Hacker News Reader

Oh, please. There's a million threads on HN complaining about Google and Facebook. Doesn't even matter if they did something, any post will still have those comments. You can't consider the proportionality of the response by just one thread.

It's really quite amazing that when a company that's hitched it's brand entirely to privacy first commits a big privacy faux pas, hides it for a year, and then doubles down on it not being a problem, you have somehow managed to turn the top voted thread to a discussion on the failings of other companies instead. Bravo.

It was not IMHO meant to deflect from DDG. It was a more general statement about peoples responses. I dislike trendy phrases but the one in play here is "outrage culture". Its not good and it's getting more common.

Thanks, that was exactly my point, which some people are missing.

>hides it for a year

Huh? It's an open source project. Maybe you consider them closing the issue on GH to be "hiding it" but I don't. And the plenty of people talking about it in that thread still apparently don't, either.

IMHO their response made sense. You're already trusting DDG with your search history which for most people might as well be a list of 99% of the domains they visit. If you trust their privacy policy for that, I don't see the big deal here.

I do agree that it should be changed, but only because as is it seems imperfect and I seek perfection in most things. Again, it's an OSS project. AFAIK, any one of these people comprising the screaming masses are free to fix it themselves. Personally, I don't think it's worth my time.

The point is DDG has insisted that they put privacy first, & don't collect user data, then (supposedly) in the interest of a small performance increase they introduce code that — wait for it — COLLECTS USER DATA. All they would need to do is use {URL}/favicon.ico which most if not sites have. From what I understand according to posts on the github page this could be done on-device so no need for sending anything to a server. Then when the issue was opened it was closed without the issue being fixed.

I think what angered people was actually that a company saying to hold privacy high was simply refusing to change something after a mistake was pointed out and instead kept on defending it with a technical argument, which makes no sense at all.

The reaction would have been actually a lot different if someone from the company admitted the mistake and promised it will be changed.

Update: Gabriel Weinberg has promised to change it, linking it here so it does not get buried in the pile of comments: https://news.ycombinator.com/item?id=23711597

Yeah people burnt witches in the past ...

If they are confident that this feature has no privacy implications they are right to defend the point, despite what people say or think

People don't run DDG, the company

People can use another search engine if they want

I'll keep using DDG anyway

DDG can do what they want and people can as a result publicly state their opinions on it. Freedom goes both ways.

You’ve described the race to the bottom we live in. Can we please try and break the cycle?

Those witches have a right to be on fire.

Where's my pitchfork?

Read your comment again.

You are faulting someone for defending thier own argument. You suggest that people who do not cow and apologize to the mob deserve the anger and retribution the mob has to offer.

People have a right to think differently and express themselves without threats, bullying, or shaming.

The mob does not deserve apologies. The comment above is spot on - we've lost all sense of proportionality.

It is an indication of the modern online mob sickness that they always demand others beg for forgiveness.

What emotional void are mob participants trying to fill with the apologies of others?

i cant fully agree.

you obviously should be allowed to make a mistake and be forgiven for it. that does not mean that i personally would ever forgive any `company` that markets itself as pro-privacy after its been caught gathering data on its users.

i could forgive the people working at the company and would definitely expect future employers not to hold that against them, however.

but if a `company` does something while claiming to stand morally opposed to exactly that.... proves that it doesn't actually care about the topic. it just wants the publicity for marketability, discrediting them entirely for all future communication.

in this particular case, i wouldn't go that far however. they weren't gathering any data on their users if i understood it correctly. it was just a badly implemented feature, which will get changed

This is a really strange take.

Once people have gone down the avenue of earnestly reporting private information leakage, the correct answer is to investigate. DDG decided not to do this and instead dismissed the problem completely out of hand and ignored it for almost a year without taking any action.

No one asked for an apology, they asked DDG to admit fault and then to fix the problem. ie "we shouldn't have done that" not "we're sorry we did that."

You keep saying "mob" but these people didn't collect to harass, if you actually read all of the comments the vast majority are people who are (rightly!) concerned about their data privacy advocate built software leaking every visited URL.

You’re absolutely ignoring the possibility of an argument where there is no fault and this is being blown out of proportion. You just assume your opinion is correct and they owe you to fix it. That is in itself the problem OP was exposing.

Great! Can you provide that argument or am I supposed to think it up myself?

>defending it with a technical argument, which makes no sense at all.

Well hold on now. If there's a valid technical argument, and it's not a violation of privacy, why doesn't that make sense?

If people are so distrustful of DDG that they don't believe that argument, why use their browser under any circumstance?

A performance optimization around a trivial thing like a favicon is no reason to destroy everyone's security.

Let's assume DDG is a great and honest company and will collect all the info, but never use it for anything bad. Guess what, they can get still hacked and all the info leaks out.

This is a horrendous breach of trust that they WERE collecting it however, and I'm glad they got caught. It will not be tolerated. They'll have to change this or face a revolt.

If you claim to fight for privacy and rise to popularity by shaming your competitors' evil anti-privacy (or shady) practices and do something exactly what the rest do, you deserve every bit of criticism. Why should you receive a free pass and the competitors shouldn't? Simply because of your marketing stance??

And for the record, collecting your browser history just to display a stupid favicon is the most ridiculous excuse I've heard in a long while. And I am not going to blindly believe them because they said that's what they use it for.

I agree with this.

As a privacy-first company, for them to make any decision that is for performance but adds additional privacy risk shows they make the wrong decisions.

They also left this for over a year after being told about it and part of the only reason it was caught was that their browser app is open-source. What about all their closed-source services, like their favicon service their browser apparently relies on.

We shouldn't blindly trust any company and a privacy-first company should be willing to assume we don't trust them and therefore it is up to them to prove everything they do.

I get a few of the responses on their Github page are now non-helpful, but the big point here is that by DuckDuckGo taking this series of actions (implementing the browser like this, ignoring a valid bug report about it, and only reopening the issue after massive push from users) it shows that DuckDuckGo isn't as privacy-focused as I thought, nor many others.

I've been using DuckDuckGo as my sole search provider for several years now, on all my devices, but I'm concerned about what else they may have done in the sake of "performance" over privacy.

"collecting your browser history just to display a stupid favicon is the most ridiculous excuse I've heard in a long while"

Though I agree the the implementation could be better, they should just check the head and the root for the icon and if not found that's that. But the possibility of something be used for malicious ends does not entail confirmation of it being used that way. Just because we have knifes in our kitchen does not make us automatically guilty of stabbing people. I find it easier to believe that this was actually, if misguided, an attempt to solve a problem rather than a nefarious plots to track users across the web.

> But... the reaction here is "they made a mistake, let's pile on like kids in a playground"

It's not one mistake, but several. Other then the initial mistake there is also the sloopy reaction and the fact they just closed the issue without bothering to fix it. And this was 1 year(!) ago. Nothing changed in the meanwhile. Now someone pushed it to public and after just some hours they reopen the issue and promise to fix it.

This is the reason why people react loud, because it works. And often it's even the only way that works.

Part of the point is that likely this has zero privacy implications (except potentially disclosing to someone monitoring your traffic that you are using their browser).

The mistake is rather an area of improvement where they can change something that respect privacy by policy to something that respect privacy by design.

>Part of the point is that likely this has zero privacy implications (except potentially disclosing to someone monitoring your traffic that you are using their browser).

It has zero implications if you trust DDG and good privacy is not based on blind trust. Keep in mind that you also need to trust the government under which DDG acts to not require them to disclose this data, trust the government to not put black boxes in the DDG data center, trust DDG's security apparatus against external state actors, trust any rogue DDG employee to not use this data and so on.

I agree, I still think it is relevant to treat actual privacy violations differently from engineering choices that might make privacy violations easier in the future.

My opinion is that DDG should have never made this choice in the first place, but as far as I am concerned this is at the level of an implementation detail that can be improved, not as if DDG was intentionally using user data in some non-private way.

The concern as I see it is that this issue and the initial DDG response to it shows a lack of understanding of technical privacy controls. What they are and why they matter so much. DDG's backend is not audited and so one wonders if that same lack of understanding applies to the backend as well. DDG cites privacy policies but, in my experience, the best policies are backed with strict technical controls as humans never follow policies perfectly on their own.

Google don’t sell privacy.

Anyways, what’s this got to do with Google? “Privacy browser violates basic privacy to do something useless” is actually ridiculous. And the response is even more ridiculous! How does literally every single other browser do it?

I’m disappointed because I put my reputation on the line to recommend DDG to users based on...privacy. But here we see they actually do not hold true to their stated values. And they don’t even seem to care.

> Google don’t sell privacy.

Of course they do. They sell users' privacy for advertising dollars.

I am not defending DDG here, as they are clearly in the wrong - but let's not pretend that their error is even close to what Google does.

It’s an explanation of why complaints are being directed at DuckDuckGo (privacy is their raison d’être) even when Google is worse (privacy is not their product – or, in wording that’s more ambiguous in isolation, Google don’t sell privacy).

Do they sell PII data ?

Because I don’t think they do.

Can you explain how they sell "privacy"? This is thrown around all the time but I don't think it means what people think it means.

"Google don’t sell privacy."

What does DDG 'sell'?

Which is to say, how much have you paid them?

If you're not paying for it, then you are the product, that's the inevitable trade. There is no free lunch.

> ignoring the genuinely huger issue of the amount of info and mining that google

By using DuckDuckGo you're doing the opposite of ignoring privacy issues in Google products.

And hence the reaction. Why use DDG at all, if they're not safely protecting your private data 100%?

This is my feeling exactly

Because some protection is better than no protection

Why use a condom which doesn't protect you 100%?

Or why wear a motorcycle helmet since there's still a chance you'll sustain a serious head injury and die if you crash? Like you, I find the extremity of the GP's point of view lacking in wisdom.

You're okay with them having data on what you're searching for, but them potentially having data on the domains you're visiting from those search pages is where you draw the line?

I mean, I agree with the principle of storing as little data as possible but this isn't a huge deal in my eyes.

I disagree, or maybe we read different responses, but the ones I read where more critical of how (a) ddg (employee) handled this.

Didn't see anyone claim that this was on a google-level of bad, more like pointing out that google started out as a small company wanting to "do no evil", but slowly turned into what it is today.

Is it really that weird that people are worried that this might be the first of many small steps down the slippery slope?

> Didn't see anyone claim that this was on a google-level of bad

The point is that people are reacting as if it was.

I didn't have to go through the posted link for long to find people reacting as though this was more than a slippery slope issue:

> But instead to react professionally and contritely you made it worse to stamp on the shards to make sure no useful piece of trust will survive.

> I've just de-installed the Duckduckgo app and also won't be using their search engine anymore. Trust is lost. Their CEO can put his statement where the sun doesn't shine.

> But... the reaction here is "they made a mistake, let's pile on like kids in a playground" ignoring the genuinely huger issue of the amount of info and mining that google et al. do. There's no measure of proportion in the responses, someone is making a mistake then there's a wolfish, pack-like desire to get stuck in and hurt someone.

Sadly people simply derive satisfaction from piling on like this. The pop psychology explanation is that it's because people are dissatisfied with their own lives and are lashing out at anything that allows them to vent that underlying frustration. It sounds plausible, but it also sounds like it might be an over-generalisation.

I think it's certainly fair to say - as depressing as it is - that it may be somewhat in our nature to behave in this way, that most or all of us may possess this characteristic to a greater or lesser extent, and that the current political, cultural, economic, and media climate is only serving to amplify that tendency.

Also with the current social media platforms, it's really easy to find and participate in such pile up.

The current social media climate favors disagreement. This is directly in correlation with 'engagement' around which platforms are designed. Call it banking on outrage/hacktivism/quarrelling or simply engaging in peaceful debates. Companies and their algorithms have come to a funny conclusion that this is what increases said engagement (I'm not questioning their business model). User retention is crucial in this era, so is the intention of getting them to check back in ever so often.

Thus, dark patterns emerge. Point is, once you get used to 'that' online-aura, you unwillingly carry it with you wherever you go. Human brain does not have buttons to switch between modes. It's comically easy to get into this mindset and hard to shun it.

My guess is that DDG is being held to a higher standard because it's the liferaft competitor in a world of Google data harvesting, targeted manipulation and selling customer data.

Most complaining or being heavily critical about DDG are probably already upset to the point of abandonment with other services and they don't want the same trend to happen to this competitor (DDG). This sort of reaction is, IMHO, due to poor diversity of viable competitors.

In our societal structure, competitive options are the only things that keep power in check. I'm personally not entirely convinced you can have a reasonable amount of diverse competition in our economic system and there are some inherent equilibria that we tend to converge on over and over again in a market space (without corresponding massive social equalibria shifts).

If you do have any sort of faith left in our economic system, then you certainly want competitors like DDG to be different and be successful. Even if you don't have much faith, outside of say stringent regulation, supporting these sort of competitors is really the only practical option we have in the current state of affairs.

> There's no measure of proportion in the responses

Man. You just described 2020.

Anyway, I’m now using the DDG browser, which until today, I didn’t know existed. I think DDG will do the right thing, ultimately.

Many argue that "other things are worse". This argument is invalid in my opinion. We're talking about this special case and if people feel like they need to openly show their opinion about it this is okay. Even if the response is big in numbers.

That just shows how much also the small things matter.

If you only care about "the biggest" or "the worst" you'll never get anywhere...

You're right mr throwaway, let's be adults here and stop using DDG.

What would you suggest as a better alternative to protect your privacy?

... any other browser?

After we have been stung for the umpteenth time patience starts to wear thin.

> But... the reaction here is "they made a mistake, let's pile on like kids in a playground" ignoring the genuinely huger issue of the amount of info and mining that google et al. do.

What about genocide too? Please people, stop with these "but the other bigger unrelated issue should get more visibility".

> Which is why politicians rarely admit mistakes, because it's taken as a sign of weakness, not strength, to admit you were wrong.

Can you point me where DDG admitted they were wrong doing this in their first response? They didn't... they just explained why they did it but completely ignore the greater issue because they consider themselves "good". Just like that politician you may talk about, or Google, or whatever. They are part of that bigger issue you mentions.

This is about DDG.

Luckily that pile of kids in a playground made them realize that mistake, they would have ignored otherwise (like they did on their first respond).

> But... the reaction here is "they made a mistake, let's pile on like kids in a playground" ignoring the genuinely huger issue of the amount of info and mining that google et al. do.

What about genocide too? Please people, stop with these "but the other bigger unrelated issue should get more visibility".

> Which is why politicians rarely admit mistakes, because it's taken as a sign of weakness, not strength, to admit you were wrong.

Can you point me where DDG admitted they were wrong doing this? They didn't... they just explained why they did it but completely ignore the greater issue because they consider themselves "good". Just like that politician you may talk about, or Google, or whatever.

This is about DDG.