A month with DuckDuckGo

It wasn’t long after Google went live that they became my search engine of choice – with the only other (somewhat) viable option being Yahoo, it was an easy choice. In the years since then, I’ve not questioned that choice, but now that Google is focusing on killing features and building little-used social features, the time seemed right to see if there are better options.

So a month ago I began an experiment, I committed to using DuckDuckGo for a month – here’s what I’ve found.

Quality: The quality of the results is at par with Google for the vast majority of queries. On some queries where there are few results, Google tends to rank the results more accurately.

Index Size: The Google index seems to be larger, with faster additions than DuckDuckGo, though this was only a real issue for very obscure search terms. For the majority of queries, this isn’t noticeable.

Bang Syntax: DuckDuckGo has a great feature called ‘!bang’ which allows you to search specific sites easily. Of all the options here are the ones I used most often:

!amazon – Search Amazon.com
!g – Google Search
!man Search the *nix man pages

The bang syntax works great with the Search/Address bar in Chrome, making this my favorite feature.

Speed: DuckDuckGo feels much faster that Google does now (which is sad, as Google used to be amazingly fast, even on extremely slow connections), and the results page is clean and free of useless distractions.

Image Search: One that DuckDuckGo is missing compared to Google is a useful image search feature. Though you can easily jump to Google’s image search by adding “!i” to your query.

Zero Click Info: For a number of searches, DuckDuckGo displays an answer from an authoritative source, often giving you what you need to know without having to go any further. For me, the most useful of these is data from StackOverflow and Wikipedia.

Auto-Complete / Suggestions: This is the single biggest thing I’ve missed, it seems like a minor feature but I didn’t realize how useful it was until is wasn’t available. Hopefully they’ll add this at some point, would be a real step in the right direction.

Overall: I’m impressed. It’s not perfect, but it’s far more competitive than I expected. It’s clean, lean, and private. Over the last month I’ve still used other Google services and products (Chrome, Gmail, Google Voice, Google Authenticator, etc.) so it wasn’t a complete separation from Google – but enough to remind me that innovation is still happening elsewhere.

As Google has shifted much of its energy from information to social, companies like DuckDuckGo are continuing to innovate and find better ways to provide the information that we live on.

Adam Caudill

HP Folio 13

When Intel and various industry partners started talking about “ultra-books” as competition against Apple and tablets, I was more than a little skeptical. Ultra-books are small and light weight – but not cheap (average price being around $1,000) and rather underpowered compared to what you can get for the same money with a more traditional laptop (they are basically MacBook Air knock-offs). I had written them off almost as soon as they were announced.

Win by Building for Failure

Systems fail; it doesn’t matter what the system is. Something will fail sooner or later. When you design a system, are you focused on the happy path, or are you building with the possibility of failure in mind? If you suffered a data breach tomorrow, what would the impact be? Does the system prevent loss by design, or does it just fall apart? Can you easily minimize loss and damage, or would an attacker have free rein once they get in?

TLS: 64bit-ish Serial Numbers & Mass Revocation

During a recent discussion about the DarkMatter CA on a Mozilla mailing list, it was found that their 64-bit serial numbers weren’t actually 64 bits, and it opened a can of worms. It turns out that the serial number was effectively 63 bits, which is a violation of the CA/B Forum Baseline Requirements that state it must contain 64 bits of output from a secure random number generator (CSPRNG). As a result of this finding, 2,000,000 certificates or more may need to be replaced by Google, Apple, GoDaddy and various others.

on Unfair Judgement

Recently I was leaving a store after doing some Christmas shopping, as I entered my car someone recognized me and waved – this is the story of what went through my mind in that moment, the mistakes it revealed, and the regret that went with it. For those that are here in hopes of an article on information security or development, please pardon the interruption; this is about human nature. I know the value of your time so I try to diverge from my normal topics as little as possible, but this incident was striking enough that I thought it worthy of publication.

Juniper, Backdoors, and Code Reviews

Researchers are still working to understand the impact of the Juniper incident – the details of how the VPN traffic decryption backdoor are still not fully understood. That such devastating backdoors could make it in to such a security-critical product, and remain for years undetected has shocked many (and pushed many others deeper into their cynicism). There are though, some questions that are far more important in the long run: