19 ms·

Debian's Chromium changes default search engine to DDG

402 points by nobodyCloak 4y ago

aendruk 4y ago
Some unintended consequences: > This change caused my chromium browser to report that it's being managed by my "organization". I thought that my machine was somehow compromised. This is terrifying! I wound up deleting my entire chromium profile before I discovered that the root cause was this DuckDuckGo config change. https://bugs.debian.org/956012 https://bugs.debian.org/956012
- DiabloD3 4y ago
  That sounds like a Firefox bug (and a common one I've seen in other software). Tell me what organization. "Debian" would have been perfectly fine to show here.
  - mattashii 4y ago
    How is that a Firefox bug if the software it is reported on is Chromium? Those are two very distinct projects.
    - nazgulsenpai 4y ago
      Perhaps it reminds them of a similar bug in Firefox?
    - deleted 4y ago
      [deleted]
    - aendruk 4y ago
      - lohfu 4y ago
        how can you be sure? feigning verity isnt helping anything; at best you will not get downvoted.
        aendruk 4y ago
        People sometimes absentmindedly misspeak. Either that happened and you can politely s/Firefox/browser/ so that the comment reads as a reasonable, even insightful contribution to the discussion, or the comment is utter nonsense and you can feel smug that you’re not as stupid as they must be. Granting the former interpretation is the more charitable option. You should also understand that “Surely…” doesn’t mean the same thing as “I am sure”. “Surely…” is a plea for sanity.
    - chippiewill 4y ago
      Mozilla's never been the same since they started putting bugs in Chromium
    - bscphil 4y ago
      They are referring to the fact that Firefox does the exact same thing as Chromium if certain settings are changed via enterprise policy. Here's a screenshot from my browser: https://i.imgur.com/pNMMKUC.png https://i.imgur.com/pNMMKUC.png I really don't understand why Debian wouldn't just patch the source code to change the default search engine rather than shipping an enterprise policy like this.
  - DiabloD3 4y ago
    Whoops, meant Chromium. My bad.
- vetinari 4y ago
  If it was implemented by managed policy file, then Chrome/Chromium will complain exactly this way. You can see the details in the chrome://policy page.
- neilv 4y ago
  Yeah, that was alarming. Figuring out that it was innocuous took me 15-30 minutes of urgent, drop-everything-else work. I should've thought to post a Debian bug report after that (especially since the Debian bugs database was one of the first things I checked). I'd reported the cause informally to some colleagues, and then must've gotten distracted with what I was trying to do before I saw the suspicious message.
- candiddevmike 4y ago
  Sounds like a Chromium bug, not a Debian bug--it's an insidious way to keep Google search as the default.
  - sascha_sl 4y ago
    Reporting that there is a policy is no bug, but maybe there should be a way to signify that it's customized by your software vendor (i.e. signed and keys are compiled in) and that it just sets the default search engine. Chromium does change the message to "This device is managed by <google workspaces domain>" if attached to Chrome Enterprise.
    - brnt 4y ago
      Being "managed by" and loading a policy config do not equate in meaning, unless we let PR departments redefine words. Moreover, defaulting to Google is also a policy.
      - sascha_sl 4y ago
        The intent behind policy loading in Chrome is to allow an MDM to configure the browser, not for distros to not write a real patch.
        brnt 4y ago
        Perhaps. Describing loading a custom policy with "managed by" is still incorrect and potentially misleading.
      - kccqzy 4y ago
        The policy config is designed for enterprises, not software distributors. It's Debian that's taking an unnecessary shortcut here. They could've patched the source code to change the default search engine.
  - yunohn 4y ago
    Preconfigured profiles are the right way to solve this, it’s just that the message could be worded more kindly.
- sascha_sl 4y ago
  Fedora did this for a while to inject the word "Fedora" into the User Agent. They eventually stopped because users were similarly spooked.
  - fbhabbed 4y ago
    They still do it
    - babypuncher 4y ago
      I'm on a fresh install of Fedora 36 (KDE Spin) and my Firefox UA is currently showing as "Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0".
      - lohfu 4y ago
        cool, so don't switch to chromium. then the internet will know you run fedora.
        fbhabbed 4y ago
        I mean all he has to do is to uninstall fedora-chromium-config
  - MichaelCollins 4y ago
    Putting even more identifying information into User Agent strings seems completely insane, who's interests is that meant to serve? The number of people in any town with Fedora in their UA must be minuscule, that blows a huge number of 'privacy bits', and for what?
    - bravetraveler 4y ago
      I think it's for installation tracking to some degree -- they do this by the browser user agents but _also_ machine-ids sent with DNF (the package manager) I love the project, I really dislike this 'gather things that might be useful to someone' behavior and having to MITM my system to see what it's actually doing
- bravetraveler 4y ago
  This is actually not that uncommon... I've stumbled on a similar thing with the browsers as shipped by Fedora It's superficial but I completely understand the alarm For those noticing this, be aware that you'll likely see it elsewhere. Don't panic.
xuhu 4y ago
Is it common for distros to have deals with search providers in exchange for keeping them as the default in their browsers ?
- BeefWellington 4y ago
  Common? Probably not. It's not unheard of though. See: Ubuntu.
  - oblak 4y ago
    It was so cool to have amazon snoop on your presumably local searches...
    - groovybits 4y ago
      Citation? Lots of folks misremember how the Unity Home Lens feature actually worked, and that the Ubuntu installer explicitly asked you whether you wanted it enabled. If enabled, there was no presumption of local-only search. It was front and center in your search results, and the affiliate revenue was only collected when you clicked on that Amazon result. Canonical claimed that the search was forwarded to them, and then anonymized to Amazon. That's more than what Microsoft seems to do with Bing results in Windows search, which you can't seem to disable without installing third-party scripts. Was it a perfect solution? No - But it was a way to make revenue in an otherwise open-source project and free of cost. Its interesting how on some days, people argue for more money towards FOSS devs, and then others argue that revenue-building systems shouldn't be implemented. Yeah, Canonical makes enterprise investments, but they're obviously weren't in the realm of Red Hat in terms of enterprise support.
      - silisili 4y ago
        I agree that some talk at the time was overblown, most of it even. That said, it was a braindead idea to begin with. Not one person in existence wants or expects shopping links when searching their computer via a dock like interface. This is meant for applications or files. When shopping, most are going to research on Google...or perhaps search a category on Amazon itself before choosing a product. I'd be curious it Ubuntu even made a single sale from that venture.
jchw 4y ago
This leaves me with conflicting emotions. I don't know where the easiest place to find the actual explanation of the change is (not very familiar with Debian development practices) but I wonder if it clears things up.
- teloli 4y ago
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012
bla3 4y ago
DDG is for-profit and serves for the most part Bing results. Why not pick something truly open, like search.marginalia.nu?
- rvnx 4y ago
  - RockRobotRock 4y ago
    Why are you spouting off accusations without any evidence? This blind cynicism makes HN a worse place.
  - flatiron 4y ago
    They know the types of items you buy. You don’t get the exact items from Amazon. They can guess if you click a link to an iPhone and then later bought a $1,200 electronic but if you click on an iPhone and buy a PS5 they don’t know what you bought.
    - jbman223 4y ago
      That’s not exactly true - as an Amazon affiliate you do see the exact items purchased under each of your specific tracking IDs, as well as the price it was purchased for, category and device group it was purchased using (desktop, tablet, mobile). This also includes any purchases the user makes in a 24 hour session of browsing after clicking your referral link to Amazon. I’m unsure how many tracking IDs you can create in your account, and as far as I’m aware and can tell, you cannot pass specific UTM codes or other identifying information along with a click to Amazon that is passed back to you on the reporting side. Meaning, you could track users you send to Amazon, and where you’re sending them, and you can see outcomes, but Amazon only provides the tracking ID back to you as a reference (this ID is meant to be used on a site/channel wide level, but as I mentioned above could possibly be abused depending on how many you can create)
  - goodpoint 4y ago
    > I hope Debian negotiated better Do you have any evidence that Debian negotiated a deal? Debian is not a company.
lingotec 4y ago
- celdon25 4y ago
  Interesting how every post ever made on your account is to spam that link, which also happens to be the first time I had ever heard of it.
jonas-w 4y ago
Best approach i think is, they way "ungoogled-chromium" does it. They don't enforce organization policies, but they set the default config to "no search" and then leave it up to the user to change it.
- deleted 4y ago
  [deleted]
- bastardoperator 4y ago
  ^This, let the user choose. If you can run Debian you can change your default search engine.
- canadaduane 4y ago
  This is only useful for people who know what a search engine is. (Seriously, many people equate "googling" = "search engine", and don't know there is a general category of this thing). Unless there are two big bold buttons on start-up--one that says "Use Google for Search" and the other that says "Use Duck Duck Go for Search"--it would appear broken to them. Even then, almost everyone would pick "Google" just for name brand recognition.
  - lohfu 4y ago
    i would argue most people that install chromium, not chrome, no what a search engine is. unfortunately, since chromium lost google account login capabilities, i do not install chromium anymore. now i just think "search engine" means "google".
    - strken 4y ago
      I would argue that even though most people can e.g. walk up stairs or fill in a form or change their browser settings, you should often provide e.g. wheelchair ramps or helpers or sensible defaults for the ones who can't.
    - LtWorf 4y ago
      Installing chrome on debian is certainly harder than installing chromium. And you are assuming there is only 1 user in the machine. Which is not the case for people who have kids.
teloli 4y ago
Context and rationale here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012
- drexlspivey 4y ago
  TLDR > Hey let’s change the default engine to DDG > I’ve used DDG for a week, let’s do it!
  - encryptluks2 4y ago
    The way they did it shows lack of experience as well, as this will enforce the change to all users rather than simply change the default profile settings upon creation.
- chasil 4y ago
  ...slightly related question, what is the benefit of using the Debian package, versus the Ubuntu snap? As a CentOS user, the Ubuntu snap is updated much more often than the EPEL package.
  - mdaniel 4y ago
    I'm not a Debian user, but Ubuntu 22.04 tried to force snap down my throat with Firefox and it broke the hell out of everything. It turns out that a web-browser needs to run outside of a sandbox, who could have foreseen?! Anyway, so now I just manage my own updates via the tar.gz because I can't be bothered to rebuild .deb for the releases and hope snap and its flatpak friend go the way of the dodo
smm11 4y ago
Oh, no! All the people buying Debian desktops at Best Buy will be locked into issues with DDG forever.
wheelerof4te 4y ago
Did they fix the bug that did not allow you to log on to your Google account and sync from Chromium? Or was that intentional?
- striking 4y ago
  That's something Google did to Chromium, not Debian.
  - wheelerof4te 4y ago
    Ah, thank you. That's a shame.
edward 4y ago
Better link: https://tracker.debian.org/news/1355283/accepted-chromium-10405112101-1deb11u1-source-into-stable-security-embargoed-stable-security/ https://tracker.debian.org/news/1355283/accepted-chromium-10...
jacooper 4y ago
If anyone uses the debian chromium package that is. Because its always out of date, just use Flatpak.
kyrra 4y ago
Googler, opinions are my own. I don't work on chrome or anything related. Many companies put out free software to drive people towards their products, and Chrome with Google Search seems to be one of those. As many know, improving and maintaining Chrome is not free, and having Google Search being a default is one part of what helps pay for this work. Yes, this is Google, yes, this is likely a tiny drop in the bucket for them, but at the same time, it's taking away potential revenue from Google. If this was some smaller company that produced a product that had some default that pointed to one of their SaaS offerings or the like, there would be potential issues raised over the Debian maintainers changing this default.
- account42 4y ago
  > Yes, this is Google, yes, this is likely a tiny drop in the bucket for them, but at the same time, it's taking away potential revenue from Google. Good. Hopefully we will see anti-trust enforcement force Chrome and Android to not default to Google search either.
- guipsp 4y ago
  > If this was some smaller company that produced a product that had some default that pointed to one of their SaaS offerings or the like, there would be potential issues raised over the Debian maintainers changing this default. Well, thankfully this is Google, and not a small company then.
- mtmail 4y ago
  > it's taking away potential revenue from Google. Google still has 92.5% global market share, 10x more than all other search engines combined https://radar.cloudflare.com/notebooks/searchengines-2022-q1 https://radar.cloudflare.com/notebooks/searchengines-2022-q1
- bityard 4y ago
  Chromium isn't just gratis software ("free" has a different meaning), it's open source software. There is no implicit expectation that downstream users can't change it any way want[1] and redistribute the result, that's the whole point of the open source license that Chromium is released under. 1. Within existing legal boundaries, of course
TLLtchvL8KZ 4y ago
Didn't DDG recently have some controversy about censoring things they didn't like related to Russia or Russian sites/news? I don't have links stored in history but it was fairly recent, it was their CEO on twitter I believe and they got a LOT of backlash.
- blamazon 4y ago
  > "At DuckDuckGo, we've been rolling out search updates that down-rank sites associated with Russian disinformation. In addition to down-ranking sites associated with disinformation, we also often place news modules and information boxes at the top of DuckDuckGo search results (where they are seen and clicked the most) to highlight quality information for rapidly unfolding topics." https://twitter.com/yegg/status/1501716484761997318 https://twitter.com/yegg/status/1501716484761997318
  - melony 4y ago
  - yegg 4y ago
    I realize that due to own my unfortunate phrasing, how our news results rankings work have been highly misinterpreted since then. I subsequently put out a clarification thread (https://twitter.com/yegg/status/1515635886855233537 https://twitter.com/yegg/status/1515635886855233537) and then we (DuckDuckGo) made a help page to explain how our news rankings actually work. I suggest anyone interested check it out (it’s short): https://help.duckduckgo.com/duckduckgo-help-pages/results/news-rankings/ https://help.duckduckgo.com/duckduckgo-help-pages/results/ne... In hope to quickly clear up some common misconceptions about them though: we don’t censor, we don’t move things so far down that they are effectively censored, we don’t have any definition of misinformation, and we don’t rank based on any political agenda or opinions (that includes mine!). This is just a summary though so would read the help page for details.
    - torpid 4y ago
      You still haven't convinced me, or many others who used your service to the contrary, and your explanation like in this thread here doesn't match what you are preaching. https://twitter.com/pkm_inc/status/1515677462251945986 https://twitter.com/pkm_inc/status/1515677462251945986
ncmncm 4y ago
There was a posting on HN not long ago warning that DDG was run by spammers, and that the "privacy" focus is purely a marketing ploy. This should be predictable on the basis that it is a free service, making you the product, and somebody else, therefore, the customer. It is hard to know what else one can do to get useful search functionality. It has been a long time since Google dropped any emphasis on usefulness. Any useful results seem purely luck nowadays. You cannot even buy a subscription to "useful" from them or from, AFAIHF, anybody else.
- zaphar 4y ago
  I can find no actual evidence that DDG is run by spammers. This does not strike me as credible.
  - ncmncm 4y ago
    I can find no evidence that DDG is not run by spammers. Any claim that it is not is clearly what would demand solid evidence.
    - cmeacham98 4y ago
      That's not how the burden of proof works here.
      - ncmncm 4y ago
        The extraordinary claim here is the one DDG is making. They have every incentive to lie about it. There is no obvious way to check their claim.
- cmeacham98 4y ago
  Regardless of whether you are right or wrong about DDG: Doesn't this line of logic lead to every free site being evil, including the one we're talking on?
- GuB-42 4y ago
  Privacy and ads/spam are different things. DDG has ads based on your search query, that's how they make money. The difference is that they don't profile you, at least that's what they say. You can spam and respect people privacy, just by not looking who you are spamming. And yes, "privacy" is a marketing ploy for anyone who is not Google. As for general purpose search engines, there are only two: Google and Bing, most others (including DDG) are just a front for Bing. There are other, more specialized crawlers including Marginalia whose author often posts on HN, and there is Yandex for Russia and Baidu for China, but the general idea is that if it is not Google, it is Bing.
gouggoug 4y ago
Wouldn't changing the default search engine to "no default" be a solution too? I'm sure many people have thought about it, so, I wonder, what is the issue with this approach?
- judge2020 4y ago
  The year of the Linux desktop gets further away as people try to use their browser and go “why can’t I search” and drop it all together. A lot of people really don’t have the patience to configure their computers, they want it to ‘just work’.
  - gouggoug 4y ago
    Yea I guess. Though I'm having a hard time with the idea that someone who went through the trouble of running on Debian in the first place would have this reaction to the browser not automatically opening a search engine.
    - kube-system 4y ago
      Not everyone who uses Debian also was the same person who installed it. There are a few people (like me) who are crazy enough to give Linux desktop systems to real end users. Although I suppose I could just set their search engines for them, but that's just a pain.
- tinus_hn 4y ago
  For a solution to be required there first has to be a problem. Then it has to be shown the new solution is better than the current implementation. You’re not happy with the default which you can trivially change but no one has to change, so you propose having no default so you still have to change it but now everyone has to change it.
seydor 4y ago
tbh if we want some competition to google we should support bing
- Liquix 4y ago
  The big reasons people seem to be looking for alternatives are privacy concerns and increasingly aggressive optimization for NLP. DDG and Bing both have ~1% market share and both return decent results - why support the one that will ostensibly become Google II if given the opportunity?
- celdon25 4y ago
  DDG already pays Bing for use of their API though?
- codetrotter 4y ago
  DDG relies heavily on Bing, I think
- loudmax 4y ago
  Depends what kind of competition you're looking for. If we want competition for PC software, we should support anything but Bing.
Koshkin 4y ago
Halleluiah?
vladcodes 4y ago
How about removing every search engine and letting a user decide? I believe Debian users can handle this technical challenge.
unknownaccount 4y ago
Can someone please explain why we are supposed to trust DDG? Isnt it just a random website that popped up out of nowhere claiming to be private yet no audit has ever been conducted which substantiated those claims?
- no_time 4y ago
  You aren't supposed to. Even if you assume they lie in every sentence about their data collection, with their current setup it would be much harder for them to build a valuable shadow profile about you. They haven't been caught running fingerprinting scripts yet and they dont have an account system to tie to your searches. At best they could use your ip to build a shadow profile and thats wildly inaccurate in our mostly ipv4 world.
  - unknownaccount 4y ago
    How do you know what server-side profiling occurs or does not occur? There is no way to know that. DDG gives people a completely misplaced and false sense of security, when they are just as easily comprimisable/corruptable/subpoenable/susceptible to NSLs, EDRs and secret court orders as any other company. And I disagree with your premise that it's particularly difficult to link a persons IP to their real world identity. There are organized fraud gangs who have it down to a science. know exactly what dept. of the ISP to call, what to say, etc. Basically if someone knows your IP and your ISP account is registered in your name it's game over.
    - no_time 4y ago
      I am aware that they are susepctible to nation state level data collection, just like every site on the internet. I conduct all my non e2e encrypted communications/interactions with this in mind. I just want to avoid my data being monetized.
      - unknownaccount 4y ago
        I'm more worried about teenage crooks equipped with Emergency Data Request PDF templates than any nation state. We know Google, Facebook, Snapchat etc were all giving up information on users without a court order to these crooks. All it took(probably still) was a EDR notice alleging an imminent threat to human life is about to occur -sent from a real or fake police dept email- and companies will hand over your data without second thought.
radium3d 4y ago
Drop the default search engine and show us a list of search engines with the option to add our own instead of setting it for us on first run.
rlpb 4y ago
DDG is a more practical default than Google simply because I don't get a "We'd like to abuse your personal data" pop-up that gets in the way every time I open an Incognito window to search for something.
- vhgyu75e6u 4y ago
  Sadly I have found the DDG lacking, most times I have to go back to Google to find information that just doesn't show up on DDG. As an example, I don't have Twitter but I follow certain sport journalist with a huge following, all thanks to his Twitter. When I search for his name + twitter, DDG shows me articles about the journalist and even a Facebook page link, but not his twitter even if it is in the query and his handle is literally his name!
  - mdaniel 4y ago
    Did you use the "Send Feedback" in the bottom left corner? I've heard (via a comment on HN) that they do read them. I also readily admit the bottom left corner is a suboptimal place to put a feedback link, but here we are
  - rlpb 4y ago
    Twitter are so hostile to casual anonymous browsing via the web that I'm not surprised DDG aren't indexing them, and actually prefer that. It's like Twitter are actively choosing to not be part of the web. But yes, I do use !g when needed to jump to Google. It's just the default that works better on DDG for me due to the Incognito window issue - so much so that I've been running DDG by default for quite a long time now, just for that reason.
- superkuh 4y ago
  This switch by Debian to DDG is less of an issue for me than it would have been a few years ago. Google has recently been claiming it will only ever show 1000 results (10 pages of 100). But for many users, myself included, google will only ever show less than 400 results. This is apparently an intentional policy (at least according to the support forums). For me this is terrible. I can scan through 100 search results pretty quick, going 4 pages deep is something I have always done often. Seeing the reported ~82 million results shrink suddenly to 4 pages and maybe 389 results with ommitted included is extremely disheartening. But at least google scholar still works properly. When I found out about this I was so pissed I made a crappy little website to more easily complain about it to people. http://googlesearchonlyreturns400results.lol/ http://googlesearchonlyreturns400results.lol/
zzo38computer 4y ago
I think that they will need to fork the web browsers and maintain the forks instead of the originals, in order to make improvements. This is one of them but is not only one. To actually make the web browsers good, will require further changes (sometimes involving adding stuff back in that was removed in older versions, or removing some of the newly added stuff while keeping some of it). However, I would prefer the default to be "no search", and to only search if the user explicitly specifies which search engine to use. (This does not necessarily mean that Debian has to do this; it only means that it is what would be my own preference. Some other people will agree with me, although some people will disagree.) Regardless of the default settings though (sometimes different default settings might be suitable due to the distribution; in this case it doesn't matter, but for some settings of some programs, it will matter), the end user should have the opportunity to change all of the settings.
- godshatter 4y ago
  I wish they would have gone with search.brave.com, but DDG is also acceptable to me. The main reason I would have preferred brave.com has to with their using their own search engine for at least a portion of their results. I also like the discussions result they added.
Kukumber 4y ago
What a mistake It is literally against anything Debian has done the past decades Why would they choose a proprietary software and proprietary service? Chromium at least has a BSD like license and is open source [1], the search provider alternative should be similar Literally nobody can confirm DDG's privacy claims, they refused every independent audits and your search is leaking to their servers [2], it happened again [3] And let's not forget the Microsoft Bing trackers ;) [1] - https://chromium.googlesource.com/chromium/src/+/HEAD/LICENSE https://chromium.googlesource.com/chromium/src/+/HEAD/LICENS... [2] - https://github.com/duckduckgo/Android/issues/527 https://github.com/duckduckgo/Android/issues/527 [3] - https://github.com/duckduckgo/Android/issues/2004 https://github.com/duckduckgo/Android/issues/2004
andrewfromx 4y ago
surprised this isn't changing to presearch.com. Google and DDG are great but the presearch concept of paying ME to do searches, I just love.
- mdaniel 4y ago
  I can't recall a single 502 response that I've ever gotten from DDG, but plenty of them for presearch, to say nothing of their closed-source node software. I enjoy advocating new tech as much as the next person, but not "route searches through who knows what, and only respond to queries some of the time" worth
account42 4y ago
Changing the search engine of existing installs is quite questionable and it is worrying that this was released without a much bigger discussion involving not just the maintainers of the browser package going by their personal feelings. If I was a debian user I would be mad.
- frenchman99 4y ago
  Debian being free of cost, I dont think you have a right to be mad about anything if you don't help with maintenance. Open source maintainers are not your employees. Users can always switch back to Google if they so desire.
GuB-42 4y ago
I don't mind the idea of changing the default search engine to DDG, but not in a stable release, do that in testing. It is opinionated choice, not a bug fix, and definitely not a security update (severity: wishlist). I don't have a problem with maintainers having opinions, but on a stable distribution like Debian, I would have preferred they expressed them before the freeze.

402 points by nobodyCloak 4y ago

Some unintended consequences: > This change caused my chromium browser to report that it's being managed by my "organization". I thought that my machine was somehow compromised. This is terrifying! I wound up deleting my entire chromium profile before I discovered that the root cause was this DuckDuckGo config change. https://bugs.debian.org/956012 https://bugs.debian.org/956012

DiabloD3 4y ago
That sounds like a Firefox bug (and a common one I've seen in other software). Tell me what organization. "Debian" would have been perfectly fine to show here.
- mattashii 4y ago
  How is that a Firefox bug if the software it is reported on is Chromium? Those are two very distinct projects.
  - nazgulsenpai 4y ago
    Perhaps it reminds them of a similar bug in Firefox?
  - deleted 4y ago
    [deleted]
  - aendruk 4y ago
    - lohfu 4y ago
      how can you be sure? feigning verity isnt helping anything; at best you will not get downvoted.
      - aendruk 4y ago
        People sometimes absentmindedly misspeak. Either that happened and you can politely s/Firefox/browser/ so that the comment reads as a reasonable, even insightful contribution to the discussion, or the comment is utter nonsense and you can feel smug that you’re not as stupid as they must be. Granting the former interpretation is the more charitable option. You should also understand that “Surely…” doesn’t mean the same thing as “I am sure”. “Surely…” is a plea for sanity.
  - chippiewill 4y ago
    Mozilla's never been the same since they started putting bugs in Chromium
  - bscphil 4y ago
    They are referring to the fact that Firefox does the exact same thing as Chromium if certain settings are changed via enterprise policy. Here's a screenshot from my browser: https://i.imgur.com/pNMMKUC.png https://i.imgur.com/pNMMKUC.png I really don't understand why Debian wouldn't just patch the source code to change the default search engine rather than shipping an enterprise policy like this.
- DiabloD3 4y ago
  Whoops, meant Chromium. My bad.
vetinari 4y ago
If it was implemented by managed policy file, then Chrome/Chromium will complain exactly this way. You can see the details in the chrome://policy page.
neilv 4y ago
Yeah, that was alarming. Figuring out that it was innocuous took me 15-30 minutes of urgent, drop-everything-else work. I should've thought to post a Debian bug report after that (especially since the Debian bugs database was one of the first things I checked). I'd reported the cause informally to some colleagues, and then must've gotten distracted with what I was trying to do before I saw the suspicious message.
candiddevmike 4y ago
Sounds like a Chromium bug, not a Debian bug--it's an insidious way to keep Google search as the default.
- sascha_sl 4y ago
  Reporting that there is a policy is no bug, but maybe there should be a way to signify that it's customized by your software vendor (i.e. signed and keys are compiled in) and that it just sets the default search engine. Chromium does change the message to "This device is managed by <google workspaces domain>" if attached to Chrome Enterprise.
  - brnt 4y ago
    Being "managed by" and loading a policy config do not equate in meaning, unless we let PR departments redefine words. Moreover, defaulting to Google is also a policy.
    - sascha_sl 4y ago
      The intent behind policy loading in Chrome is to allow an MDM to configure the browser, not for distros to not write a real patch.
      - brnt 4y ago
        Perhaps. Describing loading a custom policy with "managed by" is still incorrect and potentially misleading.
    - kccqzy 4y ago
      The policy config is designed for enterprises, not software distributors. It's Debian that's taking an unnecessary shortcut here. They could've patched the source code to change the default search engine.
- yunohn 4y ago
  Preconfigured profiles are the right way to solve this, it’s just that the message could be worded more kindly.
sascha_sl 4y ago
Fedora did this for a while to inject the word "Fedora" into the User Agent. They eventually stopped because users were similarly spooked.
- fbhabbed 4y ago
  They still do it
  - babypuncher 4y ago
    I'm on a fresh install of Fedora 36 (KDE Spin) and my Firefox UA is currently showing as "Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0".
    - lohfu 4y ago
      cool, so don't switch to chromium. then the internet will know you run fedora.
      - fbhabbed 4y ago
        I mean all he has to do is to uninstall fedora-chromium-config
- MichaelCollins 4y ago
  Putting even more identifying information into User Agent strings seems completely insane, who's interests is that meant to serve? The number of people in any town with Fedora in their UA must be minuscule, that blows a huge number of 'privacy bits', and for what?
  - bravetraveler 4y ago
    I think it's for installation tracking to some degree -- they do this by the browser user agents but _also_ machine-ids sent with DNF (the package manager) I love the project, I really dislike this 'gather things that might be useful to someone' behavior and having to MITM my system to see what it's actually doing
bravetraveler 4y ago
This is actually not that uncommon... I've stumbled on a similar thing with the browsers as shipped by Fedora It's superficial but I completely understand the alarm For those noticing this, be aware that you'll likely see it elsewhere. Don't panic.

xuhu 4y ago

Is it common for distros to have deals with search providers in exchange for keeping them as the default in their browsers ?

BeefWellington 4y ago
Common? Probably not. It's not unheard of though. See: Ubuntu.
- oblak 4y ago
  It was so cool to have amazon snoop on your presumably local searches...
  - groovybits 4y ago
    Citation? Lots of folks misremember how the Unity Home Lens feature actually worked, and that the Ubuntu installer explicitly asked you whether you wanted it enabled. If enabled, there was no presumption of local-only search. It was front and center in your search results, and the affiliate revenue was only collected when you clicked on that Amazon result. Canonical claimed that the search was forwarded to them, and then anonymized to Amazon. That's more than what Microsoft seems to do with Bing results in Windows search, which you can't seem to disable without installing third-party scripts. Was it a perfect solution? No - But it was a way to make revenue in an otherwise open-source project and free of cost. Its interesting how on some days, people argue for more money towards FOSS devs, and then others argue that revenue-building systems shouldn't be implemented. Yeah, Canonical makes enterprise investments, but they're obviously weren't in the realm of Red Hat in terms of enterprise support.
    - silisili 4y ago
      I agree that some talk at the time was overblown, most of it even. That said, it was a braindead idea to begin with. Not one person in existence wants or expects shopping links when searching their computer via a dock like interface. This is meant for applications or files. When shopping, most are going to research on Google...or perhaps search a category on Amazon itself before choosing a product. I'd be curious it Ubuntu even made a single sale from that venture.

jchw 4y ago

This leaves me with conflicting emotions. I don't know where the easiest place to find the actual explanation of the change is (not very familiar with Debian development practices) but I wonder if it clears things up.

teloli 4y ago
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012

bla3 4y ago

DDG is for-profit and serves for the most part Bing results. Why not pick something truly open, like search.marginalia.nu?

rvnx 4y ago
- RockRobotRock 4y ago
  Why are you spouting off accusations without any evidence? This blind cynicism makes HN a worse place.
- flatiron 4y ago
  They know the types of items you buy. You don’t get the exact items from Amazon. They can guess if you click a link to an iPhone and then later bought a $1,200 electronic but if you click on an iPhone and buy a PS5 they don’t know what you bought.
  - jbman223 4y ago
    That’s not exactly true - as an Amazon affiliate you do see the exact items purchased under each of your specific tracking IDs, as well as the price it was purchased for, category and device group it was purchased using (desktop, tablet, mobile). This also includes any purchases the user makes in a 24 hour session of browsing after clicking your referral link to Amazon. I’m unsure how many tracking IDs you can create in your account, and as far as I’m aware and can tell, you cannot pass specific UTM codes or other identifying information along with a click to Amazon that is passed back to you on the reporting side. Meaning, you could track users you send to Amazon, and where you’re sending them, and you can see outcomes, but Amazon only provides the tracking ID back to you as a reference (this ID is meant to be used on a site/channel wide level, but as I mentioned above could possibly be abused depending on how many you can create)
- goodpoint 4y ago
  > I hope Debian negotiated better Do you have any evidence that Debian negotiated a deal? Debian is not a company.

lingotec 4y ago

celdon25 4y ago
Interesting how every post ever made on your account is to spam that link, which also happens to be the first time I had ever heard of it.

jonas-w 4y ago

Best approach i think is, they way "ungoogled-chromium" does it. They don't enforce organization policies, but they set the default config to "no search" and then leave it up to the user to change it.

deleted 4y ago
[deleted]
bastardoperator 4y ago
^This, let the user choose. If you can run Debian you can change your default search engine.
canadaduane 4y ago
This is only useful for people who know what a search engine is. (Seriously, many people equate "googling" = "search engine", and don't know there is a general category of this thing). Unless there are two big bold buttons on start-up--one that says "Use Google for Search" and the other that says "Use Duck Duck Go for Search"--it would appear broken to them. Even then, almost everyone would pick "Google" just for name brand recognition.
- lohfu 4y ago
  i would argue most people that install chromium, not chrome, no what a search engine is. unfortunately, since chromium lost google account login capabilities, i do not install chromium anymore. now i just think "search engine" means "google".
  - strken 4y ago
    I would argue that even though most people can e.g. walk up stairs or fill in a form or change their browser settings, you should often provide e.g. wheelchair ramps or helpers or sensible defaults for the ones who can't.
  - LtWorf 4y ago
    Installing chrome on debian is certainly harder than installing chromium. And you are assuming there is only 1 user in the machine. Which is not the case for people who have kids.

teloli 4y ago

Context and rationale here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956012

drexlspivey 4y ago
TLDR > Hey let’s change the default engine to DDG > I’ve used DDG for a week, let’s do it!
- encryptluks2 4y ago
  The way they did it shows lack of experience as well, as this will enforce the change to all users rather than simply change the default profile settings upon creation.
chasil 4y ago
...slightly related question, what is the benefit of using the Debian package, versus the Ubuntu snap? As a CentOS user, the Ubuntu snap is updated much more often than the EPEL package.
- mdaniel 4y ago
  I'm not a Debian user, but Ubuntu 22.04 tried to force snap down my throat with Firefox and it broke the hell out of everything. It turns out that a web-browser needs to run outside of a sandbox, who could have foreseen?! Anyway, so now I just manage my own updates via the tar.gz because I can't be bothered to rebuild .deb for the releases and hope snap and its flatpak friend go the way of the dodo

smm11 4y ago

Oh, no! All the people buying Debian desktops at Best Buy will be locked into issues with DDG forever.

wheelerof4te 4y ago

Did they fix the bug that did not allow you to log on to your Google account and sync from Chromium? Or was that intentional?

striking 4y ago
That's something Google did to Chromium, not Debian.
- wheelerof4te 4y ago
  Ah, thank you. That's a shame.

edward 4y ago

Better link: https://tracker.debian.org/news/1355283/accepted-chromium-10405112101-1deb11u1-source-into-stable-security-embargoed-stable-security/ https://tracker.debian.org/news/1355283/accepted-chromium-10...

jacooper 4y ago

If anyone uses the debian chromium package that is. Because its always out of date, just use Flatpak.

kyrra 4y ago

Googler, opinions are my own. I don't work on chrome or anything related. Many companies put out free software to drive people towards their products, and Chrome with Google Search seems to be one of those. As many know, improving and maintaining Chrome is not free, and having Google Search being a default is one part of what helps pay for this work. Yes, this is Google, yes, this is likely a tiny drop in the bucket for them, but at the same time, it's taking away potential revenue from Google. If this was some smaller company that produced a product that had some default that pointed to one of their SaaS offerings or the like, there would be potential issues raised over the Debian maintainers changing this default.

account42 4y ago
> Yes, this is Google, yes, this is likely a tiny drop in the bucket for them, but at the same time, it's taking away potential revenue from Google. Good. Hopefully we will see anti-trust enforcement force Chrome and Android to not default to Google search either.
guipsp 4y ago
> If this was some smaller company that produced a product that had some default that pointed to one of their SaaS offerings or the like, there would be potential issues raised over the Debian maintainers changing this default. Well, thankfully this is Google, and not a small company then.
mtmail 4y ago
> it's taking away potential revenue from Google. Google still has 92.5% global market share, 10x more than all other search engines combined https://radar.cloudflare.com/notebooks/searchengines-2022-q1 https://radar.cloudflare.com/notebooks/searchengines-2022-q1
bityard 4y ago
Chromium isn't just gratis software ("free" has a different meaning), it's open source software. There is no implicit expectation that downstream users can't change it any way want[1] and redistribute the result, that's the whole point of the open source license that Chromium is released under. 1. Within existing legal boundaries, of course

TLLtchvL8KZ 4y ago

Didn't DDG recently have some controversy about censoring things they didn't like related to Russia or Russian sites/news? I don't have links stored in history but it was fairly recent, it was their CEO on twitter I believe and they got a LOT of backlash.

blamazon 4y ago
> "At DuckDuckGo, we've been rolling out search updates that down-rank sites associated with Russian disinformation. In addition to down-ranking sites associated with disinformation, we also often place news modules and information boxes at the top of DuckDuckGo search results (where they are seen and clicked the most) to highlight quality information for rapidly unfolding topics." https://twitter.com/yegg/status/1501716484761997318 https://twitter.com/yegg/status/1501716484761997318
- melony 4y ago
- yegg 4y ago
  I realize that due to own my unfortunate phrasing, how our news results rankings work have been highly misinterpreted since then. I subsequently put out a clarification thread (https://twitter.com/yegg/status/1515635886855233537 https://twitter.com/yegg/status/1515635886855233537) and then we (DuckDuckGo) made a help page to explain how our news rankings actually work. I suggest anyone interested check it out (it’s short): https://help.duckduckgo.com/duckduckgo-help-pages/results/news-rankings/ https://help.duckduckgo.com/duckduckgo-help-pages/results/ne... In hope to quickly clear up some common misconceptions about them though: we don’t censor, we don’t move things so far down that they are effectively censored, we don’t have any definition of misinformation, and we don’t rank based on any political agenda or opinions (that includes mine!). This is just a summary though so would read the help page for details.
  - torpid 4y ago
    You still haven't convinced me, or many others who used your service to the contrary, and your explanation like in this thread here doesn't match what you are preaching. https://twitter.com/pkm_inc/status/1515677462251945986 https://twitter.com/pkm_inc/status/1515677462251945986

ncmncm 4y ago

There was a posting on HN not long ago warning that DDG was run by spammers, and that the "privacy" focus is purely a marketing ploy. This should be predictable on the basis that it is a free service, making you the product, and somebody else, therefore, the customer. It is hard to know what else one can do to get useful search functionality. It has been a long time since Google dropped any emphasis on usefulness. Any useful results seem purely luck nowadays. You cannot even buy a subscription to "useful" from them or from, AFAIHF, anybody else.

zaphar 4y ago
I can find no actual evidence that DDG is run by spammers. This does not strike me as credible.
- ncmncm 4y ago
  I can find no evidence that DDG is not run by spammers. Any claim that it is not is clearly what would demand solid evidence.
  - cmeacham98 4y ago
    That's not how the burden of proof works here.
    - ncmncm 4y ago
      The extraordinary claim here is the one DDG is making. They have every incentive to lie about it. There is no obvious way to check their claim.
cmeacham98 4y ago
Regardless of whether you are right or wrong about DDG: Doesn't this line of logic lead to every free site being evil, including the one we're talking on?
GuB-42 4y ago
Privacy and ads/spam are different things. DDG has ads based on your search query, that's how they make money. The difference is that they don't profile you, at least that's what they say. You can spam and respect people privacy, just by not looking who you are spamming. And yes, "privacy" is a marketing ploy for anyone who is not Google. As for general purpose search engines, there are only two: Google and Bing, most others (including DDG) are just a front for Bing. There are other, more specialized crawlers including Marginalia whose author often posts on HN, and there is Yandex for Russia and Baidu for China, but the general idea is that if it is not Google, it is Bing.

gouggoug 4y ago

Wouldn't changing the default search engine to "no default" be a solution too? I'm sure many people have thought about it, so, I wonder, what is the issue with this approach?

judge2020 4y ago
The year of the Linux desktop gets further away as people try to use their browser and go “why can’t I search” and drop it all together. A lot of people really don’t have the patience to configure their computers, they want it to ‘just work’.
- gouggoug 4y ago
  Yea I guess. Though I'm having a hard time with the idea that someone who went through the trouble of running on Debian in the first place would have this reaction to the browser not automatically opening a search engine.
  - kube-system 4y ago
    Not everyone who uses Debian also was the same person who installed it. There are a few people (like me) who are crazy enough to give Linux desktop systems to real end users. Although I suppose I could just set their search engines for them, but that's just a pain.
tinus_hn 4y ago
For a solution to be required there first has to be a problem. Then it has to be shown the new solution is better than the current implementation. You’re not happy with the default which you can trivially change but no one has to change, so you propose having no default so you still have to change it but now everyone has to change it.

seydor 4y ago

tbh if we want some competition to google we should support bing

Liquix 4y ago
The big reasons people seem to be looking for alternatives are privacy concerns and increasingly aggressive optimization for NLP. DDG and Bing both have ~1% market share and both return decent results - why support the one that will ostensibly become Google II if given the opportunity?
celdon25 4y ago
DDG already pays Bing for use of their API though?
codetrotter 4y ago
DDG relies heavily on Bing, I think
loudmax 4y ago
Depends what kind of competition you're looking for. If we want competition for PC software, we should support anything but Bing.

Koshkin 4y ago

Halleluiah?

vladcodes 4y ago

How about removing every search engine and letting a user decide? I believe Debian users can handle this technical challenge.

unknownaccount 4y ago

Can someone please explain why we are supposed to trust DDG? Isnt it just a random website that popped up out of nowhere claiming to be private yet no audit has ever been conducted which substantiated those claims?

no_time 4y ago
You aren't supposed to. Even if you assume they lie in every sentence about their data collection, with their current setup it would be much harder for them to build a valuable shadow profile about you. They haven't been caught running fingerprinting scripts yet and they dont have an account system to tie to your searches. At best they could use your ip to build a shadow profile and thats wildly inaccurate in our mostly ipv4 world.
- unknownaccount 4y ago
  How do you know what server-side profiling occurs or does not occur? There is no way to know that. DDG gives people a completely misplaced and false sense of security, when they are just as easily comprimisable/corruptable/subpoenable/susceptible to NSLs, EDRs and secret court orders as any other company. And I disagree with your premise that it's particularly difficult to link a persons IP to their real world identity. There are organized fraud gangs who have it down to a science. know exactly what dept. of the ISP to call, what to say, etc. Basically if someone knows your IP and your ISP account is registered in your name it's game over.
  - no_time 4y ago
    I am aware that they are susepctible to nation state level data collection, just like every site on the internet. I conduct all my non e2e encrypted communications/interactions with this in mind. I just want to avoid my data being monetized.
    - unknownaccount 4y ago
      I'm more worried about teenage crooks equipped with Emergency Data Request PDF templates than any nation state. We know Google, Facebook, Snapchat etc were all giving up information on users without a court order to these crooks. All it took(probably still) was a EDR notice alleging an imminent threat to human life is about to occur -sent from a real or fake police dept email- and companies will hand over your data without second thought.

radium3d 4y ago

Drop the default search engine and show us a list of search engines with the option to add our own instead of setting it for us on first run.

rlpb 4y ago

DDG is a more practical default than Google simply because I don't get a "We'd like to abuse your personal data" pop-up that gets in the way every time I open an Incognito window to search for something.

vhgyu75e6u 4y ago
Sadly I have found the DDG lacking, most times I have to go back to Google to find information that just doesn't show up on DDG. As an example, I don't have Twitter but I follow certain sport journalist with a huge following, all thanks to his Twitter. When I search for his name + twitter, DDG shows me articles about the journalist and even a Facebook page link, but not his twitter even if it is in the query and his handle is literally his name!
- mdaniel 4y ago
  Did you use the "Send Feedback" in the bottom left corner? I've heard (via a comment on HN) that they do read them. I also readily admit the bottom left corner is a suboptimal place to put a feedback link, but here we are
- rlpb 4y ago
  Twitter are so hostile to casual anonymous browsing via the web that I'm not surprised DDG aren't indexing them, and actually prefer that. It's like Twitter are actively choosing to not be part of the web. But yes, I do use !g when needed to jump to Google. It's just the default that works better on DDG for me due to the Incognito window issue - so much so that I've been running DDG by default for quite a long time now, just for that reason.
superkuh 4y ago
This switch by Debian to DDG is less of an issue for me than it would have been a few years ago. Google has recently been claiming it will only ever show 1000 results (10 pages of 100). But for many users, myself included, google will only ever show less than 400 results. This is apparently an intentional policy (at least according to the support forums). For me this is terrible. I can scan through 100 search results pretty quick, going 4 pages deep is something I have always done often. Seeing the reported ~82 million results shrink suddenly to 4 pages and maybe 389 results with ommitted included is extremely disheartening. But at least google scholar still works properly. When I found out about this I was so pissed I made a crappy little website to more easily complain about it to people. http://googlesearchonlyreturns400results.lol/ http://googlesearchonlyreturns400results.lol/

zzo38computer 4y ago

I think that they will need to fork the web browsers and maintain the forks instead of the originals, in order to make improvements. This is one of them but is not only one. To actually make the web browsers good, will require further changes (sometimes involving adding stuff back in that was removed in older versions, or removing some of the newly added stuff while keeping some of it). However, I would prefer the default to be "no search", and to only search if the user explicitly specifies which search engine to use. (This does not necessarily mean that Debian has to do this; it only means that it is what would be my own preference. Some other people will agree with me, although some people will disagree.) Regardless of the default settings though (sometimes different default settings might be suitable due to the distribution; in this case it doesn't matter, but for some settings of some programs, it will matter), the end user should have the opportunity to change all of the settings.

godshatter 4y ago
I wish they would have gone with search.brave.com, but DDG is also acceptable to me. The main reason I would have preferred brave.com has to with their using their own search engine for at least a portion of their results. I also like the discussions result they added.

Kukumber 4y ago

What a mistake It is literally against anything Debian has done the past decades Why would they choose a proprietary software and proprietary service? Chromium at least has a BSD like license and is open source [1], the search provider alternative should be similar Literally nobody can confirm DDG's privacy claims, they refused every independent audits and your search is leaking to their servers [2], it happened again [3] And let's not forget the Microsoft Bing trackers ;) [1] - https://chromium.googlesource.com/chromium/src/+/HEAD/LICENSE https://chromium.googlesource.com/chromium/src/+/HEAD/LICENS... [2] - https://github.com/duckduckgo/Android/issues/527 https://github.com/duckduckgo/Android/issues/527 [3] - https://github.com/duckduckgo/Android/issues/2004 https://github.com/duckduckgo/Android/issues/2004

andrewfromx 4y ago

surprised this isn't changing to presearch.com. Google and DDG are great but the presearch concept of paying ME to do searches, I just love.

mdaniel 4y ago
I can't recall a single 502 response that I've ever gotten from DDG, but plenty of them for presearch, to say nothing of their closed-source node software. I enjoy advocating new tech as much as the next person, but not "route searches through who knows what, and only respond to queries some of the time" worth

account42 4y ago

Changing the search engine of existing installs is quite questionable and it is worrying that this was released without a much bigger discussion involving not just the maintainers of the browser package going by their personal feelings. If I was a debian user I would be mad.

frenchman99 4y ago
Debian being free of cost, I dont think you have a right to be mad about anything if you don't help with maintenance. Open source maintainers are not your employees. Users can always switch back to Google if they so desire.

GuB-42 4y ago

I don't mind the idea of changing the default search engine to DDG, but not in a stable release, do that in testing. It is opinionated choice, not a bug fix, and definitely not a security update (severity: wishlist). I don't have a problem with maintainers having opinions, but on a stable distribution like Debian, I would have preferred they expressed them before the freeze.