I think, general (tech-savvy) audience would more enjoy encrypted logging (message archiving), using some variant of XEP-0136, but storing messages encrypted to user's public PGP/GPG key.
So the messages are kept (in case you want to refresh your memory, but don't have locally-stored history), but are unaccessible by third parties.
I'm not sure about that. People who want chat logs can simply generate them on the client side. That way, even if they're using OTR they still get the chat logs.
I'm using OTR, but only for conversations that are worth protecting. IMHO securing typical chat with friends (mostly consisting of funny/interesting link exchanges) is almost pointless.
But having the history is still useful ("remember that article I've sent you yesterday").
Not as pointless as most people intuitively think. What if the chat server you're using is compromised by a hacker trying to make a name for themselves and they publish all of the chat logs on bittorrent?
Some examples of comments in a private chat that might at first appear like they don't need encrypting, but might come back and bite you in the arse if they ever get published:
"God work is boring today. Need to update my CV/Resume"
"Bob was a bit of an idiot last night wasn't he"
"Thinking of skiving off work tomorrow."
"The wife has been nagging at me all afternoon. Fancy a pint later?"
Depending on how secure you want to be, the existence of encrypted/non-encrypted information reveals things as well. Someone could infer something by just knowing that you turned on OTR at a certain time.
> People who want chat logs can simply generate them on the client side.
That wouldn't fulfil 90% of the purpose of keeping logs, for me at least. Not everyone has the same requirements as you - I for one very rarely bother with OTR, but I have to search my chat logs for something on an almost daily basis. I use XMPP on my work PC, on my laptop and desktop at home, and on my phone. Splitting the logs across all those devices would make them literally useless.
We at DuckDuckGo assure the same anti-tracking policy on our XMPP server. There is nothing greater about DDG then other sites following the same policy :-). But its DDG :-)
That's cool. But I've no idea if you're retaining IP logs and chat logs. You really need a service specific privacy policy which details exactly what you store and for how long.
For those that haven't tried before, running your own XMPP server is incredibly easy on even a small VPS. I'd recommend ejabberd, its pretty solid, light weight and fast.
Very cool, although it could probable use a name. Maybe "DuckDuckChat"? "DuckDuckGo XMPP Service" is not going to be used by all but the most technical of users I think...
Even "DuckDuckGo Jabber Service" is better, XMPP just sounds so unfriendly.
Note the #. Now, remove it and everything after it and reload the page.
Why am I being downvoted? Didn't we all just throw shit at gawker for doing the same thing?
EDIT: This fundamentally breaks the web. The # and everything after it are _not_ sent to the server. It relies on javascript and extra-protocol information to get the document, which breaks the idea of a resource having its own name. The # was suppose to denote a section of a resource, not a resource in-and-of itself. I'm sure everyone here knows this, but I had to get it off my chest.
I'm most interested this oblique reference: "...add our DuckDuckGo Jabber Conference, it will soon be linked to the IRC channel #duckduckgo on freenode".
Where's the technology for linking an XMPP conference to an IRC channel? I lurk in some IRC channels that would love to migrate to a more modern protocol, and that seems a good way to bridge the gap.
A friend did this: https://gitorious.org/irctk ("irctk is a general-purpose IRC wrapper written in C with libircclient"). I think it could be pretty straightforward to do the job using it.
We prefer Perl, cause we got one solution for everything and can easily combine the thousands components offered. Just cause a lib does IRC doesnt help us much :-) It must be easy! :)
I'm sorry but I don't really understand the utility of that service ? Is there any link to other protocols ? What are the benefits of using this server instead of something like gtalk or some other widespread service ?
Why should I jump to this service and make my friend so the switch as well ?
Thanks :)
edit: I know perfectly what is DDG and I really love this search engine, but still.. don't get me wrong, I'm just asking for answers there, not being rude
You dont need to convince them to switch! You can still talk to your gtalk friends, its all XMPP/Jabber! This is not a service just for inside duckduckgo. Inform yourself a bit more about XMPPP/Jabber :-).
I'm confused about this, too. Is this mostly to replace discussion about DDG on IRC? Why is this exciting? (As with the parent comment, I'm not trying to tear anyone down. People are clearly excited about this, and I'm wondering what coolness I'm missing out on.)
I have an account on my own XMPP server. I just added "im@ddg.gg" and I can now do DDG searches through my chat client. Not sure how useful that is, but nice nontheless. And all without having to sign up for an account directly with their XMPP service, because of federation.
37 comments
[ 8.6 ms ] story [ 81.4 ms ] threadWill you be following the same principals in regard to privacy as the DDG search engine follows? Personally, I would love to see the following:
1.) No connection logging. Ie, don't log when people log in and from which IPs
2.) No chat logs
3.) High profile information and instructions on how people can use OTR (Off the Record) for end to end chat encryption
4.) A Tor hidden service gateway to the XMPP server
Regarding 1 and 2, the least that is required IMO is a privacy policy detailing which information is stored and for how long.
So the messages are kept (in case you want to refresh your memory, but don't have locally-stored history), but are unaccessible by third parties.
Besides, anyone who is tech savvy enough to mess with public key encryption is going to be using OTR anyway, making server side logs useless.
But having the history is still useful ("remember that article I've sent you yesterday").
Some examples of comments in a private chat that might at first appear like they don't need encrypting, but might come back and bite you in the arse if they ever get published:
"God work is boring today. Need to update my CV/Resume"
"Bob was a bit of an idiot last night wasn't he"
"Thinking of skiving off work tomorrow."
"The wife has been nagging at me all afternoon. Fancy a pint later?"
That wouldn't fulfil 90% of the purpose of keeping logs, for me at least. Not everyone has the same requirements as you - I for one very rarely bother with OTR, but I have to search my chat logs for something on an almost daily basis. I use XMPP on my work PC, on my laptop and desktop at home, and on my phone. Splitting the logs across all those devices would make them literally useless.
http://duck.co/topic/duckduckgo-s-new-public-xmpp-jabber-ser...
See down under the comments, i explained there what is so far logged, but we will tune this now over the next days.
Even "DuckDuckGo Jabber Service" is better, XMPP just sounds so unfriendly.
EDIT
See this post by yegg, the duck duck go founder
http://www.reddit.com/r/technology/comments/epd59/google_poi...
Note the #. Now, remove it and everything after it and reload the page.
Why am I being downvoted? Didn't we all just throw shit at gawker for doing the same thing?
EDIT: This fundamentally breaks the web. The # and everything after it are _not_ sent to the server. It relies on javascript and extra-protocol information to get the document, which breaks the idea of a resource having its own name. The # was suppose to denote a section of a resource, not a resource in-and-of itself. I'm sure everyone here knows this, but I had to get it off my chest.
Where's the technology for linking an XMPP conference to an IRC channel? I lurk in some IRC channels that would love to migrate to a more modern protocol, and that seems a good way to bridge the gap.
If you are interested, just join us on IRC and we talk about it :)
And to answer your question, taka a look at
http://xmpppy.sourceforge.net/irc/
Thanks :)
edit: I know perfectly what is DDG and I really love this search engine, but still.. don't get me wrong, I'm just asking for answers there, not being rude
I think that perhaps, like me, they were hoping that you would be interested in sharing a couple of use cases for XMPP with us ...?