USER8> Why dont they just title this "why we made plausible.io?" Make it clear up front that this is content marketing. It would still be a worthwhile read but it wouldn't be nearly as sleazy feeling as disguising an ad as a blog post type thing. I think a lot of people on this forum would enjoy reading about how the founders approached the problem and what they see as the solution, either out of curiosity about new tech being developed or to evaluate the product by reading about what the founders were trying to fix with competing solutions. This just doesnt read as an honest marketing attempt.

</comment><comment><USER19> If you're going to tear down a competitor's product and shill your own you should probably be up front about it.

<comment><USER20> I think that if a blog shilling a company/product is hosted on said company's website, they're already sufficiently up-front about it.

<comment><USER19> I really don't think so, I've never heard of this company I didn't know what they sell. I had to poke around the website and read the comments here to realize. That's really the exact opposite of being up front.

<comment><USER21> I've never heard of Plausible either but the instant I browsed to the article I suspected they were a competitor. I skimmed the table of contents and saw the last item was recommending a product with the same name as the website, and my suspicion was confirmed. They're perfectly up front and obvious about it, not hiding anything.

<comment><USER19> >They're perfectly up front and obvious about it, not hiding anything.

Wtf, this is the opposite of "up front." You had to poke around and figure it out yourself based on a suspicion. Up front means that they just tell you, no figuring out required.

<comment><USER21> I didn't poke around. I knew by the time I finished reading the Table of Contents, before I even got to the content.

Even if they had said in their very first sentence of the content "Disclaimer: We are a competitor to Google Analytics", I would have already known before that.

It's blatantly obvious, they didn't need to spoon feed me. This isn't some submarine article.

[http://paulgraham.com/submarine.html](http://paulgraham.com/submarine.html)

<comment><USER19> Your comment reminds me of this: [https://rachelbythebay.com/w/2018/04/28/meta/](https://rachelbythebay.com/w/2018/04/28/meta/)

>"I am THE ONE. You only need to know me. I am better than all of you."

<comment><USER21> All the examples given in that article are people belittling complex programming tasks. But this was just a simple a reading comprehension and logical deduction task, not even remotely in the same league.

But maybe to you this was a similarly difficult task, so I apologize if I was being insulting by belittling it. Sorry!

<comment><USER19> Wow what a pretentious person you are.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> > These two tracking scripts combined add 45.7 KB of page weight to each and > every page load.

Which is only true is there is no caching and I highly doubt that these files are configured not to be cached after the first load

<comment><USER23> The Google Analytics script itself, analytics.js, is cachable and cached.

By design, Google Tag Manager and gtag should not be cached. The behavior of those scripts can be configured from wizard interfaces, and there is an expectation that published changes take effect immediately.

Also, all of these scripts are deeply and thoroughly asynchronous. They are designed not to impact site speed. Not to say that they can't or won't (I've seen GTM do horrendous things when used improperly), but I would trust an actual timing metric over a file size metric.

</comment></comment><comment><USER24> It seems like plausible is a GA competitor (and I didn't see disclaimers, but could have missed them). It seems very clean and well thought though!

</comment><comment><USER25> The biggest drawback to not having Google Analytics on your website is if you choose to run Google Ads for your site and you have to retarget/remarket on Google properties. Without Google Analytics you are out of luck as you can enable remarketing only in Google Analytics (and you would need Analytics linked to Google Ads). If you have a personal website or a business that grows organically without needing to use Advertising then you can go ahead with any analytics provider of your choice. But the value add provided by using Google Analytics far outweighs other negatives from a business point of view.

<comment><USER26> don't run google ads either

<comment><USER25> That is not an option if you are a profit driven enterprise. There is no alternative that is as good/optimized as Google Ads is. You are literally bidding on search intent.

<comment><USER27> I find that for information search intent is a poor pre-qualifier for sales leads.

<comment><USER25> Evidence says otherwise. Hard data shows that conversions happen the most through these advertising networks. Can't deny the obvious. Unless you want us all to go back to the pre-Internet era where we cold called clients and vendors with a hope of getting leads. We have technology for a reason. Not all tech is bad. Not all advertising is bad either. It is the intent that matters.

<comment><USER27> Perhaps I wasn't clear.

 _Information_ search. The last time you looked up how to do something, for example, you bought a product off of a Google ad?

What do you define as a "conversion?" I specifically said "sales." People in the ad biz want to define "conversion" as something else- but those of us paying for the ads want to make a sale. If somebody (or a bot) who has _no intention of buying_ clicks on the ad it's a mistake for both of us. Yet with Google anyway, any attempt I make to keep people from mis-clicking (by putting a price in the ad, for example, to indicate up front that if you're looking for free this is not your link) earns me a penalty by reducing something deceptively labeled as my "quality score."

I would love to see the numbers you are referring to, though. Maybe something would occur to me to help me see how to navigate the mess.

</comment></comment></comment></comment></comment></comment><comment><USER28> "Here are completely legit reasons to stop using Google Analytics." <gains credibility> <gains more credibility> <gets me thinking about switching to something else>

"Try our product instead!"

<closes tab in disgust>

</comment><comment><USER29> We use Simple Analytics [[https://simpleanalytics.com/](https://simpleanalytics.com/)] as alternative to GA and it's also privacy-friendly.

I saw Plausible appeared after Simple Analytics launched their product. I'm glad to see GA alternatives becoming popular.

</comment><comment><USER30> Not sure who makes Plausible, but if the "live demo" is reflective of the actual product, it's sorely lacking. The reason that GA so popular is because of the free tier, sure, but also because GA 360, the really amazingly expensive version, has features that let you really get insights about your visitors.

Here's a popular question these days: "when can I stop supporting IE 11?" With GA, the answer comes in a couple of clicks; revenue generated sliced by browser version. I don't even see the revenue generated section of Plausible, or really any way to associate any metadata with custom events. GA gives you this functionality without any coding.

If you don't want to use GA, try something like Amplitude, which has a lot more data manipulation options than Plausible.

</comment><comment><USER31> What do people suggest if you have a website that sells something?

Knowing where your traffic is coming from, if your new redesign helped or hindered users in finding content, and knowing which traffic sources result in the most sales sounds business critical to me.

I've seen lots of situations where when we look into analytics, it becomes obvious users are having trouble finding content or don't know the content is there to be found (e.g. putting an important link behind a navigation menu was a bad idea).

I feel people can overly focus on the more manipulative side of A/B test, but analytics is useful for improving your UX as well. Not everyone runs a personal blog without a care for monetisation or viewership either.

<comment><USER32> You can look over the product I'm building (self-hosted analytics): usertrack.net. It's not free though.

</comment></comment><comment><USER33> Does using cloudflare counts in as well? I've been using cloudflare for some time now, because I've wanted to save some of my static website bandwidth & it offered https setup pretty easily. I've setup google analytics just to compare visitor statistics and this is what I've found over 1 month:

GA unique visitors: ~350 Cloudflare unique visitors: ~2900

So the difference is pretty overwhelming - I assume that cloudflare count some bot traffic as well or something?

Is it even a reliable source of stats (cloudflare)? If not, why?

</comment><comment><USER34> Is this an ad?

<comment><USER35> Yes

> Give Plausible Analytics a try Plausible Analytics is built with simplicity, > speed and privacy in mind. We've used Google Analytics for years and > understand its pitfalls

</comment></comment><comment><USER36> If this is your personal website, one option to consider is dropping the analytics completely. Do you really need to know exactly (and it's not even that exact, since people block or can't load your analytics) how many people viewed your blog posts? Anecdotally, if you put your email at the bottom of the page you'll get a pretty good idea just from the number of people who send you one.

<comment><USER37> > Anecdotally, if you put your email at the bottom of the page you'll get a > pretty good idea just from the number of people who send you one.

You can't be serious. Who in this day and age reads an article and thinks "Hmm, that was useful, I'll send the author a note of thanks"?

This might have been the case in 1995 when there were only a few websites around, and Internet use was considered leisure time and not part and parcel of everyday life.

<comment><USER38> > Who in this day and age reads an article and thinks "Hmm, that was useful, > I'll send the author a note of thanks"?

I do. Maybe you should, too?

<comment><USER5> For what it's worth I find it minorly annoying when people send me emails about my posts. I'm happy for people to comment on them, but typically an email is an invitation to have a private discussion and I'd much rather talk publicly ([https://www.jefftk.com/p/comment-dont- message](https://www.jefftk.com/p/comment-dont-message))

<comment><USER38> You may get more comments/emails than I do. I think I've gotten 3 worthwhile comments and 2 emails in the 8 years my blog has been active. I actually turned comments off, because I was getting thousands of spam daily, and that seems like a waste of everyone's time.

<comment><USER5> I host my comments externally. For example, [https://www.jefftk.com/p/mosh](https://www.jefftk.com/p/mosh) is currently on the HN frontpage as [https://news.ycombinator.com/item?id=22810589](https://news.ycombinator.com/item?id=22810589), and I think of that like my comment section. I have my blog pull in the comments from there: [https://www.jefftk.com/p/mosh#hn-22811119](https://www.jefftk.com/p/mosh#hn-22811119)

I also pull comments from LessWrong and Facebook, though the FB comment integration is pretty temperamental.

<comment><USER36> Is there a way to comment on your post if it's not been posted to Hacker News/Facebook/LessWrong?

<comment><USER5> I post everything to FB and LW. If you want to comment on HN and you think it's a post that's relevant here you could submit it?

<comment><USER36> I don't submit things to Hacker News :(

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> Congratulations on getting your subtle advertising on the front page. I admire your restraint in only mentioning your product at the conclusion of a long article - nicely done!

That said, you state what many have been been saying for years - GA is overkill for most sites and gives a stupid amount of information to Google. But sites are giving up their users information to any 3rd party analytics package, not just GA.

Hosting your own analytics is the only ethical way to go, unless you really, really need the demographic data that GA provides (which you probably don't).

Having passive feedback that people are actually reading your posts is nice but a simple hit-counter would probably do the job and relieve your readers of losing another little slice of their privacy.

I'm going to take a leaf out of the poster's book and mention my own project in passing: [https://sheep.horse/visitor_statistics.html](https://sheep.horse/visitor_statistics.html)

</comment><comment><USER40> The million-dollar question: will removing GA hurt my search raanking?

<comment><USER37> No. Hacker News does not use GA. Yet it ranks at the top for many searches.

<comment><USER36> Hacker News also happens to have a monopoly on certain search terms ;)

</comment></comment></comment><comment><USER41> Google Analytics data isn't tied to ad targeting. Google doesn't profile you based on data from sites you visit with GA.

<comment><USER42> According to google, it is:

 _"Google uses the information shared by sites and apps to deliver our services, maintain and improve them, develop new services, measure the effectiveness of advertising, protect against fraud and abuse, and personalize content and ads you see on Google and on our partners' sites and apps"._

<comment><USER23> Disclosure: Google Analytics consultant. Not a Google employee, but my bread is very clearly buttered on one side here.

The article's use of that verbiage is deceptive. I think it's not actually a lie, but it's misleading.

When you use the Google Analytics product, Google is a _Processor_ under GDPR and a _Service Provider_ under CCPA. They are contractually bound not to process that data beyond providing the service to you, which is dashboards. It is illegal for them to dip into this data for their own purposes without additional authorization from the customer. (Note that in contrast, when you include a Facebook share button, Facebook is a Joint Controller and not a Processor.)

Sharing Google Analytics data with Google is _possible_ but _optional_. It's fairly easy to do and encouraged (it enables certain features), but those checkboxes have big legal terms next to them that tends to give people pause.

In particular, the Advertising Features setting allows Google to make a connection between Google Analytics data and Google Ads or DoubleClick data.

<comment><USER43> This is a really good point. It's very disingenuous of the parent article to not mention that. Google being a _Processor_ of data removes their ability to use this data for targeting and profiling.

<comment><USER44> It may remove legal basis for using the data, but it certainly doesn't remove their abilities.

<comment><USER41> The implication here being Google might be conducting a massive illegal conspiracy to mine data they don't have rights to use? I do not buy it.

<comment><USER43> Especially given the multi-billion dollar fine if they were caught.

<comment><USER42> I agree they probably aren't doing it, but there is almost zero chance of a multi-billion dollar fine.

They'd just explain it away as an error and be given a few million dollar slap on the wrist.

It would be very easy for Google to make a plain language public statement about this and clear things up, the way Apple goes about their privacy/data handling.

It's not a good sign that they choose not to.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER45> The correct proposition instead would be to stop analytics on your website, period. There's many sites that benefit greatly from the insight, but I'd argue they're a minority. Your personal blog doesn't need analytics. Let's be honest, for many people, analytics is just a way to feed their ego — my ramblings reached 100 people, so you could say I'm kind of a big deal. Google is, obviously, very well aware of this target market, and tries to feed back into this loop as well. It's not without reason you get weekly summaries and more into your inbox by default. The reality, of course, is that it's serving them while hooking you, much like social media notifications driving engagement etc.

<comment><USER46> With any website it's important to know how many visitors it is receiving. In the context of a blog knowing you're getting a lot of traffic can motivate you to publish more content and knowing more about your visitors can also feed into what sort of content you publish. You could look at your server logs, of course, but analytics is easier to set up and gives you higher quality data than something like AWStats. Since Google lets you opt out of sharing your data with them I don't see much argument against using it.

<comment><USER47> How does embedded script provide better data? You mean if the page is delivered from network cache you still get analytics or something else?

<comment><USER46> By filtering out bots and giving you the number of visits rather than just pageviews, and also giving you data on things like screen resolution and time on page that can only be retrieved in javascript.

</comment></comment></comment></comment><comment><USER48> Plausible was hovering less than 50 users on its own web site, and I wouldn't risk sending my visitors to this relatively new web service either.

Analytics requires a lot of trust to not screw you up. It's a third party script that you add in pretty much every page of your web site. I'm still looking for a provider that I can tame with CSP rules, and comes with the most minimal things I need to know. A pixel tracker would have suited majority of us.

<comment><USER49> You can self host your own analytics, like matomo. [0]

[0]: [https://matomo.org/](https://matomo.org/)

</comment></comment><comment><USER50> "Nobody was fired for using Google Analytics" (c) Is financial burden to change any part of your product, including GA, and 99.99% of all companies in the world don't give a damn about users of their products, so it will never happen unless some global power restructure happens and Google will fall out of grace. And even then most likely it will be simply replaced with even worse GA-2.

<comment><USER51> I would say that 99.99% of businesses _do_ give a damn about their customers. And particularly they care about their customers' preferences as demonstrated by their economic behavior. Very few customers care whether a business uses GA enough to change their purchasing decisions. Businesses therefore rightly view the decision as neutral with respect to customer preferences.

<comment><USER50> That customer model is a mental construct of said companies. Just because customer does not proactively ask/request/mention something don't mean that he doesn't care about this. People implicitly assume that their personal information is not used for malicious purposes, despite that it is not true anymore for most of the companies. And in the era of monopolies/doupolies customers don't have vote with their wallet anymore, unless going full luddite and live in a cave.

<comment><USER51> So, a few objections. Most sites that use Google Analytics are not owned by monopolies or duopolies, so that aspect of your comment does not really apply. I also don't know if your claim r.e. malicious purposes is true. Probably depends on whose definition of malicious you're talking about.

> That customer model is a mental construct of said companies.

Well enough, but as I said, it's the one they care about. You seem to have a dualist view of customers where there are some things they care about that do affect economic behavior, and others they care about but which do not affect their economic behavior. I don't buy that model. I prefer the monist model where in competitive markets the customer expresses the totality of their preferences through economic behavior. I know it's incorrect, like all models, but I think it's least incorrect.

I doubt there's more than a tiny fraction of customers that even knows the existence of Google Analytics. Of them, only a small fraction of those has any idea of its capabilities. And of those customers, only an even smaller fraction even checks whether a site is using it before deciding whether to shop. The notion that a large fraction of customers care about the use of GA just doesn't fit with these other observations and conjectures. Please correct me with data if you think I'm wrong.

And anyway, whether you're right or me, the monist model encompasses everything companies have any incentive to care about, so it's the one that will be used to drive decisions. It's also the one that we can use to predict company behavior.

<comment><USER50> I suspect that we won't agree on global and complex issues like GA or surveillance (metadata = surveillance after all, see (1)). But I want to discuss more specific issue - "monist model". I disagree that defining what people buy is approximately what people want. Yes, it is in some narrow scope, but that is not all. I can't buy what I want if it doesn't exist, right? And is I buy picking from two set choices while I want some thing different doesn't mean that I wanted what I bought. Example - I have Android phone, but I don't want it specifically, I don't want a gadget filled with permanently enabled Google surveillance. But the alternative is only one - Apple, slightly less but still about the same. The only reason I'm buying them is because I want convenience more than privacy and I'm only human after all. People don't know about GA, 99.9% don't know. But they do know about their home address or credit card number or SSN or photos. They just don't have proper information to connect all these links.

(1): [https://www.schneier.com/blog/archives/2014/03/metadata_surv...](https://www.schneier.com/blog/archives/2014/03/metadata_survei.html)

<comment><USER51> Just a minor clarification. When I was speaking of customers, I was speaking in aggregate. I'm not making a claim that all individual customers are having their expressions adequately expressed by their purchasing decisions.

</comment></comment></comment></comment></comment></comment><comment><USER52> How is this different than Fathom? ([https://usefathom.com/](https://usefathom.com/))

</comment><comment><USER53> I really dislike the user experience of GA. I literally know 1% of the functionality it offers and I only _need_ 1% of what it offers. But I do like that it's free. Was planning to one day give [https://simpleanalytics.com/](https://simpleanalytics.com/) a shot.

<comment><USER37> GA is complete overkill for hobby websites that get ~100s of visits/day. If you have a commercial website selling stuff, or conduct A/B testing, or have marketing channels funnelling traffic to the site, then you pretty much have to use something like GA or Adobe Analytics.

<comment> munk-a I'm actually of the exact opposite opinion - for the majority of websites just shoving GA on it and calling it a day is quite sufficient... It's only if your website really lives and dies by making sure users are hitting the important components and converting into paying customers that a more feature-full analytics tool may be valuable.

</comment></comment></comment><comment><USER54> I like that they gave some alternatives.

With the web there are a lot of crusade like topics that while technically correct the maelstrom of finger waving blog posts really don't seem to change much and few really offer workable solutions to accomplish the goals that doing the thing they don't want you to do accomplishes.

<comment><USER38> One alternative that should be seriously considered is not having analytics at all. I don't doubt that they're useful for many people in many situations, but consider whether they're useful to _you_ in _your_ situation. When was the last time you look at analytics? What did you learn from it? What actions did you take? Are you really gaining anything from them? I think most personal blogs, for example, gain nothing from having analytics running. In fact I'd argue almost all non-commercial activity has no reason to gather analytics.

<comment><USER55> If you don't care if people are reading your blog, why bother posting it online at all? Why not just blog into a local Word document, like the character Creed on "The Office"?

If you do care whether people are reading what you write, then analytics is the obvious way to find out.

<comment><USER38> I think "analytics" and "traffic stats" are different things.

<comment><USER55> Traffic stats are a subset of all possible analytics you can gather about a website.

But even if all you want are traffic stats, a client-side analytics package is still a better way to gather that information.

Google Analytics--and similar client-side analytics packages--supplanted server-side log analysis for a reason. It's much easier to implement, and gives you much more accurate counts of real people visiting your site, as opposed to spiders, bots, scripts, and other automated traffic that doesn't matter.

</comment></comment></comment></comment></comment><comment><USER56> No I won't. It is free and fine.

</comment><comment><USER57> What are good self-hosted alternatives? Something like Webalizer, but a bit more modern.

<comment><USER58> [https://goaccess.io/](https://goaccess.io/) ?

</comment></comment><comment><USER59> For those interested, my own solution to this was to use AWStats with an anonymization script [1].

It provides high-level analytics such as unique visitors, referring sites and most viewed pages, without having to store any personal data such as IP addresses, and it's 100% server-side.

IP addresses are compared against a Bloom filter in order to count unique visitors, without actually permanently storing them.

[1] [https://gitlab.com/jamieweb/web-server-log-anonymizer- bloom-...](https://gitlab.com/jamieweb/web-server-log-anonymizer-bloom- filter/)

</comment><comment><USER60> >Google, the world's largest ad-tech company, [...]

This is kind of snarky, especially in the light that the author is writing this post solely to sell something in competition with Google.

</comment><comment><USER61> Their own analytics dashboard is public: [https://plausible.io/plausible.io](https://plausible.io/plausible.io)

<comment><USER62> And it's really interesting: see the HN effect!

</comment></comment><comment><USER63> I liked it when you announce it's open source till I checked your Github page:

> At the moment we don't provide support for easily self-hosting the code. > Currently, the purpose of keeping the code open-source is to be transparent > with the community about how we collect and process data.

So basically you ask people to work for free on something only you can use? No thank you.

</comment><comment><USER64> I wrote a blogpost about webanalytics and authentication. [https://www.mathieupassenaud.fr/webanalytics_enemy/](https://www.mathieupassenaud.fr/webanalytics_enemy/) Using "authorization code grant" is not as secure as we imagine with those kind of analytics

</comment><comment><USER65> I'm also working on an analytics & A/B testing tool ([https://splitbee.io](https://splitbee.io)). The big difference is that it needs to pin unique users for A/B testing. It is a mix out of mixpanel & google analytics & optimizely!

</comment><comment><USER66> The first reason is about Google being evil. They may well be. However unless your alternative is as good, or better or has a unique selling point that GA doesn't have you will find people won't use it.

Don't tell me about how your competitor is bad. Tell me what you offer in comparison to your competitor.

</comment><comment><USER67> Posthog.com is another solid option for privacy-focused analytics. They too have a self-hosted version

</comment><comment><USER68> If you have access to an AWS account, you can host your own website statistics with very little costs. That's why I built [https://ownstats.cloud/](https://ownstats.cloud/) Would love to get some feedback.

</comment><comment><USER69> These posts are the trash of the internet. Why?

This post...

1 - Fails to explain until the end that they are a competitor writing a "bash" piece

2 - Gives conclusions based on incomplete data and comparisons (website speed is barely affected by 45kb these days, many websites have much bigger reductions on multi-mb loads)

3 - States giant scary click-baitish claim in bold and then in smaller print gives the real story. "It's a liability..." to "it is a potential liability"

4 - Gives a false sense of "many reasons" ("It's a liability" and "It uses cookies" are the same complaint)

5 - States opinions as facts ("It worsens the UX...") -- it might, but the vast majority of websites use cookies, and so this doesn't add anything that you wouldn't have to deal with anyway.

</comment><comment><USER70> Those looking for more ethical alternatives to the Spyware you're using see [https://switching.software](https://switching.software).

</comment><comment><USER71> Can you be penalized for not running Google Analytics? If you have a website with no analytics or non-Google analytics, will your Google ranking be worse?

</comment><comment><USER72> Slightly off-topic, but are there any analytics for open source projects?

Even if they require the actual data to be public (which would actually be pretty nice)

</comment><comment><USER73> "It's owned by Google." Who knew!?

</comment><comment><USER74> Thanks but no thanks And stop using this type of advertisement to your products.

I would rather stick to GA.

And, you never pay for analytics on personal website.

</comment><comment><USER75> What's the best server-side only, self-hosted analytics platform if I don't want to add any JS to the front-end?

Running nginx here

<comment><USER76> In my opinion there are no longer any really viable server side analytics/log processing that's equivalent to what you get with GA unless you want to either install some kind of server with a ton of features and dependencies or use a tool that will most likely also require the use of js.

The amount of crawlers, botnet spam, hacking or scanning activity and other non-visitor related hits you get these days will require a lot of filtering, updating spamlists, blacklisting, etc and you'll probably end up spending more time tweaking your webserver and analytics setup than actually gathering any relevant information from said analytics.

That said, the "old" log processing tools like AWStats, Analog, Webalizer, etc are still available although I'm not sure if they've been kept updated. I'm sure there is also a lot of more competition on self hosted tools that try to replicate what GA does but I'm not that familiar with any either.

<comment><USER75> This is helpful, thank you.

You mean to say that spambots don't respect robots.txt??

Good to think about. I'll check these out and see what they've done (if much) to mitigate that issue. I'd imagine that would need to be front and center, unless they're focused more on internal services.

</comment></comment></comment><comment><USER77> I've been relying on Cloudflare lately for analytics. Gives me a rough idea, and "good enough".

<comment><USER53> Oh, nice. I didn't think of this. But good idea. I'll look into their analytics.

</comment></comment><comment><USER78> Is that Tailwind UI that you're using? First time I've seen that in the wild in that case!

</comment><comment><USER79> For the average modern website, how much load time does shaving off 44kb save?

</comment><comment><USER80> Looks nice. Is the account multiuser with separation between sites? If it is, it's a service I'd consider throwing into my maintenance packages as an added value. Most clients don't need the complexity of Google Analytics and with GDPR the data is increasingly out of line with reality, given we load GA based on consent.

<comment><AUTHOR> Thanks! At the moment, it's one user per account. However, you can create password-protected links to share the stats with your clients. Each link/password combination only gives access to the stats for a single site without having to create an account.

</comment></comment><comment><USER81> everyone hating on this in the comments, yet it's getting upvoted. Silent support is a bit annoying. I'd also rather not be told what to do with these titles "Stop doing this, etc"

sigh

</comment><comment><USER82> Or Matamo. Its free and I've found it to be excellent.

</comment><comment><USER83> all of these alternatives which people are posting: simpleanalytics.com plausible.io are not free, which is the main reason people use Google Analytics

</comment><comment><USER84> >It's a bloated script that affects your site speed Once I removed GA, the speed increase was surprisingly very noticeable. That alone was enough for me to keep it off.

</comment><comment><USER85> How does this compare to SimpleAnalytics?

</comment><comment><USER86> Stop using Google Analytics and pay for your project? Sorry. I'm not convinced by the logic.

</comment><comment><USER87> Segment integration?

</comment><comment><USER88> If you're so concerned about GDPR, probably hotjar is a good choice. It's free for personal use and it's all EU based.

</comment><comment><USER89> I stopped reading after the words "surveillance capitalism".

</comment><comment><USER90> Take this post with a pinch of salt... Out of the 10 points made, I'd argue only 2 are actually valid and another 2 are "technically correct but..."

      It's owned by Google, the largest ad-tech company in the world

Yes. Google provides a free service and in return gets a view into your traffic. Very fair point, but not terribly controversial IMHO

      It's a bloated script that affects your site speed

Um, not really. I'm a big web performance advocate but 45.7KB of JS is small for the service provided. You do not need to use Google Tag Manager either so if you care you can reduce the JS footprint to 18KB.

      It's overkill for the majority of site owners

Yes. I'd agree with this. You probably do not need it if you are not a business.(Given the source of this point I'm guessing they do not offer most of the features of GA)

      It's a liability considering GDPR, CCPA and other privacy regulations

Hard disagree. You can limit PII in GA to large degree like not gathering full IP address, and reduce logging.

If GA is your only reason to have a Consent option then fine, its a burden to do. However if you have any other analytics or services that use cookies its a minor check-list item to cover this.

      It uses cookies so you must obtain consent to store cookies

They are repeating their previous claim in a different form here... skipping.

      It's blocked by many plugins and browsers so the data is not very accurate

Technically correct, but you don't need highly accurate data to make product decisions. GA does sampling after a certain threshold anyway.

      It requires an extensive privacy policy

No. It does not. You should acknowledge it and talk about why you use GA and you can link to GA's privacy policy. Plenty of boilerplate text you can copy to cover this if you really care.

      It's abused by referral spam that skews the data

Maybe your experience if different but this is hardly a problem worth noting. Certainly not a GA specific issue.

      It's a proprietary product so you need to put your trust in Google

Yeah. Same with any service you use, but ok.

      It worsens the user experience due to the necessity for the annoying prompts

Again, most 3rd-party services on your site mean you need to go this path. There are good and bad ways to do this.

I'm sure this service is worth trying. I would also recommend looking at Simple Analytics: [https://simpleanalytics.com/](https://simpleanalytics.com/)

<comment><USER42> If it weren't controversial nobody would be discussing it.

<comment><USER90> Not sure how you draw that conclusion. Its made to sound controversial (by a would-be competitor).

My point is that it is really not when you look below the surface.

</comment></comment></comment><comment><USER91> As someone who still uses GA for multiple sites, can we actually discuss the claims of the article and not the broad idea of it?

> " > These two tracking scripts combined add 45.7 KB of page weight to each > and every page load."

Google makes fantastic products that are available for free (with limits) because they make most of their money from ads. I may not like it, but gmail, Drive, YouTube are all great and I would prefer people who can't pay for such products have the free option.

> "It's a bloated script that affects your site speed"

As others have said, no? Not with caching? Anyway my websites are probably bloated by all sorts of bigger things, I am no web dev and have had no time to optimize them overmuch, and the still work fine. So guilt tripping me about GA Analytics aint gonna work.

> "It's overkill for the majority of site owners"

I like having the flexibility ; I seriously doubt this is a good pitch for any growing company or even project.

> "It's a liability considering GDPR, CCPA and other privacy regulations"

Is it? It's not like Google is not addressing GDPR concerns ([https://www.cookiebot.com/en/google-analytics- gdpr/](https://www.cookiebot.com/en/google-analytics-gdpr/))

> "It uses cookies so you must obtain consent to store cookies"

Okay, finally a good one -- nobody likes the cookie popup, so removing GA analytics would improve user experience. Then again, it's so common that people maybe are used to it?

> "It's blocked by many plugins and browsers so the data is not very accurate"

'There's no definite answer on how many people block Google Analytics as that depends on the audience of your site, but for a tech audience, you shouldn't be surprised to see 50% or more of the visitors blocking Google Analytics.' Really? I kind of doubt it..........

> "It requires an extensive privacy policy"

Any analytics should have privacy disclosure, presumably.

> "It's abused by referral spam that skews the data"

And other analytics aren't?

> "It's a proprietary product so you need to put your trust in Google"

Fair, Open Source is preferable.

> "It worsens the user experience due to the necessity for the annoying > prompts"

A repeat

\</comment><comment>-----

So yeah. Look, I am uncomfortable with big huge giant companies like Google ruling the earth. But I also have quite limited time and money, and already use gmail and Drive. So far Google has not done anything to seriously hurt my trust and I think their products are excellent. Most of these points seem weak to me, as someone already using GA analytics.

Still, for someone building a new website, I could see this being enough to make the point. But, I think it would be far more effective if it was more concise and less easy to point out holes in the arguments.

</comment><comment><USER92> GA can't really be replaced easily.

There is an army of web consultants ready to help you set up and track your marketing with GA, and just as many marketing consultants that can only work with GA.

While it's nice that someone works on alternatives—although I don't really see anything wrong with GA—it's here to stay.

Reminds me of Excel, people have been trying to replace Excel for 20 years now.

</comment><comment><USER93> Great if it's not written in some sort of exotic language and just in php. Don't get me wrong I'm not a fan of php but if it's written in php it would be run anywhere but not only on your private special configured VPS.</comment>


Hacker Who Sent Me Heroin Faces Charges in U.S - <AUTHOR> http://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/ <comment><USER4> One thing I'm curious about with stuff like this is how some of the information gets given to the authorities and how it's allowed to be used in court. I imagine I can't just walk into my local police station, file a report, and go "so I have this illegal copy of a database that let me illegally access someones email account that contained illegally acquired information ...". Wouldn't that be inadmissible in court even if the police did accept it and act upon it? And doesn't it expose me to potential legal problems as well?

<comment><USER5> This is a common misconception. The fourth amendment only limits the actions of the state, and case law establishes how evidence is excluded from trials. So, if I break into my neighbor's house and find child porn on his computer, that evidence is admissible in court. But if the police break into my neighbor's house without a warrant and search his computer, it isn't admissible, because it's a fourth amendment violation. But if they have a warrant to search the computer, it is admissible. If the judge who issued the warrant made a mistake and shouldn't have issued the warrant, the evidence is still admissible. This last situation also surprises people.

<comment><USER6> Surprising that a judge doesn't make a mistake all the freaking time. The legal system is a religion, it has little basis in reason.

<comment><USER7> Think in terms of branches of government. The executive branch investigates crimes, and the judicial adjudicates them. The exclusionary rule is designed to punish the executive branch for abusing the Fourth Amendment. But if it's the judge that's mistaken, it's the judicial, not the executive, at fault, and the incentive behind the exclusionary principle ceases to exist.

(If it helps: the US's exclusionary rule is significantly stronger and more consistent than those of European countries, particularly the UK.)

<comment><USER8> Doesn't the fact that a judge's career depends on promotion by the executive branch create such an incentive?

<comment><USER5> It's more complicated than that... in order for the judge to abuse the system this way, the police would have to be acting in good faith, but still bring a groundless request to the judge, who would have to figure out that the warrant was groundless but decide to issue it anyway. That's a pretty unlikely scenario.

Here's a comic about the 4th amendment: [http://lawcomic.net/guide/?p=1604](http://lawcomic.net/guide/?p=1604)

</comment></comment></comment></comment></comment></comment><comment><USER9> '("cc" is a reference to credit cards)' \- CC (and MUXACC1) is not a reference to credit cards, it's a reference to the Tsetse Fly [https://en.wikipedia.org/wiki/Tsetse_fly](https://en.wikipedia.org/wiki/Tsetse_fly) which spreads Sleeping Sickness - [https://en.wikipedia.org/wiki/African_trypanosomiasis](https://en.wikipedia.org/wiki/African_trypanosomiasis) \- for whatever reason it's part of the Russian folklore used as a metaphor for something particularly nasty.

Edit: (thanks rnovak!) apparently "cc" in thecc[dot]bz _is_ credit cards, though the CC in MUXACC1 is definitely a reference to Tsetse.

<comment><USER10> Uh, he's referring to thecc[dot]bz which is a carding forum, which literally refers to credit cards (and is _extremely common_ [1][2]). That excerpt is also nowhere near the MUXACC1 reference.

[1] [http://www.acronymfinder.com/Credit- Card-(CC).html](http://www.acronymfinder.com/Credit-Card-\(CC\).html)

[2] [https://books.google.com/books?id=lGC2AgAAQBAJ&pg=PT48&lpg=P...](https://books.google.com/books?id=lGC2AgAAQBAJ&pg=PT48&lpg=PT48&dq=cc+abbreviation+credit+card&source=bl&ots=P4wmfyHr6o&sig=mIBAEuNy4EoEW0VCdx9RR4fG9vc&hl=en&sa=X&ved=0CEMQ6AEwBjgKahUKEwiD3o_H5cfIAhUW0WMKHaz2ClI#v=onepage&q=cc%20abbreviation%20credit%20card&f=false)

</comment></comment><comment><USER11>
      Payment information contained in those emails — including
      shipping and other account information — put the happy
      couple and their young son in Naples, Italy.

I am not at all surprised they found him in Naples. That city is a festering breeding ground for scammers, fraudsters, mafiosi, Camorra, and every kind and type of unscrupulous person. I have never hated a city I've visited so much as Naples.

<comment><USER12> Season world traveler, and the only place I have been scammed was Naples. The waiter pulled the "show you the receipt then take it away."

I think I was out an extra 40 euro before I realized what happened.

Edit to explain the scam:

The waiter brings you the bill, and the price looks "reasonable" at first (maybe because humans are bad at money estimation). The waiter takes the bill away before you can inspect each charge and inquire. You pay and leave before realizing you were overcharged, and only as an afterthought do you realize.

<comment><USER13> Is the scam that they've added extra charges to the bill, and therefore don't want to give you time to read it?

</comment></comment></comment><comment><USER14> That's the problem when you're being hunted; you can't slip up even once. The people chasing you can make all the mistakes they want; you have to make zero.

</comment><comment><USER15> I've had to decide to face down evil before... I went forward and it landed people in prison. I know I did the 'right' thing, but I didn't sleep well until moving away and wiping my online identity. I salute your work and wish you the best.

</comment><comment><USER16> This statement has very serious implications:

        According to a trusted source in the security community, that
        email account was somehow compromised in 2013. The source said
        the account was full of emailed reports from a keylogging
        device ...

If I understand "security community" to mean law enforcement or intelligence agencies, that means they are sharing data from surveillance of private individuals with journalists.

This suggests that assurances about the security of that data and the integrity of their processes are not reliable. Who else is given this data? You may like Krebs and think it's justified, but who decides whose private data is ok to leak? What about your private data?

<comment><USER17> I'm not sure that I agree with your policework there. The "security community" here almost certainly refers to a private security researcher or firm. I can't see why it would have been a government source.

In general direct information sharing is one of the most important things in information security, but the government has its hands tied in this area in a way that private companies do not.

</comment></comment><comment><USER18> OP seems a bit naive, but I can't believe it given everything he's written. Of course the Fly won't send threats over mail, he knows everything he writes is being watched. I would be worried, however, that he somehow gets word to someone to exact his revenge, since he really has nothing to lose at this point.

<comment><USER19> I agree with you entirely.

Implied death threat (to him) sent to his wife from someone whom he has now gotten imprisoned who knows where he lives and confirmed it by sending a card... he seems awfully calm about all this and perhaps half-jokingly states he'll visit Fly in prison to meet him in person.

I'd be getting placed under a witness protection program (is this even applicable?) and relocate. Move somewhere that _doesn 't_ have risk of being burned down if Fly manages to contact anyone.

Anyone deep enough in the criminal scene has connections to people that can make bad things happen to other people for the right price. This isn't something I'd be posting about on a blog as if it's some sort of crime detective story... his life and his wife's life could potentially be in danger.

<comment><USER20> I doubt it, this isn't a drug cartel kingpin or mafia don we're talking about. He's just a troll.

<comment><USER19> Even low hanging fruits have connections. I think all the hush-hush on black markets creates as much danger as it creates safety in making such discussion taboo. The idea that only kingpins or the mafia have connections to hitmen is something that exists only in Hollywood media.

I guess thinking about it further, the 'good' news is that if the criminal was successful at what he did and had a couple grand to hire a hitman - <USER3> wouldn't have needed to crowdfund the heroin. So you're right in that it's more likely a small time, not-black-market-rich troll rather than someone more dangerous.

<comment><USER21> Let's not forget that getting someone in trouble and/or threatening harm/death are not the same thing as actually causing physical harm, and that is not the same as actually causing death. Just because someone is part of the underworld doesn't mean they have no qualms about ordering someone's death, and the only thing holding them back is the money.

<comment><USER19> Revenge is one of the most powerful motivators for murder and can turn otherwise good people into hot-blooded killers [0-5].

Few people would kill indiscriminately, but if you give them a powerful enough motivation? They'll have no qualms taking a life. This guy has had his life ruined, I doubt his marriage will survive this, and he'll be spending a good portion of his life in prison in a foreign country. Furthermore, he gets to be humiliated not once - not twice - but _thrice_ by Krebs. That's a lot of motivation to get back at a guy and it would be foolish to not even entertain the _thought_ that he may seek revenge.

I could link to _hundreds_ if not _thousands_ of stories about revenge killings. Hell - it's such an old motivator it's featured in many parts of Greek and Roman mythology.

E:

Ignoring that the reason the Witness Protection Program even exists is to protect peoples' lives after they ruin a criminal's life.

[0] Possibly NSFW ; no gore but someone dies: [https://www.youtube.com/watch?v=_PUE8fYxjq8](https://www.youtube.com/watch?v=_PUE8fYxjq8)

[1] [http://www.theguardian.com/uk-news/2015/aug/12/ex-ira- gunman...](http://www.theguardian.com/uk-news/2015/aug/12/ex-ira-gunman-shot- dead-in-apparent-revenge-killing)

[2] [http://www.dailymail.co.uk/news/article-3009762/Man-gets- lif...](http://www.dailymail.co.uk/news/article-3009762/Man-gets-life-without- parole-revenge-killing-girl-2.html)

[3] [http://www.nydailynews.com/news/crime/texas-dad-accused- murd...](http://www.nydailynews.com/news/crime/texas-dad-accused-murdering- drunk-driver-killed-sons-found-not-guilty-article-1.1919158)

[4] [http://www.dailypilot.com/news/tn-dpt-me-0711-van- sentencing...](http://www.dailypilot.com/news/tn-dpt-me-0711-van- sentencing-20150710,0,4320715.story)

[5] [http://indianexpress.com/article/india/india- others/nearly-4...](http://indianexpress.com/article/india/india- others/nearly-40-yrs-after-murder-revenge-killing-in-up/)

<comment><USER21> I'm not saying criminals don't kill people. I'm simply making a point about assuming all criminals are the same. There are plenty of white-collar criminals that have and will cause the death of innocent people and there are plenty of violent criminals that won't purposefully cross the line to killing a person.

If for no other reason, we should be wary about stereotyping criminals because what is considered criminal is sometimes quite arbitrary and can change quite fast. How many years ago was it a felony in some states to possess more than token amounts of marijuana, or to take part in sodomy?

<comment><USER19> What I think is dangerous is _confirming that he got the Xmas card_. Depending how that was sent, he has confirmed that he hasn't relocated his home and that puts him in danger. If Fly wanted revenge, he wouldn't want to hire a hit on the wrong house, now would he? Confirming his family is still in that house makes it a target for a hit or arson if Fly seeks revenge.

Even if Fly was not already a criminal - merely a troll - there are now seeds of revenge planted. He doesn't need to have been a criminal or done any criminal actions for him to want to seek revenge. People who are seeking revenge can be dangerous - to deny that is to ignore millenniums of history proving otherwise. While it has been pointed out this wasn't Krebs first and likely won't be his last - and that he's likely accustomed to such things. The danger is still there.

I am not trying to argue "because he is criminal, he will try to kill" I am saying "because he may seek revenge, he may try to kill". This has nothing to do with his criminality - and my bringing up his criminal behavior was more trying to shed light on "anyone can hire a hitman. they just need money and enough motivation to want someone dead." because it's a commonly held belief that only the rich and powerful (kingpins, political leaders, etc.) have connections or can hire hitmen.

The motivation aspect is covered by "revenge" and "need enough money" can be covered by "criminal activity".

Anyways, I'm done here. I hope he stays safe and I hope his confirming he got the Xmas card doesn't bring him or his wife/family(?) into harm.

<comment><USER21> I was responding specifically to:

> I guess thinking about it further, the 'good' news is that if the criminal > was successful at what he did and had a couple grand to hire a hitman - <USER3> > wouldn't have needed to crowdfund the heroin. So you're right in that it's > more likely a small time, not-black-market-rich troll rather than someone > more dangerous.

There's a couple ways to interpret that. One is that he didn't have money because he crowdsourced his scheme, which I think is fallacious on a few levels (e.g. maybe he crowdsourced it because it was a community rep thing, and he wanted to be seen organizing it). The other is that he only sent the heroin because he didn't have the money to hire the killer _which he would have if he had the money_ , which is how I read it. Perhaps you meant the former. but my replies were meant to address the latter. I don't disagree with any of your replies, but they are non-sequiturs to mine, likely because we are arguing separate things.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> A really interesting thing that isn't mentioned in the article, and I don't know that I've got all the facts right: is he being extradited to the U.S. for these crimes, while having never set foot in the country? Does that freak anyone else out?

</comment><comment><USER23> "I say to you againe, doe not call up Any that you can not put downe"

<comment><USER24> This sounds like advice never to begin farming.

<comment><USER25> As a farm boy who grew up on a wheat farm, at the end of the season after harvesting the wheat that we had "brought up" in the spring or the previous winter, we would plow the remainder under, bringing it down again.

<comment><USER24> There are people who will tell you that agriculture was just a giant mistake on the part of some enterprising hunter-gatherers, since it locked all of humanity in to agriculture forever.

</comment></comment></comment></comment><comment><USER26> _so I began looking through databases of hacked carding and cybercrime forums_

Where does one acquire these databases? Genuinely curious...

<comment><USER27> Read through Kreb's archive, he has screenshots and more info. If I remember correctly one was on the clearnet but required some sort of verification before you got access.

<comment><USER28> I've been a fan of Krebs for a while. He get's a lot of access and information from other hackers (that were pissed at another hacker) or security analysts. Gotta give him props though, he taught himself a lot, including learning Russian

<comment><USER27> I think one of his best features is his follow through too. Real good journalistic nose for following a lead.

</comment></comment></comment></comment><comment><USER29> Not to simplistically vilify an entire city but Naples is a horrible, horrible place.

</comment><comment><USER30> It's interesting to see the moral ambiguity in this, in the comments and in the article itself. Perhaps the comment with the rarest insight of empathy is the one by Matthew B.:

" _The people who conduct this type of crime often think of it as justified. After all, Americans are rich aren't they? How could it hurt them to lose some money? We are poor, if they won't share, we'll just take it. We will make them share!

They think of it as a game. A lucrative game in which they get to win over and over again. Even those of them who may be kind to their friends and even generous with those they love, don't really see their victims as people. Not being a member of their group makes the rest of us not quite human.

This type of tribal thinking isn't as uncommon as you might want to believe. I've seen it here in the US over and over during my lifetime. Most people who suffer from it don't consider themselves evil. They just consider the rest of us their lawful prey.

We tend to feel otherwise. Thanks for the great work Brian._"

What I find a bit crass is the sensationalistic complete disclosure of identity employed - going all the way to the classical mugshot. All of this will certainly not help for Fly's later reinsertion, say, when he decides to get a job in IT. And I'm not playing devil's advocate here, it just seems to me that the author is pushing aside his inner moral voice in order to write a more viral article. Justice is taking care of prosecuting the criminal, but let's push him further down if it can attract some pageviews. I suppose I'm simply being bitter about journalism, though.

<comment><USER7> You are complaining that Krebs doxxed a credit card scammer who tried to frame him for dealing heroin?

<comment><USER30> Framing someone for dealing heroin is criminal and morally terrible. The guy's certainly paying and going to prison for it, and for his other crimes. This is justice doing its job.

The question that I'm trying to ask is whether public shaming, especially to such a large audience, is really a civilized response. The consequences are also devastating, and reduce the possibilities of getting a second chance at life, something that I strongly believe in.

<comment><USER31> > whether public shaming, especially to such a large audience, is really a > civilized response.

This concept is also often referred to by it's more common name: "journalism"

<comment><USER32> I've been pondering this distinction lately. We recognize that doxxing, etc. are Definitely Bad Things but that's exactly what journalists have always done.

It's a matter of degree and intent, of course, but there's an awfully blurry line in-between.

<comment><USER31> The difference between "doxxing" and "journalism" can indeed get blurry every once and awhile[0], but it's usually not that hard to figure out.

Journalism is newsworthy and has the intention of informing people in the public interest, doxxing is typically not newsworthy or in the public interest and has the intention of harassment or intimidation.

[0] [http://nymag.com/thecut/2015/07/gawker-slammed-for-story- out...](http://nymag.com/thecut/2015/07/gawker-slammed-for-story-outing-conde- nast-exec.html)</comment></comment></comment></comment></comment></comment>


Debugging Fortran code with GDB – tips and tricks - <AUTHOR> http://undo-software.com/blog/debugging-fortran-code-with-gdb/ <comment><AUTHOR> We are used to using GDB for debugging C and C++ but it can also be used to debug other languages including Fortran, D, Go and Ada. The Undo team shows a simple example of how to debug Fortran programs, using features provided by GDB and gfortran.</comment>


Expatriate Americans Break Up With Uncle Sam to Escape Tax Rules - <AUTHOR> http://online.wsj.com/articles/more-expatriate-americans-break-up-with-uncle-sam-to-escape-tax-rules-1402972439 <comment><USER3> I wish the title of the article better reflected the real point - explained in the article itself - instead of saying "escape tax rules", with all the implications

The fact is, more and more of us with solid middle-class incomes and perfectly normal lives are becoming increasingly concerned about laws that are poorly explained and advertised to us, but with huge potential penalties if we go unaware of them. These are exclusive to people living in other countries - <USER2> they imposed some of these on non-expatriates, there would be a riot.

It is becoming a very stressful burden.

<comment><USER4> The paperwork burden caused by poorly known and viciously complex tax rules is probably the first reason people give me for cancelling citizenship. Especially since the US government seems hellbent on imposing astonishingly large penalties for paperwork failures.

The risk is too large for middle class people.

The second tax reason people give is the estate tax.

<comment><USER5> A family friend ran into this. She lived in Canada nearly all her working life and only heard about having to file paperwork with the US when it was being announced there was going to be a crackdown due to the recession.

Fortunately between her and her husband they had enough money to get a good lawyer and get it sorted out before they tried to nail her for all the tax she owed.

I think the biggest issue with the "tax by citizenship" is that it turns US citizenship into a commodity to be traded for personal benefit.

It's noble to try to chase the tax dodgers, but it's a lot more practical to tax the people who stay and ensure anybody who wants to flee is going to be losing sizeable amounts of their property.

Canada has investment rules based on nationality/citizenship and the owners of those shares can't just elope and expect to keep their controlling interests. In fact most of the big companies that face these rules have their foreign investments near maximum, so that anyone fleeing would be forced to sell all their stake and selling a big stake of any company means selling at a sizeable loss.

</comment></comment></comment><comment><USER6> >"U.S. citizenship is the most coveted citizenship in the world. To give it up, it has to be pretty serious,"

It's pretty serious to give up your birth citizenship no matter where you're from. But, as someone with American citizenship, this doesn't ring particularly true for me. There are a number of passports I would trade, today, right now, for the one I currently hold. Anyone claiming American citizenship is the most coveted in the world is saying a lot more about themselves than they are the US.

<comment><USER7> What countries's citizenships would you suppose is coveted by more people worldwide than the US?

<comment><USER8> Any EU citizenship is more useful and less dangerous and more lucrative and more flexible and subjects you to less world-wide paperwork, tax, and business restrictions.

So Estonia, Poland, Romania, Bulgaria, Slovenia (or is it Slovakia?), Lithuania, Latvia, Slovakia (or Slovenia?), and Greece have more valuable passports for their citizens.

If you travel a lot in East Asia, Japan's passport is awfully useful and has much nicer perks than US citizenship.

Obviously, France, Britain, Canada, Germany, Italy, Sweden, and other core wealthy nations have much, much better deals for citizens, too.

The US passport and citizenship is more and more like a third world quality passport every year, with one major exception. That exception, of course, is the right to live in the USA, which is a dang nice country with excellent open country, parks, forests, space to breathe free, big highways, fishing, hunting, the right to keep and bear arms, and fine honest people.

But if you don't love this land, you're better off with Latverian or Hungarian or Freedonian citizenship, because our politicians have done squat to keep our citizenship valuable around the world.

<comment><USER7> It sounds like you're talking about the usefulness of citizenship _for traveling_. But the quotation discussed by deciplex, and his statements, are not qualified in this way.

Extensive nation-hopping is not something most folks in the world can do. (The "onerous tax filing" being even more of a rich-person's problem.) I'd guess that the US citizenship is in fact the most coveted worldwide, all things considered.

<comment><USER6> Well, at least you admit you're just guessing...

And, did you bother to read the article? I'm surprised you write off these regulations for expats as 'rich-people problems'.

<comment><USER7> The typical American moving abroad is richer than the median American, and the median American is much, much richer than the vast majority of humans on Earth. The middle-class person being discussed in the article had $100k in the bank, which is more than most humans earn in a lifetime.

So yes, rich-people's problems.

<comment><USER6> Yes, I suppose we should all learn to deal with oppressively stupid regulation until world peace is achieved and no one goes hungry.

I really don't get your point. So, if you are 'rich enough' (note: the people in this article are solidly middle-class) to actually maybe be affected by and give a shit which passport you've got, your opinions are immediately written off as 'rich people problems'. On the other hand if you're among the poor in the developing world and your passport is perhaps not something you'll ever think about or care about, then because _maybe_ according to jessriedel you _might_ prefer a US passport to e.g. a French one or a Swedish one or whatever, the US passport is 'the most coveted in the world'. Despite (apparently too rich to count) people giving them up in record numbers.

I'm fascinated to hear other opinions you hold on random shit, if this is any indication of how you arrive at your conclusions. Do tell.

<comment><USER7> You're completely mistaken about my position. I also haven't said anything to warrant your rudeness.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> I was quoted in this article. I do lots and lots of this work -- helping people log out of the USA cleanly and permanently. AMA.

<comment><USER9> Im very interested in this. Which countries are best for expats from a quality of life and ease of obtaining citizenship standpoint?

<comment><USER4> You have to solve two problems -- your place of citizenship and your place of residence. Dominica and St. Kitts are the two places most people look to buy citizenship. There are other more expensive places too.

Residence - this is easier to arrange. If the country will give you a tourist visa you're in, at least temporarily.

<comment><USER10> Any places cheaper than St Kitts/Nevis ($400K)?

<comment><USER4> Look at Dominica.

Scam artists have been known to exist in selling citizenship in Central America. Be wary. Don't try clever stunts.

<comment><USER10> Thanks. Dominica looks fairly reasonable at $100K for an individual, and $175K for a couple.

</comment></comment></comment></comment></comment></comment><comment><USER11> The US needs to adopt a residency based tax system like the rest of the world.

This would solve so many problems.

The main issue why this remains a problem is that Congress doesn't care about American citizens who live abroad. Congress knows they can abuse Americans who will never comprise a large enough portion of any district for their votes to really matter. This is why people are actually renouncing. They have no other practical solution or representation.

</comment><comment><USER12> Why does WSJ (and NYT) add extra words to make headlines more awkward?

Is WSJ really trying to argue that expats are dodging tax _rules_ , not _taxes_?

<comment><USER13> > Is WSJ really trying to argue that expats ate dodging tax rules, not taxes?

Actually, yes. Maybe you didn't read the story, but it specifically talks about how the major burden for middle class expats isn't necessarily taxes but the penalties for failing to file specific paperwork.

Anecdotally, this is certainly true for the expats I know (including myself). I didn't have to pay any US taxes, but the penalty for not filing excessive disclosure forms on all local bank accounts is very onerous.

<comment><USER4> This is exactly right. HNers who are US citizens will set up a perfectly ordinary corporation in their country of residence and run their company perfectly legally in that country. Years later they hear of Form 5471. The government's SOP on this is to impose a $10,000 per year penalty then force you to beg for the penalty to be removed. Sometimes that happens. Sometimes that doesn't. How many small businesses could stand a $40,000 or $50,000 hit just because you didn't file a piece of paper saying you owned stock in a foreign corporation?

</comment></comment></comment><comment><USER11> isaacbrocksociety.ca

This link needs to be here. If you're an American abroad suffering similar treatment, you can find support with these people who are in the same situation. They are trying to help end the US's unfair CBT citizenship based taxation and switch to RBT residency based taxation like the rest of the world already uses.

</comment><comment><USER14> Any non paywalled link?

Edit: [http://pastebin.com/TrTF32uw](http://pastebin.com/TrTF32uw)</comment>


What do people here use for boring back-office stuff? - <AUTHOR>

I've been working on an all-in-one system to run my own startup since 2001 (accounting, CRM, taxes, payroll, etc.). It works, and I've tried selling it, but to no avail. Big businesses don't want to trust a startup. Other startups seem like a logical target market, but maybe people are satisfied with what they're using now (QuickBooks?), so they don't want to switch, either. It would be helpful to gather some data to see if that's really the case. I know that in the case of my own startup, I had some custom needs that QuickBooks wasn't able to satisfy. So, have I made a product that no one needs because everyone is happy? Or one that a lot of people need, but that no one knows exists? <comment><USER2> I recently set a client up with a GroupReady installation (<http://groupready.com/>). They make some pretty solid scheduling, contact management, and office communication software. Almost every time I've called them, I've gotten friendly, competent service. (I'm not affiliated with them in any way other than as a customer.)

The reason I mention them is, they're not a big business. They're family owned and run, and they're doing gangbusters.

Pretty much, I'm a complete ignoramus at what it takes to be a successful software company. But, if I were to look at those guys -- who I don't think are all that far off from what you're doing -- then I think that the following formula will work:

1\. Make sure people can find you. I found GroupReady while digging through Google looking for scheduling software.

2\. Be really straightforward. I ended up disregarding some competing companies because they wanted me to fill out an online form to get a price quote before they'd even talk to me.

3\. Keep improving your product. Looking at what Quickbooks is doing is useful in that it can give you hints for what people want, but mostly, concentrate on your product. Like Guy Kawasaki says, churn churn churn.

4\. Be reachable. I absolutely love being able to ring up GroupReady once a month or so, when I get stuck, and talk to Barry or one of the other guys there. It lets me get a call from my client, visit their office, work on their problem for a bit, and then if I get stuck, immediately get an answer.

I think if you hit those points, your market will find you. Maybe not all at once the way a lot of startups like, but you'll have a sustainable business and that's not so bad. As you become more stable, more people and small businesses will trust you.

Also, I'm interested in what you've got. My little one-man operation just picked up a second person, I'm drowning in work, and my books are pretty much ... well, I don't wanna talk about it (eek).

</comment><comment><USER3> I think you're suffering more from a people-don't-know-you-exist syndrome.

My suggestion would be to target all the contract/consultant Accounting/CFO firms and show them your product. Offer them a referral fee for every client they bring onto your platform. Show them how it will make their life easier, and listen to their feedback.

I think you'll have a harder time convincing individual SMB "owners" to use your product/platform. But, I know very little information about your app, so it's hard to say for sure.

My point is that people who are "afraid" of taxes/payroll will be less likely to trust an unknown/new player because they can't appropriately evaluate the product. Consulting CFO's might be more receptive to the idea and might see value in a new platform.

</comment><comment><USER4> Take a look at <http://www.netbooks.com/> from one of the guys who managed Quickbooks at Intuit. There is absolutely a market for what you are doing.

</comment><comment><USER5> Try to find the sweet spot between QuickBooks and enterprise. 10 to 100 employees. $1 million to $10 million in revenue (depending on SIC Code). It's there. And it's huge. Try Chamber of Commerce, local tech groups, industry trade associations. Your prospects are out there, they need more than they have, but they don't know who you are. Tell them.

Oh, and don't call it boring. Show a little passion.

<comment><AUTHOR> As I said, I started working on the product in 2001. It's been seven years. I think I'm passionate enough. :) Most people I talk to about accounting do think it's boring. You are the exception, which I of course appreciate.

Thanks to everyone for your feedback. It's been very helpful.

<comment><USER5> "Most people I talk to about accounting do think it's boring."

Talk to different people.</comment></comment></comment>


For Sale: The Library of Edward Tufte - <AUTHOR> http://www.christies.com/LotFinder/searchresults.aspx?intSaleID=22834#action=refine&intSaleID=22834&sid=5e98dde0-eea8-4b92-8c73-fce75eb03eb7

<comment><USER2> More information from ET himself, including a partial answer to _csmeder_ 's "I still don't quite get why he is selling everything": [http://www.edwardtufte.com/bboard/q-and-a-fetch- msg?msg_id=0...](http://www.edwardtufte.com/bboard/q-and-a-fetch- msg?msg_id=0003kB&topic_id=1&topic=Ask+E.T).

Super-brief summary: He no longer needs these books for research purposes; if I've interpreted his slightly cryptic language correctly, he's selling them to finance his museum+gallery and some space for "landscape sculpture".

</comment><comment><USER3> Edward Tufte owns all of these documents and is now selling them? There are $40k and $80k Picasso drawings in here, how rich is Tufte to procure such a large collection of documents and drawings?

Edit: Hmm some googling turned this up [http://www.edwardtufte.com/bboard/q-and-a-fetch- msg?msg_id=0...](http://www.edwardtufte.com/bboard/q-and-a-fetch- msg?msg_id=0003kB&topic_id=1) I still don't quite get why he is selling everything. Its so he has room to make a gallery?

<comment><USER4> I think he's done really well between sales of his books, speaking fees, and teaching one-day courses. His one-day courses alone net 6-figure revenues each time they're taught: fee of $380, audience of about 350 people. Even if less than half that is profit, it seems like he can pull in upwards of $50k from teaching a single-day course.

<comment><USER5> It's true. I took one of those seminars years ago and was shocked at how packed the hotel ballroom was.

He deserves it, too. The man mortgaged his house to self-publish his first book when no existing publisher would gave him creative control.

</comment></comment></comment><comment><USER6> Finally, a compelling reason to become wealthy.</comment>


Show HN: Coolant for Mac – Lets you know when apps start draining your battery - <AUTHOR> https://coolantformac.com <comment><AUTHOR> Hey HN, I made this after working from a coffee shop when I happened to notice my battery was already at 50% – after just an hour. Turns out one of the browser tabs I had open was using 100% CPU. It'd been going on for awhile so the fan was spinning like crazy but I couldn't hear it over the noise in the shop.

So what the app does is it lets you know when a program starts draining your battery so you can close it and save battery power. Specifically, it triggers a notification when any process uses x% CPU or consumes y gigabytes of memory for z seconds (you choose the x, y, and z values).

This is the first piece of software I've written that isn't a web app and the first release I've felt comfortable sharing widely. Any feedback would be greatly appreciated.

<comment><USER2> Seems nicely done. Not sure I personally would need it, as my battery is dead anyway but I might give it a go.</comment></comment>


Success Stories of Internet of Things - <AUTHOR> https://medium.com/simbirsoft/4-success-stories-of-internet-of-things-b26bc3e94a78 <comment><USER2> From article: "Coca-Cola was one of the first to introduce IoT to customer service and in 1982 one third of vending machines were connected to the Internet."

That seems really unlikely. Assuming it was a typo, does anyone know what they meant to say, and/or have a source?

</comment><comment><USER3> I would be interested to hear these as well</comment>