4 ms·

The problem with self-hosted search engine is that they make you _very_ unique: you’re the only client of the ”backend“ engine with that (static and non-NATed)

The problem with self-hosted search engine is that they make you _very_ unique: you’re the only client of the ”backend“ engine with that (static and non-NATed) IP. Furthermore, you’re now one of the small group of people with ”hosting“ IPs. Using self-hosted SearX may make you easier to track, not harder. Using SearX hosted by someone else is marginally better, but now you have to trust the owner of the server, which is probably not what you want for privacy-centered search engine.

woodruffw 5y ago
Could you clarify where the privacy concern is here? As I understand it, I'm sharing my IP with search engines anyways; the only difference with a self-hosted SearX instance is that I'm sharing my server's IP instead. Is the concern that the latter's IP isn't behind a NAT, and therefore is more unique? If so, I think that's the least concerning of the identifying datapoints that a search engine has access to -- my browser metadata is far more identifying. With SearX, that information doesn't get forwarded (IIUC).
- mekster 5y ago
  Server IP can easily be differentiated from casual internet users' IP, and since you also don't usually get a server IP rotated, you're pretty much stuck on a single IP and you're easy to be categorized as an unique user no matter which device or location you use it from.
randomsilence 5y ago
When you click a link on your SearX instance and you don't use referrers, how can anybody track you? Nobody knows that you are coming from your "backend" engine. You just reveal your search queries to the hosting provider if he maliciously intercepts them.
marc_abonce 5y ago
If you don't want to expose your IP address, you can configure searx to proxy all the queries through Tor. This obviously makes the instance way slower and you'll have to disable some engines that block Tor exit nodes, so it's a trade-off.
- goldsteinq 5y ago
  Tor exit nodes are public and given that SearX traffic is easily distinguishable from normal traffic, you're once again in a very unique group of people who use SearX + Tor setup.
- mekster 5y ago
  Probably better to let your server go through some public VPN service.
3np 5y ago
What you can do is: * Share your instance with some friends (though of course it shifts the trust one level down) * Route outgoing requests through tor / some VPN. In a hosted environment that you configure once for "everywhere", it's more feasible to do fun things like "Google searches over OperaVPN, bing searches through Mullvad, everything else through Tor". You could even change proxies. Especially with the latter you can kind of "eat the cake and have it too", with some added latency of course. As a bonus, searx can also be configured to rewrite links (yt->piped, twitter->nitter, imgur->rimgu etc) and remove tracking query parameters.
- no_time 5y ago
  Do you know hosting companies that allow crawling and scanning? Most explicitly forbid such things as it makes their ip addresses worth less.
  - 3np 5y ago
    Really? Past employers have done quite heavy automated web queries across several major providers, who never had an issue, even when discussing our use-cases with them. At one point we had ~1000 AWS EIPs in one account solely for increasing throughput (this was an effect of the legacy solution outgrowing its intended lifetime way longer than we wanted, if you scoff at how uneconomical that sounds and is. Just saying, AWS supported us throughout). Either way, what we're talking about here is more akin to an http proxy than scanning/crawling - since every request is explicitly triggered by manual user action as opposed to automated so it shouldn't be any issue. If you expose and advertise a public unauthenticated frontend and end up with 10ks of users maaaaybe some providers will start talking to you about it but otherwise I wouldn't have any concerns. And if you get to that scale, you may already want to look at proxying through providers like Luminati anyway.
  - 3np 5y ago
    To add on my other comment: Vultr and Linode are both providing guides on how to set up searx on their platforms, so there you have two that will not raise any issue. https://www.vultr.com/docs/install-searx-with-nginx-on-ubuntu-20-10 https://www.vultr.com/docs/install-searx-with-nginx-on-ubunt... https://www.linode.com/content/maximize-your-privacy-with-searx-diy-cloud/ https://www.linode.com/content/maximize-your-privacy-with-se...

woodruffw 5y ago

Could you clarify where the privacy concern is here? As I understand it, I'm sharing my IP with search engines anyways; the only difference with a self-hosted SearX instance is that I'm sharing my server's IP instead. Is the concern that the latter's IP isn't behind a NAT, and therefore is more unique? If so, I think that's the least concerning of the identifying datapoints that a search engine has access to -- my browser metadata is far more identifying. With SearX, that information doesn't get forwarded (IIUC).

mekster 5y ago
Server IP can easily be differentiated from casual internet users' IP, and since you also don't usually get a server IP rotated, you're pretty much stuck on a single IP and you're easy to be categorized as an unique user no matter which device or location you use it from.

randomsilence 5y ago

When you click a link on your SearX instance and you don't use referrers, how can anybody track you? Nobody knows that you are coming from your "backend" engine. You just reveal your search queries to the hosting provider if he maliciously intercepts them.

marc_abonce 5y ago

If you don't want to expose your IP address, you can configure searx to proxy all the queries through Tor. This obviously makes the instance way slower and you'll have to disable some engines that block Tor exit nodes, so it's a trade-off.

goldsteinq 5y ago
Tor exit nodes are public and given that SearX traffic is easily distinguishable from normal traffic, you're once again in a very unique group of people who use SearX + Tor setup.
mekster 5y ago
Probably better to let your server go through some public VPN service.

3np 5y ago

What you can do is: * Share your instance with some friends (though of course it shifts the trust one level down) * Route outgoing requests through tor / some VPN. In a hosted environment that you configure once for "everywhere", it's more feasible to do fun things like "Google searches over OperaVPN, bing searches through Mullvad, everything else through Tor". You could even change proxies. Especially with the latter you can kind of "eat the cake and have it too", with some added latency of course. As a bonus, searx can also be configured to rewrite links (yt->piped, twitter->nitter, imgur->rimgu etc) and remove tracking query parameters.

no_time 5y ago
Do you know hosting companies that allow crawling and scanning? Most explicitly forbid such things as it makes their ip addresses worth less.
- 3np 5y ago
  Really? Past employers have done quite heavy automated web queries across several major providers, who never had an issue, even when discussing our use-cases with them. At one point we had ~1000 AWS EIPs in one account solely for increasing throughput (this was an effect of the legacy solution outgrowing its intended lifetime way longer than we wanted, if you scoff at how uneconomical that sounds and is. Just saying, AWS supported us throughout). Either way, what we're talking about here is more akin to an http proxy than scanning/crawling - since every request is explicitly triggered by manual user action as opposed to automated so it shouldn't be any issue. If you expose and advertise a public unauthenticated frontend and end up with 10ks of users maaaaybe some providers will start talking to you about it but otherwise I wouldn't have any concerns. And if you get to that scale, you may already want to look at proxying through providers like Luminati anyway.
- 3np 5y ago
  To add on my other comment: Vultr and Linode are both providing guides on how to set up searx on their platforms, so there you have two that will not raise any issue. https://www.vultr.com/docs/install-searx-with-nginx-on-ubuntu-20-10 https://www.vultr.com/docs/install-searx-with-nginx-on-ubunt... https://www.linode.com/content/maximize-your-privacy-with-searx-diy-cloud/ https://www.linode.com/content/maximize-your-privacy-with-se...