I've taken a screenshot of what I am referring to, but this occurs on both the machines I have installed Debian Bullseye on, so I'm naturally curious as to why this would occur.

I have guessed it could be some kind of mitm injection attack of sorts, but that just seems silly, why would they put it the http link they want me to click on in that separate little window, and have it identical to the first search result all but the missing s in https. That just seems to be counter productive if the objective was to be tricky. enter image description here

The following unusual verbose output from the browser also occurs:

ATTENTION: default value of option mesa_glthread overridden by environment.
Sandbox: Unexpected EOF, op 0 flags 00 path /proc/cpuinfo
  • 1
    This feels like a question for meta.stackexchange.com .. or Duck Duck Go. Also, just because a website is using http doesn't automatically mean anything bad is going on. And if you visited the link you'd see you quickly get sent to https.
    – bxm
    Nov 24, 2023 at 22:57
  • Sorry I'm just not at a competency to not worry or worry about it yet, just thought it was a little odd. I didn't even know that duckduckgo and presumably all search engines have a stack exchange site but ok that's pretty funny Nov 24, 2023 at 23:22
  • and also that comment could be the final touch in an elaborate plot to trick me into clicking Nov 24, 2023 at 23:31
  • Virtually every site that has been signed by a certificate authority or CA redirects http on port 80 to https on port 443. It is highly unlikely that there is any malicious intent going on. If there were then something that blatant would have been found and removed long ago. Nov 25, 2023 at 0:24
  • 1
    @bxm « if you visited the link you'd see you quickly get sent to https » ... but it's far too late. OP fears for their security and they mention MITM. With DNS spoofing, they may be redirected to another IP that wouldn't do https. Even without DNS spoofing, the first HTTP request (before being redirected to HTTPS) is enough to steal cookies with some sites (not with stackexchange I bet)
    – xhienne
    Nov 25, 2023 at 0:24
  • 2
    @AdamLedger I can reproduce this. This is a bug on DuckDuckGo. (BTW congrats for your vigilance, I wouldn't have paid attention to this, security-wise)
    – xhienne
    Nov 25, 2023 at 0:26
  • sure i mean nothing of any real significance is on my systems at this point so its going to be a disappointing day when they find ive just been mucking around with arduino trying to build a pigeon location tracking device lol but yeah they are both working perfectly fine but i get your point about http and https i mean i only just changed the mirrors in my repository from http to https this week so yeah lol Nov 25, 2023 at 0:47
  • 1
    @xhienne iirc SE websites have HSTS preloading done so browsers should switch to HTTPS without having to go to the HTTP site and getting a redirect.
    – muru
    Nov 25, 2023 at 0:57
  • 1
    I’m voting to close this question because this seems to be a problem with DDG and nothing to do with Unix or Linux
    – muru
    Nov 25, 2023 at 0:58
  • Sure ok if it isn't something that is related to the stack exchange domain by all means I've just noticed it always occurs for stack overflow or unix SE, but that might just be because everything i search is related to bash scripts and linux commands Nov 25, 2023 at 1:20
  • the thing that caught my attention is that it wasnt always doing it, one day it just started doing it and sometimes it stops, and it was that behavior that lead me down the javascript is malware trying to gas light me rabbit hole Nov 25, 2023 at 1:35
  • Again, I am running Debian Bullseye, so if its not related to Linux at all it seems impossible that i would be writing this comment on a computer with a linux OS Nov 25, 2023 at 2:52
  • Also i haven't even said what browser I am using, and I really don't see how you can be sure the source of the fault is the search engine Nov 25, 2023 at 2:56
  • @muru: no, Stack sites are NOT on the preload list, though they do redirect and (then) serve the HSTS header (with max-age=180days as is very common). Nov 25, 2023 at 4:12
  • 2
    FWIW, it doesn't seem to be limited to stackexchange, a DDG search of define hubris brings a "knowledge panel" with a HTTP link to perldoc.perl.org (which itself for me and with curl UA redirects to HTTPS with HSTS). Whether that's a bug or intentional is a question for DDG. It could be that they prefer giving HTTP links as it still works in regions where HTTPS is blocked. Other questions we could ask them is how they choose the contents of those "info boxes"/"knowledge panels", in particular for the SE ones. Nov 25, 2023 at 10:30


Browse other questions tagged .