Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125953
Feedback-ID: i8414410d:Fastmail
Precedence: bulk
MIME-Version: 1.0
Date: Wed, 13 Nov 2024 19:53:40 -0600
To: "php internals" <internals@lists.php.net>
Message-ID: <faac8011-e404-42ec-afa3-bc0d1fe4abd7@app.fastmail.com>
In-Reply-To: <ea18e2ef-206c-4619-95f5-6de8be58d242@jnvsor.net>
References: <55320aad-758a-4d06-b1bd-3eac2b5a5f71@app.fastmail.com>
 <AM8P250MB0170E88F2B19CA8C91786F66E2562@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <af567362-efd0-4e4a-9869-2f379f85e0ff@app.fastmail.com>
 <3963499a-c9ac-4cbe-b40d-44d62a9240d2@jnvsor.net>
 <b4fb5593-bd15-4f95-95b3-e47952b4a949@app.fastmail.com>
 <ea18e2ef-206c-4619-95f5-6de8be58d242@jnvsor.net>
Subject: Re: [PHP-DEV] [RFC] PHP.net analytics
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
From: larry@garfieldtech.com ("Larry Garfield")

On Wed, Nov 13, 2024, at 1:06 PM, Jonathan Vollebregt wrote:
> On 11/11/24 8:11 PM, Larry Garfield wrote:
>> Metrics that go into a black box with a 3rd party are bad.  That's not what is being proposed.
>
>  From my perspective it's still minified (obfuscated) code going into a 
> black box. Just because you own the box doesn't make it any more 
> transparent to me.
>
> This is a tradeoff between users privacy and useful metrics. You can get 
> more than half of the way there without any client-side code, with only 
> the information users were already sending you.
>
> If server side tracking isn't an option, and minimal (As opposed to 
> minified) client side tracking isn't an option either, then it sounds 
> like you already made up your mind.

I don't understand why the JS being minified (which basically everything does for performance) is an issue.  In concept, there's no reason we couldn't link from the Privacy Policy page or footer or something to the Matomo website, or even deep link to the code file, though that seems excessive.  Just identifying it and letting people go look up the code themselves if they want should be sufficient for 99% of the people who would even notice or care, which is already less than 1% of visitors.

And data going into a black box is the same no matter where it's collected; it's a GPL analytics server, but of course we're not going to release raw data.  So that's no different no matter where the collection happens.

--Larry Garfield