00:00 Hello, I'm Seth For Privacy, and welcome to Season 2, Episode 12 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they've found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Have you been looking for a privacy-preserving and lightweight search tool that you can self-host? This episode, we're sitting down with Ben Bespey to chat about his project, Whoogle Search.

Welcome on to Opt Out, Ben. Thanks for having me, Seth. Yeah, I am very excited to chat about this because Whoogle is a tool that I've been using personally and that I've been hosting for kind of the community that's formed around this podcast and around the education work that I do on Twitter. So it's been one of my most used tools. I mean, it's my default search in all of my browsers, my WISE browser. It's definitely a heavy, heavy use tool for me.

So I'm really excited to learn more myself, but really just to get the word out there, get other people familiar with what Whoogle does, with what the approaches you've taken to building it are. And yeah, very excited to dive into that. But for those who aren't familiar with you, do you mind just introducing yourself and telling us a little bit about what Whoogle is? Sure. So I'm Ben Busby. I'm a freelance programmer, musician, and game developer that frequently works on open source projects, one of which is Whoogle, obviously.

It's just a, I mean, to boil it down, it's just a Google search proxy or meta search engine that grabs Google search results and filters out pretty much everything that you don't need, including like ads, tracking, JavaScript, AMP links, refer header, pretty much everything that like isn't really crucial to the search experience that I was annoyed by. And yeah, that's about it. Yeah. I think that's honestly one of the strengths of Whoogle is it's a very simple tool.

It's Google search without all the crap that you don't want to have to deal with. So it also makes it a very easy tool to transition people onto because if you're familiar with Google search, you can figure your way around Whoogle quite quickly. So before we dive too deeply into the tool itself, I'm really curious to learn a little bit more about you and kind of what kicked off Whoogle and just kind of what it was that woke you up to the need for personal privacy initially.

Sure. I guess as far as personal privacy and my interest in that goes, it kind of was born out of a frustration with the byproducts of lack of privacy. So the kind of things that were popping up, like, so I guess I should back up. Growing up, I wasn't interested in tech at all. I was like a musician and I kind of begrudgingly decided to major in computer science and just sort of going from this like hard break mindset of like, from just kind of treating the internet as like, oh, it's just my curiosity playground to like, oh my God, it's frighteningly easy to collect data on people and people are doing it and making just ridiculous amounts of money doing it.

That hard transition just really threw me in the deep end. And I was, I don't know, I just ended up feeling kind of violated. And I was like, I don't know, like search engines in general, I think everyone kind of treats them as a natural extension of their curiosity. And so to kind of violate that trust in someone and start using what they're curious about to sort of market to them better, I just find the whole thing gross. And I think most people do on some level, but I was fortunate in that I found it gross and also was able to do something about it.

And that sort of led to the creation of Google. I guess I can just sort of pivot right into that. And I mean, I guess on one level, Google was sort of born out of a frustration with mobile browsing. So I was like most people using Google search. And anytime I wanted to like share a link with someone, it was always an AMP link. And as someone who always inspects every link that I send or view or anything like that, I was having to manually edit these links all the time.

And so the very, very first iteration of Google, all it did was serve identical Google search results, but without the AMP link, like you just, it was doing the editing for me essentially. And then there were just, there was a very obvious snowball effect from that, where I was just like, oh my God, like I can just take everything I don't like about Google search and remove it and make a more lightweight, more immediate experience. Because I'm also someone who's extremely impatient.

If I want, if I search something, I want the very first thing I see to be what I'm looking for. And that just, there's just a reflex with normal Google search for you instinctively scroll past ads to get to what you're actually looking for. So yeah, I mean, it was a combination of impatience, hatred of AMP links, hatred of ads, just like, I don't know, I guess in general, I kind of gravitate more towards low tech things in general. Like if it were up to me, the entire browsing ecosystem would be closer to like Gemini or something where it's more plain text based anyways.

So it was just kind of my contribution where I could get rid of annoyances myself. And as a byproduct, have a product that I can share with other people and allow them to do the same. Yeah. And that's one of the beautiful things about the free and open source space. And obviously, Google is open source. It's just that you can kind of take your personal need, build something out of that. Obviously, you have the talent to build that and you've done great work there.

But you can build that product and allow other people to benefit from the things that came out of your own frustration, which I feel like is the source of so many of the tools that we end up using out of the free and open source space. If someone gets fed up with the centralized or the closed source alternative, builds a tool that fits their specific needs, their specific wants. And that ends up being a tool that's so helpful to other people. And I'm glad you touched on the search angle and how the invasion of privacy there, it really hits on even further details than just the facts about who you are.

Like, it's not just your name. It's not just your address. It's not those things which are important that you have the choice who gets access to those. But like you mentioned, it also even hits on your curiosities and even the things that are pre-belief. They're pre-part of your identity. They're things you're just trying to get a question answered or learn more about something. And those things are being used to profile users to build a fingerprint about who you are and what you like and maybe who you're going to become.

Or, I mean, obviously, there's the famous cases of retailers figuring out that someone's pregnant before they know that they're pregnant because of the things that they've been buying and doing. There's a lot there that even before you know something about yourself, a search engine where you're putting all of these queries, where you're putting all these searches, can learn that about you and be able to leverage that against you for their own monetary gain, which is really a disgusting concept but has become the crux of a lot of the internet today.

Yeah. I mean, it's just gross. I don't know how anyone can kind of sleep at night and contribute to that sort of thing. But here we are. It's like the entire tech industry practically is driven by targeted advertising. And I don't know, just learning as much about someone. Yeah. I don't know. I could go on forever about just like how much I hate it. But yeah. Yeah. It's definitely one of those things that I think I'm sure someone started with the idea of like, oh, we have this data anyways.

We'll just use it to make some money on the side. And it snowballed into being the kind of the cornerstone of the majority of Silicon Valley and then the tech that's being built out. Because that's the easiest way to make money is siphon up that data and sell it off or use it yourself to build products that target those people. Yeah. It's definitely an unfortunate thing that the internet turned out like that. But obviously pivoting back to Whoogle, I'm thankful that there are ways that we can start taking steps for ourselves.

Obviously, Whoogle is a tool that I've been using heavily. I talked about that a little bit earlier. But what is it that someone who starts using Whoogle, what is it that you hope that they get out of that? I think the number one thing that I hope they get out of it, and I think it's pretty obvious just from how much time I've spent with documentation in particular, is just how easy it is to set up. I've really tried to take care to make it so that anyone of any experience level can just sort of spin up an instance.

Ultimately, like a cleaner search experience, I guess. Like an easy and clean search experience. Like I don't want someone to see the Whoogle page and be like, oh my gosh, this is way too technical for me. And there's no chance in hell that I can get this spun up. I've tried to make it so that people have one click deploy options to Heroku and REPL. And I mean, if you have any sort of technical experience, you'll see that it's also very easy with that regard too.

I mean, you can run it in a Docker container. You can just run it from a PIP package. I think, yeah, if there's one thing that I hope users get from it is just how easy it is to spin up. And then as far as like the experience, I just hope that someone immediately sees the value in using it. Like if they perform a search that it's like instantly obvious. It's like, oh, this is what's different. Like this isn't just Google, but like reskinned. It's actually like stripping out a lot of the junk that I don't typically find useful.

Yeah. Yeah. I definitely have noticed that effort that you've put into the hosting options. And I'm using the quote unquote most complex option, which is the Docker container. But one of the reasons that I first set up Google instead of something like CRX or some of the other alternatives was that it was so much simpler than any of the other choices out there. It was one Docker container, very straightforward, very easy to proxy through something like Trafee.

It was a very clean approach and made it really simple for me to just throw out the service and start testing it immediately. And obviously that's really the most complex way to host it.

10:00 And you provided a lot of other approaches there. So what are some of the things that people should be aware of when self-hosting Hoobl? Maybe around the privacy aspects of what they can expect, and then just any kind of tips or tricks for self-hosting that you may have. So as far as self-hosting goes, I guess the argument has been made in the past that if you self-host on a VPS that you own, I guess there is like an element of you're now kind of singling out that you are like you, someone who's like paying a like provider is hosting a Whoogle search instance.

And then so your searches could be more easily tied to you. I'm not quite sure I like see like I see like the point of that. But as far as like, like, I don't know, you can't really prevent against like a worst case scenario like that. Like you kind of have to like weigh your pros and cons and sort of decide like what it is that you're actually trying to achieve with hosting. And so it's like self-hosting. I guess the number one thing, the number one like sort of limitation that I guess new users need to be aware of is that obviously Google doesn't appreciate Whoogle search.

They do try to like clamp down pretty hard on people using their service without being able to collect data on them. And so there'll be often, well, I guess it kind of depends. Like some users have run into CAPTCHA problems and like rate limiting and stuff more frequently than others. I seem to be in a weird lucky bubble where like I never have any problems at all with any of the instances I host. But just sort of being aware that like you are using a service that isn't in the best interest of the company that it's pulling data from.

And so they're trying to do what they can to stop you from using it. And if you hit a roadblock like that, it's just kind of, I don't know, an inevitability that you will at some point. But I have done what I can in terms of like building out. There's another service that I'm building called Farside. And it easily lets you jump to another public instance of Whoogle or any other instance like of, I think it's CRX. I've always said Cirx, but then you just said it in a different way.

So I'm kind of... I'm confused too. So I had never said it out loud till the episode I recorded with the start page. And I tried it and we ended up editing it out because I butchered it so badly. So I don't know if it's CRX or Cirx. I'm not sure, but we'll roll with it. Yeah. So Cirx, I include the ability to, if there's for whatever reason, like not a single public Whoogle search instance available, you can just easily hop onto a Cirx instance and continue your search as normal.

And so like, I don't know, I've been doing what I can to like sort of not over engineer Whoogle because I like to keep it as simple as possible. And so I don't want to include any like sort of ethically questionable, like sort of like CAPTCHA solving services that you like pay for and build that into Whoogle because I'm not really sure that's great. So, I mean, Farside, not to like, this isn't an episode about Farside, but it... It's an important piece of Whoogle now, especially when you do get rate limited.

I mean, I think it's an important thing to touch on. Yeah. So it's a separate, an entirely separate service that periodically queries lists of public instances for privacy respecting front ends, as well as like, so like Knitter, Bibliogram, LibReddit, all those. And so you get like this pool of available public instances. And so you can just sort of use Farside to bounce between them and make sure that you always hit an instance that's live and not being rate limited.

And so the way that I integrate that into Whoogle is if you get rate limited, you can just pop on over to a Whoogle instance and just like all of your configuration settings and everything carry over to the new instance. And it should be just very seamless. I've been considering making that an optional thing where you can just automatically jump like you don't have to like click another link. I'm not really sure how strongly I want to couple those two services because they are intended to be like completely separate.

But that at least addresses the number one issue with regard to self-hosting, which is rate limiting, like blocking. Okay. So I guess another important thing to bring up about self-hosting is that if you're self-hosting a public instance, the chances that you run into rate limiting are extremely high just because you're going to get a wide variety of searches hitting Google's backend. And they're all going to be very different. And it's going to be very easy to detect that multiple people and very likely not a household are using like something like Whoogle.

But if you want to use like a private instance that you and your family or you and your friends use and like maybe just like a handful of people, I don't think I can't promise it, but I don't think it's actually going to be a problem. So it's really like your end goal with how you like what you want to achieve with self-hosting is really going to depend on your experience. But like I said, I've done what I can to alleviate the biggest roadblock there, which is rate limiting.

Yeah. The integration of Farsight was a great kind of out of the blue thing. I didn't see that you were developing that. And then on the public instance I run, it definitely does get rate limited. It's not as frequent as I expected, but it has been rate limited for like a couple of days at a time. And when that happens, I think the first time it happened was right after you had integrated Farsight and just got that nice little link to go to another Whoogle instance or go to CRX and work like a charm.

So it's a really nice way to work around that potential problem, especially for public instances like mine. Because obviously, like you mentioned, it's very clear to Google that all of that traffic, all of the different searches that are going through from one single IP are definitely something that's not a person or not a household. So I'm surprised that it hasn't been rate limited more. But Farsight has been a nice tool to make it so that I don't have to.

Previously, when it was rate limited, I would just swap my search engine on all my browsers until it was on rate limited. And I'd go back and swap it all back in. So Farsight is a nice little simple tool that I'm glad you did build out around that. And it's definitely a super useful piece of working around that. Nice. Glad to hear it. Yeah. Yeah. And a couple other notes on the self-hosting piece. Just some things that I've been thinking about with it.

I think it's important that people, just like in any kind of part of the privacy ecosystem, think about their threat model. And if your threat model is you don't want Google knowing that any searches are happening from a certain IP address, you're probably going to want to use someone else's hosted instance or your own public hosted instance. So there's at least some kind of a crowd to hide in. But I think the beauty of Google is that even if you're using it, like you're hosting it at home and you're using it research, is you're still getting that removal of the tracking scripts, of the JavaScript, of all of the, like you said, the ad links at the top of the AMP links and the other referral links and all of the different ways that Google uses to track you outside of just these searches come from this IP address.

And you're able to yank all of that out, even if you're hosting an instance directly from home where, yes, Google still sees this query is coming from this IP address, but you're still gaining all of that privacy that you wouldn't have otherwise. So it's definitely kind of a, it's a sliding scale. I mean, you decide what fits your specific use case and your specific threat model, but it provides much better privacy than using Google search results no matter what.

So it's definitely a lot of advantage there. Right. And another thing to just mention is like, I know that quite a few users host Google from home and then just sort of like Google has sort of first class support for proxying. And like, if you want to send the traffic through an external node so that it's not your personal IP address that's being sent out, that's easy enough as well. So, I mean, there's, yeah, there's just like, You mean? Yeah. Yeah.

And so, I don't know, there's just, there's quite a few different options. Like you just have to kind of assess what you're trying to achieve and be realistic. And yeah, I mean, it's all documented and I'm also an open book. So if you ever want to like try and configure an option for your use case, I'm happy to talk to you. Yeah, it's definitely, I've seen a lot of growth already. And obviously it's been great to see the work that you've been doing on it.

I did try out the tour proxying and I think I'm just too impatient. So I got a little frustrated by the slowness that can sometimes happen there when you are making those requests. But I definitely, I'm appreciative of the feature being there and being like, it's one environment variable that you set and you're proxying through tour. So it's a very simple tool there and a very simple feature that people can't easily turn on when they, when that's part of their threat model that they want to hide.

This search came from this IP address. It's super simple to proxy it through tour. Yeah. Yeah. Google hates tour. I mean, they absolutely despise it. So they, they're more aggressive about blocking tour than they are about just regular Whoogle instances. So, yeah. Yeah. Definitely going to be other limitations that you run into when you do that, but obviously it just kind of comes with the territory there. And then for someone jumping into using Whoogle for the first time, are there any specific kind of settings or features?

So not for actually the hosting, but for the users of Whoogle, are there any specific settings or features that you recommend people become familiar with? Um, so I've kind of tried to just sort of like take ideas from the big players in search right now. So there's, there's support for bang searches, which, uh, is a duck.go exclusive thing as far as I know. Um, which was like a hugely requested feature and I've always gotten appreciative comments

20:00 about that. There's also soon to be an anonymous view, a la start page, which will be very soon, probably this week. And that will be, I think, of interest to people. The number one thing that I got bugged about a lot was supporting custom theming, which sounds kind of funny because has absolutely nothing to do with privacy. But I guess like there isn't a case to be made, you're not going to use something if you don't like how it looks. So beyond just like setting specific colors for things, you can adjust the layout of the page and sort of have free reign over the actual like CSS of your search results. I think a lot of people do like that. Before I implemented it, I was getting an email like once a week practically asking me to implement themes.

So it's finally out there. Another big one, I guess, is being able to block certain sites from appearing in search. Like I, for instance, hate seeing Pinterest anytime like in image searches or just regular searches or anything because it never provides an actual like, it's not useful. Like it doesn't, the website doesn't provide anything useful for me. So you can just have a universal block list of sites that you don't find useful or just spammy or just like content farming. And you can just add them to a list and they'll never appear from search. And that's sort of just a like weird hacky sort of thing where I'm just doing Google's built in minus site colon site name. But you don't have to type it out every time because I don't think that's a feature that they like you using. So they make it like incredibly cumbersome. So blocking sites. I don't know, you can set like I try to have like language support be as fleshed out as possible. I don't know exactly how many languages are supported

right now, but I think it's over 10 and always a work in progress. Like I always appreciate seeing PRs come in for more language support. And I mean, on like, sort of related to that is just being able to search for a specific country, like you can set a specific country for your Google instance, and be able to get results that are relevant to where you are. So you don't have to rely on, like in the early days of Google, the instance just returned results that were relevant to wherever the actual hosting was happening. So if you had an instance hosted in, I don't know, Ireland, then the search results were all relevant to Ireland, like, and if you were in a different country, it kind of was annoying. So you can just easily set it to whatever country you're in, and it should be as close as possible to just searching natively using like actual Google search.

I think those are kind of the main features, more or less. There's a point to be made, I think, for keeping the number of features and number of settings and stuff that people can enable very simple. And right now, I kind of consider it to be a little bit out of control. Like when Google first launched, there were like five different settings. And it's just like, light or dark theme, and like, I don't know, no JS mode, which is still supported, but I don't think anyone uses it.

I don't know, it's just very simple. And I don't like my end goal, essentially, is to just have things that people would care about in the configuration menu. And so I don't know, I think those are the big ones. And if you want more, I don't know, probably not going to happen. I'm just kidding. But I do try to, I take it very seriously to keep Google as simple as possible. So yeah, yeah, don't want to overwhelm users who do jump into that configuration menu and see 1000 options and just decide to close it. Right? Yeah. I think the number one thing with like getting new people to try a service like this, is to not be overwhelming and to kind of like streamline them into a like workflow that they're used to. Like no one wants to be able to like, or no one wants to have to like configure something before they use it. So my ultimate goal is just like, they can open Google and be like, Oh, I get it. And then they just search, and it's done. And then the configuration menu should be more for like power user cases. And definitely not necessities that they need to

set up before they start using it. So if I've really tried to have like very sensible defaults, and just overall make the process very easy so that the settings and features that are built in are things that you that just aren't necessary, they're they're nice to have. And I think that the the core product itself is, it has enough value for the average person to jump in and be like, I get it. Yeah. And that's, I mean, that's hugely important for any privacy tool to be as simple as possible to use so that if you have that added friction, most people are not going to switch to something that's privacy preserving, just because it's privacy preserving. Obviously, there are those people out there like I would do that. But my parents aren't going to do that. So if you can keep a tool, that's, it's almost like using Google, but you don't have to deal with any of the other stuff.

And you get faster results and the web page loads faster. And there's a lot of advantages that go along with the privacy piece. So it's a lot easier sell and easier transition to, to people who maybe aren't kind of privacy first in the way that they approach tools. So I definitely do see the value in keeping things really simple there. Yeah, big one for me was having my parents just be able to like set up their own Google instance without much of any help from me. I was like, okay, I'm doing something right here. No shade to them, obviously. But like, it's, it does kind of say something if you can have someone who's not technically like, if like someone who's not like a programmer DevOps or someone like that, just be able to like see the read me and be like, okay, like, here's how I deploy it. I just click this blue button for this one service. Yeah, I just thought that was cool.

Yeah, especially the deployment of it. I actually switched my wife from Google to Google. And I don't, I don't think she ever knew that I switched it. I think I mentioned it. I don't think she ever even noticed that there was a difference, which I think also says a lot there because she's very much not in technical. She's not really interested in digging in or like hosting something herself. Obviously I host it, but she just quickly transitioned. Didn't take her any time to learn it, anytime to transition. She just kept using it just like she had used Google, which I think says a lot about how a tool can be built to be simple, but also be privacy preserving and really build in a lot of value in that way. So definitely thankful for that simplicity. Nice. Yeah. One quick question around the actual configuration. And this is something I probably should look into and know before coming into this, but is the configuration like a per user stored in a cookie or stored in their browser? Or is it a per instance? Because my understanding was it is per instance. So like when I

initially had configuration available on my public instance, people had started to change the config and it changed it for me too. But if I'm wrong there, I would love to be corrected. Yeah. So that's under, that's, that's been through a number of different development cycles. Um, so when I very first made Google, I was very anti like publicly hosted, um, instances primarily because I didn't want to be responsible for supporting. Like I, like I knew before I even made the project, I was like, this is going to be extremely easy to block, um, by Google. And I don't really want to like get these angry emails saying like, Hey, my instance is blocked. Like, why are you awful? Like that sort of thing. Um, but, uh, I like eventually kind of came around to it, um, and realized that there's no real harm in, in supporting it, but that involved kind of taking, uh, a certain paradigm that I had approached developing Google with, which was like one configuration per instance, and then just sort of like shoehorning the ability to have an instance per session. Um, so per browser session.

And so currently it is a session by session based configuration. So each browser instant or like each, each time you visit who go on a different browser, you should have a completely clean slate configuration. And the default configuration is actually static now, um, and immutable. Like you can't change the default settings at all. So everyone, anytime you get a brand new configure, each time you open Google in a new browser, it should be a completely clean slate that starts at the same level for everyone. Um, and that is, I mean, that's, again, that's sort of like a, another work in progress feature. Um, I know that some people still have issues with like the session being cleared. Um, I know quite a few, there's like a big overlap between users who use Whoogle and then users who use stuff like cookie auto delete. And so like any extension that sort of modifies with things that like are typically used for tracking, like Google doesn't use cookies for tracking Google or I mean, Whoogle, um, isn't trying to track you by any means, but it does have to use a cookie to set a session.

And so if you're using an extension that wipes out cookies, you do get all of your configuration settings removed as well. Um, so I've had quite a, like a large number of users actually come through and say like, why is my configuration gone? And I'm, I have to like ask them about their extensions. And they're like, Oh yeah, the cookie's getting annihilated by this extension. It's like, well, that's why. Um, but I mean, I'm always interested in coming up with new ways to support it. Uh, I'm by no means like an expert on all of this stuff. Like I'm, I'm more than happy to like talk to someone who like has a better idea. Um, or even just like, if you want to open a PR, I'm more than welcome to like, I don't take offense if someone's like, Oh, this, this could have been implemented much better. Um, like, uh, yeah, no person, like nothing would be taken personally there.

It's the beauty of open source. Exactly. Do something and you know a way to do a better open up a request and let the dev decide if that fits in. Like that's a, it's a, a big part of, of why open source does have a lot of power because people who have specific expertise,

30:00 can step in and change a specific feature or code it better or implement it better and right it's kind of the beauty of collaborating and building in something together that maybe started out as your pet project but now there's a large community around it that can can help to contribute there yeah yeah i've had quite a few people come through with pull requests that are just like holy crap i never would have thought of like like updating the filter like this and it's always just really impressive um and i appreciate it every time i think if you asked anyone who's ever open to pr i'm always extremely grateful and very helpful and i'm never like oh like it'll go away like anything like that so i mean i know that some open source devs are kind of like that um i'm definitely the opposite end of the spectrum and i like to think of myself as very like welcoming with that kind of stuff yeah you definitely happen in the in the the interactions we've had in the past you've been very welcoming to to my prs even my my little little ones to just add my instance to your

list nothing too crazy but that is good to know about the user configuration piece because i i think i must have deployed hugo before that was switched over um so i'm gonna have to make sure to start using that and actually enable that because i have disabled user configuration on my instance because it was before that existed so okay it's a good thing for me to learn and i definitely will we'll switch that on and let people start to configure themselves and and choose what what options they like best so that is a i think a very important feature but i'm glad you called out that if you do anything that deletes cookies or wipes cookies on browser exit or uh anything like that like you are going to lose that because there's there's not another way to to store that data long term um so that's just a good call out for people who are setting that specific type of feature another thing worth worth mentioning with the config is um i've kind of tried to put a lot of effort into making it uh translatable

between um the configs that you have enabled and like a url param string um which is useful for like far side because then i can just pass your exact config over via url params um so i've been kind of considering the idea of making like so a lot of people end up adding google as a primary search engine by like manually typing in the url with like the percent s for the query and i think what would be kind of a cool option or alternative i guess is being able to like um from the config menu this is just me spitballing a feature by the way i actually haven't really thought about this i like the idea already um being able to like just go into the config menu and just say like copy like this params or url string with all of my config params as i want them and then just sort of like pop that into your browser uh like for your primary search engine and um be able to not really worry about your your session ever being deleted because it's already hard coded into your url so i don't know just kind of an idea yeah

i think that's an excellent one i mean then you don't rely on cookie storage or anything like that as long as there's no like character limit on the the search url in browsers or anything weird that would cause problems i mean that's uh definitely a huge win to be able to just copy and paste that in once into your search settings for your browser and then not have to worry about worry about it again especially if it's easy to to export them and copy out of there so i like it cool i have support let's take a quick break from this episode to chat about the sponsors of opt out Cake Wallet and LocalMonero Cake Wallet is a key tool that i use daily as it allows me to easily and quickly use monero for private by default payments it's available in both ios and android it is a fantastic way to get started buying and using monero with a simple and easy to understand user experience i regularly onboard new users to Cake Wallet and hope that it will help simplify and ease your journey into cryptocurrency if you're interested in purchasing monero for the first time or helping to bring

others into a parallel economy i'd recommend you look at using LocalMonero like i do to buy and sell monero while maintaining your privacy and avoiding invasive exchange surveillance local monero is entirely peer-to-peer and is an important part of opting out of the surveillance state and into a parallel economy thank you to both sponsors for their incredible support and partnership and i hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com slash sponsors uh so another question that i know a lot of people have is uh just kind of figuring out how hugo compares to other similar services i think i want to kind of go in in two directions here first off how does it compare to services like crx or cerx um and then secondly how does it compare to centralized privacy preserving search providers like duck duck go or start page um and then just kind of what makes hugo better or unique in your opinion obviously it's a passion project but i'd love to hear

more about like what specifically you like about hugo and compare it to those as well right um i guess i'd hesitate to call it better than any of them really it's just kind of different but um as far as like the whole like google versus cerx crx comparison uh for those who i guess might be like out of the loop um cerx like provides uh like it provides search results from a multitude of sources google is one of them but if google gets blocked you can still get results from duck duck go or bang or wikipedia like it just sort of pulls results from a bunch of different sources and the like the intent of hugo is to only pull google results and while that can be kind of seen i can see the argument for like oh like if you're only pulling from one source if google blocks you this is going to get very like i'm just i've caught myself so many times saying google and hugo like interchangeably i hope i'm doing it right this whole time but like you named the tool so ultimately you're a fall here but yeah i know i should have

named it something funnier or like different um but like for i think the vast majority of people like so the goal of hugo was to be easy for an outsider someone who's not like terribly interested in privacy or tech maybe um to be able to like jump into this tool and be like well it's not that hard of a transition so sure i'll just keep using it if like people say that it's privacy preserving um i think that that adds a lot of benefit and a lot of people are used to the standard that google search provides um which is i mean huge asterisk there i think it's on a steep decline right now actually but um that's a whole different topic uh so people i think myself included sort of gravitate more towards google search results for their accuracy and so i'm not terribly interested in getting like bing or duck dot go results because it's not usually what i'm looking for um the added bonus with hugo versus start or serks is um that uh like google kind of has like a priority for like the very first result being something useful like if you

want to search like for a movie and get like all the breakdowns of like the the reviews that the movie has across different sites google typically returns like a card with like all of those all that information packed into like one result which i love like stuff like that is like why i use google yeah um and so i mean as far as i know it's been like i'll admit it's actually been a while since i've used serks i used it quite a bit before i made hugo um and i've kind of converted to my own tool obviously but from what i remember there wasn't that ability in serks or start page actually um which kind of pivots over to like centralized services i guess um as far as i know i mean both duck dot go and start page pay like they're they're they're like parent to like give them search results like they're paying for the opportunity to be given search results from another source um and so i guess i don't know you're kind of like you're you're entrusting your your privacy to that company and sort of hoping that they do the right thing and like i don't i don't think people should go the

full like tinfoil hat route all the time like i think there's definitely a use case for deck dot go and um start page but i don't know like with something just as like personal to you as as searching like i just i find it hard to trust anyone who's making money at a company to like be responsible with things that i'm curious about like if i want to search for like some i don't know like random non-nefarious topic i don't want that to like be traced back to me on their back end or on anyone else's back and i just want that to be like between me and whoever i'm like searching with and not stored on their servers preferably um so i think there's a case to be made that like search itself shouldn't really be controlled by like one central service uh besides the obvious like it could also be blocked very easily by like a nation state or something like if if someone has like a vendetta against people searching for things they can just block google or duck dot go or have them censor results or something like that and there's no real there's no real recourse you as like a private citizen can

have against that um and i mean i guess that's that's kind of the main things that i would say about that like everyone just has their own use case and their own preference like if you if you enjoy duck dot go search results that's great i i just don't um i've never really and i maybe i should give it another chance i guess i don't know it's just uh it's one of those things you grow up with like a certain expectation of like how you want your search engine to respond to you and it's just hard to break out of that and i am understanding of that mindset for other people and that's i mean that's why i built Whoogle and made it so easy to deploy um also i do want to like mention that um like no shade i guess but like start page does not play well with vpns in my experience they do not unfortunately i've run run into that recently yeah yeah um the one time like i i actually considered start page before i built Whoogle um and besides not really having the ability to make it so i'm not going to be able to

40:00 return like the the like the like kind of info card uh first result in search which i rely on quite a bit um for like stupid little things um if i was using a vpn i was having to like solve a captcha every like two minutes and so that was a bit of a deal breaker for me just because i like i've i mentioned earlier i'm just very impatient so um something that like i i don't know hopefully they're working on that but yeah i know i just chatted with them for a recent episode and i know that they've been working on integrating a lot of the kind of card features they don't actually pull that data from google so they've kind of built in their own integrations for some similar things like weather and that that sort of thing but it's not as fully featured as the google cards and i think like when i'm thinking about comparing hugo with the other alternatives out there specifically the centralized services i definitely i definitely agree with your take and i think the two main areas people want to think about is like where do you want the source of your results to be from like

do you prefer google search results then you need to use something like google or something like start page to be able to get those google search results and as much as we hate google's privacy practices and we hate the approach they've taken to user data and all of that they became the dominant search engine for a reason like their their search results have historically been fantastic the tools like the the cards that they built into search are fantastic and work extremely well so if you need those specific things like google obviously wins out and that's one of the reasons why i keep coming back to google from other tools and i like to pivot and keep kind of circling back through and trying them all to kind of see where everybody's at and see where advances have have happened but i i always fall back to to google because i i value the approach that google takes to search but obviously i don't want to be using google search directly and i want to be able to preserve some of my privacy while doing that um right and the other

piece you hit on is is really the the data piece is who do you trust with your data do you trust yourself more and your ability to to self-host google and either host it from home or host it in a vps which obviously like we mentioned earlier the the caveat there is yes the vps provider could monitor what you do on that that vps instance you should assume that they have access to that data if they want but normally that's not that's not a concern for most threat models um or you can self-host at home but if you do that you're trusting yourself with that data you're trusting yourself with that data and obviously you're going to take care of yourself you're not going to be selling your own user data to some other company or something like that to to make money i would hope you got a funny it may have happened i don't know but uh normally people aren't doing that so while i do think that duck.go and startpage are both ethically driven companies that have found ways to to monetize without selling out the customer obviously you are still trusting them with that data like you're

trusting them with that data like you are still trusting a central entity and you're trusting on their privacy policies and their reputation to persist and for them to handle those things well so if you're comfortable with that and you're comfortable with the way they provide search they do seem to be good options but obviously whenever possible i like to default to me controlling the data i want to be in ultimate control of control of that because i want to strip as much of that as possible away both for privacy and ultimately for security as well because i can have more more tight control over that yeah exactly i do also want to mention that like um from like a personal standpoint i don't really see like meta search engines or just sort of search engines that pull results from any other third-party source i don't really see that as the end goal like yeah for Whoogle i don't see this as like a permanent solution like ultimately what should happen is that like someone comes along and makes this like absolutely killer search engine that um i mean

hopefully that you could like host yourself but i mean realistically that's probably quite a ways out but even just like someone who comes along and i know that um like i've been hearing rumors about this like uh search engine that's like kind of in beta right now which is called kagi or kg k-a-g-i um yeah it's it's being worked on by someone who's very like i mean from their hacker news posts they're very pro privacy and um they're they're essentially trying to make google but private and from what i've heard of people who have been allowed into their exclusive beta uh it's been met with like extremely good reviews so i'm pretty excited for that um because yeah i mean like i said i just don't like ultimately like like with uh with projects like google and like serks you're always battling the the source that you're fetching data from yeah like none of those sources really want you doing that so they're always going to be trying to like play whack-a-mole with all the public instances and like prevent you from

doing that so those aren't really an option and then um duck duck go and and start page relying on their own third-party sources for search like i don't know just something about it like i just think it should be like a self-contained like search engine like that should be the goal here like it shouldn't be to use these sort of workarounds for privacy like it should be privacy first and then a great service as well yeah i definitely am hopeful that there will be a first-party privacy tool that that can do things right and offer that and like you mentioned self a self-hosted version would be ideal but in the meantime i'm hopeful that things like potentially brave search i haven't dug into that too much or used it myself but i'm hopeful that those approaches to actually do their own search results while being privacy preserving do take off um and i'll definitely have to look into the kg or kg search that you mentioned and and see if i can get into that beta and test that out because the the more

alternatives we have just even as options is great but obviously shifting the paradigm forward rather than relying on just workarounds to the existing system which i'm glad that you even as the dev of hugo mentioned that like you don't want it to be the the the end goal like it's not that we stop here with tools that are great and they do help us to proxy and kind of deal with the current broken system but it would be ideal if we get tools that can be a first-party service that really do care about user privacy while providing good search results and and those two things are obviously very hard to combine and historically have been hard to combine but hopeful that something like that will will come along and and allow us to kind of move into a new approach to search so for those users who decide not to self-host for whatever reason um but decide to use some public instance what are the what are kind of the things they need to keep in mind with what data they're sharing with that instance um or maybe what

logs are available to the person who runs the instance about the searches that are happening there yeah um so when you're using a public instance i mean it'd be preferable if you use one that's hosted by someone that you at least vaguely know like someone that's in like the privacy community or something someone that doesn't stand to gain anything by like tracking what you're searching but i mean with access to Whoogle's source code and like hosting it themselves they could easily just modify it to write out your ip address and what you searched to a file and then just have access to that in perpetuity um which is not great but it's just sort of a thing that you need to be realistic about like if you're using a public instance hosted by someone you have you have no clue who they are that's obviously a risk that you run uh but by default like what i tried to do with building Whoogle is to make it by default very um log unfriendly like the the request method used for all searches is post

which means that you're going to send like a request body with your search query in it uh rather than it being part of the actual url so if you just have nginx for example access logs turned on it's not like all of your logs are going to be all of your queries with you like your ip address are going to show up up in like an access log file um which is like something that i in particular like wanted to do as a default setting because i think that that sort of prevents against um someone who's not really meaning anything maliciously but they like just don't really care about their setup they use all the default settings for like if they're proxying or if they're reverse proxying with nginx like i mentioned and just like kind of copy and paste the configuration from some stack overflow post and it has access logs turned on it's not something that you need to worry about as much um so i mean yeah i mean ultimately i guess i would just say like know whose instance you're using if you're worried about that kind of

thing um but i mean unless they're intentionally setting out to like sort of like explicitly grab what you're searching and like store that some reason for their own personal benefit um it's not something that i think most people hosting their own instance would just kind of accidentally stumble upon i'm glad that you designed it intentionally to kind of handle that use case of the person who just does the simplest setup possible and has those those access logs enabled because like you mentioned the default in nginx and in many tools is to have the access logs because they're helpful for many other things but even if the person is not malicious and they have the logs about everyone who's used that instance locally on disk and that that gets broken into or confiscated or whatever obviously that could compromise the people who have been using that instance so the more minimized that is the better so i'm glad that's been a conscious effort there and i mean just like we talked about at the very beginning it's very

simple to self-host google so unless there's some very good reason that you can't do it yourself you really should be doing it yourself to get the full benefit um and obviously i mentioned i i host an instance which is search.sethforprivacy.com and it sees a ton of traffic so i know people are using it and my instance, there's no access logs all along.

50:00 is disabled internally there, disabled in Trafic. There's no access that I have to those logs, but obviously you're still trusting me. So, I mean, obviously I think I'm trustworthy and I'm taking good approaches, but people have to decide. Like you, I still could just go in one day and switch it on and like you said, edit the source code to start logging directly the query to IP and start tracking that. Something that is technically possible. So if people are worried about that, just host your own instance.

And if you can get an instance hosted, maybe offer to let friends and family who can't host an instance themselves or aren't aware, or maybe aren't in that stage of their privacy journey, let them use that and kind of build these kind of local clusters and communities of users for Google instances, rather than these huge public instances that could be a target for either the owner themselves or just someone else who sees, hey, this instance gets used a ton.

I bet those logs are valuable and decide to jump in. So definitely, even as someone who runs a public Google instance, I definitely do recommend that people try to avoid using it and use their own hosted instance as much as possible. Yeah. Yeah. And I guess kind of on a related note, what I've found to be sort of the sweet spot for avoiding rate limiting is like under five people typically. So if you're hosting a private instance, don't feel like you have to like hog that to just yourself.

Like you mentioned, you can share it with friends and family, I guess, within that sort of lower-ish range. And with any instances that I've hosted where that's sort of the number of like frequent users using it, I've never encountered any like severe rate limiting. Like it's extremely rare for me. So just something to keep in mind. Yeah. Yeah. It's good to know that there's kind of a rough threshold there where people can expect that. And I guess also like if you're hosting it on, like if you're using like a domain that you purchased to access it and you're worried about people kind of stumbling across that domain and having access to your Google instance and bombing it with queries and then you're rate limited.

I also support, well, not me, Google supports setting like a username and password that is easy enough to just sort of use as a really like easy gateway for just the people that you know or are in your inner circle so that they can use the instance and kind of keep out just bot traffic that stumbles across the domain and starts just like hammering it with queries. Yeah, definitely a nice feature to limit that to the people you actually want using the instance.

So obviously, Google is a free and open source project and it's something that, like you mentioned, you kind of kickstarted out of personal frustrations and a thing that you saw needed to be fixed. So there's no, there's no company behind Google, nothing like that. But is there any kind of funding method that you have or that you've made available to help to make it sustainable? Donations or buy me a coffee or anything like that, that gives people the chance to kind of give back to you or to the project generally for the work that's going on there?

Yeah. So I do have GitHub sponsors. I have some like just extremely generous people that have like decided to throw me a few dollars every month for Google. And I think that's just incredible. Like I didn't go into it, obviously, to make any sort of money, but I think it's really like, I don't know, it's special to me that people care enough to want to financially support it. So there's GitHub sponsors. And then I also do have a, like a Kofi, ko-fi page that's linked on the GitHub.

Occasionally people donate through that. The whole idea of like kind of, I guess it sounds kind of weird, but like the idea of making money from Google, like it just feels a little strange sometimes. So I try not to like prioritize or emphasize like, oh, you guys need to be like paying me so that I develop this. Like I don't ever want that to be the idea that like, unless people give me money, I'm going to stop developing this. Like Google itself is sustainable because I like, I use it myself.

Like I don't rely on it making me any sort of money. Like I fund it and I use it every day. So it's just going to be, I don't know. It's going to be, it's going to be in development as long as I am using it, which is for the foreseeable future. And that's going to be regardless of any sort of donations or sponsors. Though I like, like I said, I very much appreciate them. And I think that's just super crazy that anyone wants to give me money for this.

Yeah. Yeah. I mean, I'm glad that people have, have jumped in and, and given back because obviously the, the work that you put into this, I'm sure is hundreds and hundreds of hours and it provides an incredibly useful service. So like, I think the beauty of the free and open source space is anyone can jump in and start using Google without any hoops to jump through, no payments, nothing like that. But one of the problems I think in the free and open source space is the people who pour the hours into building these things often don't get anything tangible back, or maybe even just good feedback from users and good positive feedback.

So having ways for people to kind of tip you and say, thank you for the work that you've done. I think it's really important. So I'm, I'm glad that you have those methods. And I will just do a quick shout out. A lot of people in the Monero community are kind of big, obviously in the privacy space because Monero was a privacy preserving cryptocurrency. So most of the other front ends, similar to Google for other tools like Tedd and Knitter, accept Monero donations.

And it's just a super simple static address that you can paste in the, the read me. But if you ever are interested in accepting Monero for donations, I would both love to donate that way. But I'd also be happy to help if, if you need any help getting that set up. Okay. Yeah, definitely. I'll look into that. Awesome. Well, that is the list of things I wanted to roll through with you. Thank you so much for, for jumping in for, I think really just nailing these questions, knocking them out of the park.

And the last one I have for you is really just how can people jump in and help to support what you're doing with Google? I guess the big thing is just like, so I'm, I'm almost perpetually juggling too many projects. I was telling Seth before we got started. So any sort of development help at all is always very much appreciated. Like if you're interested in learning, so who goes in Python, um, far side is in Elixir. If you're interested in learning either language, I'm more than happy to sort of walk you through anything.

Even if you just like, don't know what to contribute, you can always reach out and I can try and think of something that we could work on together. Like I, I really enjoy teaching people. So, um, any sort of development assistance there, like, I mean, where someone can kind of jump in and alleviate a little bit of the load or a little bit of the burden that, um, comes through in the form of GitHub issues for either project is very much appreciated.

Um, and then I guess aside from that, just hosting your own instance, if you want, um, like if you host an instance of Whoogle, it'll get pulled into the far side pool of instances. So that benefits everyone. Um, yeah, I mean, I guess those are the main two ways that you could, you could help out. Those are definitely huge to me. Yeah. Yeah. I definitely hope that especially more technical listeners will, will jump in if they, if they enjoy using Whoogle and they benefit from it.

Um, especially if they see particular areas where they'd love to see changes or they see, like we talked about earlier, things that can be done better or approaches that can be taken. I, I do hope that some of the more technical listeners will jump in and find something that they can contribute to make a pull request and, and walk through that process to start doing their part, to help build up Whoogle. And, uh, just kind of to make that more sustainable, more survivable, obviously to take stuff off your plate.

And, uh, it really does simplify the open source process when a lot more people are, are active contributors back to the things they, that they use and not just consumers. Um, which is something that I, I hope we'll continue to see increase and grow in the open source space. See people really taking the time out of their day to say like, I'm using this tool. It's free and open source. I want to find a way to, to give back, whether that's a donation to you, whether that's, um, jumping in, like you mentioned, getting, submitting a PR, uh, helping with issues, anything like that is, is something that goes a long way in projects like this.

So definitely hopeful that people will do that. Yeah, definitely. Well, Ben, thank you again for, for coming on, for carving out a time of your, your busy schedule and chatting about Whoogle. I'm, I'm really excited for, for listeners to hear more, um, hopefully to, to dig into, to hosting it for themselves and just finding a, another way that they can approach privacy, preserving search using Whoogle. Yeah. Thanks for having me on. It's been a pleasure talking to you.

Have a great rest of your night, Ben. Yeah, you too. Thanks for listening. And I hope you enjoyed this episode of opt out. If you did, please take a moment and subscribe to the podcast, or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the link to the guest content and contact info, as well as links to all of the tools we discussed in today's episode. Now get out there and opt out this week.