[nunobrito]

I'm a software auditor in Europe (per times consulting the European commission itself), mostly for open source licenses but also for cybersec and privacy matters.

This topic with DDG is recurring since years. You cannot verify the infrastructure, it is not hosted on EU-bounded servers and they have been asked for cooperation. Nothing moved as far I follow.

With Ecosia you are right. The point is that Ecosia accountable to European Law in case of scam. You can trust germans to close down the service if ever deemed to be a scam.

[gdm85]

Not sure if you are aware of this (I hope it's not on purpose), but your personal website mentioned on your 'About' description contains some questionable content (gambling?) in indonesian language.

If I may ask, was it hacked, you lost the domain or you have put that content there on purpose to generate some revenue?

[nunobrito]

Thanks. Seems my own domain got expired some months ago and then taken over by someone else. It was old, nothing updated in years. I removed from it from the profile box, thank you for letting me know.

In the old days was just used for hosting a blog and some papers to share with others. I guess nowadays having a personal domain becomes increasingly less needed.

[teekert]

I'd argue it is increasingly needed, but it depends on your needs/goals ;)

[gdm85]

You're welcome; I figured it was something like that.

Sorry "vultures" took it over, I would use something like GitHub/GitLab pages if you are looking for minimum maintenance.

[m00dy]

What would be the practices for infrastructure review ?

[nunobrito]

Usually involves talking with someone on the architectural level (Chief Architect, maybe CTO, VP or head of engineering if knowledgeable enough). Then involves onsite visits, questioning about where the data is hosted and factual verification of these claims.

Depending on company size/challenge, you might do some tests on their claims from the outside over the period of 24 months. For example, registering an account and then verifying if that one-time email got leaked into some other service.

Or, on cases of higher-criticality you will have monitoring of what data is coming out from the datacenter where the apps are running.

Direct access to source code reviews is rare. Albeit depending on the level of cooperation it could be a possibibility.

[DavideNL]

What do you think about Startpage?

And, which European search engine would you recommend?

[jakub_g]

Startpage was acquired by an adtech company a few months ago https://www.ghacks.net/2019/11/16/startpage-search-owner-cha...

[DavideNL]

Yes i'm aware of that, but they were not 'acquired'... although it's definitely not a good development, i'd argue Startpage is still better (privacy wise) than for example Google.

[krageon]

> i'd argue Startpage is still better

Why would you argue this? Adtech companies are one of the big sources of problems with privacy online.

[nunobrito]

That one was verified and passed.

While sharing coffee with a colleague years ago, he argued that something smelled odd about them. In is opinion was a front for the CIA or some other sponsored group that harvests data.

Mind you that he provided no facts to support this claim.

I tried to inform myself as much as possible about them, about their technology and people working there. Very scarce info exists. Try it by yourself, then let me know if you do manage to find more info about them.

My only recommendation at the moment is qwant on the european side. Not because of privacy, but mostly to enable diversity of choice on the continent. In case of war or embargo, consequences here would be devastating on the tech-side.