12 ms·

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain pla

• fiddlerwoaroof 6y ago
  This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.
  • tagawa 6y ago
    We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.
    • baby 6y ago
      I think people here are more interested to know if you’re going to fix it.
    • systemvoltage 6y ago
      It seems like DDG just doesn't want to do more work to make the browser do the sensible thing and instead piggy back on their existing favicon service, and then going to make the argument that it is safe with us. The domain of browser is totally different from reaching out to the website and rendering favicons server side. Do you not see this as a problem? I think it is acceptable to say "We agree this is a problem, and we are gonna look into fixing this" instead of pushing back on an obvious problem.
      • deleted 6y ago
        [deleted]
    • CivBase 6y ago
      > In addition, doing it this way avoids another request (and potentially multiple) to the end site. Potentially saving a few requests here and there is certainly not worth phoning home with that kind of data regardless of what records you keep how much you do to anonymize it. This is especially true for a company that has built its brand on promises of privacy! Besides, favicon requests are small potatoes compared to the kind of tracking, ads, metrics, and other often-unnecessary page resources that bog down most of the modern web. And a well-designed website can mitigate the issue pretty easily.
    • jquery 6y ago
      Saving a request is not a good reason to phone home, especially given what the DDG brand is built on and the main reason I would use it over Google. Please reconsider.
    • empressplay 6y ago
      You may not collect it, but your upstream could collect it, and encryption has a shelf life. It's a really bad look and you should ditch it.
    • woofie11 6y ago
      And all you lose in the process is hard-earned trust from people like me, who switched to DDG years ago for privacy concerns. This is troubling.
    • deleted 6y ago
      [deleted]
    • santraginean 6y ago
      Surely you could fetch the favicon asynchronously and update the address bar or tabs or wherever you display it only after the other assets are loaded? It’s not like the DOM has elements that depend on it. This is a really, really weird hill to die on.
    • miguelmota 6y ago
      I understand we’re suppose to take your word but it’s making me skeptical now about the actual intentions. If DDG truly cared about user privacy then you shouldn’t transmit user information for something as trivial as favicons.
    • franky47 6y ago
      Is this service open-source and publicly auditable ? Because we've learned not to trust one's word of "don't be evil", only facts matter. If you say the service is anonymous and does not leak data, prove it.
    • ComodoHacker 6y ago
      Please ask your higher-ups to educate you about essentials of privacy in the modern age. It's not about what you may be doing wrong, it's about what you technically could do wrong.
    • Igelau 6y ago
      It's alright, folks. We got E2EE and a pinky-swear.
    • enriquto 6y ago
      > The service is private as we do not collect any personal information This sentence is 100% meaningless. I understand you have good intentions, but these things must rely on proof, never on trust. Either you get this information or you don't; whether you say you "collect" it is inconsequential.
    • franga2000 6y ago
      I'm sorry, but this is bullshit. If the received HTML contains a <link rel="shortcut icon" ...> element, you already only need one request, so this is not an improvement. If that is present, you should NEVER use your API. If it's not present, then you have options, and yes, using your weird API is an option (which I still don't like, but ok). But sending private information to your servers even when sites follow the standard show either that you're probably not trustworthy, or that your product team is so painfully incompetent that I'd be afraid to use their browser at all.
    • stordoff 6y ago
      > We had already had created this anonymous favicon service for our private search engine. Which presumably means you've already created the logic for determining favicons. I'm not sure why this couldn't be implemented in the browser.
    • fredoliveira 6y ago
      > We had already had created this anonymous favicon service for our private search engine. I don't think here's a need for adjectives here. Why stress that it's anonymous (when that's hard to verify) or that the search engine is private, when that too is starting to come into question? Repeating these things won't will them into the reader's perception. > In addition, doing it this way avoids another request (and potentially multiple) to the end site. This isn't true, unless I'm missing something here? When I access a website, the HTML response I get from that website includes all the information my browser needs to, on its own, get and display the favicon. Can you clarify why you think/say this avoids one or more requests? What mechanism is this service a substitute for?
  • deleted 6y ago
    [deleted]
• mysterydip 6y ago
  Are all these edge cases part of the html/w3c/whichever standard? If not, let the edge cases fail. I'm not going to lose sleep over an icon not showing for a site I'm visiting once.
  • neiman 6y ago
    I agree. Sometimes it feels that companies throw any possible value out of the bus in order for the perfect UX.
• SimeVidas 6y ago
  How can users turn this off?
  • lvturner 6y ago
    Route icons.duckduckgo.com to null. Sidenote: The more I use pi-hole the more I realise how essential it is!
    • jb775 6y ago
      Are you able to block youtube ads using pi-hole?
      • moepstar 6y ago
        Sadly, not anymore - used to be the case quite a while ago, but not today anymore as the ads come from the same domains the videos are streamed from. Those simpler popover-ads which can be closed clicking an X in the upper right corner still are blocked tho... Spilling my secret tho (and YouTube execs hate me for it!): i block YouTube in my mind and only rarely go to it if i really need to watch a video (which, for me, is rarer than i ever thought it'd be).
        • dredmorbius 6y ago
          https://invidio.us https://invidio.us Or mpv (for single videos, or local playlists), or mps-youtube, or youtube-dl.
      • mahaganapati 6y ago
        It's complicated and a quickly moving target. I use pi-hole plus local browser blocking like uBlock origin.
    • jobigoud 6y ago
      Is there a difference between using pi-hole and edinting etc host on Windows? I've heard about pi-hole but I'm not sure what it does exactly.
• ajnin 6y ago
  You really can't use "we promise we won't misuse the information" as an argument, that's what everyone says whether it's true or not, and the whole point of using a privacy-centric browser is that as a user you can't trust those kinds of promises.
  • TedDoesntTalk 6y ago
    > You really can't use "we promise we won't misuse the information" as an argument Sure they can. Doesn’t mean you have to believe them.
    • cortesoft 6y ago
      When people say "you can't do" something that is already being done, it means they can't justifiably do it. Context matters for what words mean.
  • baddox 6y ago
    They’re primarily a search engine, so yes, you definitely have to trust that they won’t misuse information about what search terms you are querying for.
    • WhitneyLand 6y ago
      That’s pretty shaky ground. Trusting a site for X has nothing to do with being comfortable to trusting them with X + Y when Y is unnecessary.
      • baddox 6y ago
        I suppose that's valid. This is the first time I had heard that DDG has a browser too, and I was just assuming that anyone who would use the browser probably also uses the search engine, which they obviously have to trust when they send search queries to it.
  • lowwave 6y ago
    By the way how DDG spend money on the ads like at bus stop, I already starting to NOT trust them. Spend the money on development of development of products. Seems like time to get SearX a try now: https://searx.me https://searx.me
• ddevault 6y ago
  I'll state this in no uncertain terms: this is not acceptable, and you need to stop doing it. It makes sense on your search engine, but adding it to your web browser is very much over the line. I have read your explanations in good faith and they don't cut it. This behavior cannot continue. Good privacy promises are not based on trust - they're based on not ever handling private data in the first place. If you don't quickly admit your mistake and roll this back, it will jepoardize your entire brand - and rightfully so. If you believe this behavior is okay, then it demonstrates incompetence; if you don't believe this behavior is okay but do it anyway, it demonstrates malice. This is the one thing you Should Not Have Done.
• NotSammyHagar 6y ago
  I appreciate you answering, probably knowing you'd face some negative feedback. Saying "we should trust you, it's for a good reason" is what google and everyone else says. You'll be better off if you just end this. The loss of the fav icon is less important than keeping your credibility.
  • abnercoimbre 6y ago
    Seconded. Day in and day out we're given empty promises we can never audit -- now it's being done DuckDuckGo staff too?
    • asdfk-12 6y ago
      thirded. an inconsequential token is not a suitable reason to engage in this kind of data collection, especially for a search tool that prides itself on 'not tracking' users..
      • ehsankia 6y ago
        Fourthed, and honestly it's strange that they are willing their promise to privacy on saving 2-3 queries on something as trivial as favicons? Why does no other browser need to do this?
        • xchaotic 6y ago
          Favicon what a hill to die on
          • rawoke083600 6y ago
            For the want of an icon, the kingdom was lost !
  • Thorrez 6y ago
    > is what google and everyone else says. Do Chrome, Firefox, or Safari do this? I would assume they do it on-device.
• st3fan 6y ago
  Take the code from Firefox iOS or Android-components. We spent a lot of time on these and it is all on device. https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/android-components https://github.com/mozilla-mobile/Firefox-iOS https://github.com/mozilla-mobile/Firefox-iOS
  • nexuist 6y ago
    What a world class reply. This is what makes open source valuable.
  • antpls 6y ago
    I wonder how many lines of code from big open source applications are generic enough to be reused in other projects. Firefox and Google Chrome probably have the equivalent of many small high quality libraries embedded in them, implementing 'business' logic or protocols, that could be reused in more places. I guess a large scale study on github could be done, with a graph analysis to show potential "cut off" points in codebase.
    • sillysaurusx 6y ago
      Yeah... the gesture is nice, but good luck extracting any code from a massive project. Might as well say “Here’s some free oil; all you have to do is dig for it.” Unlike oil, this might not be worth the excavation. It’s a bit telling that they linked to the GitHub repositories rather than specific lines of code they were talking about.
      • bad_user 6y ago
        Yeah, let's violate privacy instead.
      • jan_Inkepa 6y ago
        Looking at the iOS project linked, https://github.com/mozilla-mobile/firefox-ios/blob/76faae8c6c94e22c8fbc0de72e2d06f615738e2c/Client/Utils/FaviconFetcher.swift https://github.com/mozilla-mobile/firefox-ios/blob/76faae8c6... , other than being written swift, it looks pretty self-contained/ok?
• ximeng 6y ago
  You're repeating what's on that page, which is exactly what everyone is worried about in the first place.
• jtdev 6y ago
  I don’t care if I get the favicon or not... can I just opt out of this functionality?
  • pschastain 6y ago
    From elsewhere in this thread: https://duckduckgo.com/settings#appearance https://duckduckgo.com/settings#appearance Uncheck the very last option "Site Icons"
    • harry8 6y ago
      appears to be the search engine results _not_ the browser. How if you type a url into the browser how do you stop the browser from sending that url to ddg to get the favicon?
• deleted 6y ago
  [deleted]
• aronpye 6y ago
  The road to hell is paved with good intentions. At the end of the day, your privacy policy is just a bunch of words with nothing to actually prevent you from abusing the data collected. Instead of us relying on DuckDuckGo to act ethically, just don’t collect the data in the first place.
• ViViDboarder 6y ago
  Complicated code can run just fine on device. I’ve been an avid DDG user for years and it worries me that DDG staff don’t see why this is an issue. We shouldn’t have to trust your privacy policy if you minimize exposure.
  • dTal 6y ago
    This. No matter how tricky the logic is, there's literally no reason to run that code on DDG server's and throw in a remote connection. What the hell?
    • DangerousPie 6y ago
      That's not fair. There is a very clear reason: it simplifies development for them and avoids duplicating functionality in two different codebases. You can argue about whether or not that's a good trade-off given the privacy implications (and I would agree that it's not) but you can't claim that there is "literally no reason".
• alistproducer2 6y ago
  The reviews are in for this response and they are bad. It's concerning that given the react it got, there's no edit addressing the concerns. The HN audience has to be the power user, bread and butter of a product like this and when you see a company ignore the concerns of a key constituency like this, their future almost never looks bright.
• bluetwo 6y ago
  Can you tell, for instance, how many of your users visited site A? Can you tell how many visited site A and also site B?
• Mandatum 6y ago
  What a bizarre potential privacy flaw to introduce for a tiny little icon nobody cares about. I understand it, usability and UX is important - but you guys are DDG! Come on! Your customers all have tinfoil hats!
  • Aeolun 6y ago
    > Your customers all have tinfoil hats! Generally speaking. Mine is shielded with lead.
• iandanforth 6y ago
  This is obviously an insufficient answer. Why risk your one selling point on such a trivial bit of code?
• trustmeimdrunk 6y ago
  What a wussy excuse. This should have been a no-brainer decision: do we quietly compromise privacy so that our users can have little icons on their browser tabs? How absurd. Duckduckgo chose compliance with the inconsequential minutae of bigtech over its primary pain point. This is indicative of misalignment between stated values and the values demonstrated through actions. If you guys made this call, sacrificing privacy for something so banal, it doesn't bode well for what's going on in the rest of your operations. That means the problem isnt technical, its cultural, which are unfixable, therefore it's pretty much over. Good luck to regain trust once you've been outed as a put on.
  • ta17711771 6y ago
    They need to run international ad campaigns, what's that tell you?
    • nothal 6y ago
      What is this possibly meant to imply? Nonprofits run international ad campaigns, governments run international ad campaigns, the military runs international ad campaigns, most organizations could probably find a reason if they have international domain. What is your insinuation specifically?
  • deleted 6y ago
    [deleted]
• sujesh 6y ago
  come on dude. I thought you got a better answer.
• cheez 6y ago
  I wonder how tone deaf you have to be to leave this response and think you're doing the right thing.
• byteshock 6y ago
  I’m very disappointed in how you guys responded to this. As a privacy focused company I would not have expected an answer that sounds like it came from a data collecting company like Google. I just switched to DDG browser a week ago and will now be looking for a new browser now. I hope you know this is not an appropriate response to the situation. Especially because all you guys do is preach about how much you protect your users’ privacy. Now you’re here asking us to trust you not to abuse our data and just linking us your privacy policy. I’m sad to say that my faith in the DuckDuckGo company and team is now lost.
  • minerjoe 6y ago
    Lost lost lost. I'ts not like we couldn't have predicted this disaster. One more reason to never trust a companies "word". Show me the code.
• ComodoHacker 6y ago
  Technical aspects aside, don't you agree it's a legitimate privacy concern from the user's point of view?
• jacquesm 6y ago
  Does Gabriel know about this? If not could you please clue him in and get some guidance because you are absolutely getting roasted here and are wrecking DDG's carefully built up reputation. I can easily see how this might seem to be a good idea to you and other DDG engineers but it goes 180 degrees against DDG's stated mission. In other words: you may be well outside your paygrade on this.
  • Igelau 6y ago
    > this might seem to be a good idea to you and other DDG engineers If that's true, then I am so glad they ghosted me when I applied there.
  • drawfloat 6y ago
    I don't think it's fair to say this comment is 'wrecking DDG's carefully built up reputation'. If what he describes is damaging their reputation to you, that's on the business, not on the commenter. If anything, the commenter seems to have been honest and straightforward with what's going on. Sounds like you'd prefer him to have run a message past management/public relations first?
    • jacquesm 6y ago
      If you speak in a public form in response to something that seems damaging to the reputation of the company in a way that is probably even more damaging to the reputation of that company you are either an official spokesperson or way out of your depth. Pointing that out is a service, not a sleight. And yes, if this is not in an official capacity he should either keep quiet or run it by the PR dept. People have lost their jobs for far less. Anyway, I've pinged @yegg, hopefully he can shine some light on this.
  • raxxorrax 6y ago
    > you may be well outside your paygrade on this. Not as worse as publicly denouncing an honest engineer while referencing his paygrade. I hope there is no affiliation you have with DDG to be honest, because this is much, much worse.
• Igelau 6y ago
  At this point we're all well aware why the app phones home. Continuing to spout that like it's some ward against the fact that this is a very real vulnerability is an insult. Trust me, your target audience doesn't give a crap if favicons work; they care that DDG acknowledges the risk of a glaringly obvious vulnerability. Who do you even think you're arguing with on HN and GitHub? My children can't multiply yet but they'd be able to understand why this is bad practice. The repeated handwaving that no one in your company is ever going to do something bad or stupid when the browser phones home for what amounts to a cute sticker is extremely suspicious.
• speedgoose 6y ago
  This is a bit concerning that for a company with a marketing so focus on privacy, you guys thought it was a good idea to have such a service. Nobody in the company at any point thought that it could be a problem? Your strict privacy policy mean nothing by the way, because you are a USA company and you must respect your local laws such as the patriot act, which are not very privacy friendly.
• deleted 6y ago
  [deleted]
• bn7t 6y ago
  Please choose another hill to die on. This is just not worth it. Clearly it's possible to do this on device like mozilla did it.
• MrGilbert 6y ago
  Maybe I'm too old for this, but wasn't a favicon supposed to be located at "fancy.url/favicon.ico", or alternatively as a "<link rel="shortcut icon" \>"? Curious to know why this is an issue.
  • ricardo81 6y ago
    There are variations of it now due to mobile devices, social sharing etc that may prefer a larger icon. An online favicon generator will create these variations <link rel="apple-touch-icon" sizes="57x57" href="/ico/apple-icon-57x57.png"> <link rel="apple-touch-icon" sizes="60x60" href="/ico/apple-icon-60x60.png"> <link rel="apple-touch-icon" sizes="72x72" href="/ico/apple-icon-72x72.png"> <link rel="apple-touch-icon" sizes="76x76" href="/ico/apple-icon-76x76.png"> <link rel="apple-touch-icon" sizes="114x114" href="/ico/apple-icon-114x114.png"> <link rel="apple-touch-icon" sizes="120x120" href="/ico/apple-icon-120x120.png"> <link rel="apple-touch-icon" sizes="144x144" href="/ico/apple-icon-144x144.png"> <link rel="apple-touch-icon" sizes="152x152" href="/ico/apple-icon-152x152.png"> <link rel="apple-touch-icon" sizes="180x180" href="/ico/apple-icon-180x180.png"> <link rel="icon" type="image/png" sizes="192x192" href="/ico/android-icon-192x192.png"> <link rel="icon" type="image/png" sizes="32x32" href="/ico/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="96x96" href="/ico/favicon-96x96.png"> <link rel="icon" type="image/png" sizes="16x16" href="/ico/favicon-16x16.png"> <link rel="manifest" href="/ico/manifest.json"> <meta name="msapplication-TileColor" content="#ffffff"> <meta name="msapplication-TileImage" content="/ico/ms-icon-144x144.png"> Nonetheless, the browser can see this when parsing the page and choose the appropriate path.
    • MrGilbert 6y ago
      Geez, I've been out of the webdev loop for around 10 years. That's insane.
      • pkursawe 6y ago
        favicons should be SVGs and done with it. This is really insane!
  • 6y ago
• dvdkhlng 6y ago
  In germany we have the words "Datensparsamkeit" (data parsimony) and "Datenvermeidung" (data prevention) [1]. Which wikipedia merely translates as "Privacy by design" [2]. DDG is unneccessaryly producing (aggregating), transmitting (and collecting?) very sensitive user data here, which is just the opposite of data protection. I can't even understand why they try to justify their actions. It's like omitting the seat-belt in a car, then telling customers that this was required to make the in-car entertainment system more usable. [1] https://de.wikipedia.org/wiki/Datenvermeidung_und_Datensparsamkeit https://de.wikipedia.org/wiki/Datenvermeidung_und_Datenspars... [2] https://en.wikipedia.org/wiki/Privacy_by_design https://en.wikipedia.org/wiki/Privacy_by_design
  • warpspin 6y ago
    In fact I think what they do here is illegal by GDPR. It does not matter that they say they do not collect the information, it is enough it is unnecessarily sent to their servers to make the whole function illegal. The transmission of ip address alone, which is necessary for the TCP request to happen, deanonymizes the request enough to not be considered anonymous within the GDPR framework. GDPR Article 5 (1) c: "Personal data shall be ... adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);" - this is the "Datensparsamkeit" you mentioned. Exceptions from Article 7 do not apply: The user has to give wilfully give informed consent, which he cannot do as the privacy policy of the browser omits the information that all visited domains are transmitted to DDG servers. GDPR Recital 30 "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags." Oh, and the fact I'm downvoted for a purely informational comment additionally does not shine a good light on DDG.
    • dvdkhlng 6y ago
      Yes it does not look very GDPR conformant. They may try to argue that the transmission of visited domain names serves a purpose (browser performance) and that the user agreed to that transmission by accepting the TOS etc. However, I think they may be in trouble as consent for data processing under GDPR needs to be given "freely" [1]: "When assessing whether consent is freely given, utmost account shall be taken of whether, [..] the performance of a contract[..] is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." As DDG's favicon-hack is not strictly neccessary for operating the DDG-browser, DDG would need to give users the option to opt-out of the favicon-retrieval, otherwise they may have "forced" the users to consent to the data processing, thereby voiding that consent as far as the GDPR is concerned. [1] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/
• beshrkayali 6y ago
  I'm surprised at how you're handling this. DDG is supposed to be friendly to privacy-aware users. You're dismissing people's valid points and asking them to trust you, just like any other privacy-non-friendly service would do. Edit: I'm speculating here. But specifically because of the way you've replied here and on Github, my actual level of trust in DDG team went down.
  • deleted 6y ago
    [deleted]
• rezonant 6y ago
  Doubling down is fairly ridiculous when one has to imagine the original reason for doing this was to save on time and engineering for the app by leveraging what DDG had already built, but a mindful response would be that you are aware of the downsides of this approach and you'll be working to change it. Besides, how do you handle Intranet, VPN sites, and auth-only sites where DDG's god-tier favicon parser in the cloud couldn't fetch the URL anyway?
• izietto 6y ago
  You are just repeating what's already written in the link, it isn't very useful. Try to address users' concerns instead.
• zzo38computer 6y ago
  Does it have an option to disable the internal favicon service and/or an option to disable favicons entirely? (I disable the favicons on my own computer, since I don't use them.)
• leowoo91 6y ago
  favicon has fairly enough known meta tags in case favicon.ico url is lacking
• bluesign 6y ago
  Sorry but this is not enough reason. There is a simple question you should ask to yourself. - Would you be ok to use a third party for this with same privacy policy?
• dna_polymerase 6y ago
  > We use an internal favicon service because it can be complicated to locate a favicon for a website That must be the worst justification for this possible. Favicons. Complicated to locate? Who are you trying to fool, 5 year olds?
• gap 6y ago
  It’s amazing how tone deaf technologists can be when it comes to privacy, even when they have nothing to gain by exploiting the user’s data. DDG’s response reminds me of Mark Shuttleworth’s argument that they “have root”, so we can trust them with our life. Dear DDG, you are getting complaints on GitHub and Hacker News. This is not the general public, it’s people who understand the issue. You should definitely reconsider whether you’re doing something wrong.
• scoutt 6y ago
  This answer and other replies from yourself in this page seem copypasted from here: https://help.duckduckgo.com/duckduckgo-help-pages/privacy/favicons/ https://help.duckduckgo.com/duckduckgo-help-pages/privacy/fa... why?
• Sir_Substance 6y ago
  I don't know how you can misunderstand your core demographic this badly mate. If you think the next time I hit the shitter I'm not going to be looking for a new browser, you're dead wrong. Just do the basic checks and then fall back to a DDG logo, no one cares that much about the favicon.
• bambax 6y ago
  > the purpose of the request... ... is completely irrelevant. Even if they were trying to save babies from a fire (which they really aren't) it wouldn't excuse the fact that they're doing something orthogonal to their stated policy and sole reason for existing. Everyone makes mistakes, that's not the point. The point is to correct them when they're found, instead of digging one's heels in the ground and pretending it's nothing.
• sm2i 6y ago
  so, essentially you blew privacy because of favicons? favicons??