Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

51–60 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#51

Formerly worked with DuckDuckGo My advice: Install ungoogled-chromium: https://github.com/Eloston/ungoogled-chromium Install these extensions: https://github.com/gorhill/uBlock https://github.com/ilGur1132/Smart-HTTPS There is also a Chromium extension that lets you install from Chrome Web Store: https://github.com/NeverDecaf/chromium-web-store Set duckduckgo.com as your default search engine with a blank home page.…

Why ungoogled-chromium over Firefox?

Faster + less bloat

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#52
DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases and simplifies retrieval within our apps and our search engine.

Like our search results, the favicon service adheres to our strict privacy policy[1] in that the requests are anonymous and we do not collect or share any personal information.

[1] https://duckduckgo.com/privacy

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#53

Formerly worked with DuckDuckGo My advice: Install ungoogled-chromium: https://github.com/Eloston/ungoogled-chromium Install these extensions: https://github.com/gorhill/uBlock https://github.com/ilGur1132/Smart-HTTPS There is also a Chromium extension that lets you install from Chrome Web Store: https://github.com/NeverDecaf/chromium-web-store Set duckduckgo.com as your default search engine with a blank home page.…

Why ungoogled-chromium over Firefox?

Why ungoogled-chromium or Firefox over Brave?

Brave is the only browser that includes strong ad and tracker blocking by default, which is the best way to ensure your privacy on the internet.

In fact, every decision I've seen from them makes me think they care the most about user privacy, period.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#54

Earlier quoted context omitted.

One major issue is that the "standard" favicon size has historically been 16x16 pixels... which, in the age of high density displays will render either comically small or comically blurry. There are other meta tags like Apple's "apple-touch-icon" which has some higher resolution options. But already you can see the logic here isn't trivial.

It still seems trivial to me. Parse all meta icon tags, prefer one that matches exact client resolution of current display (don't even have to download the icons - the sizes are defined as part of the meta tag), else use the largest-resolution one, else in desperate bid try site/favicon.ico, otherwise give up. Really shouldn't be complicated enough to need a special service to handle "edge cases". Another comment men…

I guess the problem is when you want to quickly provide a favicon with the search result (beit in the omnibar or actual search page), as you're typing and results are being displayed you cannot send off a request to the site, wait for HTML html to finish up downloading, send off a request to the manifest if its defined for multiple sites at once.

On a technical level of course its doable but in reality it's a complete waste of data and processing, not to mention it could take a long time to show up. I imagine they have these favicons all cached on their side so they can quickly send the right file down and/or do this processing if needed.

That being said maybe they should just not use a favicon if it's that big of a deal.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#55

Earlier quoted context omitted.

Don’t they already have access to all the search results anyways? This doesn’t seem to be any privacy loss relative to that.

This is about their browser, not their search service.

Ok, that makes sense, I agree not using the browser to fetch the favicon is suspect.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#56
post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#57
post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

Are all these edge cases part of the html/w3c/whichever standard? If not, let the edge cases fail. I'm not going to lose sleep over an icon not showing for a site I'm visiting once.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#58

EDIT: I didn't notice that this topic was about the DDG browser (which I didn't know existed) and responded assuming this was about the site/extension. For a browser, yes, a client-side solution is possible and probably preferable. Please check and upvote other comment trees. This makes sense to me and is not alarming. Getting favicons actually is difficult to do robustly; many applications and websites use Google's…

"This is not to say that DDG is perfect: links you click do seem to be redirected through a /l/ page on their domain ..."

I am surprised the user is not complaining about this instead of the favicons. Their privacy policy goes on about the privacy implications of Referer headers and instead of calling out browsers for sending Referer by default, they instead give themselves power to record all the user's clicked results themselves. The Referer problem is something that can be solved by the user at the browser level through, e.g., using a client that does not send Referer, browser extensions/plug-ins that can control headers sent, or perhaps with a local proxy to remove the Referer header.

Unless DDG has changed, these prefixed result URLs are the default. It is possible to get unprefixed result URLs using the "lite" version of DDG however that is not the default. "Privacy-focused" search engine chooses less private default. News at 11.

I recently noticed that DDG has started redirecting queries submitted via POST to /lite/. The redirect is to the same domain. No explanation. I have a custom client that does not follow redirects and I now have to submit two sets of HTTP headers instead of one.

These guys are trying to make money from advertising just like everyone else. They have to be very particular in the methods they use to do it -- check the exceptions in their privacy policy -- but it is the same game. Ads and affiliate links. That sort of business and privacy are always going to be at odds with each other.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#59

Earlier quoted context omitted.

Why ungoogled-chromium over Firefox?

Why ungoogled-chromium or Firefox over Brave? Brave is the only browser that includes strong ad and tracker blocking by default, which is the best way to ensure your privacy on the internet. In fact, every decision I've seen from them makes me think they care the most about user privacy, period.

I cannot recommend Brave due to the autosuggestions-for-profit feature.

Previous discussion: https://news.ycombinator.com/item?id=23474842

You can install uBlock Origin in 10 seconds from the GitHub release page (see previous link shared). This is vastly better than anything I've seen for ad-blocking.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#60

Earlier quoted context omitted.

It still seems trivial to me. Parse all meta icon tags, prefer one that matches exact client resolution of current display (don't even have to download the icons - the sizes are defined as part of the meta tag), else use the largest-resolution one, else in desperate bid try site/favicon.ico, otherwise give up. Really shouldn't be complicated enough to need a special service to handle "edge cases". Another comment men…

I guess the problem is when you want to quickly provide a favicon with the search result (beit in the omnibar or actual search page), as you're typing and results are being displayed you cannot send off a request to the site, wait for HTML html to finish up downloading, send off a request to the manifest if its defined for multiple sites at once. On a technical level of course its doable but in reality it's a complet…

Oh, this is for putting an icon next to search results? Yeah, that changes the calculus considerably. I thought this was about showing the favicon in the browser for a site the user visits (per the issue title).

In that case, yeah, I don't think the icons are necessary to show at all...

Post reply on HN