A more privacy-friendly blog

https://vincent.bernat.im/en/blog/2018-more-privacy-blog

by vbernat • 8 years ago

146 50 8 years ago

vincent.bernat.im

sachleen• 8 years ago

This is neat. I use disqus on my blog and had never heard of Isso. I'll have to check it out.

aw3c2• 8 years ago

Check out https://github.com/schn4ck/schnack as well!

adtac• 8 years ago

Shameless plug: my own alternative to Disqus: https://github.com/adtac/commento

There's also a hosted service I've been building for the past five months, if you don't want to bother with setting up and maintaining servers, but also don't want your readers to be mercilessly tracked by Disqus and their endless tracking partners. It's currently in private beta, but I'd be glad to invite anyone reading this (as a bonus, you'll get a lifetime free subscription for beta testing); shoot me an email (address in profile) :)

KajMagnus4• 8 years ago

There's also Talkyard, which is like Disqus, and open-source, no ads, no tracking. Serverless hosting. Google, Facebook etc login.

https://www.talkyard.io/blog-comments (I'm developing it)

jazoom2• 8 years ago

Your pricing being cheaper for people in developing countries is interesting. I quite like the idea behind that. A few Euros is practically nothing for me but for some people it's a week's worth of food.

misterbowfinger2• 8 years ago

I opted for a simpler solution: no analytics. It also enables me to think that my blog attracts thousands of visitors every day.

I lol'd

curiouscats• 8 years ago

But now they don't get to see the huge amount of traffic sent from Hacker News :-(

loup-vaillant• 8 years ago

You can still `grep | line` the logs. There are also tools that do more precise analysis.

mhd• 8 years ago

Back in the days, the textpattern software (pre-1.0) that I used had a pretty neat (httpd) log viewer, and I got some joy out of browsing the google/altavista search terms that brought them to me.

gkya• 8 years ago

For analytics you can try log analyzers like Webalizer and Goaccess. I use the former and I kinda dislike it, but I at least don't not like it as much as Goaccess. All I look at is just the list of referrers most of the time anyways, to see if there are any backlinks.

WRT comments and fonts, you can just get rid of both for good. Not imposing your fonts on the reader is almost always good, and you save on the bandwidth. And when it comes to comments, I prefer to host my content only on my website. People do e-mail, and asking them to email if they want to discuss with me is an incredibly effective spam filter.

WRT big media like videos and sound files, and bigger images, I think it's better to just link to them. Software like mpv, mplayer, VLC, &c are capable of streaming, so it becomes a matter of copying the link and "curl <link> | mpv -" or adding a mailcap entry.

Another thing I can add is to use shared hosting. It's easier to maintain and safer if you trust your host (I use NearlyFreeSpeech.NET, and if this mention counts as an ad, let that be; I really like them). I just generate my static blog and rsync it over ssh. rsync the logs and run webalizer on them every now and then. As simple as it gets.

theandrewbailey• 8 years ago

As it is unlikely that more than three people will use the search engine in a year, this seems a good idea to not spend too much time on this non-essential feature.

I disagree. When I want to remember something, I blog about it. When I implemented a search feature on my site, it was a godsend, and wondered why I had overlooked it for so long. Finding something I had blogged about years ago wasn't a pain anymore, since a box is right there.

vbernat3• 8 years ago

I often use the search engine myself too, but I believe nobody else does. When I was using Google Custom Search, I think I had hardly a few hits by year.

coldtea2• 8 years ago

I disagree. When I want to remember something, I blog about it. When I implemented a search feature on my site, it was a godsend, and wondered why I had overlooked it for so long. Finding something I had blogged about years ago wasn't a pain anymore, since a box is right there.

You can use Google or whatever to search your blog, or search local files with your posts or whatever.

In any case, and especially since you're not adding the search feature on your blog for the blog's visitors, but for you, it sounds totally redundant.

yborg• 8 years ago

You can use Google

_emacsomancer_• 8 years ago

I wonder if searx.me could be used instead. You can get it to return more or less the same results as Google.

misterbowfinger2• 8 years ago

There has to be a simpler, privacy focused way to figure out pageviews, right? As long as I don't know _who_ looked at my site, I should be able to find out _how many_.

Similar thing goes for "how many people clicked this button"

Or am I way off here....

newscracker• 8 years ago

You can self-host a free analytics solution like Matomo (formerly called Piwik) [1] and choose whether you're fine analyzing web server logs alone or want to track finer details by injecting JavaScript (provided in the solution) on your pages.

[1] https://matomo.org/

notatoad• 8 years ago

I don't know what the author uses as his blog engine, but I thought pageviews was a part of most blogs. Wordpress certainly does it. You don't need an analytics suite to run a simple counter.

antjanus2• 8 years ago

I've heard a lot of people coming to rely on back-end tracking because it can't be blocked by the client. I think this works especially well on a single page application because you can infer how a user interacted with the site solely based on API calls.

mattbierner• 8 years ago

Very helpful. I've hosted a few videos using cloudfront but there were lots of little gotchas with setting up both the hosting and the player. I wish I had found the linked to guide earlier: https://vincent.bernat.im/en/blog/2018-self-hosted-videos

NetOpWibby• 8 years ago

I’ve wanted something like this for so long but never knew where to start. Thanks!

antjanus2• 8 years ago

Thanks for posting this, I've been meaning to make similar transitions with my site.

craftyguy• 8 years ago

If you are already self-hosting services, why not self-host your search too? Searx is a very good service that aggregates results from any number of search engines, which is collects by stripping out any/all identifiable info from the requests it submits. You (not DDG, etc) can explicitly disable logging and be confident that your system is not preserving logs, instead of trusting Yet Another 3rd Party to do the right thing.

vbernat3• 8 years ago

One reason I prefer to use DDG is also to promote them. I started using DDG when I saw other people using it. The other reason is I also try to limit the number of services that I have to maintain.

fghtr• 8 years ago

I would like to add http://yacy.net to the list of self-hosting web searches.

mobitar• 8 years ago

I work on Listed as part of Standard Notes, which is a privacy focused blogging platform focused on authors, and allows authors to receive tips, sell content, and use custom CSS.

More here: https://listed.standardnotes.org

tomc19852• 8 years ago

Way back when we all installed software that analyzed Apache (et al) logs, before Google came in and killed it with their GA package. Why not a return to this classic style?

I remember messing with a module in webmin (i think?) that did this, and watching traffic come in and have it show up in the reporting tool. Was pretty cool considering the whole thing was self-contained

edit: I'm thinking of AWStats

sleavey• 8 years ago

Urchin [1] was a popular one. It was bought and killed by Google.

[1] https://en.wikipedia.org/wiki/Urchin_(software)

tomc19852• 8 years ago

I think we are thinking of something different. AWStats?

eps• 8 years ago

They were still selling Urchin (self-hosted) licenses up until a few years ago, at $5K a pop or thereabouts. May be they still do?

z3t4• 8 years ago

If you have RSS on your site you can use the search script I made for my static web site/blog: https://www.webtigerteam.com/websearch/ Earlier discussion: https://news.ycombinator.com/item?id=14717182

cagrimmett• 8 years ago

Awesome! I dumped Disqus and Google Analytics earlier this year, too. I hadn't thought about Google Fonts, so I'll dump that soon, too.

Since you are using CloudFront, I highly recommend http://s3stat.com for analytics. It grabs CloudFront's (or S3's) server access logs and visualizes them.

For search, I like this method Mat Hayward uses for Jekyll: https://github.com/mathaywarduk/jekyll-search Dump the site contents out into a JSON file with the titles and links accessible, crawl through the JSON file with javascript whenever someone runs a search, then display the results. I know you use Hyde instead of Jekyll, but you can port over the general idea.

CobrastanJorji• 8 years ago

There's one small downside to using your own font. The Google Font is very likely already cached in the browser and won't need to load from anywhere remote.

An even better solution might be to just not specify a specific font unless you really, really need one.

LeoNatan252• 8 years ago

Use a system font stack. Both macOS and Windows come with good font choices, and Linux … is Linux, more often than not, users are not even aware of typography or why it matters.

smoyer• 8 years ago

I would have book-marked your page to reread it later (I've been working on a new blog design). Unfortunately, something on your page is blocking pinboard.in.

vbernat3• 8 years ago

I believe this is the CSP. You can confirm that in the Javascript console. Extensions should be able to work around that. Bookmarklet are bound by the CSP and the major browsers don't want to fix that (https://bugzilla.mozilla.org/show_bug.cgi?id=866522, https://bugs.chromium.org/p/chromium/issues/detail?id=233903).

KajMagnus4• 8 years ago

Is there any open source browser session recording tool? With recording features like the one in Fullstory or Hotjar.

So one can record what people do at one's website, and see what UX problems they run into, and if something makes them feel bored and leave. Without sending their browser session to a 3rd party. (Fortunately the one I'm using right now is able to exclude parts of the recording, client side. E.g. `input` fields. But still would feel better to not send anything to a 3rd party)

lern_too_spel• 8 years ago

While Google Fonts may be covered by the generic Google Privacy Policy (haven't verified this myself), it is technically unable to track users very well due to caching for a day at a time and serving from a cookieless domain. If a user visited any other site using the same font that day, visiting your site won't result in a request to Google. https://developers.google.com/fonts/faq#what_does_using_the_...

hostcord• 8 years ago

I built a hosted comment service powered by Isso - https://comment.sh :)

KajMagnus4• 8 years ago

What's your goals & plans with `comment.sh`? Right now the website says "Free Signup" — I'm thinking either the plan is to start charging money later, or, if it stays free, then there is some altruistic / ideological reason you're doing this project & will continue long term ?

(There's no About page so I couldn't find out :- ))

kaushalmodi2• 8 years ago

Thanks to your post, I learnt about Content-Security-Policy in HTTP headers. I thought, that's awesome, let me add a tight CSP to my site (https://scripter.co) as I don't load any content from outside and the only thing going out are Webmentions sending requests... and then I realize that I use #mathjax on some pages..

MathJax requires me to add 'unsafe-inline' and 'unsafe-eval' to script-src, and 'unsafe-inline' style-src. So my overall CSP becomes quite weak :(

Anyone would have an idea how to implement CSP without those, and uses MathJax?

Thanks.

kaushalmodi2• 8 years ago

I fixed this finally, thanks to Github user dpvc and his suggested way of writing MathJax config: https://github.com/mathjax/MathJax/issues/1988#issuecomment-....

A more privacy-friendly blog

Related Stories