#social 2018-04-20

2018-04-20 UTC
#
dansup Thanks for the opinions on javascript!
timbl joined the channel
#
ajordan dansup: can't tell if you're being sarcastic? I assume no?
#
dansup Heh, nope
#
dansup I was just wondering what people thought about it, I know mastodon uses react and quitter is a js heavy UI.
#
dansup And I got this response, https://mastodon.social/@kit_darko/99884705917217035
#
Loqi [Kit Darko] @dansup A full page reload just for liking something though? 🤮
#
dansup I'll be using js but it wont be required, the js experience will be a lot smoother though
JanKusanagi joined the channel
#
ajordan dansup: excellent haha, just checking
#
ajordan I mean FWIW pump.io requires JS too, but that bothers me
#
ajordan honestly I want to throw away all the frontend code we have currently and try for a simpler model
#
ajordan and also I'd like to do a better job of supporting people without JS on
#
ajordan Legacy(tm)
#
dansup Nice, I think a fresh UI could help both pump and gnu social a lot!
#
dansup I started a gnu social clone using the laravel framework, https://mastodon.social/@dansup/99807919226835952
#
Loqi [dansup] Sneak peek of the basic bootstrap UI.
evanp joined the channel
#
dansup hey evanp, big fan of your work on statusnet and pump! I've recently been working on new patches for GNU social (including ActivityPub support), and tinkering with stuff like https://git.gnu.io/gnu/gnu-social/issues/308
#
dansup I ran a statusnet instance from 2012 to 2015 on the hyperboria network (wasnt federated since it required cjdns access)
#
dansup Just the beginning... https://git.gnu.io/dansup/ActivityPub/blob/dev/actions/activitypubactor.php
evanp joined the channel
#
ajordan ahh so to be clear dansup
#
ajordan that refactoring I was talking about would be different than a UI redesign :-)
#
ajordan though I'd like to improve the web UI too haha
#
dansup ajordan: Oh I see, I might be able to help with that. I'm familiar with bootstrap, bulma, semantic and foundation. https://dansup.github.io/bulma-templates/
#
ajordan ah nice
#
ajordan I mean so am I, it's just a matter of time
#
ajordan I'm bad about reviewing PRs too unfortunately
#
ajordan there's some low-hanging fruit like e.g. getting us off Bootstrap 2 lol
#
dansup Yeah I hear ya, I've been trying to add bcrypt/argon2I support to GNU social and performance/security takes precedence over UI
#
ajordan yeah for sure
#
ajordan I have so many ideas to improve security
#
ajordan just never enough time...
evanp and cdchapman joined the channel
#
dansup ajordan: does pump support ActivityPub or does it just support ActivityStreams 1.0?
#
ajordan dansup: AP support is WIP
#
ajordan actively being worked on
#
dansup ah nice
cdchapman joined the channel
#
ajordan yep
#
ajordan I expect AS2 support will ship in our next beta
#
ajordan that's blocked on me doing a review unfortunately
#
dansup if you support image uploads, I will be able to federate your content to the instagram clone
#
ajordan we do!
#
ajordan (fair warning I'm going to bed literally any minute now)
#
dansup goodnight!
#
Loqi sleep tight!
#
cwebber2 ajordan: :D :D
#
cwebber2 go go AP in pump.io!
vasilakisfil, xmpp-social, mib_lfcapy, githree, fr33domlover, Zakia, gf, hadleybeeman and downey joined the channel
#
Gargron cwebber2: https://github.com/tootsuite/mastodon/issues/1629#issuecomment-382767542
#
Loqi [Gargron] In that case maybe you don't want polls, maybe you want to use Strawpoll... Either that or ActivityPub needs a way to display answer counts without listing individual answers. Tbh, imagine a typical poll on Twitter, it can get thousands of replies. T...
#
cwebber2 Gargron: *reading*
#
cwebber2 Gargron: I gave a suggestion
#
cwebber2 !tell evanp hey, could you look at https://github.com/tootsuite/mastodon/issues/1629#issuecomment-383095637 ?
#
Loqi Ok, I'll tell them that when I see them next
#
Loqi [cwebber] Maybe each answer that shows up in the poll could itself be an AS2 collection which can give its totalItems, but which can (optionally, if non-anonymous) also expose its items (which are the actual response objects) in case anyone wants to "audit" it...
#
Gargron is evan back in activitypub development?
#
ajordan Gargron: evan's been hacking on AP in pump.io
#
cwebber2 !tell pfrazee is this true? does Dat use nodejs' representation of json as its "canoicalization" format? https://news.ycombinator.com/item?id=16879954 Is there any plans to change that?
#
Loqi Ok, I'll tell them that when I see them next
#
Loqi [Vendan] (I'm the author of the repo in question) Note that this repo has been sidelined, as I have fundamental issues with the protocol SSB is built on. Unless there's changes to how the messages are signed and verified, I'm not planning on putting any seri...
#
cwebber2 oh wait
#
cwebber2 SSB not dat
#
cwebber2 nm then :D
#
cwebber2 I keep mixing up SSB and dat
#
cwebber2 !tell pfrazee once again I mixed up SSB and dat apparently. Never mind and carry on!
#
Loqi Ok, I'll tell them that when I see them next
evanp joined the channel
#
cwebber2 hey hey evanp
#
cwebber2 I left you messages with Loqi ;)
#
cwebber2 I think you need to speak to get them! :)
#
ajordan ahhh SSB
#
ajordan it *does* have a lot of interesting ideas
#
cwebber2 otoh this commenter has it right https://news.ycombinator.com/item?id=16880304
#
Loqi [zeveb] I know that I sound like a broken record, but this is exactly the issue which canonical S-expressions were designed for, and which SPKI wrestled with & solved twenty years ago. The SPKI version of a message would look something like (I've removed...
#
cwebber2 yeah yeah canonical s-exps for life
#
cwebber2 notes they co-authored a protocol that does not use canonical s-exps but shhh
evanp joined the channel
#
ajordan cwebber2: heathen!
#
ajordan has exactly zero opinion on canonical s-exps
#
cwebber2 canonical s-exps are great and it makes me sad that SPKI/SDSI didn't take off (well, I'm sad about that for lots of reasons)
#
ajordan searches
#
ajordan aw man
#
ajordan that looks really nice :/
#
cwebber2 yeah instead we got X.509 and SSL Certificate Authorities
#
cwebber2 sad
#
ajordan no kidding
#
ajordan at least we have Let's Encrypt I guess?
#
cwebber2 Let's Encrypt is a useful tarp (built an maintained by wonderful people) thrown over the current dystopia of certificate authorities
#
cwebber2 if you haven't considered it before, consider that SSL CAs are only as strong as the *weakest* CA you have
#
cwebber2 any CA, if compromised or unethical, can lie
#
cwebber2 and in fact, some CAs will lie if you pay them to
#
cwebber2 I forget which but some of the CAs allow corporate environments to purchase a "service" where they will allow you to MITM sites on a corporate network
#
ajordan cwebber2: I'm aware of all the problems with PKI (moxie's talk on Convergence is really good for that and also I taught a class on this lol)
#
ajordan and I totally agree
#
michiel cwebber2: would SPKI have solved that issue?
#
ajordan right now the situtation is still pretty bad but I think Certificate Transparency will actually get us to a decent place
#
cwebber2 michiel: yes, SPKI/SDSI as I understand it allowed there to not be one "central authortiy" but allowed one to set up a trust network
#
cwebber2 michiel: it had a petnames system using path based names IIRC
#
cwebber2 however most of my knowledge comes from only skimming the specs, but reading and falling in love with the canonical s-exps one ;)
#
cwebber2 and talking with ocap folks
#
cwebber2 and also Christopher Allen
#
cwebber2 who is the person behind tls/ssl
#
cwebber2 and also *did not want* a certificate authority system, and wanted to use SPKI/SDSI
#
cwebber2 well, the main person behind, I should say
#
ajordan oh interesting
#
ajordan according to someone moxie talked to they just "threw [PKI] in at the end"
#
cwebber2 btw if you read the petnames thing (unfinished) that I was working on with Mark Miller and etc for Rebooting Web of Trust that's a good idea of how a different naming and security model could work: https://github.com/cwebber/rebooting-the-web-of-trust-spring2018/blob/petnames/draft-documents/making-dids-invisible-with-petnames.md
#
ajordan I wonder if he talked to Christopher Allen or someone else
#
cwebber2 sadly unfinished
#
cwebber2 yes Christopher Allen told me something like "we tried to warn Netscape about all the problems that would happen if they went with a CA model but they were like, this is easy to ship, so let's roll it out"
#
cwebber2 the petnames stuff will probably be more important as we're starting to see more experiments with activitypub over tor onion services
#
ajordan Kip Hickman (sp?) apparently
#
ajordan right
#
ajordan https://strugee.net/presentation-https-deployment/#11
#
cwebber2 and webfinger sure as heck won't work for that :P
#
cwebber2 especially not as onion v2 services roll out with a zillion character long onion names
#
cwebber2 petnames reduce phishing risks as well
#
ajordan lol I've had a vanity onion v2 generator running for... let's see
#
ajordan two months apparently
#
ajordan I should just give up right?
#
ajordan https://pump.strugee.net/alex/note/Zp6YptdKQq-LVxir8PwN9w
#
Loqi [AJ Jordan] I'm now generating (vanity) Tor onion service keys for strugee.net and nodecompat.com. Onion services coming Real Soon Now™!
#
Loqi +1
#
cwebber2 heh
#
cwebber2 vanity .onions are funny but also kind of dangerous
#
ajordan dangerous how?
#
cwebber2 especially the facebook one worries me
#
cwebber2 they increase phishability
#
cwebber2 if you get used to the idea that something like facebookcorewwwi.onion is really facebook
#
ajordan ohhh yeah that's interesting
#
cwebber2 then facebookcorewwii.onion may be an easy way to trick people
#
cwebber2 and this will be worse in tor onion services v2
#
cwebber2 where they're much larger
#
cwebber2 even harder to distinguish
#
cwebber2 if you only look at the first N characters, you might say "seems legit?" and go through
#
cwebber2 and then bam, phished
#
cwebber2 petnames are the right answer
#
ajordan well that depends on how you keep track of onions
#
ajordan I have a text file where I record known onions
#
cwebber2 ajordan: that's an informal petnames system :)
#
cwebber2 now let's make a formal one
#
ajordan you could argue that v2 will improve things because it forces more people into that kind of setup
#
ajordan ah true
#
cwebber2 bookmarks are also petnames
#
cwebber2 now, if you add edge names
#
cwebber2 where I can recommend you
#
cwebber2 er, recommend to you
#
cwebber2 some names
#
cwebber2 cwebber => rhiaro
#
cwebber2 here's how you find Amy
#
cwebber2 now you start to establish a system where, like real world connections between people
#
cwebber2 we can introduce folks to each other
#
cwebber2 and also!
#
cwebber2 DNS doesn't need to appear
#
cwebber2 it just becomes an equal participant
#
cwebber2 if you have a dns petname, then
#
cwebber2 dns => dustycloud.org
#
cwebber2 er, doesn't need to disappear :)
#
cwebber2 same thing with namecoin or even your local university staff directory
#
rhiaro considers herself found
#
cwebber2 MIT Staff => Gerald Sussman
#
cwebber2 hi rhiaro :)
#
ajordan hm interesting
#
ajordan also side note because of this conversation I was like I wonder what rhiaro is up to? and so I went to http://amy.gy and well
#
ajordan poop emoji :P
#
rhiaro That's because online rhiaro is authoritative not amyg
#
rhiaro rhiaro.co.uk should tell you what I'm up to more or less
#
ajordan lol yeah I went there
#
rhiaro is on a bus to Prague
#
ajordan I couldn't remember the URL and wanted to be lazy so I took a guess :D
#
ajordan rhiaro: nice, how come?
#
rhiaro Where to start
#
ajordan hahaha
#
Loqi hehe
#
rhiaro Convenient connection to Lyon for webconf is the simplest explanation
#
rhiaro Anyone here going to webconf next week? I know Sandro is
#
ajordan ahh nice
evanp left the channel
#
aaronpk I haven't been paying enough attention to conferences ahead of time to actually go to much this year. Hopefully next year I can do more since I can plan ahead now
cdchapman, jankusanagi_, fr33domlover, JanKusanagi and bwn joined the channel
#
@kevinmarks ↩️ @alicemazzy This sounds like Activity Streams: https://www.w3.org/TR/activitystreams-core/#example-3 (twitter.com/_/status/987437917940408320)
cdchapman joined the channel