DuckDuckGo just launched a DDG branded XMPP service | Hacker News Reader

DuckDuckGo just launched a DDG branded XMPP service

duck.co

98 pointsmike-cardwell36 comments

I'm sorry but I don't really understand the utility of that service ? Is there any link to other protocols ? What are the benefits of using this server instead of something like gtalk or some other widespread service ? Why should I jump to this service and make my friend so the switch as well ?

Thanks :)

edit: I know perfectly what is DDG and I really love this search engine, but still.. don't get me wrong, I'm just asking for answers there, not being rude

You dont need to convince them to switch! You can still talk to your gtalk friends, its all XMPP/Jabber! This is not a service just for inside duckduckgo. Inform yourself a bit more about XMPPP/Jabber :-).

>Inform yourself a bit more about XMPPP/Jabber :-).

I think that perhaps, like me, they were hoping that you would be interested in sharing a couple of use cases for XMPP with us ...?

I'm confused about this, too. Is this mostly to replace discussion about DDG on IRC? Why is this exciting? (As with the parent comment, I'm not trying to tear anyone down. People are clearly excited about this, and I'm wondering what coolness I'm missing out on.)

I have an account on my own XMPP server. I just added "im@ddg.gg" and I can now do DDG searches through my chat client. Not sure how useful that is, but nice nontheless. And all without having to sign up for an account directly with their XMPP service, because of federation.

Ah, thanks for the explanation.

For those that haven't tried before, running your own XMPP server is incredibly easy on even a small VPS. I'd recommend ejabberd, its pretty solid, light weight and fast.

I always suggest prosody :-) And we use this as our XMPP server cause its the modern way to use XMPP :)

I second the Prosody recommendation. I'm in the process of migrating my Jabber server to it, and it's quite slick.

I'm most interested this oblique reference: "...add our DuckDuckGo Jabber Conference, it will soon be linked to the IRC channel #duckduckgo on freenode".

Where's the technology for linking an XMPP conference to an IRC channel? I lurk in some IRC channels that would love to migrate to a more modern protocol, and that seems a good way to bridge the gap.

We use a Perl Bot for this. It will uses POE-Components to connect to the IRC and to the XMPP and then dispatches the messages to one from the other.

If you are interested, just join us on IRC and we talk about it :)

A friend did this: https://gitorious.org/irctk ("irctk is a general-purpose IRC wrapper written in C with libircclient"). I think it could be pretty straightforward to do the job using it.

We prefer Perl, cause we got one solution for everything and can easily combine the thousands components offered. Just cause a lib does IRC doesnt help us much :-) It must be easy! :)

At one of my internships they had written a simple server in Java to bridge XMPP and IRC. Sounds like it's been re-invented a few times.

XMPP has a concept of transports, that are gateways to other networks. Gateways exists for MSN, ICQ, AIM and IRC.

And to answer your question, taka a look at

http://xmpppy.sourceforge.net/irc/

There are many secure ways to use XMPP. What is so great about ddg doing it?

I can't answer that question. However, I did leave the following comment on their announcement page:

Will you be following the same principals in regard to privacy as the DDG search engine follows? Personally, I would love to see the following:

1.) No connection logging. Ie, don't log when people log in and from which IPs

2.) No chat logs

3.) High profile information and instructions on how people can use OTR (Off the Record) for end to end chat encryption

4.) A Tor hidden service gateway to the XMPP server

Regarding 1 and 2, the least that is required IMO is a privacy policy detailing which information is stored and for how long.

I think, general (tech-savvy) audience would more enjoy encrypted logging (message archiving), using some variant of XEP-0136, but storing messages encrypted to user's public PGP/GPG key.

So the messages are kept (in case you want to refresh your memory, but don't have locally-stored history), but are unaccessible by third parties.

I'm not sure about that. People who want chat logs can simply generate them on the client side. That way, even if they're using OTR they still get the chat logs.

Yes, but how they're going to access logs when connecting to XMPP service from multiple machines?

By checking the logs on the machine the logs are on.

Besides, anyone who is tech savvy enough to mess with public key encryption is going to be using OTR anyway, making server side logs useless.

I'm using OTR, but only for conversations that are worth protecting. IMHO securing typical chat with friends (mostly consisting of funny/interesting link exchanges) is almost pointless.

But having the history is still useful ("remember that article I've sent you yesterday").

Not as pointless as most people intuitively think. What if the chat server you're using is compromised by a hacker trying to make a name for themselves and they publish all of the chat logs on bittorrent?

Some examples of comments in a private chat that might at first appear like they don't need encrypting, but might come back and bite you in the arse if they ever get published:

"God work is boring today. Need to update my CV/Resume"

"Bob was a bit of an idiot last night wasn't he"

"Thinking of skiving off work tomorrow."

"The wife has been nagging at me all afternoon. Fancy a pint later?"

Depending on how secure you want to be, the existence of encrypted/non-encrypted information reveals things as well. Someone could infer something by just knowing that you turned on OTR at a certain time.

> People who want chat logs can simply generate them on the client side.

That wouldn't fulfil 90% of the purpose of keeping logs, for me at least. Not everyone has the same requirements as you - I for one very rarely bother with OTR, but I have to search my chat logs for something on an almost daily basis. I use XMPP on my work PC, on my laptop and desktop at home, and on my phone. Splitting the logs across all those devices would make them literally useless.

We at DuckDuckGo assure the same anti-tracking policy on our XMPP server. There is nothing greater about DDG then other sites following the same policy :-). But its DDG :-)

That's cool. But I've no idea if you're retaining IP logs and chat logs. You really need a service specific privacy policy which details exactly what you store and for how long.

We definitly will add such a page, so far i can point you to the statement on our forum, you can see it here:

http://duck.co/topic/duckduckgo-s-new-public-xmpp-jabber-ser...

See down under the comments, i explained there what is so far logged, but we will tune this now over the next days.

apparently Google pointed duck.com at the Google search main page after Duck Duck Go inquired about it. I guess this is why its duck.co

EDIT

See this post by yegg, the duck duck go founder

http://www.reddit.com/r/technology/comments/epd59/google_poi...

The URL make me cry:(

Why?! :-)

https://duck.co/#Topic/28469000000637077

Note the #. Now, remove it and everything after it and reload the page.

Why am I being downvoted? Didn't we all just throw shit at gawker for doing the same thing?

EDIT: This fundamentally breaks the web. The # and everything after it are _not_ sent to the server. It relies on javascript and extra-protocol information to get the document, which breaks the idea of a resource having its own name. The # was suppose to denote a section of a resource, not a resource in-and-of itself. I'm sure everyone here knows this, but I had to get it off my chest.

Very cool, although it could probable use a name. Maybe "DuckDuckChat"? "DuckDuckGo XMPP Service" is not going to be used by all but the most technical of users I think...

Even "DuckDuckGo Jabber Service" is better, XMPP just sounds so unfriendly.

Quack?

We will see :-) So far we dont have a place where we put the name lol :-) All step by step! :-)

DuckDuckJab

Reply on news.ycombinator.com