7 ms·
DuckDuckGo just launched a DDG branded XMPP service
- va_coder 16y agoThere are many secure ways to use XMPP. What is so great about ddg doing it?
- mike-cardwell 16y agoI can't answer that question. However, I did leave the following comment on their announcement page: Will you be following the same principals in regard to privacy as the DDG search engine follows? Personally, I would love to see the following: 1.) No connection logging. Ie, don't log when people log in and from which IPs 2.) No chat logs 3.) High profile information and instructions on how people can use OTR (Off the Record) for end to end chat encryption 4.) A Tor hidden service gateway to the XMPP server Regarding 1 and 2, the least that is required IMO is a privacy policy detailing which information is stored and for how long.
- drdaeman 16y agoI think, general (tech-savvy) audience would more enjoy encrypted logging (message archiving), using some variant of XEP-0136, but storing messages encrypted to user's public PGP/GPG key. So the messages are kept (in case you want to refresh your memory, but don't have locally-stored history), but are unaccessible by third parties.
- mike-cardwell 16y agoI'm not sure about that. People who want chat logs can simply generate them on the client side. That way, even if they're using OTR they still get the chat logs.
- drdaeman 16y agoYes, but how they're going to access logs when connecting to XMPP service from multiple machines?
- mike-cardwell 16y agoBy checking the logs on the machine the logs are on. Besides, anyone who is tech savvy enough to mess with public key encryption is going to be using OTR anyway, making server side logs useless.
- drdaeman 16y agoI'm using OTR, but only for conversations that are worth protecting. IMHO securing typical chat with friends (mostly consisting of funny/interesting link exchanges) is almost pointless. But having the history is still useful ("remember that article I've sent you yesterday").
- mike-cardwell 16y agoNot as pointless as most people intuitively think. What if the chat server you're using is compromised by a hacker trying to make a name for themselves and they publish all of the chat logs on bittorrent? Some examples of comments in a private chat that might at first appear like they don't need encrypting, but might come back and bite you in the arse if they ever get published: "God work is boring today. Need to update my CV/Resume" "Bob was a bit of an idiot last night wasn't he" "Thinking of skiving off work tomorrow." "The wife has been nagging at me all afternoon. Fancy a pint later?"
- mnutt 16y agoDepending on how secure you want to be, the existence of encrypted/non-encrypted information reveals things as well. Someone could infer something by just knowing that you turned on OTR at a certain time.
- ZoFreX 16y ago> People who want chat logs can simply generate them on the client side. That wouldn't fulfil 90% of the purpose of keeping logs, for me at least. Not everyone has the same requirements as you - I for one very rarely bother with OTR, but I have to search my chat logs for something on an almost daily basis. I use XMPP on my work PC, on my laptop and desktop at home, and on my phone. Splitting the logs across all those devices would make them literally useless.
- gettygermany 16y agoWe at DuckDuckGo assure the same anti-tracking policy on our XMPP server. There is nothing greater about DDG then other sites following the same policy :-). But its DDG :-)
- mike-cardwell 16y agoThat's cool. But I've no idea if you're retaining IP logs and chat logs. You really need a service specific privacy policy which details exactly what you store and for how long.
- gettygermany 16y agoWe definitly will add such a page, so far i can point you to the statement on our forum, you can see it here: http://duck.co/topic/duckduckgo-s-new-public-xmpp-jabber-service-on-dukgo-com http://duck.co/topic/duckduckgo-s-new-public-xmpp-jabber-ser... See down under the comments, i explained there what is so far logged, but we will tune this now over the next days.
- AdamGibbins 16y agoFor those that haven't tried before, running your own XMPP server is incredibly easy on even a small VPS. I'd recommend ejabberd, its pretty solid, light weight and fast.
- gettygermany 16y agoI always suggest prosody :-) And we use this as our XMPP server cause its the modern way to use XMPP :)
- HedgeMage 16y agoI second the Prosody recommendation. I'm in the process of migrating my Jabber server to it, and it's quite slick.
- almost 16y agoVery cool, although it could probable use a name. Maybe "DuckDuckChat"? "DuckDuckGo XMPP Service" is not going to be used by all but the most technical of users I think... Even "DuckDuckGo Jabber Service" is better, XMPP just sounds so unfriendly.
- sudont 16y agoQuack?
- gettygermany 16y agoWe will see :-) So far we dont have a place where we put the name lol :-) All step by step! :-)
- newman314 16y agoDuckDuckJab
- throwaway32 16y agoapparently Google pointed duck.com at the Google search main page after Duck Duck Go inquired about it. I guess this is why its duck.co EDIT See this post by yegg, the duck duck go founder http://www.reddit.com/r/technology/comments/epd59/google_points_duckcom_at_google_search_after_duck/c19v4cz http://www.reddit.com/r/technology/comments/epd59/google_poi...
- jimktrains2 16y agoThe URL make me cry:(
- gettygermany 16y agoWhy?! :-)
- jimktrains2 16y agohttps://duck.co/#Topic/28469000000637077 https://duck.co/#Topic/28469000000637077 Note the #. Now, remove it and everything after it and reload the page. Why am I being downvoted? Didn't we all just throw shit at gawker for doing the same thing? EDIT: This fundamentally breaks the web. The # and everything after it are _not_ sent to the server. It relies on javascript and extra-protocol information to get the document, which breaks the idea of a resource having its own name. The # was suppose to denote a section of a resource, not a resource in-and-of itself. I'm sure everyone here knows this, but I had to get it off my chest.
- thristian 16y agoI'm most interested this oblique reference: "...add our DuckDuckGo Jabber Conference, it will soon be linked to the IRC channel #duckduckgo on freenode". Where's the technology for linking an XMPP conference to an IRC channel? I lurk in some IRC channels that would love to migrate to a more modern protocol, and that seems a good way to bridge the gap.
- gettygermany 16y agoWe use a Perl Bot for this. It will uses POE-Components to connect to the IRC and to the XMPP and then dispatches the messages to one from the other. If you are interested, just join us on IRC and we talk about it :)
- p4bl0 16y agoA friend did this: https://gitorious.org/irctk https://gitorious.org/irctk ("irctk is a general-purpose IRC wrapper written in C with libircclient"). I think it could be pretty straightforward to do the job using it.
- gettygermany 16y agoWe prefer Perl, cause we got one solution for everything and can easily combine the thousands components offered. Just cause a lib does IRC doesnt help us much :-) It must be easy! :)
- cdr 16y agoAt one of my internships they had written a simple server in Java to bridge XMPP and IRC. Sounds like it's been re-invented a few times.
- agazso 16y agoXMPP has a concept of transports, that are gateways to other networks. Gateways exists for MSN, ICQ, AIM and IRC. And to answer your question, taka a look at http://xmpppy.sourceforge.net/irc/ http://xmpppy.sourceforge.net/irc/
- ritonlajoie 16y agoI'm sorry but I don't really understand the utility of that service ? Is there any link to other protocols ? What are the benefits of using this server instead of something like gtalk or some other widespread service ? Why should I jump to this service and make my friend so the switch as well ? Thanks :) edit: I know perfectly what is DDG and I really love this search engine, but still.. don't get me wrong, I'm just asking for answers there, not being rude
- gettygermany 16y agoYou dont need to convince them to switch! You can still talk to your gtalk friends, its all XMPP/Jabber! This is not a service just for inside duckduckgo. Inform yourself a bit more about XMPPP/Jabber :-).
- pbhjpbhj 16y ago>Inform yourself a bit more about XMPPP/Jabber :-). I think that perhaps, like me, they were hoping that you would be interested in sharing a couple of use cases for XMPP with us ...?
- Estragon 16y agoI'm confused about this, too. Is this mostly to replace discussion about DDG on IRC? Why is this exciting? (As with the parent comment, I'm not trying to tear anyone down. People are clearly excited about this, and I'm wondering what coolness I'm missing out on.)
- mike-cardwell 16y agoI have an account on my own XMPP server. I just added "im@ddg.gg" and I can now do DDG searches through my chat client. Not sure how useful that is, but nice nontheless. And all without having to sign up for an account directly with their XMPP service, because of federation.
- Estragon 16y ago
- deleted 16y ago[deleted]