umami

> Everyone with a website needs to know some basic facts about their website: ... What other sites sent traffic to my website? No. If this product is capable of collecting that sort of data in the first place then it's not privacy first as far as I'm concerned. > ... we don’t “fingerprint” individuals via their IP address ... That _can't_ be true. How else would a single "visit" (their terminology) be tracked? A self-hosted analytics solution (ex: https://github.com/mikecao/umami) would allow you to actually preserve user privacy if you wanted to.

Hi HN community! Are you familiar with any OSS projects that aim to have somewhat parity with using an identity service like auth0 or octa? The idea is for this to have all the nice things about having a 3rd party service for identity, but being able to run in one's infra. Something e.g. what https://github.com/mikecao/umami does for analytics. What I'd like this to have: (a) .sql files to setup the DB, (b) Dockerfile for easy deployment, (c) admin panel for stuff like tracking/revoking sessions, etc, (d) built on something battle-tested (e.g. devise).

Recommend to create an issue on the Github https://github.com/mikecao/umami

noticed you didn't write any tests: https://github.com/mikecao/umami What was your reasoning? Personally, I write tests for all my projects, it forces me to really think hard about how to break down the different components and functionalities and it helps others feel more confident to contribute.

One of the claims of Umami is that it's GDPR compliant: > Umami does not collect any personally identifiable information so it is GDPR and CCPA compliant. No cookie notices are needed because Umami does not use cookies. From auditing the source code, this doesn't seem to be the case. First, it claims it doesn't use cookies, but it clearly uses localStorage to store a "sessionKey"[0]. The other claim, that Umami is GDPR and CCPA compliant because it does not collect any personally identifiable information is only half true. While the data collected isn't PII (because you can't use it on it's own to identify a user), it's still "personal data". This is because the "sessionKey" stored alongside all events is actually a pseudonymous user identifier. It's really just a hash of the user's IP along with a few other properties[1]. Because the dat

You can create an issue on Github and I'll try and answer, https://github.com/mikecao/umami/issues

From a quickscan of the GitHub repo [1], this is a JavaScript client, like Google Analytics, that sends data to a self-hosted Node.js backend that stores the data in MySQL or PostgreSQL using the Prisma database toolkit: [1] https://github.com/mikecao/umami