#dev 2023-04-10
2023-04-10 UTC
[manton], Soni and rory1 joined the channel
# 
prologic Twtxt ftw :)
# prologic seriously
# prologic https://yarn.social just works
# prologic forget all these complicated push-based protocols
# prologic Yeah I have to a limited scope
# prologic I mean it works, I'm not 100% happy with it, but its bettter than when I started
# prologic yeah I'm finding the same myself
# prologic its almost too much work really
# prologic for little gain :)
# prologic whoot I have two karma points :)
# prologic we already support webmentions :)
# prologic natively
# prologic and indiewuth (provider only atm)
# prologic and websub (pods peer with one subscribe to each other for near real-time pulls)
# prologic I mean I really don't know what more you need
# prologic just start running yarn pods everywhere ;)
# prologic ditch this Twitter™, Bluesky and Mastodon stuff ;)
# prologic sorta half kidding, but not really :D
# 
@siygle 又換啦，Deno、Fresh 以及 Webmention https://sylee.dev/blog/2023-04-10-change-again-deno-fresh-webmention
本站就在不斷更換技術桟之中成長 #誤 (twitter.com/_/status/1645311489933447168)
angelo joined the channel
# bkil How ironic. The site that preaches to developers of independent retro-websites uses Cloudflare, the hive mastermind, but still went down with HTTP 500 due to it being served by a complicated dynamic backend prone to failure. Compare this to much higher availability and cheaper solutions that can be served from a static host in exchange for a bit of JavaScript sprinkled over it. https://nojs.club/
holiday_1 joined the channel
gxt__ joined the channel
^ilhalmer, laker, [marksuth] and [dave] joined the channel
# bkil [snarfed]: Let's bring the conversation here. What is it doing exactly that is against the ToS?
# bkil Are we talking about this? https://addons.mozilla.org/en-US/firefox/addon/instagram-atom/ https://addons.mozilla.org/en-US/firefox/addon/bridgy/
# bkil Reverse engineering for interoperability purposes is explicitly permitted in the EU.
# bkil Regardless of what a given ToS says.
# bkil On the screenshot, I see an *.appspot.com URL. That seems to imply that this browser was doing some sketchy backend-side crawling/scraping/probing that is way more sketchier than a client-side solution.
# bkil But then it must upload the result to some server to republish it again. That is a no-no in terms of a ToS.
# bkil It's also bad in the context of the GDPR.
# [snarfed] GDPR is more complicated, but not necessarily true. https://brid.gy/about#gdpr
# bkil Again, I neither use Instagram, nor this addon, nor have read this ToS. But I have read a bunch of similar services and it usually goes this way.
# bkil So if you have installed an extension that collaborates in such an illegal data exfiltration operation, it falls under different provisions. If, however, your browser would only display and process it in scope of a Reader app, but not transmit it anywhere, it would fall under a different classification.
# bkil It doesn't matter where the author of the extension is.
# bkil But I feel as most people in the indieweb are from the US, they seem to be against any and all mentions about it.
# bkil Let's just talk about the ToS, privacy and common sense aspects that nobody debates here ther.
# bkil This is not scraping
# bkil It depends. Is it under the command of a human operator (i.e., in reaction to a user clicking on a profile). If it is, it can not be classified as scraping.
# bkil I would think that the ToS will include a "miscellaneous" clause that allows them to suspend accounts for any other reason than one that is listed explicitly and it usually also grants them the right to not disclose the reason of suspension.
# bkil If I integrated such bridging into _my_ Reader, it would only fetch a feed when a user clicks "fetch", posts a new reply or the first time they open a post that includes a post by a new user, etc. So in all cases, _I_ would be safe from being classified as scraping.
# bkil All similar extensions I've seen over the years did something terribly wrong. If it's how you describe it above, this might be the case here as well. It's still not the case that you can do "nothing" to solve the issue. You just have to be considerate in your implementation.
# bkil They would not shut me down, as the method I described above would generated a traffic pattern consistent with any other existing client of theirs.
# bkil I.e., it is trivial to see a cron polling pattern in a web server log, so it is a no-brainer to write an automated ban tool on their side.
# [snarfed] I appreciate your interest here! I'd definitely like to avoid this problem. but I've spent over a decade building and running tools that access many different social networks' data, via both APIs and scraping, and I've seen them shut many of my tools down, ask me about others, etc, along with other peoples'
# bkil I know that Friendica succeeded in bridging for quite a few years, but they didn't have sufficient volunteer manpower to keep updating the API code.
# bkil Keeping changing the API to annoy third party developers is not the same as locking you out.
# bkil By the way, note that you as the developer of the extension and any collaborator can be locked out personally by them. I've seen many examples of this over the years.
# bkil Especially if you didn't develop and deploy it anonymously.
# bkil Note that many existing provisions within the ToS allow them to do that as you are considered a malicious actor by the above reasoning.
# bkil Do you have a way through which users can report this back to you for you to aggregate? This sounds odd that only 4 people are impacted and within such a large time window.
# bkil Note that as long as you use a walled garden, any day can be considered a gift - they can and will lock you out without any reason. I know a bunch of people who got locked out of such products over the years.
# bkil Even ones who weren't using such addons, but just didn't click on enough likes or ads or whatever (we never figured it out).
# bkil So whatever the reason, I would rephrase the hunch that the reason (motivation) of blocking was not because of using a third party client - it was a considerable and noticeable increase in server load from certain well defined endpoints and well defined user accounts due to scheduled polling that can be interpreted to fall within DDoS-mitigation best practices.
[jacky] joined the channel
# 
[jacky] might be useful for those doing progressive enhancement with their sites using blurring https://www.npmjs.com/package/blurhash-to-css
# bkil aaronpk: Yes, we discussed that above.
# bkil I shared my viewpoint that a bridge implementation would be possible that the would not block.
# bkil they
# bkil Full disclosure: have worked on the other side for detecting robots accessing our services, but please don't tell anyone.
# bkil 🙀
# bkil Yes, I know. I just asked for it to be included there. 😉
# bkil I see a fetch is supposed to run once every 30 minutes as long as the browser is open https://github.com/snarfed/instagram-atom/blob/main/browser-extension/background.js#L17
# bkil Do you happen to have detailed logs about the scraping browser and the service just before they locked you out? snarfed ?
# bkil Do you happen to leave your browser open for long stretches of time, such as 24/7?
# bkil That's a pity. The periodicity itself can be detected easily, there are multiple factors at play.
# bkil It's odd that they haven't even sent a mail about it.
# bkil Yes aaronpk , that one of the main defenses other than the usual heuristics. Getting you prompts and if the bot code does not handle them the same as a human with a browser would be handling it then it could be caught easily.
# bkil Hence why in my scrapers... er, the scrapers of people I don't know... they are doing double confirmation and consistency checking of previous before proceeding to fetch based on the schedule, otherwise it could result in ever worse lock-out (usually resulting in ones that can't be just waved away with 2FA).
# bkil The seriously require you to submit a photo of yourself? What if you don't want them to handle that information?
# bkil 🤦
# bkil You people are weird...
# bkil But 🆗
# [snarfed] and yes maybe I could evade the bot detection by building an end user app/UI to only fetch on demand, but I'm not interested in building that kind of app, esp since there are already plenty of good social readers. not too interested in reinventing that wheel just to see IG selfies outside of the app
# 
[tantek] weird++ Correct bkil: https://indieweb.org/principles#fun 🙂
# bkil Anyway, yeah, Facebook had been doing even more creepy things to combat payed like-bots. They are running bot detection and biometric collection of how you type on the keyboard and how you move the mouse. If the patterns do not match your human self, it gets flagged as well. Guilty of developing such things as well. Come to think of it, I've been into quite creepy tech over the years, contributing on the wrong side.
# bkil Hope it's not to late to contribute on the right side if I started today 👼
# bkil Try posting likes to random posts by random accounts. But they are also more observant of those who act from a single IP/ASN, such as "like for hire" enterprises who are doing this all day long with hundreds of accounts in parallel. Today, they only succeed because it is still allowed to do it manually by hiring hard laborers...
# bkil Haven't looked into the efficiency of the stuff they have over Instagram, but I would assume they would port at least some of their systems over there as well eventually.
# bkil Yeah, that was just wishful thinking. Have also seen mergers from inside and I know for fact that even in mid-sized players, the tech stacks won't ever be converged. As certain components get phased out once every few years, such parts get rewritten to be used by multiple subsystems naturally instead.
# bkil Well, you have to cut corners to justify acquisitions and rewriting proven stuff that is working pretty well is a hard sell to investors. Who said Facebook was not a cheapskate?
# bkil But also, isn't the end goal of such integration & bridging to combat the network effect so that over time, more regular people could migrate from silos to independently hosted solutions using open protocols?
# 
[schmarty] bkil: yep - https://indieweb.org/POSSE#Why
# bkil And how did it work out so far for you? I know that practically nobody uses RSS readers among regular people I know.
# bkil Sorry, I just wanted to share my disappointing personal experience with you.
# bkil I'd been trying to spread the word for decades now with little success, maybe only my methods were in error.
# bkil So I would be open for any good idea that you got working in your circles.
[campegg] and [KevinMarks] joined the channel
# 
Loqi A social reader is a modern interactive reader that allows you to directly respond to posts (with a like, comment, etc) right there inline with posts as you read them (as people do in social media), in contrast to legacy feed readers which were one-way read-only experiences and provided no mechanisms to interact with or respond to posts https://indieweb.org/social_reader
# bkil Thanks. I've already read that some time ago.
# bkil I don't watch videos to acquire information, though if you were referring to the keynote, so such links are usually automatically a pass from me.
# bkil Or were you referring to this one? https://aaronparecki.com/2018/04/20/46/indieweb-reader-my-new-home-on-the-internet
# bkil Okay, I've also read that blog post.
# bkil And I agree that building a good Reader would be one part of a good ecosystem (hence why I'm building one currently).
bret joined the channel
holiday_medley joined the channel
# [tantek] capjamesg, the short answer is that market forces incentivize incompatibility by default. It takes a clever (and often long) game of marketplace/competitor "chess" to reach a dynamic equilibrium where an interoperable open protocol is strong & stable enough (network effects) to defend against huge capital investments to capture open markets for rent-seeking.
# IWDiscordRelay <capjamesg#4492> Did I link this already?
# IWDiscordRelay <capjamesg#4492> https://news.ycombinator.com/item?id=33436051
# [snarfed] we discussed this in depth at fediforum. rel-me is great but not sufficient on its own. in many (most?) cases, a mainstream audience won't necessarily know the correct DNS domain for the person they're trying to follow. eg for the example here, I have no idea if Taylor Swift's web site is taylorswift.com or taylor-swift.com or something else
# IWDiscordRelay <capjamesg#4492> That is an interesting point.
# IWDiscordRelay <capjamesg#4492> I posited that if Taylor Swift ran a Mastodon instance we’d have a million more users on the platform 😅
# IWDiscordRelay <capjamesg#4492> swift.town or something to that effect.
# IWDiscordRelay <capjamesg#4492> Does mastodon need a couch system?
# IWDiscordRelay <capjamesg#4492> I say I am jamesg.blog, do rel me. I say I vouch for @taylor@seifti.es.
# IWDiscordRelay <capjamesg#4492> I meant vouch system. Autocorrect.
# IWDiscordRelay <capjamesg#4492> Self vouch?
# IWDiscordRelay <capjamesg#4492> Swift gives a press conference announcing her new mastodon username?
# IWDiscordRelay <capjamesg#4492> Link?
# IWDiscordRelay <capjamesg#4492> Hm.
# IWDiscordRelay <capjamesg#4492> What’s next?
# IWDiscordRelay <capjamesg#4492> I have a QR code to my AI bot on my business card.
# IWDiscordRelay <capjamesg#4492> (Personal business card)
# IWDiscordRelay <capjamesg#4492> If I hand you the card, you know jamesg.blog is me.
# IWDiscordRelay <capjamesg#4492> How does one scale that?
gRegor joined the channel
# 
[KevinMarks] You can do third party vouching with rel=me. The authority creates a profile page for each person it is vouching for, and does the bidirectional rel=me
# [KevinMarks] That works for employers, academic institutions, professional bodies that issue credentials etc.
# [KevinMarks] This is already happening with mastodon
# [KevinMarks] There are third parties too eg https://www.presscheck.org/
# [KevinMarks] The ACM or IEEE could validate members similarly
bret joined the channel
# [KevinMarks] Twitter broke their dkim?
# [KevinMarks] My "it me" app got suspended