Our XMPP services at DuckDuckGo

Thanks for using DDG!

I have found it easy to recommend to non-technical people. (In the early days of Google, I had to spell it for people too... at least this is 3 common words.)

I think the emphasis on converting non-technical people is also often misplaced. Non-technical people don't care about any of the issues that lead to development. The number of people using Skype shows most people don't care about privacy. That doesn't mean DDG's offering is not unique or valuable, it's just that the people to recognize that value will not be the majority by any stretch - but, it never is - and converting people who have the hardest time understanding that value should be a low priority IMHO.

In promoting privacy, DDG captures the union of early adopters, technically literate, and digital evangelists - all groups that are most likely to understand as well as turn around and effectively promote it (for example, by setting the homepage and default search engine after cleaning up a system for a friend)... This is the crowd to keep happy (without raising the barrier to entry either... for example, late adopters will not use bangs or care that you search Hacker News too, but the early adopters appreciate it greatly). These were the same types of people promoting the early Internet to the masses, who barely saw the point in having a computer.

In that vein, one of the best things for DDG, IMHO, would be to make setting ALL browsers as easy as possible (homepage+default search). (I know I'm not saying anything new...) There are add-ons for individual browsers, for example (which I tend not to use, because I like vanilla installations without extensions to upgrade later), and conventional methods (which I prefer, but have been de-emphasized in favor of add-ons), but further-centralizing the process of applying these customizations would be nice. For example, I'd rather download a single native app or portable script (WSH) that was capable of searching out browsers and - through check-boxes - setting their homepage and search (ideally to the SSL search), via the browser-native method (or add-on method), in one pass (usable offline, and ideally at an easy-to-type URL like "duckduckgo.com/tools"). This would help high-turn-over scenarios like tech-support shops, which has the chance to affect the most users but are also under pressure, so want to do the minimum possible (Idea: actively promote to these places).

On a different note, I'm curious how the costs associated with this XMPP service are expected to grow and how it is seen from the business side. If 100000 people started to use it for messaging, would it become too burdensome and be discontinued, or is there a plan for cost-recovery (or is the ddg bot enough of a case)?

https://jitsi.org/

They should really just rename it to Duck Duck Gray Duck.

I know it's shallow to judge a product/service by its name, but for most people hearing the name for the first time counts as an initial encounter with the product/service, and since that can leave an impression, it matters a lot.

For any media coverage about Lady Gaga, you are more likely to see column inches dedicated to deriding her appearance than you are to discussing her music.

When the Occupy protests were at their height, there were so many comments along the lines of "They may have a valid point, but no-one is going to listen to them if they dress like that"

All too often I see comments criticizing appearance as being something that indicates their value to be less. frequently it comes in the form of "I know it has value, but you should change the appearance so others can see".

I think this is counter-productive. Appearing business-like may make more people believe you are business-actual, but it also reinforces the attitude that means people judge the business-like as business-actual. It may be good for you but bad for the world. Those who wear the right suits and walk the right walk but cannot actually do the right work can deceive a lot of people.

I think pushing back against this attitude is a worthy endeavour.

  - Neil Graham,  Screaming Duck Software.

A serious product, made by serious people, focuses on serious issue (privacy) shall look like one.

Start with the core spec, RFC 3920. Right away you'll run smack into the problem of XML namespaces, which is a feature that every XML library pretends to support, but with a whole bunch of caveats. Before you can do so much as initiate a session, you will need to search the universe of XML libraries for one that implements a full parser and has good namespace support.

(When I wrote an XMPP library, I ended up using libxml2 because the only platform I care about is Linux.)

Next you'll have to implement encryption (TLS) and authentication (SASL). As with all security-related code, this part of your application is terribly easy to fuck up in a non-obvious-but-user-endangering way. Does your TLS library check that the certificate is valid? Many don't by default. Does your SASL library implement the spec correctly? SASL is complicated and difficult to test, so it's easy for even experienced developers to break authentication for some subset of users.

(I used gnutls and gsasl to do most of the heavy lifting, but still ran into many problems. For example, my library doesn't work with some versions of ejabberd because ejabberd's implementation of SCRAM-SHA-1 was broken: https://support.process-one.net/browse/EJAB-1632).

OK, so you've found a full-featured XML library, you've figured out TLS and SASL, and you can send "hello world!" to another account. Think you're done? Hahaha, no my friend, you're just getting started.

To do anything interesting with XMPP, you need to implement XMPP extensions (XEPs). There are currently three hundred and twenty seven XEPs, indexed at http://xmpp.org/xmpp-protocols/xmpp-extensions/ , and many of them are at least as large as the core spec itself. XEPs cover such important functionality as multi-user messaging, file transfer, voice/video chat, full encryption, avatars, and away messages.

(I decided to skip all that, not do any XEPs at all, and limit my library to simple one-on-one chats because that's all I needed it for. If you're writing something for use by customers, you will not have that luxury.)

And of course, it's all implemented in XML. Hope you've got a sturdy keyboard.

I still use XMPP with GChat and IMAP with Gmail. Either of those things changes I'm probably going to start using Bing and find a new email provider.

There are many practical reasons that people and organisations would rather be in control of their communications, so XMPP (or something, the protocol doesn't matter) is here to stay. The challenge is making that open network worth the big players' time, they currently don't seem to think it is.

To deal with an onslaught of spam, Google disabled incoming subscription requests for a short time. During this time, all other XMPP federation features continued to work.

No major government will forbid effective encryption, because citizens are far more afraid of other citizens than they are of the government. That's why governments request backdoors, or pass legislation permitting warrantless searches.

Think of it this way: your city council will never be able to pass a law forbidding people from locking their car door, because everyone with a car would be screaming about theft. But they could easily pass a law requiring car manufacturers to provide a master key to law enforcement.

Thanks for the feedback, and feel free to hit me up with questions (if you have any) at my $username at duckduckgo.com :)

EDIT: Or, hop on Freenode and chat with us in #duckduckgo