Chiffre.io

End-to-end encrypted, privacy-first web analytics 🔑📈

[Chiffre.io @chiffre_io]

On Monday, we'll send some invites to the preview version of Chiffre Analytics in our weekly newsletter, sign up here:

https://t.co/fQIlWa4hPb

[Chiffre.io @chiffre_io]

Annotations are a great way to increase transparency.

[François Best @fortysevenfx]

✨ New release for 47ng/actions-clever-cloud

📥 Save deployment logs to artifacts
🚥 Annotate your deployments
🙈 Quiet mode to avoid revealing secrets or PII

https://t.co/P5k3JtBw9y

cc @clever_cloud

[François Best @fortysevenfx]

Quick little feature for @chiffre_io while on holiday 👨‍💻🏖️

Display the min/max browser version for the current period.

This can be super useful when tweaking bundler options to drop support for old browsers.

[François Best @fortysevenfx]

Tonight's #uidesign for @chiffre_io:

Detailed analytics tooltips, to show:

- OS/browser version distribution
- Screen width distribution for various device types, including useful stats for responsive design:
- Minimum mobile width
- Maximum desktop width

[François Best @fortysevenfx]

Following this blog post, I tweaked the analytics engine of @chiffre_io to remove immutability where applicable.

On my website's "all time" (includes two HN front pages):
Before: 1 minute
After: 1 second

🤯⚡️😍

Thanks @Swizec!

[Chiffre.io @chiffre_io]

@bmann @steveklbnf @nnnnicholas Apart from a fully P2P design (which has its drawbacks), hosting costs are unavoidable, whether going self-hosted, cloud or blockchain-based.

We prefer to use an indie PaaS. It's simple. It works.

cc @clever_cloud 💙🤍❤️

[François Best @fortysevenfx]

📺The video for my talk on @chiffre_io is up!

Note: the demo is at the end (demo gods had their way the first time).

[François Best @fortysevenfx]

📢 In 30min, I'll talk about my side project @chiffre_io live on the Internet®

🔐 What is end-to-end encryption for analytics
🚧 How it works
🕵️‍♂️ The challenges of building a privacy-first SaaS
✨ Live demo

📺 Join the livestream here:
https://t.co/fASGVVicto

[Fission @FISSIONcodes]

Join us for this Thursday's Fission Tech Talk, on April 29th. @fortysevenfx will be presenting how he built @chiffre_io, a privacy first #e2ee analytics package.

Register to join us https://t.co/V5xWj1Rw4y

[François Best @fortysevenfx]

📩 Upcoming @chiffre_io #buildinpublic newletter issue:

🚦 Adding a status page (featuring @alisalahio & @RozenMD)
🌊 Investigating streams for data fetching
🗣️ Speaking at @FISSIONcodes talks on Thursday

Signup here: https://t.co/iVy2CfqJVk

[François Best @fortysevenfx]

@tdinh_me @chiffre_io For now you would only get an "activity report" by email showing you a volume of visitors graph over a given period.

For the detailed data you'd have to login: sending clear text data to addresses like Gmail would void all encryption efforts.

[Chiffre.io @chiffre_io]

@BrendanEich @JackEllis @AdriaanvRossum @ay_meshkov @kfranasz Not PHE, but I had a look at FHE at the time which was largely impractical.

I don't think it would change the problem much though, if the heart of the debate is a problem of trust. At least with client-side decryption, the code that runs can be inspected.

[Chiffre.io @chiffre_io]

@BrendanEich @JackEllis @AdriaanvRossum @ay_meshkov @kfranasz The volume of data is definitely an upper bound on what can be done, for sure.

Some hacks can be done to do the same `reduce` operation client-side and cache aggregates, but won't scale indefinitely (there is only one machine to compute with, vs infinitely scalable servers).

[Chiffre.io @chiffre_io]

@JackEllis @BrendanEich @AdriaanvRossum @ay_meshkov @kfranasz Unless doing HTTPS end-to-end with the final server, IP and user-agent are target for logging in middleware services (CloudFlare, firewalls, load balancers etc).

But this approach may be difficult to scale.

[Chiffre.io @chiffre_io]

@BrendanEich @AdriaanvRossum @JackEllis @ay_meshkov @kfranasz This is a simplified diagram of our architecture:

The Chiffre server acts like a message queue for public-key encrypted data. It's decrypted on the client dashboard accessed by 1p, and analytics are calculated in the client.

[Chiffre.io @chiffre_io]

@BrendanEich @AdriaanvRossum @JackEllis @ay_meshkov @kfranasz Another potential issue is that 3p solutions will still always have server-side access logs (in addition to the data they provide via a tracker script). They can claim to not keep them, but again it's a trust issue, and a harder one to prove since it happens on the backend.

[Chiffre.io @chiffre_io]

@BrendanEich @AdriaanvRossum @JackEllis @ay_meshkov @kfranasz The approach we're exploring is 3p via end-to-end encryption, so that only 1p has the analytics data.

It shifts the problem from data collection/ownership to a trust problem, that 3p will do what it says.

[Chiffre.io @chiffre_io]

@BrendanEich @JackEllis Thanks Brendan, you can contact @fortysevenfx for Chiffre.

Maybe add the @PlausibleHQ folks ? @ukutaht @MarkoSaric

[Chiffre.io @chiffre_io]

@fortysevenfx Don't worry, I got this. ⚡

[Fission @FISSIONcodes]

And that's a wrap for today! Video up on Monday

Join us next week for @karlicoss, and the week after for @fortysevenfx and @chiffre_io

Sign up to attend --> https://t.co/LU4fmISG3b