Hacker News Reader

Gotcha.

> ...generally in very old browsers that need to use our non-JavaScript site (http://duckduckgo.com/html).

I use duckduckgo.com/html & duckduckgo.com/lite on all my (up-to-date) browsers (Firefox Mobile for Android / Chrome for Debian as two examples); they are "not very old" at all, and I still get ddg-proxied hrefs.

A feature request (if I may): Old browser or not, if the dnt header is set, I'd ideally want ddg to not proxy/redirect anything at all on my behalf.

The redirect can be disabled in our settings.

Go to https://duckduckgo.com/settings#privacy and disable the bottom setting, "Redirect (When Necessary)"

Set it. 12 hours on and still getting redirected via ddg servers. The Settings page shows correct preferences.

I'm not on an older browser.

I'm not using private tabs / incognito.

I haven't cleared cookies.

The “very old” browsers seem to include the very latest version of WebKitGTK-based GNOME Web aka Epiphany. (It does have legitimate conformance problems, admittedly, so I don’t know if this is one of them.)

Then Epiphany needs to fix it.

You trading potential tracking by thirdparties with potential tracking by yourself. Since you are the one making this tradeoff and als the one who can benefit off it it always will be suspicious.

Really, Referer-related privacy problems should be fixed in the browser and any browser that still sends cross-origin Referer headers by default cannot claim to care about privacy - and that includes Firefox.

> Some browsers (especially older ones) do not support this standard, however. For those browsers, and also in situations where meta referrer doesn't work, we send the request back to our servers to remove search terms.

Disabling javascript is one of the first things to do to take back control of your privacy so you deciding to leak more data for those users who make that choice is not a good look.

> You trading potential tracking by thirdparties with potential tracking by yourself.

You're not making any sense. Proxying all requests is the only way to shield you from being tracked by third parties. If DDG wants to track you they don't need some convoluted dance - you're already on their website.

> If DDG wants to track you they don't need some convoluted dance - you're already on their website.

I don't trust their website either but the user-agent that I use that has enough anti-tracking measures I trust (whether those might be defeated is an orthogonal topic). The redirects through their servers... I cannot control what runs on it, just as I cannot control what terms they sign up with Microsoft.

Is urlencoding sufficient to hide this? Doesn't appear to be.

and what is the rut=4a9ada2347e29c8fce96a95bde34e6343c279202dbc22b4fe61524ab39bf8eff for?

It is a random hash (not any kind of user identifier) for security to make sure we don't have an open proxy.

I think the term you want is open redirect

I'm sorry but why do you post an example of an href, saying it's "horrible", when you don't know what it is doing?

Because I can no longer just right click copy or hold/tap to link it to a friend

You can. The link still works, it's just ugly. And, as @yegg said, it's because you're browsing the lite version. Just disable the anti-tracking feature if you want.

This ddg redirect misfeature should be opt-in, not opt-out, imo.

Considering this is a well-known, well-advertised feature from many many many years ago, and has long been the way they do things, it's not going to suddenly change because you think more people should be tracked by default.

Considering it is a misfeature, I'd rather they think twice: I'm neither on a older browser nor do I disable JavaScript and yet I'm subject to ddg's terribly slow redirects.

> terribly slow redirects

Huh? Ive just checked with multiple links, it’s quite fast. I don’t think that user experience that can be measured in fractions of second can be referred as “terribly slow”.

Latency is a long tailed distribution, and that's discounting the fact that various regions in the world won't see similar perf. Given the number of times I use ddg in a day, I usually hit slow redirects more often than not. I mean, we didn't go from http1 to http2 / vps to edge / tcp to quic only for ddg to add an additional redirect.

> various regions won’t see similar perf

How’s the latency of ddg redirects depends on the region?

> given the number of times I use ddg in a day

What’s you estimation? A hundred? It’s something like a minute or two of accumulated time. It’s not even worth mentioning.

Also I doubt that the redirect delay should be taken in account at all. The workflow may vary (obviously) but I normally open a link in a separate tab. By the time you click on this tab all the redirect work has finished. What’s your workflow and how does the redirect delay impact it?