Whoa! I missed the announcement of implementing the marvelous new
hitcounter. What happened to concerns about spoofing hits by way of
bypassing the sampling - is it a non-javascript thingy that is therefore
impervious to spoofing? I'd love to see the logic/code.
Just to add to the "logging hashed versions of ip addresses" fray: we could
recreate and overwrite the supersecret key daily (or even hourly). It then
occurs to me that you could theoretically use this, along with the stats of
consistently popular pages, to try to decrypt the hash, but that's gotta be
a fantastically difficult. You could further mix it up by changing the hash
every day (is that stupid? sounds like a good idea). Then, you could see
multiple views of a really popular page by the same guy (he'd have to have a
*lot* of views, to be picked up through the sampling rate). Any holes in
this logic? Fun to think about.
Regards,
Aerik