Our XMPP services at DuckDuckGo

https://dukgo.com/blog/xmpp-services-at-duckduckgo

by dn2k • 13 years ago

267 135 13 years ago

claudius10• 13 years ago

So they have a public XMPP server and a bot that gives out the instant answers in their search – I somewhat fail to see how this is groundbreaking or even interesting in any way?

Sure, the bot is nice to play with, but somewhat cumbersome in the long term for me. So why is this great? :)

prg318• 13 years ago

I can see this being utilized by Google users who still need to use XMPP. With Google removing XMPP support from their messaging services, users will need to find a new XMPP server, and DuckDuckGo fits the bill.

claudius10• 13 years ago

There are quite a few other public XMPP servers at [1]. Personally, I’ve used jabber.ccc.de for a few years but found it to become unreliable in late 2011 and then decided to host my own, first using Prosody, then ejabberd. Works like a charm.

Being a search engine is not exactly a prerequisite to running an XMPP server. :-)

[1] http://xmpp.net/

p4bl0• 13 years ago

There already are plenty of way to get an XMPP account. I'm going to advertise the one which comes with FSF memberships [1] :-).

[1] https://www.fsf.org/associate/benefits

HyprMusic• 13 years ago

The convenience of Google talk supporting XMPP, for me anyway, was the ability to talk to other people already using Google Talk through the XMPP protocol, and the ability to use XMPP clients.

casca2• 13 years ago

TL;DR: DuckDuckGo, a search-engine known for privacy, has a public XMPP service that promises the same level of privacy as their searches. They also have an XMPP chat-bot that will respond to queries over XMPP, but this is less interesting.

I personally am a fan of DDG and use it as my primary search engine. I do wish they'd change their name as it makes it difficult to recommend to non-technical people.

xwowsersx• 13 years ago

Seriously! I love DDG, but the name has got to go!!

eterm• 13 years ago

For some reason the name always makes me think of 'toilet duck' toiler cleaner.

The name alone puts me off to a large degree, although the way it seems to go out its way to say "we're not google" puts me off too. Overall I just don't like the way they advertise, I don't feel like it should be appealing to the sort of person I am.

yegg3• 13 years ago

FWIW, we've had both for a long time (years). We just started a company blog and this was an early post.

Thanks for using DDG!

casca2• 13 years ago

Hi Gabriel,

Thanks for what you've done with DDG. Privacy is a difficult sell when everyone else is offering "free" services in return for it.

Is there any chance that you could create another brand with a name that I could get non-tech people to use? It could be exactly the same everything except the name. The number of times I've convinced someone to switch until they hear the name...

ronaldx2• 13 years ago

do you think it's harder than 'Google' to recommend to non-technical people? just curious.

adlpz2• 13 years ago

Google is an abstract nonsensical word, so it fits in the whole internet thing. DuckDuckGo sounds childish and stupid, therefore mustn't be very good.

vy8vWJlco2• 13 years ago

I don't think the name is a negative. It's made of simple words that people can spell. It's cute/friendly (just like "google"). It has a mascot. I think the energy that would be needed to "re-brand" to overcome imagined difficulties that I would attribute to more to normal lack of familiarity would be better spent improving the product further to address search coverage and context/language intelligence.

I have found it easy to recommend to non-technical people. (In the early days of Google, I had to spell it for people too... at least this is 3 common words.)

I think the emphasis on converting non-technical people is also often misplaced. Non-technical people don't care about any of the issues that lead to development. The number of people using Skype shows most people don't care about privacy. That doesn't mean DDG's offering is not unique or valuable, it's just that the people to recognize that value will not be the majority by any stretch - but, it never is - and converting people who have the hardest time understanding that value should be a low priority IMHO.

In promoting privacy, DDG captures the union of early adopters, technically literate, and digital evangelists - all groups that are most likely to understand as well as turn around and effectively promote it (for example, by setting the homepage and default search engine after cleaning up a system for a friend)... This is the crowd to keep happy (without raising the barrier to entry either... for example, late adopters will not use bangs or care that you search Hacker News too, but the early adopters appreciate it greatly). These were the same types of people promoting the early Internet to the masses, who barely saw the point in having a computer.

In that vein, one of the best things for DDG, IMHO, would be to make setting ALL browsers as easy as possible (homepage+default search). (I know I'm not saying anything new...) There are add-ons for individual browsers, for example (which I tend not to use, because I like vanilla installations without extensions to upgrade later), and conventional methods (which I prefer, but have been de-emphasized in favor of add-ons), but further-centralizing the process of applying these customizations would be nice. For example, I'd rather download a single native app or portable script (WSH) that was capable of searching out browsers and - through check-boxes - setting their homepage and search (ideally to the SSL search), via the browser-native method (or add-on method), in one pass (usable offline, and ideally at an easy-to-type URL like "duckduckgo.com/tools"). This would help high-turn-over scenarios like tech-support shops, which has the chance to affect the most users but are also under pressure, so want to do the minimum possible (Idea: actively promote to these places).

On a different note, I'm curious how the costs associated with this XMPP service are expected to grow and how it is seen from the business side. If 100000 people started to use it for messaging, would it become too burdensome and be discontinued, or is there a plan for cost-recovery (or is the ddg bot enough of a case)?

ronaldx2• 13 years ago

I like the name, but one barrier is that DuckDuckGo doesn't verb comfortably.

I can't imagine ever saying "I DuckDuckGoed it" - since that breaks the verb 'to go'.

Although I've conditioned myself over several years to say "I searched for it [on DuckDuckGo]", I sometimes still find myself saying "I Googled it".

lifeguard• 13 years ago

Add jitsi for PKI and ZRTP encryption!

https://jitsi.org/

polymatter• 13 years ago

In case nobody else has heard yet, you can use (http://ddg.gg) as a shorthand for duckduckgo.com

D9u2• 13 years ago

Terrific!

Thanks for the link. I've been wanting a shorter domain name for duckducgo ever since I first began using it.

I noticed this morning that http://lmddgtfy.net/ now takes you to the developer's blog page instead of to duckduckgo.

Many thanks for the share!

pwenzel2• 13 years ago

> I personally am a fan of DDG and use it as my primary search engine. I do wish they'd change their name as it makes it difficult to recommend to non-technical people.

They should really just rename it to Duck Duck Gray Duck.

protomyth• 13 years ago

no sir, that would be Duck Duck Goose

Non-technical people I tell the name to remember it more for the "controversy".

plainOldText• 13 years ago

I agree the name is not that great – I know others might disagree – But I once told a friend of mine about DDG, to which he replied: "DuckDuckGo? I would never use a search engine named like that."

I know it's shallow to judge a product/service by its name, but for most people hearing the name for the first time counts as an initial encounter with the product/service, and since that can leave an impression, it matters a lot.

omaranto• 13 years ago

What search engine did that person use? Altavista, maybe, if it still exists? all the others have silly names: Google, Bing, Dogpile, Blekko, Ask Jeeves, ...

marssaxman• 13 years ago

DDG is my default search engine now, but I avoided it for a couple of years because of the silly name.

Lerc• 13 years ago

It really bothers me that people are so hung up on appearance.

For any media coverage about Lady Gaga, you are more likely to see column inches dedicated to deriding her appearance than you are to discussing her music.

When the Occupy protests were at their height, there were so many comments along the lines of "They may have a valid point, but no-one is going to listen to them if they dress like that"

All too often I see comments criticizing appearance as being something that indicates their value to be less. frequently it comes in the form of "I know it has value, but you should change the appearance so others can see".

I think this is counter-productive. Appearing business-like may make more people believe you are business-actual, but it also reinforces the attitude that means people judge the business-like as business-actual. It may be good for you but bad for the world. Those who wear the right suits and walk the right walk but cannot actually do the right work can deceive a lot of people.

I think pushing back against this attitude is a worthy endeavour.

  - Neil Graham,  Screaming Duck Software.

tzury• 13 years ago

I would go for both, a name and logo change.

A serious product, made by serious people, focuses on serious issue (privacy) shall look like one.

lucian19002• 13 years ago

Sadly, most of the people I would talk to are either on Google or Facebook and neither supports XMPP federation. Where's my federated client-independent IM future?

MattJ1006• 13 years ago

While Google's recent moves are indeed a backward step, the only way we can fight them is by having open alternatives like this available to people, and by making them as attractive as possible.

There are many practical reasons that people and organisations would rather be in control of their communications, so XMPP (or something, the protocol doesn't matter) is here to stay. The challenge is making that open network worth the big players' time, they currently don't seem to think it is.

malandrew2• 13 years ago

Is it possible to set up my DNS records so that I can use DDG XMPP for chat instead of Google XMPP, while still using Google Apps for GMail?

shmerl8• 13 years ago

Google are really crooked if they decided to kill XMPP federation. A trend of them becoming evil?

guyzero• 13 years ago

As others have pointed out, it's a good thing they didn't do that then.

BarkMore2• 13 years ago

Google Talk supports XMPP federation and has done so since January 2006.

To deal with an onslaught of spam, Google disabled incoming subscription requests for a short time. During this time, all other XMPP federation features continued to work.

lucian19002• 13 years ago

Hangouts doesn't though, and it's the future direction. I should have been more precise.

shared4you• 13 years ago

Google also has a chat bot: guru@googlelabs.com . Just add it to your contacts list and you can query it over XMPP.

dn2k• 13 years ago

this is not exactly the point.. the point is that DDG gives you now a free and "we don't track users" XMPP server that support federation...

BitMastro• 13 years ago

Not to undervalue DDG, but the same service has been offered for years by those servers http://xmpp.net/

A "we don't track users" XMPP server?? Is this a thing?

cromwellian2• 13 years ago

The assertion that Google tracks XMPP and uses it to target ads has no evidence.

Besides, use OTR with XMPP chat and it doesn't matter what the cloud provider says in their privacy policy.

MattJ1006• 13 years ago

The XMPP network needs more independent servers run by trusted entities, so I welcome this very much (I've been trusting DuckDuckGo with my searches for some time now).

shmerl8• 13 years ago

Can anyone please clearly explain what exactly did Google do regarding XMPP? Just stopped using XMPP protocol in their Hangout client? Or disabled XMPP federation on their server? The later doesn't seem to be the case - I can still communicate with the contacts from Google server (though they don't use the Hangout client).

lukeschlather• 13 years ago

They cut out XMPP from hangouts, yeah.

I still use XMPP with GChat and IMAP with Gmail. Either of those things changes I'm probably going to start using Bing and find a new email provider.

shmerl8• 13 years ago

I left Google Talk and switched to another XMPP server a while ago, but a big percentage of my contacts use Google Talk. If Google wants to force all Google Talk users to switch to Hangout - it's really crooked, since all those contacts will be inaccessible.

Macha2• 13 years ago

Hangout does not support XMPP, at all. Google Talk still does, but the Google Talk Android app was replaced by Hangouts, they're slowly replacing Talk with Hangout in Gmail, and it's quite likely Talk will be shut down altogether given Google's track record.

shmerl8• 13 years ago

I.e. Hangout uses a different server than Google Talk (not just a different client), right?

brunoqc• 13 years ago

Is it accessible on the 443 port like GTalk?

jaryd• 13 years ago

Actually no, but this is something that we are discussing. We see the value in providing the service on this port, and want to accommodate all users.

Thanks for the feedback, and feel free to hit me up with questions (if you have any) at my $username at duckduckgo.com :)

EDIT: Or, hop on Freenode and chat with us in #duckduckgo

scotchmi_st3• 13 years ago

Sorry if this is slightly off-topic, but I was wondering if anyone could explain the technical reasons why, with minimal modification, we couldn't just replace all electronic messaging systems from SMS to email with xmpp, and forevermore live in a magical fantasy world where email headers, text fees and security concerns don't exist? I mean, it has these things going for it-

1. SSL/TLS embedded in the standard.

2. Easy to set up OTR encryption, (as well as any other standard I imagine).

3. Messages are "pushed" to clients, rather than "pulled".

4. The standard is simple, and servers like Prosody are super-easy to implement (unlike Exim).

5. There are plenty of clients already available. Admittedly it's not something I've researched much, but I doubt it'd take all that much to get Adium or whatever to work like a simple email client, (but with xmpp).

I'm aware of all of the social reasons why such a thing may not work, but I'd be interested to know if it were just a question of getting people to adopt it, were it to exist.

TylerE2• 13 years ago

Because push doesn't scale.

MattJ1006• 13 years ago

Care to elaborate?

scotchmi_st3• 13 years ago

Really? So there are no large-scale implementations of push-notification systems? Is there some detail I'm missing here?

eikenberry• 13 years ago

Push can scale. Ask Urban Airship. It is hard though and while polling is generally easier it has its own set of scaling problems.

nknighthb• 13 years ago

With a statement like that, you're going against decades of experience which says polling doesn't scale. Constant connection setup and teardown is incredibly expensive.

RAM is cheap.

msh• 13 years ago

The apple iOS push service would like to disagree.

jmillikin3• 13 years ago

4: XMPP is many things, but it's definitely not simple or easy to implement.

Start with the core spec, RFC 3920. Right away you'll run smack into the problem of XML namespaces, which is a feature that every XML library pretends to support, but with a whole bunch of caveats. Before you can do so much as initiate a session, you will need to search the universe of XML libraries for one that implements a full parser and has good namespace support.

(When I wrote an XMPP library, I ended up using libxml2 because the only platform I care about is Linux.)

Next you'll have to implement encryption (TLS) and authentication (SASL). As with all security-related code, this part of your application is terribly easy to fuck up in a non-obvious-but-user-endangering way. Does your TLS library check that the certificate is valid? Many don't by default. Does your SASL library implement the spec correctly? SASL is complicated and difficult to test, so it's easy for even experienced developers to break authentication for some subset of users.

(I used gnutls and gsasl to do most of the heavy lifting, but still ran into many problems. For example, my library doesn't work with some versions of ejabberd because ejabberd's implementation of SCRAM-SHA-1 was broken: https://support.process-one.net/browse/EJAB-1632).

OK, so you've found a full-featured XML library, you've figured out TLS and SASL, and you can send "hello world!" to another account. Think you're done? Hahaha, no my friend, you're just getting started.

To do anything interesting with XMPP, you need to implement XMPP extensions (XEPs). There are currently three hundred and twenty seven XEPs, indexed at http://xmpp.org/xmpp-protocols/xmpp-extensions/ , and many of them are at least as large as the core spec itself. XEPs cover such important functionality as multi-user messaging, file transfer, voice/video chat, full encryption, avatars, and away messages.

(I decided to skip all that, not do any XEPs at all, and limit my library to simple one-on-one chats because that's all I needed it for. If you're writing something for use by customers, you will not have that luxury.)

And of course, it's all implemented in XML. Hope you've got a sturdy keyboard.

scotchmi_st3• 13 years ago

Yeah I would certainly say that building a messaging system of any type with the features of XMPP /from scratch/ would be hard. Then again, just compare the config files of sendmail and exim to prosody or ejabberd. Given that tools for working with xmpp already exist, it does seem a shame to me that it hasn't seen wider adoption. Wasn't Google Wave based on it?

Zash• 13 years ago

FYI: RFC 3920 was obsoleted by RFC6120 in 2011.

Implementing a lot of features is a lot of work. How is this different from any other protocol, or any kind of system?

joeyh• 13 years ago

I also love that, to connect to a XMPP server, a client needs to use SRV. Which AFAIK cannot be queried via gethostbyname, getaddrinfo, or any other standard interface. So you need to pull in a nonstandard resolver library, or to fork off `host`.

With that said, John I'm very happy to report that thanks to your library I've been developing an XMPP client for months and have yet to even see any XML.

glomph• 13 years ago

Because not everyone has a smartphone?

cromwellian2• 13 years ago

SMTP is a delay-tolerant store-and-forward system, XMPP isn't. You can't replace all electronic messaging with a system that can't support DTN attributes.

pepr2• 13 years ago

Does anybody know if this supports custom domains or just the domain assigned by DDG? They seem to support only dukgo.com

anoncow2• 13 years ago

What will you do if they make encryption illegal?

A reason why there reportedly are backdoors in skype is because of government requirements.

For eg. see this news article about India asking Skype to setup local servers in India

http://articles.timesofindia.indiatimes.com/2013-05-20/infra...

dublinben• 13 years ago

DuckDuckGo has no legal presence in countries like that, or any desire to have one. They'll do what is legal in the US, and ignore the complaints of any other country.

jmillikin3• 13 years ago

Who is "they"? Your city council? Your nation's legislature? The commie-nazi-jewish-muslim-reptilian cabal who puts radios in your teeth?

No major government will forbid effective encryption, because citizens are far more afraid of other citizens than they are of the government. That's why governments request backdoors, or pass legislation permitting warrantless searches.

Think of it this way: your city council will never be able to pass a law forbidding people from locking their car door, because everyone with a car would be screaming about theft. But they could easily pass a law requiring car manufacturers to provide a master key to law enforcement.

anoncow2• 13 years ago

This makes sense. By 'they', I meant governments. I always wondered why no mail/im providers support pgp or similar encryption. This means there never will be such a service, since the only master key would be with the end user.

jweir• 13 years ago

This feature is great. A bit of a trojan horse - I will keep DuckDuckGo open now and search it before trying that "other" search engine.

The goodies (https://duckduckgo.com/goodies) are really cool. Although they do not seem to consistently work in the chat client. Some do, some do not.

crazedpsyc• 13 years ago

A lot of those plugins are written in client-side Javascript, so the bot can't (easily) work with those.

MMXII• 13 years ago

One of the biggest strengths of gchat is the integration with gmail, and why they have so much traction.

It makes less sense to chat on a free service that no one is using, but maybe some people will use it if there were a DDG email service.

ausjke• 13 years ago

I must agree that duckduckgo is too long and not cute, a big turn off for people like me, bad naming in my opinion, and it matters a _lot_

plus, duck goes slowly and unstably, again, ugly naming.

Hontano• 13 years ago

Our XMPP services at DuckDuckGo

Related Stories