DuckDuckGo information is wrong

[linusg]

As you can see, HTTPSWatch claims DuckDuckGo wouldn't redirect to HTTPS, which is not the case: both http://duckduckgo.com and http://www.duckduckgo.com redirect to https://duckduckgo.com/ (with HTTP status 301 Moved Permanently).

$ curl -I http://duckduckgo.com
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 01 Apr 2019 18:56:49 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://duckduckgo.com/
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self'
X-XSS-Protection: 1;mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: origin
Expect-CT: max-age=0
Expires: Tue, 31 Mar 2020 18:56:49 GMT
Cache-Control: max-age=31536000

$ curl -I http://www.duckduckgo.com
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 01 Apr 2019 18:56:41 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://duckduckgo.com/
Strict-Transport-Security: max-age=31536000
Expires: Tue, 31 Mar 2020 18:56:41 GMT
Cache-Control: max-age=31536000

[alex]

If you use the Mozilla User-Agent used here, Mozilla/5.0 compatible HTTPSWatch Bot (https://httpswatch.com) Firefox/48.0, it no longer redirects. Not sure why it has this selective behavior.

[linusg]

@alex that's odd, I have no idea why they'd do such a thing. Pretty stupid, IMO. Then technically the statement is correct, at least in some cases 😕

FWIW, I've tried some variations of the UA you provided and it only seems to not redirect once there's "(http" in there, case insensitive:

Redirect

• Mozilla/5.0 compatible ( HTTPSWatch https://httpswatch.com)
• Mozilla/5.0 compatible HTTPSWatch https://httpswatch.com)
• Mozilla/5.0 compatible HTTPSWatch https://httpswatch.com
• Mozilla/5.0 compatible ( http )
• Mozilla/5.0 compatible http(
• Mozilla/5.0 compatible https)
• Mozilla/5.0 compatible (htt

No redirect

• Mozilla/5.0 compatible (HTTPSWatch https://httpswatch.com)
• Mozilla/5.0 compatible (HTTPSWatch https://httpswatch.com
• Mozilla/5.0 compatible (http
• Mozilla/5.0 compatible (http)
• Mozilla/5.0 compatible (https
• Mozilla/5.0 compatible (https)
• (http
• (HTTP
• test (http
• (httptest

[alex]

That is odd. Perhaps someone should reach out and ask them about simply always redirecting.

…

On Mon, Apr 1, 2019, 4:00 PM Linus Groh ***@***.***> wrote: @alex <https://github.com/alex> that's odd, I have no idea why they'd do such a thing. Pretty stupid, IMO. Then technically the statement is correct, at least in some cases 😕 FWIW, I've tried some variations of the UA you provided and it seems to redirect to HTTPS once there's no (http in there anymore: *Redirect* - Mozilla/5.0 compatible ( HTTPSWatch https://httpswatch.com) - Mozilla/5.0 compatible HTTPSWatch https://httpswatch.com) - Mozilla/5.0 compatible HTTPSWatch https://httpswatch.com - Mozilla/5.0 compatible http( - Mozilla/5.0 compatible https) - Mozilla/5.0 compatible (htt *No redirect* - Mozilla/5.0 compatible (HTTPSWatch https://httpswatch.com) - Mozilla/5.0 compatible (HTTPSWatch https://httpswatch.com - `Mozilla/5.0 compatible (http - Mozilla/5.0 compatible (http) - Mozilla/5.0 compatible (https - Mozilla/5.0 compatible (https) - (http - (HTTP - test (http - (httptest — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#110 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAADBD72HZM2-KvSBvNLTSHIu32mTyGCks5vcmVIgaJpZM4cWbAF> .

[linusg]

I've reached out on Twitter. If they don't respond or silently fix it, I might look for an email address. I'll then post an update here.

[linusg]

No response, nothing changed. What a shame. Anyway, let's just close this.