Powered by RND
PodcastsBusinessInside DuckDuckGo

Inside DuckDuckGo

DuckDuckGo
Inside DuckDuckGo
Latest episode

Available Episodes

5 of 11
  • Duck Tales: How DuckDuckGo makes the sites you visit less annoying and more private (Episode 11)
    In this episode, Beah (Product) and Max (Frontend) discuss cookie pop-up protection, why our solution is uniquely private, and the feedback loops we use to help us reject cookies across more of the sites you visit. Disclaimers: (1) The audio, video (above), and transcript (below) are unedited and may contain minor inaccuracies or transcription errors. (2) This website is operated by Substack. This is their privacy policy.Beah: Hello and welcome to DuckTales where we go behind the scenes with DuckDuckGo and discuss the stories, technology and people that help build privacy tools for everyone. In each episode, you’ll hear from employees ⁓ about our vision, product updates and our approach to AI or how we operate as a company. In this case, today we’re going to be talking about a feature that I dearly love.⁓ cookie pop-up protection with ⁓ Max here. So let me just do some quick introductions, I guess, before I’m kind of getting a little ahead of myself. I’m Bea Berger-Lenahan. I lead the product team here at Tech Tech Go. And I’m going to be asking Max a few questions. Max, would you like to introduce yourself?Max: Yeah, sure. Hey, ⁓ my name is Max. I am an engineer in the front-end team at DuckDuckGo. Been here for about three years, a little more. Yeah, I’m excited to talk about cookie pop-up protection.Beah: Awesome. Thank you, Max. We’re glad you’re here. I’m glad you’re here. ⁓ So first, just tell me, tell all of us a little bit about what cookie pop-up protection is, how it works.Max: Yeah, so this is the ⁓ feature in our browsers that handles cookie pop-up for you. ⁓ And in a nutshell, it... ⁓ that’s a good question. ⁓ I mean, I think most people have seen a cookie pop-up, but yeah, the definitions vary, but we’re talking about these...Beah: What’s a cookie pop-up first? HahahaMax: dialogues that websites show you on the first visit that typically tell you something about their data sharing practices and the use of cookies and similar technologies. And sometimes they give you a way to opt out of some optional tracking ⁓ or cookies. And that’s what we’re actually doing. We’re automating, ⁓ basically clicking reject buttons for you or whatever it takes to...toggle all these little checkboxes and saving the settings. ⁓ I could demo it if that’s okay. ⁓ So let me share my screen. ⁓Beah: That’d be great.Max: So for the sake of the demo, I’ve disabled the feature in the settings right now. It’s enabled by default, ⁓ but I’m just going to show you. ⁓ So if we go to Sky Scanner, for example, and I’m in the Netherlands, so you see a Dutch version, but there is this huge cookie pop-up ⁓ when you load the page. And if I enable the feature, cookie pop-up protection and reload the page, you’re not gonna see this pop up anymore. And what happened, and then there will be a ⁓ little notification in the address bar. And if you drill down, you’ll see the explanationBeah: Okay. Okay.Max: what happened. But basically what happened behind the scenes is we clicked on the reject button rejecting the cookies automatically. And that’s why we call it cookie pop-up protection. ⁓ So for us, this is a privacy protection feature because it actually ⁓ chooses the most private option for you, which is not always easy. Let’s see.Beah: Mm-hmm. Yeah, I mean, I don’t know if we have data on this, but I imagine very few people are willing to go into, you know, click the option to actually adjust ⁓ settings and start toggling things on and off on the regular.Max: Yeah, ⁓ that’s for sure. So ⁓ some pop-ups can be really tricky to opt out. ⁓ You would need to go to click, Settings and then toggle a bunch of check boxes and then click Save. This can become... Like most people, think they just click Accept button. ⁓ And ⁓ yeah, this is of course not good for your privacy. ⁓ So we help...Beah: Yeah.Max: getting through these dark patterns.Beah: Yeah, makes sense. why did we build this? What’s the origin story?Max: Yeah, so ⁓ like many other features that go, it started as like a hack project, which is when someone goes in and tries to tackle the problem in a couple of days. And ⁓ of course, cookie pop-ups are universally annoying and wanted to do something about it. ⁓ And we built some prototypes. And then eventually we built a feature on top of a ⁓ prior work of my colleague, Sam Macbeth, who... ⁓ So we have an open source library that does most of the ⁓ things that we... ⁓ And we ⁓ use it and it powers all our... ⁓ This feature in all our browsers.Beah: Nice. ⁓ Max, did I cut off your demo? Did you want to show anything else there?Max: No, I’m trying to stop presenting it just doesn’t work. I’m clicking the buttonBeah: Oh, okay. Alright, I was just worried I cut you off. Alright, we’ll see if it responds at some point. So, okay, so just to recap, ooh, there it goes, okay. Just to recap, we are a, removing the annoyance of you’re like trying to go to Skyscanner, I don’t know what that is, you’re trying to go to Skyscanner and instead of getting whatever it is that’s on Skyscanner, you’re getting this big like notification in your face, we’re making that go away and we’re going in and we’re changing the settings to be more privacy respecting. That sounds great. What’s the downside?Max: Correct. And that’s, so like ⁓ this ⁓ approach actually is actually quite intentional, right? So as I mentioned this, we’re trying to maximize user privacy and ⁓ because there are other solutions on the market that do like ranging from clicking accept button, which is not acceptable for us. But also ⁓ there’s another approach of like preventing the interaction. And for us, this was very important to do it this way, to actually actively opt out because, well, first of all, ⁓ this is like the only way to opt out of ⁓ server side tracking we know of. ⁓ the second, it gives a clear signal to the website through the official channels.Max: And then finally, in some legislations, it’s actually the only way to opt out. So for example, in California, they can sell your data by default unless you click on the button. So ⁓ yeah, we think that as long as the site is compliant with the law, this approach is better for privacy. ⁓ And if it’s not compliant, we still have our tracker blocking and other privacy protections to fall back to. And so this is of course, so speaking of challenges, ⁓ this is a bit more involved than just, you know, blocking some requests to or blocking the pop-ups from loading. ⁓And so it needs a bit more effort because we actually need to automate each and every pop-up vendor. So it takes a bit more effort. But yeah, this is something we chose to do. I think we, for a while now, we’ve covered most of the, all of the major pop-up vendors, which is like 80, 90 % of top sites in Europe and the US.Beah: So that’s roughly the percent of cookie pop-ups that we think we’re successfully blocking at this point.Max: Yes, so that is 80 or 90 % of all pop-ups that you see on the top sites are handled. And one of the biggest challenges is this long tail of sites, because of course, no one visits just the top sites. And like, each of us has this one site that no one else visits.Beah: Mm-hmm. Okay.Max: And yeah, this is something we’ve been focusing on lately. We’re trying to ⁓ experiment in with automated approaches and using AI as well. And we’ve had some good success in the past months with it. So I think we’re gonna ramp up the this long tail coverage in the coming weeks and months. Yeah, andBeah: And how are you finding those? Do you want to talk about like how your finding those sites, which includes internal reporting, right?Max: Yeah, so we have a few different ⁓ feedback loops, as I say. of course, we have ⁓ our own crawling. So we ⁓ regularly crawl top sites ⁓ and trying to detect new pop-ups and handle them. ⁓ Then we have user reports, ⁓ breakage reports, and just user feedback reports. that we have special systems that filter out and surface the reports related to cookie pop-ups. And we also have very active internal reporting, which is DuckDuckGo employees who go above and beyond and just report new sites to us. is a very important source of feedback because we can get back to those people and verify.Beah: Who’s the number one reporter of cookie pop us.Max: the number one is Gabe. ⁓ So our CEO, he’s like, I think it’s fair to say that half of all the internal reports come from him. I have no idea how he does it.Beah: Hahaha I know. Yeah, sometimes I think maybe I can catch him, but I don’t know. I don’t know that I can. ⁓ So if a user watching this encounters a cookie pop-up, what should they do? How should they report it?Max: Yeah.⁓ So it depends on what kind of user there are. Like the easiest thing would be to send the feedback through the app. We have this ⁓ feature. Or if something actually doesn’t work, then feel free to send the breakage report, site breakage report at this. But if you’re actually a developer, thenThis whole thing is open source. And we welcome external contributions. You can go to GitHub, ⁓ find this library, called AutoConsent, and file some issues or even pull requests. This is always welcome. And we’ve had some external contributions before ⁓ from also other companies who are using this library. It’s not only ⁓ used in DuckDuckGo apps. ⁓ So yeah, if you’re that person, we’ll be happy to.Beah: Nice. So to recap, have to be, you only get this feature if you’re using our browser. If you’re using search and you click in another browser and you click on a search result and you land on a page with a cookie pop-up, we can’t really do anything to help you there, much as we’d love to. So you got to install our browser. But if you are using our browser on mobile or desktop, you can go into the menu and there’s a send feedback button and That’s a good way, like we actually read those, so please do send that feedback and we will try to fix it.Max: Yes, that’s right. So make sure to mention clearly that this is about cookie pop-up not being handled or some issue with cookie pop-ups and then we will see it.Beah: You can say, dear Max, please fix this cookie pop-up. But you have to be polite, obviously. Awesome. All right, before we wrap, Max, is there anything else that you want to add that we haven’t touched on?Max: Yeah That’s a possibility. ⁓ No, really just I’m excited ⁓ to spread awareness of this feature because ⁓ you know when it works and it does work you don’t notice it so anything we can do to ⁓ let people know that this exists and that it actually ⁓ helps.Beah: Yeah, here, here, the time when I notice it is when I go into other browsers to test things or experiment with something and I get all these cookie pop-ups. And I’m in the US, so I’m sure it’s worse if you’re in Europe, ⁓ and I’m just like, how do you live with this? So, and I scurry back to our browser. Awesome, well, thank you so much, Max. It’s been great learning a little bit more about cookie pop-up protection. Appreciate your time.Max: Yeah, thank you for having me. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit insideduckduckgo.substack.com
    --------  
    14:45
  • Duck Tales: The DuckDuckGo Subscription — more protection & peace of mind (Episode 10)
    In this episode, Gabriel (Founder) and Chris (Subscription team) discuss why we built the DuckDuckGo Subscription, its four features, and how it protects more of what you do online. Disclaimers: (1) The audio, video (above), and transcript (below) are unedited and may contain minor inaccuracies or transcription errors. (2) This website is operated by Substack. This is their privacy policy.Show notes: Learn more about the DuckDuckGo Subscription here. Gabriel: Hello everybody. Welcome back to DuckTales, everything DuckTale go. I’m Gabriel, founder, CEO. I got with me Chris. Do want to introduce yourself?Chris: Yeah, hi, I’m Chris Calvi, ⁓ long time listener, first time caller. Had to say that. ⁓ But ⁓ I’ve been at DuckDuckGo for a little over four years. I’m on the partnerships team here. And ⁓ I guess I’ll take a second to talk about the partnerships team, what we are. ⁓ We are primarily the team that handles all of the relationships with third party companies that DuckDuckGo works with.Chris: We’re a relatively small team, about 10 people. you know, classic examples of companies that we’d be working with are any of the live information that you’re seeing when you search DuckDuckGo. So that would be like sports scores or stock quotes, weather, that sort of information, also like flights and lyrics, all of those relationships, we get that information, we license it from...from other companies. that would be an example of work we would be doing. And then also, we will even work on things like infrastructure partnerships with cloud partners and AI companies and all that stuff. So that’s what we do over here at Partnerships more recently.Gabriel: Interestingly though, the way we work, and this gets more inside deck to go since the name of our blog on this, we don’t really work functionally though. We have objectives inside the company to get a particular thing done, and that thing usually involves many different functional teams. What that also means is those objectives have owners and they can be from any functional team. ⁓You tell me how you think of that, but I think if you do what doing recently actually was not very partnershipy. You’ve been helping launch different parts of our Dr. Go subscription, which involves some partnerships, but like your day-to-day job is not always partnership related.Chris: Yeah, mean, absolutely. And I think you as people, if they listen to a bunch of these episodes, they’ll see that. People might be leading an objective and they’re on the design team or in this case, the partnership team. A lot of times it is somebody from the product team. And in this case, I’m working a little closer on the product side. So you’re right.Gabriel: And yeah, so we’re going to talk today a little bit more deeply because you’ve been working on it about the DuckDuckGo subscription. We’ve mentioned it on some of these episodes, but haven’t really given a big overview. So that’s what this is going to be. The subscription is a bundle. So it’s got a bunch of different things in it, which maybe you can get an overview in a second. But just to say that we might have separate episodes about going deep into some⁓ One of those things are a technical aspect to them, but this is we can give more of an overview of kind of where it came from and what it exists today and kind of where we’re headed with it. You want to start and just tell us kind of like what’s in it and how it works.Chris: Yeah. Yeah, that sounds good. The DuckDuckGo subscription is a relatively new thing for us. We launched this in April of 2024, so it’s really only been around for a year and a half compared to the search product, for instance, that’s been around for a very long time. And what it does is really, I mean, in a nutshell, it supercharges some of the existing functionality you have. It gives you extra privacy features within your DuckDuckGo ⁓ app and experience. ⁓ It does a little beyond that too, which we’ll talk about, but that’s the key thing. ⁓ The other thing I will note is that if for long time subscribers, you may have originally remembered it being called Privacy Pro. That was the original name for it. We recently just changed it to DuckDuckGo subscription for to keep things simple. So we’ll call it the subscription for the rest of the episode. ⁓ But before I like...Gabriel: Yeah, give us the basics. yeah, what’s in it? Yeah.Chris: Yeah, the basic things, the four basic things in there are the, you got the VPN, which we’ll talk about what that is in a second. You get access to advanced AI models within Duck AI. You ⁓ get personal information removal, which I’ll talk about what that is, as well as identity theft restoration. But before I go down all that, I did want to ask back to you about ⁓ why we came up with a subscription. and then I’ll kind of unpack each of those core pieces.Gabriel: Yeah. Yeah, I mean, the way I think about it more broadly is we want to be your clean internet experience. Like if you want a more protected way to operate online where you’re not getting followed by ads and you’re not giving up your personal information, you kind of adopt the DuckDuckGo ecosystem. And so that’s our browser, it’s our search engine, it’s our AI product. And generally we want to offer those essentially for free. mean, there’s advertising model in the search engine that pays for this, but we can, we want to give it for free in the sense that mo because more people can use it around the world. However, there are certain protections that costs us a lot of money to do that we hadn’t been able to offer because of that. So VPN is the obvious, a canonical example there, because when you turn on the VPN, now all your bandwidth is running through that VPN and a lot of that’s video. ⁓ And it’s just not something that can be advertising supported. doesn’t, the numbers don’t add up. And so we’ve wanted to offer that because it is a key part of being fully protected for people who want that kind of fuller protection, but we couldn’t offer it for free. And so we needed a subscription. At that point, I thought, hey, we could just offer a VPN, but...I think there are other things in this category that have real marginal cost in business terms. ⁓ And it would be great if we could bundle them all together at one low price and allow DuckDuckGo users who really want more protection ⁓ to be able to get it in one place. You don’t have to sign up for multiple things. And that’s where the subscription came from. ⁓ I think we’re living up to that. hope over time we add more and more things and make it more and more valuable without increasing the price or much at all. ⁓ But yeah, that’s where it came from.Chris: Yeah, I mean, that makes sense to me. to dive into the four pieces of functionality, I’ll start with VPN, because you mentioned that. We probably should give a little bit of a high level of what a VPN is. So it stands for virtual private network. But what that means is that we basically have this anonymous private secure no logs VPN server that’s sitting out there, right? And we have these in 40 locations around the world. You likely are connecting to the one closest to you, but you can change it to go to another country. But what it does is all of your internet traffic, the requests that you’re making to, for instance, as you browse the web, are gonna be securely essentially tunneled through that server and then sent out to the resource where you’re requesting that information. So the website that you’re accessing,they’re not going to see, under normal conditions, without a VPN, they would see your IP address. In this case, they’re going to see the DuckDuckGo server’s IP address, which is meaningless, essentially, to them from a privacy perspective. So it preserves your privacy on that front. then they’re sending that information back, and then it’s coming back to you. So then the second place where it’s adding privacy is on your own, sort of like your internet connection. So if you’re...⁓ you’re making that request in a lot of cases your internet provider or if you’re using like a public Wi-Fi, they can see the sites that you are accessing and sometimes can see the information that’s coming back and forth. And in this case where it’s that since it’s all being encrypted and coming through the duck, going to DuckDuckGo server first, they’re only seeing that you’re connecting to this one server and that they’re not seeing any of the data in between. So it gives you sort of that two different protections when you use a VPN. I don’t know if I’ve done it justice.Chris: Yeah, I think you did a great job there. The only thing I would add to that is, yeah, so it really shields your IP address and other information from leaking to both your internet provider and the sites that you’re visiting, as well as all the places in between too. People may not realize like when you route across the internet, you connect to something and then you connect to like a bunch of different hops in between lots of other internet providers. And it shields not only from the end points, but everything in between.⁓ Additionally, the IP address is often used to get your location. ⁓ And so by effectively shielding your IP address, you’re effectively shielding your location. And the final thing I would add is like, it may seem esoteric, like do I need to shield this stuff from these people? ⁓ But it’s been well documented that ISPs, internet providers are selling this data all the time. ⁓ And so...If you want to be maxing protected, you do want to have the VPN. ⁓ And you know, I leave it on all the time, our VPN. The other thing, the final thing I would add, which you know, doesn’t relate to the privacy necessarily, but it kind of relates to it in the sense that trusting us is that we decided not to sub license this VPN or anything from anybody else. We are operate, we made this from scratch. We’re operating all the servers ourselves. ⁓ And so it’s fully DuckDuckGo operated.Chris: Yep. ⁓ Thank you. ⁓ And then on the kind of jumped into the next feature that I had mentioned was the advanced ⁓ AI model. So you get in Duck AI. So ⁓ Duck AI is free. You don’t need an account to access it. And it’s our AI chat ⁓ product. But if you’re a DuckDuckGo subscriber, you get ⁓ access to advanced models and higher limits on the models that are available for free.So the advanced models sort of the difference between the advanced models and the free models Well the advanced models just to name them are ⁓ open AI’s GPT 4o GPT 5 Anthropics ⁓ Claude sonnet 4 and Metas llama for Maverick and So we have these are available if you’re a subscriber and then we have the free models which are available to everyoneThose free models are great for lighter weight tasks that are optimized for speed, whereas these more advanced models are made for more complicated prompts and more challenging scenarios. I don’t know if you have anything to add on to that.Gabriel: No, that’s a good explanation. The only thing I would add would be it’s for the same reason like the VPN, like these advanced models cost a lot of money to run. when you’re the computation on advanced models, it’s more computation, more computation, it’s more cost. And so we just couldn’t offer them for free. But as part of the subscription, it’s a natural fit. if you’re paying for it, and we haven’t said the price yet, so why don’t you explain what our pricing is?Chris: Yeah. So.Gabriel: But if you’re paying for it, we can afford to give you this. But we’re still trying to strike a balance here and give. We’re not trying to make tons of money off this. We’re trying to give a good price for the bundle. And so we think we’ve been pricing it competitively.Chris: Yeah, absolutely. I should, yeah, let’s step back. the thing I’ll say is it’s available in 30 countries today. So the U S Canada, UK, and all 27 member countries of the European union. And you, the price in the U S is nine 99 a month and it’s nine or 99 99 a year. So basically $10 a month or a hundred dollars a year if you sign up annually.⁓ And then it’s that’s basically in your local currency if you’re subscribing from one of those other countries ⁓ But you can get a free seven-day trial too. So ⁓ That’s that’s important to note so you can give it a spin See if you like it and then if you do like it you can continue onGabriel: Got it, okay, so we have VPN and DuckAI advanced models. Now as I understand that those are available in all those countries, the other two features are more US, or there’s one of them US specific and one of them we need to talk about how it might differ, right?Chris: Yeah, yeah, let’s talk about personal information removal first because I think ⁓ that one is US only. And the reason for that is, you could probably go on about this, it’s primarily a US only problem. And so the way that, what happens if you’ve ever searched, for people listening, have you ever searched the internet for their name, which I’m sure everyone’s done at some point you’re going to see yourself show up in, especially if you type in your name in your city, if you have a less common name, you’re going to see a bunch of stuff show up, lot of of spammy sites that have your address, maybe your phone number, email, some other information, maybe socials. This stuff, ⁓ they are selling essentially, and in the US, a lot of countries make that illegal, in the US it’s not. So ⁓ what we will do is with personal information removal is,We help you go out and on your behalf, we opt you out from I think at least 80 sites like that today and we add more all the time. And so that’s how that works. Yeah, but I don’t know what else you have to add onto that.Gabriel: No, you’re right. I mean, that’s why it’s in the US because it’s just not a problem. It’s not really a problem outside of the US. I mean, the only thing I would add would be this is one of the reasons why people are getting tons of spam, texts and junk mail previously, now lots of, you know, everyone’s got a phone, spam, texts. And so if you remove yourself from these sites, that will reduce as well as potential for identity theft. And spam emails too, sometimes the emails out there. ⁓ In any case, ⁓ it’s US only, but if you’re in the US, it is a real problem. And I suggest you do something about it, if not from us, from somewhere, because it really does make a difference if you remove the things. Now, the other thing I would say, and we’ll probably do another episode of this, is that these sites are often, like you said,they’re buying and selling information from other sites and other places. And so if you just remove yourself once, your information will come back on these sites eventually because they ⁓ just buy it again and get it from somewhere else or from public record or something like that. That’s another problem with the US is they get it off from public records. like you like buy a house or something and they end up buying that information. ⁓ But that’s why you want a service to do it because we are constantly, the service is monitoring it and scanning these sites repeatedly. And so if your information shows up again, three months later, it’ll get noticed and then we’ll submit another removal request to remove it. So it’s kind of like always working in the background to remove yourself in an automated fashion from all these sites that we cover.Chris: Is it worth talking about kind of how that information stays on your local machine in this?Gabriel: Yeah, I think so. I think so because it’s a differentiator and it took us a lot more time to build this because of that. But I do think it’s a privacy benefit and worth it relative to other sites that do similar. Yeah, you want to explain it? I can do it too if you want.Chris: Yeah, mean, well, when you said it’s happening in the background, what we mean is quite literally on your computer in the background. It’s not happening on your data, you know, because we need, in order to opt out, you need to provide your name, right? And some information so that the service can opt you out. So rather than that information living on our servers and then doing the opt outs, it lives on your computer and does the opt out.And to your point, you mentioned that’s a differentiator. And it’s like a core thing for us is that we don’t want your personal information. As much as possible, we just don’t want it. And so that’s, I think, was worth mentioning with this product.Gabriel: Yeah, I’m actually not familiar with any other product that does it that way, that where your information really doesn’t live on an account on the server. It’s on your, in this case, your browser. It’s built into the browser. I think there’s two reasons for that. One is to do that, you have to have a browser. So we have a browser. So we were kind of uniquely able to do this versus like a web service. And also it’s a really pain to build this, to actually get it to work in the background. I don’t think anyone would do this. unless they really wanted to get that privacy protection ⁓ maximum, which is what we generally do. ⁓ So yeah, it’s unique in that regard. ⁓ We should probably mention that that is desktop only for that reason, because it was very difficult to bring it to mobile. But we’ve been working on bringing it to mobile. And that’s kind of like next step for personal information removal is bringing it to our iOS and Android browser.Chris: Yeah, I mean, I’m glad you mentioned that because I know that that is a big piece of feedback we receive. A lot of our users use, they may only use us on mobile, they may only have a mobile device, and so they’re not able to currently use this functionality unless they get a desktop going and get it going on there. So it’s exciting news. ⁓If we pivot over to that last piece, the four, so there’s the VPN, advanced AI models, personal information removal, and then that last one is identity theft restoration. This is essentially in the instances where you are the victim of ⁓ identity theft. ⁓and you mentioned that it’s a little bit the function, that way that it works is slightly different whether you’re in the US or in another country. If you’re in the US, if you use identity theft restoration, they’ll be able to do ⁓ some of the, if you’re trying to restore your credit and everything like that, whatever was stolen, they’re gonna give you guidance on how you can, ⁓ you’ll connect with an advisor, essentially you’ll make a phone call.They’re going to help you, they’re going to handle your case, help you get your identity restored. In some cases in the US, they’ll actually be able to handle some of that work on your behalf. They may be able to contact financial institutions and things like that for you. ⁓ For identity theft restoration outside of the United States, they’re only going to be able to provide you the steps, essentially. The guide, like they’re going to say, this is what you have to do, then you’ll have to do it. So that’s one, that is a different it’s worth noting between the US version and the ⁓ version available to everyone else. ⁓Gabriel: Yes, and so like this, I mean the way I think about this is, you know, we’re really trying as a company with the product to cover all the bases for you, you know, online and protection in your life. And so we’re, you if you use our product, you’re really reducing your personal information out there, essentially to the maximum you can easily. But it can never go to zero, unfortunately. And if someone’s really trying to target you,Maybe they’re looking through your garbage, who knows? You ⁓ can be a victim of identity theft and there’s a lot of people who have been the victim of identity theft, unfortunately, it’s not a small problem, certainly in the US. I know more about the US, but ⁓ it’s a big problem in the US in part because we were talking about those laws earlier. ⁓ But if you are, it can really be a big pain. ⁓Gabriel: People can open bank accounts on your behalf and credit cards and spend money. They can mess up your credit report. And so what this is is essentially a peace of mind such that if that happens, we’ve partnered with this service that 100 % focuses on helping people restore their identity. So you will get a personal advisor to really walk you through this process so you’re not on your own. And they do it every day.you that’s their whole business is what they do is help people restore their identity. ⁓ And so by buying into subscription, you’re essentially buying the, ⁓ for this part of the subscription, the ability to have access to this advisor should you unfortunately find yourself in this situation, which we hope never happens. But if it did happen, you’d have this ability to help you.Chris: Great, yeah. That covers the kind of the four, I don’t know how we’re doing on time, but that covers our four pieces of function.Gabriel: We have no real time limit. This is longer than we’ve normally gone, but we have, this is a big topic, so we don’t have to go super much longer, but if there’s a few things or anything else you want to hit, we could do so.Christopher: I I guess, like, I’ll just kind of piggyback. You made that point earlier about the subscription is about providing the extra functionality that would normally, that costs money, essentially. The other stuff we’re able to do in an ad-supported way or in a free way, whereas this, you know, the things that we’re offering here, it doesn’t work. You need to pay for it, essentially. ⁓ what I will say is that it’s very complimentary.to everything that DuckDuckGo is doing on the free side. And we continue to grow and add new stuff on the free side ⁓ all the time. But what I’ll say is that if you are a current user of either our search or ⁓ DuckAI or our apps, this is, like I’ve found it to be ⁓ just incredibly complimentary. It sits very nicely on top of all of that. You turn it on.⁓ And to your point, you said you use the VPN all the time. I use it all day, every day. I’m using it right now on this call and I use it ⁓ on my phone all day. ⁓ And it’s really quite delightful to have that extra protection on top of everything else and to have the extra AI models, know, GPT-5. 5 Mini is in the free version, but 5, just 5 is not. And so you get that with the...with the subscription and so, yeah, think I’ll just end it there. Some of the stuff that I really like about the VPN is you can opt out, know, unlike for instance the Mac version, you can exclude certain sites because certain sites don’t play as well with a VPN, like ⁓ some streaming video for instance, like Netflix, you might run into issues where they’re not gonna stream it to you. So you can exclude a site or, ⁓in my Android app I can snooze, ⁓ which you can snooze the VPN for 30 minutes, which is really great for if you’re troubleshooting or if you can’t access your bank’s app or whatever through. So that happens from time to time.Gabriel: Yeah, these are good points. mean, yeah, we can wrap it up. I mean, I agree it fits nicely and is designed to fit nicely just on top of our regular stuff. And in particular, it’s built in, it’s mainly built into our browser, right? So if you get it, then you have some extra stuff going on inside your experience that you can get access to. I should also add that a lot of the things that you just mentioned, those are new features since we launched this description. So.We’re adding new free stuff all the time. We’re adding actually stuff to the subscription all the time. You know, we have, we’ve plugged a few times, but we have a quarterly update website, ducktico.com slash updates. I think it’s slash updates. Yeah, okay. And you can go through and look at like quarter by quarter, there’s a section for the subscription and you can see, you know, what we’ve been doing there, but like we’re constantly thinking about what to add to it. So it’s not going to be static. In fact,Chris: It is, yeah.Gabriel: the AI model aspect of it, you worked on, just got added recently, right? So we have more coming and ⁓ yeah, so thanks Chris, thanks for coming on. Thanks everybody for listening this long. ⁓ I think we’ll do deep dives. I think we should do deep dives on each of the four things in a future episode. I think those would make good episodes. Yeah, cause there’s so much to cover there. All right, let’s get out of here. Thanks everybody.Chris: Yeah, for sure. For sure. All right, thanks Gabriel. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit insideduckduckgo.substack.com
    --------  
    25:49
  • Duck Tales: Marketing at DuckDuckGo — how we practice the privacy we preach (Episode 9)
    In this episode, Cristina (SVP, Marketing) and Chuck (Front‑end) discuss private marketing at DuckDuckGo, from making decisions with less data to the role of privacy engineers in marketing projects.Disclaimers: (1) The audio, video (above), and transcript (below) are unedited and may contain minor inaccuracies or transcription errors. (2) This website is operated by Substack. This is their privacy policy.Cristina: Hi, and welcome to DuckTales, where we go behind the scenes at DuckDuckGo and discuss the stories, technology, and people that help build privacy tools for everyone. In each episode, you’ll hear from employees about our vision, product updates, engineering approach to AI, or how we operate as a company. Today, we’re going to chat about how most companies collect a ton of information through their marketing activities and how DuckDuckGo, given our privacy policy of we don’t track you, do things like attribution very differently.I’m Cristina, I’m on the marketing team, and today I’ll be interviewing Chuck. Chuck, you wear a lot of different hats. Can you introduce yourself and some of what you work on?Chuck: Sure. ⁓ I am technically on the front end team and work on the front end of our search projects, our products, and our subscription products. ⁓ But I ultimately do whatever I need to do to get the job done, which is kind of our DuckDuckGo ethos. I do some product management, some data science, back end engineering. I work with the marketers. It’s fun. ⁓ And I need access. So getting to where lots of them is.Cristina: Hahaha. Fair enough. Well, thank you. So much like our product philosophy, privacy is core to the ethos of our marketing. There are so many common practices we don’t do, identifying and targeting individual users, retargeting, using behavioral data, using third party cookies and pixels, the list goes on. And we’ve also declined working with a lot of vendors because they don’t meet our privacy standards. As a consumer, that’s something I really appreciate.But frankly, as a marketer, it makes the job very hard. But it’s getting a bit easier thanks to work from people like Chuck, which is why I was so excited to talk to you today. So Chuck, when you first started working with the marketing team, what was your reaction to our limitations and what we were hoping to achieve?Chuck: Honestly, I was a little shocked. ⁓ There’s a pretty well-understood playbook for how marketing in a space like this should look. A playbook of tactics and tools that are well-understood. And every company will do it differently, and every brand and product will have their own personality. But we pretty much use none of those tools.Cristina: Yeah, can you help people understand what the industry norms are for marketing attribution and data and how we do it differently?Chuck: So when you visit your favorite social media site and it’s trying to decide how to fill the ad slot in your feed, the ad platform will take what it knows about you as a person, your search history, who you follow, and what it knows about your situation, like where you are and who you’re with, and line it up with their ad inventory. They’ll do some very complex math to determine the perfect ad to show you that will maximize profits for the platform and the advertiser. So the more better data they have about you, the better they can target the ads and the more money they can make.I know that’s something you’ve talked about with Peter on a previous episode, that the financial incentive for the trackers that are ubiquitous online is data that feeds the machine that helps them make more money off of your ad space. That entire ecosystem just flies in the face of our privacy principles. In fact, some of our apps will block those trackers to keep your browsing private. So when we advertise, we refuse to use those tools like you just listed that are common in digital marketing, like retargeting or reporting different types of conversions after the ad click. ⁓ just to protect the privacy of our users. Instead, we’ll collect limited data only when there’s a very clear and urgent rationale for it. And when we do, we’re transparent about what we collect and how we use it. And we’re possibly most important. We’re really careful never to let those logs link two different events to the same person. That’s really difficult to do. ⁓ We have a really fantastic privacy engineering team that reviews every project and their implementation to make sure that the work we’re doing is aligning with our principles.I’ve also gotten really comfortable making decisions with just the imperfect or incomplete data, trying to identify the solutions that meet 80 % of the business needs without, with 20 % of like the potential input.Cristina: Yeah, it feels like a lot less than 20 % of what’s actually available to us. Well, yeah. So thank you for unpacking that. That’s a helpful foundation. Can you go a bit deeper and talk about what that looks like in practice at DuckDuckGo?Chuck: Yeah. That’s probably fair.Yeah, so we largely ⁓ don’t work with other vendors ⁓ in the marketing space and rely on the tools we own and build ourselves instead. That makes sure that we aren’t incidentally feeding the machine with our own users’ data, which is really easy to do if you’re not careful. ⁓ We have a couple of tools in our toolbox, too. We’ll do as much summarization and analysis of data locally before we ever send it back. So rather than saying that a user of our browser searches15 times in a day and ⁓ sending 15 different events for those searches, we’ll send a periodic report that will say they searched 15 times during that day. We’ll reduce the precision of those signals even further. So instead of saying that that person made 15 searches, we’ll say they’re a medium volume search user. And then when we do our analysis on an ad campaign, we’ll look at the summaries of the data rather than the raw data ⁓ so that we’re looking across our users rather than the individual humans.And if it comes down to it, we are willing to redact data that might be too identifying for a person, whether it might contain PII or if it looks too unique and may be able to be traceable back to a person, we’d rather delete it and not use it than jeopardize that person’s privacy.Cristina: Well, thank you for ⁓ sharing how our ethos really comes to life there. And I’d love for you to touch on one of your claims to fame at DuckDuckGo, which is creating a better, more privacy-respecting system that we call Origin. Can you talk about how you got the idea and how you brought it to life?Chuck: Yeah, so we were struggling to run small scale campaigns that test new ad platforms or creatives. ⁓ With the tools that we have, the only way that we could do that without jeopardizing user privacy is to run big, broad, expensive, scaled campaigns. But we’re a small company. We want to move nimbly. And that made it really difficult for us to quickly validate our direction and make sure that we were dedicating our resources in the right time or in the right place. So I spent some time with our marketing leaders, including you, Cristina. ⁓trying to understand the norms and the challenges they were facing, the tools that weren’t in their toolbox. And I brought that to the privacy team. ⁓ We worked backwards, starting with user privacy as a first principle to the business goals and landed on a solution that kind of looks like this. ⁓ You see an ad and you click on it for DuckDuckGo and you install our app from it. When that app first runs, we will send one signal that says that you installed the app from that ad in that location.And then once a day, we’ll build a summary of those signals that give us pretty coarse insights that say, you know, we had 10 users install our app from that ad on that ad platform on that day. Then we’ll line that data up with other information that the ad platform gives us, like how many impressions there were of the ad and how many times it was clicked and how much that cost us. And that’ll give us some high level insights we can use to start making decisions, like how much it costs us to ⁓ per install from that ad. There’s nothing groundbreaking here technologically.It’s actually intentionally very simple and that helps us maintain the privacy properties because we have a high elevation view of everything that’s happening. We never share data outside of DuckDuckGo, so we aren’t feeding that machine. There are never person level insights. We’re looking at broad signals across our audiences. There’s no risk of PII and we’re only collecting the data that we need to make those decisions, nothing more. But it still lets our marketing team make informed decisions while working quickly and doing their jobs well.Cristina: Well, thank you. ⁓ More importantly, thank you for the months and months of work you did on that. ⁓ You say it’s nothing revolutionary, but actually, I think it’s a pretty novel approach. We don’t know of any other companies using technology like this. Typically, they use the entire suite of tools available to them. ⁓ But hopefully, one day, it won’t feel like such a novel approach, and this will become more of the industry standard. At least my naive perspective can hope for that.Chuck: Of course. I hope so. We’ll see if capitalism agrees with this.Cristina: So any parting thoughts you’d like to leave on the future of privacy respecting marketing?Chuck: One of the things that I really love about and appreciate about DuckDuckGo is the example that we set for other companies. ⁓ On the search engine side, could we collect data at massive scale and hyper-target ads to our users? Absolutely, but we don’t need to. And we love being an example of a sustainable business that respects user privacy in their searches. And I like to overlay that to our marketing efforts too. Would we benefit by using really invasive tracking like the industry standards? Yeah, probably, but we don’t need to.We’re a good example of how you don’t need to participate in that data intensive ecosystem to market your business. And I’m really proud to work on it.Cristina: Well, thank you, Chuck. I feel the same way. And for those of you listening, if you or someone you know considers themselves to be a privacy-centric marketer, including ad networks and measurement partners, would love to chat, reach out to me on LinkedIn with what you’re doing differently. Chuck, it was really great chatting with you today.Chuck: Always check, great to chat with you too.Cristina: Thanks to everyone who took the time to listen. We have so many more episodes planned on a wide variety of topics, so stay tuned. Bye. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit insideduckduckgo.substack.com
    --------  
    9:32
  • Duck Tales: Improving AI chat organization, and feature decisions at DuckDuckGo (Episode 8)
    In this episode, Gabriel (Founder) and Esteban (Design) discuss AI chat organization, from automatic chat naming to ‘pinning’ your most used chats. Disclaimers: (1) The audio, video (above), and transcript (below) are unedited and may contain minor inaccuracies or transcription errors. (2) This website is operated by Substack. This is their privacy policy.Gabriel: Hello, welcome to DuckTales. Inside DuckDuckGo features people, et cetera. You got me as the host again, this time I’m the founder and CEO of DuckDuckGo. And I got Esteban with me today. Esteban, wanna introduce yourself?Esteban: Sure. Hi everyone. I’m Esteban. Hi Gabriel. Esteban, I’m a designer in the team.Gabriel: Sweet. And that’s what we’re talking about today, Duck AI, and in particular, kind of new features we’ve been introducing around conversation organization that Estevan has been designing and working on. And we’ve been releasing kind of a few of these over the last couple of months. You want to just jump in, you want to share your screen and walk us through it. I realize we have some of this on audio now only.Esteban: Sure.Gabriel: Let’s also try to describe what we’re seeing while we do it. I’ll do the same thing.Esteban: Yes, for sure. Let me just share my screen and I’ll walk you through a few of the things that we recently dumped. Yes, so if you’re like me, you have tons of like conversations going on at the same time. What we have seen from users is that people who are very engaged with our platform, they end up having tons of conversations and then sometimes it’s harder to get back to them and to find the one that you needed. So we launched three things. The first one, I’ll show you an example. I was trying to see if I should ask you for a promotion during this podcast. Clearly no. ⁓ But the cool thing was that we, yeah, I will wait for a better time. ⁓ The first thing that we shipped was that we had ⁓ a title, the title of our,Gabriel: Good answer.Esteban: Chats were basically the same first prompt. It was just duplicated. That would make it harder to read. So the first thing that we launched was this automatic titling. We’re using the LLM to come up with a better title at the top. So it’s easier to find. ⁓Gabriel: So this is similar to how ChatGPT and some other competitors are doing it, right? So like we used to do just to repeat, so I understand fully, I think I do, ⁓ having reviewed this when it launched, but just to make sure. ⁓ Yeah, we used to just literally repeat the prompt as your title, like the beginning of the prompt. And so that it was kind of weird sometimes and duplicated sometimes, but now we run in the background something that... ⁓Esteban: Definitely Right.Yeah.Gabriel: Summarizes it for you and then automatically does this. You don’t have to do anything, right?Esteban: Yes. Exactly. And for example, I’m trying a new one. What day is today? That’s my prompt. And then immediately what I get as a title is day to day. The one thing is that sometimes the title is not exactly what you will call it. Like maybe day to day is not super descriptive. So we added this minor option, no? So we can say, I don’t know, day to day, it’s Thursday. Simple but useful.Gabriel: So if you want to do whatever you want, yeah, like if you don’t like our casing or something, you can put everything in lowercase or whatever, you can just rename it at will, yeah.Esteban: Yeah. Exactly. Yes, so after you have you want to name stuff, it’s very helpful when you have like several chats about something similar, but you want to have it personalized so it’s easier to find. So super simple, nothing that I don’t know, it’s blowing innovation in a way, but very useful. The second one is we noticed how ⁓ lots of our users were asking us for ways to save conversations and finding the conversations faster. We also have a limit of how many conversations you can have right now. There’s just 30 chats after the 30th chat. The next one gets deleted. We’re working on that, but we wanted to offer a way for you to say what’s important for you and why are the things that you want to come back to it. So I don’t know, this one. Let’s say it’s something that I was working on today, but I want to come back to it.add it to the top of the list by pinning it. So now it’s pinned at the top and it will always be there. That also means that if DocAI needs to delete one of your chats, it will go to the last one on the list and this one will not get deleted. You can pin up to five chats right now and yeah, it’s always accessible, always at the top, easy to reach.Gabriel: Got it, so it’s kind of the equivalent of like a favorite or a star or a pin in this case. All of these things are accessible from this three dot hover menu next to the ⁓ chat, chat to the individual chat. And then also you’re saying, is good, that ⁓ because the reason why we have the 30 limit at the moment is because all this is stored locally on your browser. It’s not actually stored on our servers. ⁓Esteban: Exactly.Gabriel: we’re working on an encrypted storage that we won’t have the keys to where you can get a much higher limits on it. But at the moment, or if you just want to keep it local, there is a local limit because your browser has storage limits. ⁓ But what this will allow you to do is keep ones around that you really want around, right? So you’re saying if you favorite these or pin them, in our words here, you have a pin section at the top. But if you start making a lot of chats, the non-pin ones will get.Esteban: second.Gabriel: kind of blown away first.Esteban: Exactly. Exactly. ⁓ We have plenty of requests about chat organization and some people are going as far as like, want to create projects, want to create groups, I want to organize my stuff, which it all makes total sense. And I guess up to a point you need those sort of organization tools, but the simple ones will cover most of the needs for most of our users, I would say, because maybe you have a few chats where you keep coming back to them, but then you have a bunch of quick requests, quick checkups with the LLM.And something like this is super simple. It doesn’t require a lot of effort. And yeah, we hope it helps a lot of our users.Gabriel: And you mentioned in there a few times like we did this and we’re working on this, these features in particular because we get a lot of user requests for them. ⁓ So speaking to that a little bit, like my understanding is, you know, we get lots of feedback. ⁓ We’re looking through it all and kind of organizing it, like which are the most like important issues to work on. But then also when we launch features, cause to your point, people ask for all sorts of different things. And then we, and like you in particular, design. And you’re like, well, I think this is gonna be a satisfaction of a lot of people’s requests, even if that’s not exactly the thing they asked for. And then we put it out and then how do we know whether it worked or not? Like, what are we looking at?Esteban: Yes, so to answer your question, we see a usage in particular. We don’t have, of course, data about a particular users, but we know that roughly X amount of people are using this feature. We also know from social media, we got a little bit of love ⁓ after posting that we launched this. And then the other thing that’s a really interesting metric is we see the feedback coming in. ⁓ and comparing with what kind of feedback we were getting a month ago, and we see a big decrease on charge organization requests. As said, there are still things that we can do and we’re working on them, but we see a lot of people, a lot less people requesting for things like this, which is also good news.Gabriel: I love that metric. mean, because it really is, I guess we are lucky that we have enough users and enough sample size where we can be like, wow, chat organization is a category we can ascribe feedback to. And now it’s like halved or whatever after these features come out, right?Esteban: Right. Yeah, so something we did for this project that is super interesting, it was fun for me to do was that we have this category, like chat organization, and then we get feedback directly from our users asking for a specific feature. I went and looked into all the feedback that was related to chat organization, and I tried to see why we’re asking for a specific feature. Some of them actually mentioned it, no, I want this so I can do that. And then those needs, I matched them with what type of features will work, even just by naming different types of features. You said that this was sort of favorites or it could be pinning or it could be saved or it could be bookmarked. We also have bookmarks in the browser. So how do we name the feature related to the benefit that I will have and the need that it will solve, but also how much effort will require from the users to actually get the benefit that they were asking for? ⁓ Create projects, it’s a lot of effort.And they will get a lot of benefit, but not many people are willing to spend time organizing on their chats. But pinning is one tap away So that’s a sort of ⁓ prioritization exercise that we did to define exactly what are the new features that we’re going to launch.Gabriel: Yeah, that’s a super interesting point because like all different features have different levels of complexity for us to build. And then also for the user to actually use to your point, like I’ve seen, yeah, I’ve seen lots of requests for people wanting really complex things, but then very small percentage of people would actually go through the effort to use those things. Whereas to your point here, pinning, especially the chat title is just automatic. We get that for free to everybody. But then the pinning is just literally just a one click. You don’t have to type in a name for it, a folder name for example. You just get the pinning at the top.Esteban: Right. And in some cases you actually need to go and give effort to the users in a way, because we thought automatic title would solve the problem. No, like we just add automatic title to everything. That’s it. And then by testing and seeing how some of the titles reacted, we knew that we were, it’s just not going to be bulletproof. Like in some cases you want to have your own title. So we went back and said, okay, let’s add a manual option. ⁓ Cause then we went, then that way we were solving everyone’s needs. Yeah.Gabriel: You’re like covered. Yeah, you’re covered every, at least there’s a backstop. That’s super interesting. So what’s next, if anything? Are you moving on from chat organization at the moment or are you thinking about some other kind of deeper aspects of it?Esteban: It’s still there and it’s still one of our top requests. You mentioned that we’re working on finding ways to give you a bigger list of like bigger limits, have more chats, maybe syncing between devices. And we are also thinking about search, of course, ⁓ so you don’t have to read your whole list of chats, just go straight into that answer that you remember. ⁓ from a week ago. So those are things we’re working on and I’m sure there will be plenty more organization features we could do but for the moment that’s a plan.Gabriel: Sweet. Well, thank you. I’m excited to have you back and someone, maybe I hope I’m the host, but somebody to talk about these more organization features in the future. But yeah, thanks for coming on and thanks everybody for listening. Bye everybody.Esteban: Okay. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit insideduckduckgo.substack.com
    --------  
    11:52
  • Duck Tales: How DuckDuckGo protects users from different types of scams (Episode 7)
    In this episode, Gabriel (Founder) and Thom (Security Team) discuss Scam Blocker. How it works, the types of scams it protects against, and why our ‘bad pages’ list is updated so often. Disclaimers: (1) The audio, video (above), and transcript (below) are unedited and may contain minor inaccuracies or transcription errors. (2) This website is operated by Substack. This is their privacy policy.Show notes: See the full blog post on Scam Blocker. Gabriel: Hello, welcome to DuckTales. I’m Gabriel, CEO and founder of DuckDuckGo. DuckTales is everything kind of inside DuckDuckGo. Today we have a new topic. I don’t think we have discussed much about security in our browser. I got Thom here. Thom, you want to introduce yourself?Thom: Yeah, sure. Hi, I’m Thom. I’m one of the security engineers here at DuckDuckGo. I spend most of my time kind of in and out of browser security, product security, that kind of stuff. Yeah, that’s the kind of stuff I love.Gabriel: Sweet. And I think we’re here today to talk about our Scam Blocker. If you follow our blog, we actually had a pretty big article about this when it launched a few months ago. And so you can always check that out too, but we’re going to tell you all about it here and some of the inside info on how it came together. Yeah, Thom, you want to just explain generally what it is? What is Scam Blocker exactly?Thom: Yeah, sure. So I guess Scam Blocker is what we call our in-browser phishing and scam protection. It kind of runs in the background and checks websites as you visit them all locally in the browser. And we kind of have a pretty big data set here that we get from Netcraft. So we can protect against all sorts of scams — this isn’t your standard phishing protection. We try and protect against cloned e-commerce sites, fake crypto exchanges, scareware like fake virus pages, and advertising of fake products and stuff. So we have quite a lot that we’re trying to protect against, but this feature as a whole is that warning page that you get when you’re about to visit something that could be scammy or phishing related.Gabriel: So let’s talk about that distinction a little bit. I guess backing up a little, how did this come together? How did we end up building this and then building it kind of differently than other companies?Thom: Yeah, so it came from a long way back. Originally, we had this idea that we wanted to improve our tracking protection and all of this stuff — trying to make our browsers as safe as possible for our users. We knew that we wanted to do something in this space, but the challenge was that it’s quite easy to build a feature like this where it ends up looking like you need to check people’s browsing activity — and we can’t do that from a privacy perspective. So we knew that we had to do this in a privacy-preserving way, and we didn’t like the idea of sending any data to Google or Microsoft because they pretty much own this space in terms of browser protections. We weren’t comfortable with that, so that kind of led us down the path of building it ourselves.Gabriel: Interesting. So like at a high level, our browser has a privacy protection list instead of blocking that we built ourselves because we didn’t believe anyone else was doing it up to the standard that we think it should be. But that’s all kind of behind the scenes on pages that you visit, assuming that was a page you actually wanted to visit. Privacy and security overlap, but as I understand it, some pages you visit are actually bad for you — not because there’s hidden trackers, but because the page itself has malware or scams. Those are the pages we wanted to cover. And in doing that, you need to have a list of bad pages.Thom: Yeah.Gabriel: Everyone else seems to be using Google or Microsoft, and all the other browsers are just kind of riding on Google Safe Browsing. But we wanted to go somewhere different. So we found this vendor Netcraft, who maintains a big list, and it turns out they have an even bigger list than Google’s because they cover these other categories, right?Thom: Yeah, exactly.Gabriel: Like some of these scam categories that you mentioned are not traditional malware phishing. They’re theoretically legitimate businesses that are scamming you. So for whatever reason, they’re not on Google’s list. Is that kind of how to think about it?Thom: Yeah. That’s a good way of saying it. Some of these are quite unique. One of the interesting cases I like to refer to is that sometimes even a blog post could be a scam. If this is a blog post advertising a fake product that’s going to steal your money, that’s a problem. A lot of these scam sites start somewhere trusted, like a Medium article or GitHub page, and then send you down fishy paths until you end up somewhere meant to steal your money. That’s the kind of thing we’re looking at here with Netcraft. We get data that lets us look at the source of it rather than waiting for you to click through multiple times to get there.Gabriel: So we license this data set from Netcraft who’s aggregating all of these scams from different signals. And then what do we do with it exactly? How does it work to be embedded in the browser?Thom: Basically, we pull this data — it’s constantly evolving, which is one of the challenges. We have to update it pretty much every five minutes on the backend. We pull it, process it, filter out some of the lower-risk things, and then compress it.Gabriel: Five minutes is so quick. So it’s really happening in real time. I didn’t realize we were doing it that real time.Thom: Yeah, it’s rapid. If you take a random phishing link now and look again in five minutes, chances are it’s gone.Gabriel: And that’s because all these people are reporting these things, right? It’s an arms race — things get blocked quick, they switch domains, and all sorts of crazy stuff.Thom: Exactly. It’s this constant cat-and-mouse game.Gabriel: Cool. Sorry to interrupt. Every five minutes, we’re updating this list on our backend.Thom: Yeah, and then we compress this into a small format. Our browsers pull this data every 10 to 20 minutes depending on platform. That’s how the update mechanism works.Gabriel: Got it. So once it’s sitting in the browser, the browser checks against the list. If you’re going somewhere that’s on the list, that’s when you see the warning page. Are we similar to others where you get a big warning page but can accept the risk? And do all these warning pages look the same or are there different types?Thom: Yeah, pretty much the same. You get a warning page explaining the case. We have three types of warning pages — they vary slightly in iconography and copy. They’re for malware, phishing, and scam. Malware means you might download something malicious, phishing is about credentials or credit cards, and scam is broader — like a dodgy e-commerce site.Gabriel: Got it. So any surprises in building this or challenges that arose getting it live to production?Thom: Yeah, a few. The first one is that we have four browsers — four different platforms. The core part of the feature is constantly updating, but the other challenge is intercepting navigation requests. Every browser does this differently. So we had to map out how each does it and figure out ways to do it efficiently. We pride ourselves on our browsers being quick — we don’t want to affect load times. So we had to make sure the check runs quickly, just before a page loads. There’s a lot to consider. That was one of the biggest challenges.Gabriel: Yeah, that makes sense. It basically seems like one project, but it’s four big projects — MacOS, Windows, Android, and iOS. Cool. So how has it gone? Any good response? I know we put out a blog post and got some press when it launched. It seemed positive from my view, but from your point of view, what did you think?Thom: I think we had good positive feedback. One unique thing about this feature is that it’s in the background — its success hinges on people not really seeing it. If loads of people are seeing the error page, then we’ve probably done something wrong. But overall, it’s gone well.Gabriel: Yeah, that’s a good point. It’s like our other privacy protections — always on, not breaking sites, contributing to peace of mind. It’s protection that’s there, not in your face.Thom: Precisely. People who’ve come across it said it works well and gives them peace of mind.Gabriel: Cool. So it sounds like it kind of went off without a hitch. Is there anything left to do now? Are we kind of in maintenance mode with it?Thom: Yeah, pretty much in maintenance mode. We have about three or four people monitoring metrics. But we’re exploring ways to enhance the data, maybe adding new or better data sets. We might tailor data sets by platform — for example, malware is more prevalent on Windows, scams more on mobile. I’ve also been reading about using small language models fine-tuned to detect scammy websites locally. It’s promising research — local-only, privacy-preserving — though I don’t see it in the browser anytime soon.Gabriel: That sounds fun. A good hack day project — and who knows, lots of those end up in the product. I definitely think we should ship local models or get access to local ones on the device. The problem’s been that either local models aren’t very good or the downloadable ones are too big, like three gigs. But I think it’s coming. I think there’ll be a future where we have local models in the browser, shipped by default or opt-in, maybe with extra protection. That would be an interesting incentive to download a local model if it gives extra security protection.Thom: Yeah, exactly — extra security protections. I’d love that.Gabriel: All right. Well, we’ll end here. Thanks, Thom, for coming on. Hope everyone enjoyed hearing about security, and maybe when you launch something new, come back and we’ll talk about it again. All right, bye everybody.Thom: That was great. Thanks a lot, Gabriel. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit insideduckduckgo.substack.com
    --------  
    14:57

More Business podcasts

About Inside DuckDuckGo

Behind the scenes with the DuckDuckGo team — sharing insights on product, engineering, leadership, and AI. insideduckduckgo.substack.com
Podcast website

Listen to Inside DuckDuckGo, Aspire with Emma Grede and many other podcasts from around the world with the radio.net app

Get the free radio.net app

  • Stations and podcasts to bookmark
  • Stream via Wi-Fi or Bluetooth
  • Supports Carplay & Android Auto
  • Many other app features
Social
v8.0.7 | © 2007-2025 radio.de GmbH
Generated: 12/7/2025 - 3:38:28 AM