I wonder how an exit will play out though. A big factor with DDG is user trust - that seems to limit the list potential buyers to the few that could credibly maintain that trust.
Then there is the IPO route, but that has it's own challenges. You could argue that up until now DDG has had no competition because Google doesn't think it's worth raising its hand to swat a fly. But there is no flying under the radar after an IPO. What if Google promoted a new "no track" feature which matched DDGs benefits without having to do dumb things like append query arguments, modify location, and run plugins?
You might say Google would never give up this much tracking control, but there are two caveats. First, if it's just an option buried in settings there will be limited uptake yet DDG's ability to claim differentiation would be nullified. Secondly, as DDG itself says, search can still be a great business without having to track people.
If I were lucky enough to be in DDGs position I would push for a Microsoft acquisition. MS has kept enough promises in recent years that they just may be able provide DDG users enough guarantees to maintain the trust. People have mentioned Apple but that seems like a lower probability for a variety of reasons. An MS deal would avoid the massive hassle of an IPO and enough resources to chip away at Google indefinitely without being pressured into short term decisions.
For now I'm just glad DDG is here trying to do some good.
There is a financial sweet spot where the contributors to DuckDuckGo are fat and happy and there aren't greedy investors wanting to monetize all that trust.
Google has already occupied the greedy investor niche. DDG has carved out a niche where, I fear, the greatest threat is a lack of money for the people building and maintaining DDG. If they feel underappreciated, they may start to monetize that trust. The DDG team should be rewarded for their hard work.
* The above landing page doesn't work (typing a query and pressing enter returns me back to the same page).
* Even if I manually enter a search URL like this https://duckduckgo.com/html/?q=test it doesn't fully work (page navigation and requerying is broken).
From the browser console, the origin is that of the web page you're currently viewing, so you're free from CORS concerns.
So, from my browser console in Chrome 56, with duckduckgo.com/html/ open in the browser tab, I should be able to do this without any trouble:
fetch(window.location, {
method: 'POST',
body: 'q=testddg'
})
.then(result => {
result.text()
.then(text => {
document.documentElement.innerHTML =
new DOMParser()
.parseFromString(text, 'text/html')
.documentElement.innerHTML
})
})
So I tried to make a POST request without a body instead, appending the query parameter to the URL as one would with a GET request:
fetch(window.location + '?q=testddg', {
method: 'POST'
})
.then(result => {
result.text()
.then(text => {
document.documentElement.innerHTML =
new DOMParser()
.parseFromString(text, 'text/html')
.documentElement.innerHTML
})
})
But that's absurd! The native submit behaviour of a form with method 'POST' necessarily sends a POST request with a body, the body can be of multiple types, specified by the enctype attribute, default being x-www-form-urlencoded, which mimics a GET request.
In my browser's dev tools, I checked the request in the networking panel. The fetch requests were all there, but they differed from the native requests in an important way: the body was called 'Form data' in native requests, where in fetches it appeared as 'Request payload'.
The latter is obviously not going to be identified by DDG or any website as form data to parse, so I tried fetching with the correct content-type header explicitly set:
fetch(window.location, {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
},
body: 'q=testddg'
})
.then(result => {
result.text()
.then(text => {
document.documentElement.innerHTML =
new DOMParser()
.parseFromString(text, 'text/html')
.documentElement.innerHTML
})
})
So what was the point of this? We haven't really learned much, because handling form submissions via AJAX always requires such considerations, and that's irrelevant here anyway because the web page in question does not use AJAX, it's a plain HTML version of the site!
What we have determined is that there's most probably nothing wrong with their web page and the problem is more likely to be originating from your side.
I get the feeling that your browser is, for some reason, not applying the correct default enctype for the DDG/html form or uMatrix is interrupting the request and re-sending the request as a generic POST without the explicit content-type.
I've been unable to reproduce the bug on my machine. Do you use any other browser extensions? Does the site work in other browsers you may have?
Here's the complete request/response data in HAR format: https://gist.github.com/hrj/f538ed3e67636c94934e221efe67b323
(Note that the UA string is being spoofed by uMatrix, but I don't think that's relevant. I tried disabling the UA spoofing with the same result.)
Instead of sending me to example.com, DDG redirects to a weird constructed address [2]). If I go to duckduckgo.com/lite and search there, it works fine. Any ideas? What would be the best (eh, sorry) place to post this?
Of course, thanks for your great work, and bangs are amazing!
[1] http://lists.dillo.org/pipermail/dillo-dev/2017-January/0110...
[2] https://duckduckgo.com/l/?kh=-1&uddg=http%3A%2F%2Fexample.co...
And then all of a sudden we're talking about a duck instead of why private search is important.
GoDuck might be interesting. "GoDuck it."
We wrote a post covering it in our newly launched blog: https://spreadprivacy.com/10-billion-fc7808c91343
It is always an amazing and humbling moment when we hit a new milestone in our metrics. Our team is so incredibly passionate about what we do. To have people from all over the world rally around this concept of raising the standard of trust online and build this product is one thing. But, for users to endorse that mission at such a growing pace and to share us with their friends and family -- it lets us know we're truly making a difference for people who want to be more private online, and that is incredibly rewarding.
So thank you, to all of you who search with us, all of you who know privacy matters, and all of you who work along side us to show that privacy is not a fringe interest but something we can all have!