I gave it a shot. It’s very easy to set up and the archive it generates is usable. The presentation could be improved, probably pretty easily, but it works just as is.
I have not gotten my archive yet. If the data in the archive is good, then I would probably write a Python script to convert it into a static html feed.
Then a second solution is needed to handle future tweets. Maybe just switching from “tweeting” to “posting to multiple places”. To the static feed and to Twitter.
I don’t do this myself, but the term for this is POSSE: Publish (on your) Own Site, Syndicate Elsewhere. Since there is an acronym for it, there probably also is software that can help you do it. See this page for an introduction.
I don’t see a problem here. Why wouldn’t I want to see the content of user U2 on their server? If I want to follow them, I just click a bookmarklet that opens their profile on the fediverse server I use:
As I see it, the problem is that if I have an account on S1, I am now forced to use S1’s server as my interface to the “fediverse”, and I can’t switch to another server without leaving my current identity behind.
This feels like a problem of conflating my server with my client. Of course on the web most servers have sort of “built in” looking client, but ideally it’s not my only choice.
Even if I use a client app, my experience is still largely controlled by the server. I’m at the op’s whim as to which servers to federate with or block, what content to restrict, or even whether to delete my account. Plus a malicious op can read or modify my posts.
This is brought up so often that even this reply I’m making to this exact point right now is tired, but every single one of your concerns apply to what’s called a centralized social network too. In the fediverse you can migrate to a different instance and keep all your followers if you don’t like the policies of the one you’re on.
Of course these apply to centralized networks. I’m not defending those. I just don’t think federation is a worthwhile compromise — it adds a ton of complexity but doesn’t solve enough problems. The real solution is P2P.
you can migrate to a different instance and keep all your followers
How does that work? Does it work if, say, your old instance has already banned you, or blocked the other instances your followers are on?
In a P2P system your identity is completely independent of DNS names (or IP addresses), and your content is also location-independent. You also have no need to put any trust in a server operator.
You can have servers, but they’re just well-connected peers that help with connectivity. In the system I’m working on I imagine most clients will connect with servers, not directly; but users still have the benefit that they don’t have to figure out who to trust to host their content, they don’t have to deal with blocking and bans, etc.
That sounds like something that can only really be accomplished with home keypair management, like nostr. Which is fine, the tech is cool and I’m no stranger to managing keypairs myself, but you certainly lock yourself into a certain demographic with that approach.
Yes, identities are keypairs. But if the user has to know how to manage keypairs, the UX has failed. (Someone else said “if the user ever sees a hex/base64 public key, we’ve failed”, but I don’t go that far. They’re a viable last resort for verifying an identity by hand, and an abbreviated key is the display-name of last resort in case petnaming fails.)
You can control server blocks at a per-user level with most servers. I understand some admins also do server side blocks you can’t override and for sure if that’s happening you have a problem with your choice of host/admin and not only with experience.
I’m honestly surprised this is a thing. I’ve had a Mastodon.social account since 2017 and ever since then most of the discourse around the Fediverse is “be careful about what server you choose, so you don’t get defederated by the admins from content you might want to follow”. As far as I know, no instance has been advertised as “you as a user control your own server blocks (i.e. a killfile), the admins don’t do anything”.
A cursory exploration of the Mastodon UI doesn’t show any option to block servers in my settings (again, on Mastodon.social).
On Twitter, the way approach it right now is to read my feed chronologically and without retweets, suggestions, replies etc. The search function makes this easy:
I’d love to see a study about the actual content of the Fediverse. While the graph shows a sharp increase, I’ve also seen recently a lot more spam (mostly the usual non-sensical messages from accounts with female portraits trying to get you to follow a profile link to a NSFW website).
I do not believe one can grow a social network without having to choose between anonymous accounts and mass spam, but I’d love to be proven wrong.
I don’t think anonymous vs not anonymous makes a difference.
People spam less under their real name because it costs them reputation. I would expect that any other currency works just as well. One could for example not accept messages by people who are more than 5 degrees of seperation away from oneself. So messaging you would cost the sender the work to get close enough to you.
Is that so? Most of the spam I receive that makes it through filters is under very real names, very openly.
Aside from anonymity, I’d even argue that Federation has a bit of an edge there, as moderation is a) on many shoulders and b) instances that succumb to the problem can be cut off (temporarily). This is regularly happening.
The Gnod codebase has been growing for well over a decade, and the typical function is about 10 lines. There barely are any functions longer than 20 lines.
On most sites I use, I automate something. Since I don’t like to keep two versions of the code (plain and in bookmarklet form), I wrote this editor to convert the code in both directions.
You can click on the question mark to get more infos about bookmarklets in general, this editor in particular, and some examples.
Are bookmarklets usable again, now? It seemed like all the major browser engines were ok with breaking them in favor of CSP so I had pretty much given up on them.
I would imagine the only time csp being a problem is when you connect to some external resource. if you are just modifying things locally it works fine. I have a few bookmarkletes and they work fine.
Yes, I added a text to the post which explained that this is kinda under construction. But it was removed by a mod. For some reason, link+text is not allowed on Lobsters.
The text:
I finally got around implementing an atom feed for my website. Since I like single file libraries without dependencies and couldn’t find one, I started this repo. it works fine for me. Tried it on all feed readers on the first two Google result pages for “online feed reader”. There probably are edge cases in which it fails. I will fix it as I go along (I blog only a few times per year) or as pull requests come in.
Yes, if you write the python command by hand and are aware of the issue, you can probably mitigate it.
The tricky thing is that the python call might be somewhere in a shellscript you use.
The issue actually came up when an irc user reported his computer goes bananas when he cds into a certain dir. Turned out he was using a tool that executes some Python onevery cd. In that dir, there was a “types.py”. And the shellscript ran some Python that imported “types”.
Fair enough, though (weirdly) I still cannot reproduce the original example or your example with http.server. It’s not that I disbelieve you, but I don’t understand why I cannot reproduce this.
I have tried Python installed by Debian (via apt), MacPorts, and pyenv (pyenv on macOS and on Debian). The results are not consistent. That is, sometimes, a pyenv-python ignores collections.py and other times a pyenv-python reads the local file and shows the vulnerability. So far, I have not been able to get a Python installed by Debian or MacPorts to read the local file and show the vulnerability.
If using an older version of Python (I still run py36-py38), an alternative solution is to add an extra import hook (via sys.meta_path, but an extra FileFinder in sys.path_hooks might also be enough) before the defaults to avoid this behavior.
Why does this happen? When running “import foo”, what python (approximately) does is the following:
Python looks through its sys.meta_path entries to see if any of them can handle importing foo (example if foo involves a dynamic shared object, you’d need an entry that calls dlopen).
how does the entry check if it can handle the import? It does a few checks (is foo compiled within the default libpython.so or is it frozen bytecode?) or sometimes just attempts the import outright with a try-except fallback
the lastsys.meta_path entry is usually the one that walks through the files and folders on your filesystem and this is where the whole PYTHONPATH/PYTHONSAFEPATH gimmick comes into play: Python checks the entries of sys.path (which is influenced by the env vars) one-by-one for foo.py, and the first entry in sys.path is usually "." i.e. the current directory. this is why when you have a types.py in your current directory and a script does import types, you get the local file instead of the types module from the stdlib.
Therefore to avoid this mistake we can add an entry at the start of sys.meta_path or sys.path_hooks that checks the “safe” locations first, before punting to the latter entries that use the local directory
To avoid the inverse of this mistake (ie I want to import my local foo.py but name clashes with stdlib), I try to import .foo or from . import foo but usually I just rename the local file :P
I can’t reproduce this. I’m running the exact same commands locally, and it doesn’t appear to run the code in collections.py. Is this windows specific behaviour or something?
In general I don’t find the idea that generating docs involves running arbitrary code surprising, build systems often involve running arbitrary code, and generating docs often involves running build systems. It being python, I wouldn’t even be that surprised if the whole thing was implemented via reflection. I was wondering if I could get the same behaviour with something like python3 -m http.server though, because that would be approaching surprising behaviour.
In general I don’t find the idea that generating docs involves running arbitrary code surprising,
I misunderstood this originally. The problem is not that it runs arbitrary code to generate the docs (if you’re importing a package, you’re letting the author of the that package [and, by extension, the docs for that package] run arbitrary code anyway, because Python does not have a capability model). The problem is that the docs tool reads files matching a specific name in the current directory and executes them. If someone manages a drive-by download exploit on your browser (I think Safari is still the only mainstream browser that requires you to confirm per site that you want to allow it to download files) then they can drop a file like this in your downloads directory, and if you run the docs command in your downloads directory then you’re owned. Fortunately, it only checks the current directory and not arbitrary parents (as the git vulnerability a month or two ago did), so dropping a file like this in ~/Downloads doesn’t exploit you if you look at docs in ~/Downloads/SomePythonPackage-1.2.3.4/)
Yeah, what this really boils down to is “if there’s a foo.py in the working directory directory and you run python foo.py or anything else that imports foo, you will get the working directory’s foo.py”.
Which is one of those deep tensions between making a thing discoverable/learnable (working directory being on the import path is huge for that) versus trying to lock it down as much as possible. And is getting into an area where it’s hard to really have the language stop you – Python could maybe refuse to run if it detects it’s being invoked in a directory matching common download/home dir names, or change import behavior silently, but now you get confusing inconsistency in how it works, and no amount of “are you sure you want to trust this directory?” popups will actually help the people who are most likely to need the help, since they’ll probably just click through those.
As some folks have noted, Python has a command-line flag that lets you explicitly decide to minimize the import path, which maybe is the way forward for some tutorials and other beginner/first-time materials. Or maybe it’s a thing that needs to be solved at the operating system level.
Unrelated: this is also why I and several other people strongly advocate for a code repository layout with a src/ directory top-level, and any modules/packages inside that directory. If the modules are top-level, it’s very easy to trick yourself into thinking your packaging process works because you’re likely running it from the root directory, which implicitly puts all that stuff on the import path. Using a src/ (or similar name) directory means you actually have to get the packaging right in order to successfully install/test.
The problem is that the docs tool reads files matching a specific name in the current directory and executes them.
I thought the issue was that running python3 -m foo would run foo.py (or similar, don’t know specifics off the top of my head) – that is, this is nothing to do with the docs tool itself. Am I mistaken?
Running python -m foo will run whatever foo module is found first, starting with the current working directory. The same is true of running python -m pydoc foo.
The specific “exploit” shown here is more like
Module foo imports standard library module collections
I manage to get a malicious file named collections.py into your current directory and convince you to run python -m pydoc foo
The import collections inside foo gets resolved to the current directory’s collections.py, so that’s the file that gets imported. If it has any import-time side effects, they execute.
It’s a bit convoluted to actually pull off, because generally you need to convince someone to run python from their downloads directory or something like that.
I tried it on void linux and mac os. With python3.11 on both systems. EDIT: Oops, python3.10.8 on mac, I checked the version number in a terminal with ssh open (but did fail to reproduce on the actual mac).
Your docker repro works for me, and installs python3.9. Maybe the behaviour has changed in more recent versions of python?
Continuing weirdness: I cannot reproduce with Debian’s python 3.9.2, but if I install 3.10.6 (using pyenv) I can finally reproduce what no_gravity is seeing. But I cannot reproduce it using Debian’s system python (which he seems able to do on Ubuntu).
I’m going to stop messing around with this now, but there seem to be other factors at work here.
# I installed python 3.10.6 using pyenv and made that the local python
telemachus(digitalocean) wtf$ python3 --version
Python 3.10.6
telemachus(digitalocean) wtf$ python3 -m http.server
P0wned
Could not import runpy module
# Now I've go back to the system python3
telemachus(digitalocean) wtf$ rm .python-version
telemachus(digitalocean) wtf$ python3 --version
Python 3.9.2
telemachus(digitalocean) wtf$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
^C
Keyboard interrupt received, exiting.
I also cannot reproduce—not on macOS 12.6.1 with python 3.10.8 and not on Debian 11 with python 3.10.5. (My shell is bash on both systems, though I doubt that matters.)
I can finally reproduce this, but only with some pythons and in some cases. I don’t understand this at all. In any case, I’m glad to learn about the larger issue.
When I chose a server, I considered their federation policy, because I didn’t want to out-source deciding which accounts I should be allowed to follow.
https://fosstodon.org/about and https://hachyderm.io/about/more both have long lists of suspended servers: “No data from these servers will be processed, stored or exchanged, making any interaction or communication with users from these servers impossible”.
I prefer the federation policy of https://qoto.org/about/more, which doesn’t suspend any servers. There’s a few others like that.
The unfortunate reality of being on an instance like qoto.org is other, “heavily moderated” instances will suspend/silence you because of the lax moderation policy.
Thankfully the servers blocking us are few and far between and are limited to only the most excessive and aggressive block lists. As I said, QOTO has one of the largest federation footprints on the fediverse,
Anecdotally, every other server I’ve seriously looked at joining has had QOTO completely blocked/suspended/filtered. There are some things about it I found attractive but it seems like I’d be cut off from a lot of the community I’m looking to find on the fediverse based on where my twitter follows/followers have migrated.
Alright, should have double checked before posting. It looks like this is correcting, as at least Hachyderm and infosec.exchange do allow it now. (Still appears blocked at Hachyderm but the issue removing it is closed)
I can understand your line of thought, but often times there are good reasons to defederate certain instances. For example pawoo.net (japanese instance) allows content which is illegal in other countries. And since mastodon caches content of remote servers, this makes defederation or at least restrictions almost a must.
We do not silence or block other Fediverse instances based on agenda, politics, or opinions held by their staff or users. We only require servers we federate with to follow one simple rule: respect a user’s right to disengage. Offending servers will only be silenced, not blocked, blocks will be reserved for technical assaults only such as DDoS attacks, or legal issues such as sexual abuse and child porn.
qoto.org doesn’t currently block any servers, but is willing to if needed for the above technical/legal reasons.
Other instances blocklists go beyond these technical/DDoS reasons. The advantage of a federated protocol is being able to pick.
I was on mastodon.technology, but the whole time I just wanted my own instance. Now when it shut down, I finaly have one. Then I can deal with my own policies.
One of the core ideas of Mastodon is that instances control who they federate with.
So you are free to create an account on any instance you like and post anything that stays within the instance’s rules. You just aren’t guaranteed an audience – other people may block you, or other instances my choose not to federate with the instance you’re posting on. This is freedom of speech in its purest form: you can say what you like, and other people can ignore you if they like. Or if they dislike their instance’s policies, they can move to another one or set up their own. But you can never, ever, a million billion times never, force another instance to federate with you or show your posts, or force another user to listen to you.
The way I read those pages is that the details element is simply a group of stuff with a summary and the behavior that everything except the summary will only be displayed if the user wants to see it.
I wrote the “Three things to like about the Fediverse”.
Some say it is low quality because it only contains three bullet points. But it took me quite a while to distill the essence of what is good about the Fediverse down to what I consider the three main points.
The reason I posted it here is that all three are benefits for developers.
Owning your identity like you own your domain is something easy for developers. Not so easy for regular users. Although that will probably change over time.
Fully customizing your experience can only be done by developers. As it means you have to customize the code of your instance.
Building cool stuff on top of it is also something that can only be done by developers. As it means to build new software.
The three “main points” are devoid of any meaningful content, personally:
Do you “own” a domain? You’re registered as the owner of a domain, but it’s not really ownership, it’s a lease from IANA or whoever. So what does it actually mean from a technical perspective to “own” your federated identity? There is no knowledge gained from reading this bullet point.
“Fundamentally open” would be cited as weasel words on Wikipedia. What’s open? You don’t need a FOSS instance to have a federated instance. So the ActivityPub protocol is open? That’s great, but ActivityPub is a standardised protocol - “customise your experience” doesn’t particularly mean much in regards to that. It’s a point that’s been distilled of all information.
I guess you can “build cool stuff” on top of anything with a big enough hammer, but on ActivityPub/Mastodon/Pleroma that’s fair. This again though is a point distilled of all information, there’s nothing you learn, nothing one gains from reading it.
Hope this gives some perspective on why people, or at least I, would have downvoted your submission or considered it off-topic (lacking technical content). It’s nothing personal, I’m sure your tweets are great and you have technical information, technical knowledge etc. you could share in the future.
There is a lot to unpack here. Let me start with the first point:
You are always at the mercy of some infrastructure providers. That is why in my Tweet, I wrote “You can own your identity to the same degree you can own a domain”.
IANA, ICANN, your registrar, browser vendors, operating system vendors .. they all have the power to interfere with how available a specific domain is. But these infrastructure providers are generally orders of magnitude more trustworthy than social networks. How often did you hear that one of these infrastructure providers interfered with a single domain? I can remember almost no such events. On social networks on the other hand, interference with visibility is the norm. Even outright deplatforming is pretty common.
So owning your identity to the same degree you own a domain is a big step forward.
When decentralized domain name systems like .eth become supported, you can own a domain to an even higher degree. By being the only one who knows the secret key that holds the power over your domain. That would cut IANA, ICANN and your registrar out of the loop.
How often did you hear that one of these infrastructure providers interfered with a single domain?
It happened to a website which shall not be named just the other day (recency bias? I’d have to look for other examples.) Your identity is now also subject to potential hijacking or squatting. Not having a process you can turn to and recover your stolen identity is a huge step backwards.
Side note: I think it’s a good thing that social networks interfere with visibility of certain content, and federated social media does so in very broad strokes (example). De-platforming and censorship are social debates, and debates not solved or avoided through federation.
As for why they have not been removed I can’t say since I am not a moderator.
When I ask whether they should be removed, that is more so a metaphorical question (to everyone but the admin) as to whether the community would appreciate those topics being submitted. I especially wanted to hear from people who had been around for a while, because there was a significant amount of disagreement between users upvoting and flagging the articles. A better question to ask would have been: Should I, and other newcomers like myself, be submitting stories related to social media?
Your answer, as I understand it, is: No, unless there is heavy technical content within. For example, an article describing the logistics behind running a social media database would be okay.
If you have a moment, I’d also like to ask about the nuances of your answer. I’ve also run across a few similar, older posts with no flags:
The first is more a community information exchange than anything else, so I’m okay with it. It’s analogous to a bunch of us meeting up and informally exchanging business cards,
The second is off-topic to me. I’d flag it, but it was submitted two years ago so there’s no point. I don’t think this is the place to be discussing the distribution of Mastodon and what it means for online communities.
That was the reason I held off initially. I eventually realised that the strong norm of allowing users to migrate between instances (eg mastodon admins would need to patch the code to stop it) was good enough for me.
They’re not generally cheap for one user, because they reserve resources for an entire (heavyweight) rails app. I’ve tried to get interest up in multitenancy support in mastodon, but it’s not gone anywhere yet.
Hey long time fedi user here and what is really cool is that some techys are actually integrating their own personal blogs into the fediverse. I have no idea what sort of challenge this poses but for example the person who invited me to lobsters has her own blog on the fediverse and interacts with us through that.
You can use webfinger and/or Mastodon “link verification” to connect your domain to your account, even if you use an account on an instance under a different domain.
if the github project is meant to ensure free distribution, I’m pretty sure something this small is not subject to copyright anyway. you could just share the bookmarklet itself instead of a link to a github project:
It will be updated and annotated forever. Since I made this post, I already incorporated multiple improvements people suggested. And it makes collaboration easy. Everyone can add issues and pull requests, make forks or follow the repo.
For what it’s worth, I really like bookmarklets for the security reasons alone. I know they they aren’t running any code until I click on them (unlike extensions). It’s much easier to check that nothing nefarious is going on behind the scenes. Even the simplest extensions have multiple files of boilerplate code, and they can be updated remotely. I hate to think what would happen if the developer’s account got compromised for any of the popular extensions.
Unfortunately, it seems like Chrome on Android doesn’t support bookmarklets – or at least fails on ones imported from my desktop.
Extensions are updated remotely without user interaction? That is another scary aspect.
For me, the bookmarklet works fine on Chrome on Android. I have to use it from the address bar though. I named it “t2n” and when I am on a Twitter page, I type “t2n” into my address bar. Now from the list of suggestions I click on the bookmarklet and it works.
I seem to remember this tool tiny subversions floating around the fediverse, but haven’t tried it yet. Sounds like what you want?
I gave it a shot. It’s very easy to set up and the archive it generates is usable. The presentation could be improved, probably pretty easily, but it works just as is.
I have not gotten my archive yet. If the data in the archive is good, then I would probably write a Python script to convert it into a static html feed.
Then a second solution is needed to handle future tweets. Maybe just switching from “tweeting” to “posting to multiple places”. To the static feed and to Twitter.
I don’t do this myself, but the term for this is POSSE: Publish (on your) Own Site, Syndicate Elsewhere. Since there is an acronym for it, there probably also is software that can help you do it. See this page for an introduction.
This seems to be about the situation where:
I don’t see a problem here. Why wouldn’t I want to see the content of user U2 on their server? If I want to follow them, I just click a bookmarklet that opens their profile on the fediverse server I use:
As I see it, the problem is that if I have an account on S1, I am now forced to use S1’s server as my interface to the “fediverse”, and I can’t switch to another server without leaving my current identity behind.
This feels like a problem of conflating my server with my client. Of course on the web most servers have sort of “built in” looking client, but ideally it’s not my only choice.
Even if I use a client app, my experience is still largely controlled by the server. I’m at the op’s whim as to which servers to federate with or block, what content to restrict, or even whether to delete my account. Plus a malicious op can read or modify my posts.
This is brought up so often that even this reply I’m making to this exact point right now is tired, but every single one of your concerns apply to what’s called a centralized social network too. In the fediverse you can migrate to a different instance and keep all your followers if you don’t like the policies of the one you’re on.
Of course these apply to centralized networks. I’m not defending those. I just don’t think federation is a worthwhile compromise — it adds a ton of complexity but doesn’t solve enough problems. The real solution is P2P.
How does that work? Does it work if, say, your old instance has already banned you, or blocked the other instances your followers are on?
What is the difference between P2P and federation? Isn’t that just federation but everybody is forced to host their own single-person instance?
Don’t know.
In a P2P system your identity is completely independent of DNS names (or IP addresses), and your content is also location-independent. You also have no need to put any trust in a server operator.
You can have servers, but they’re just well-connected peers that help with connectivity. In the system I’m working on I imagine most clients will connect with servers, not directly; but users still have the benefit that they don’t have to figure out who to trust to host their content, they don’t have to deal with blocking and bans, etc.
That sounds like something that can only really be accomplished with home keypair management, like nostr. Which is fine, the tech is cool and I’m no stranger to managing keypairs myself, but you certainly lock yourself into a certain demographic with that approach.
Yes, identities are keypairs. But if the user has to know how to manage keypairs, the UX has failed. (Someone else said “if the user ever sees a hex/base64 public key, we’ve failed”, but I don’t go that far. They’re a viable last resort for verifying an identity by hand, and an abbreviated key is the display-name of last resort in case petnaming fails.)
You can control server blocks at a per-user level with most servers. I understand some admins also do server side blocks you can’t override and for sure if that’s happening you have a problem with your choice of host/admin and not only with experience.
I’m honestly surprised this is a thing. I’ve had a Mastodon.social account since 2017 and ever since then most of the discourse around the Fediverse is “be careful about what server you choose, so you don’t get defederated by the admins from content you might want to follow”. As far as I know, no instance has been advertised as “you as a user control your own server blocks (i.e. a killfile), the admins don’t do anything”.
A cursory exploration of the Mastodon UI doesn’t show any option to block servers in my settings (again, on Mastodon.social).
If you want full control over who you federate and block, you can and should run your own server, or pay someone to do that for you.
To block a server from the web UI:
eh, I’m good
TIL, thanks!
I have an account on indieweb.social, but I can use elk.zone as my interface quite easily.
Unless by “interface” you mean “public profile page”, but then other people can view your account on any client they like.
You can have accounts on multiple instances.
Thanks for this, I’ve adapted for my personal redirector, it will save some clicks!
On Twitter, the way approach it right now is to read my feed chronologically and without retweets, suggestions, replies etc. The search function makes this easy:
https://twitter.com/search?q=-filter%3Areplies%20filter%3Afollows&f=live
The only feature I miss is:
I would like to collapse all tweets by a single user from the last 24 hours into a single tweet. So each user could show me only one Tweet per day.
Because there are many people I like to keep updated about but they tweet too much. Limiting everybody to one tweet per day would be perfect.
I would be interested in a client that groups messages by user, and only lets you refresh once a day.
I’d love to see a study about the actual content of the Fediverse. While the graph shows a sharp increase, I’ve also seen recently a lot more spam (mostly the usual non-sensical messages from accounts with female portraits trying to get you to follow a profile link to a NSFW website).
I do not believe one can grow a social network without having to choose between anonymous accounts and mass spam, but I’d love to be proven wrong.
I don’t think anonymous vs not anonymous makes a difference.
People spam less under their real name because it costs them reputation. I would expect that any other currency works just as well. One could for example not accept messages by people who are more than 5 degrees of seperation away from oneself. So messaging you would cost the sender the work to get close enough to you.
Is that so? Most of the spam I receive that makes it through filters is under very real names, very openly.
Aside from anonymity, I’d even argue that Federation has a bit of an edge there, as moderation is a) on many shoulders and b) instances that succumb to the problem can be cut off (temporarily). This is regularly happening.
Are you saying it’s optimal if I can read the smallest one?
I would think that the optimal distance is achieved when adjusting it further doesn’t enhance your ability to read smaller text.
Can you tell us about how you use these engines to perform refactoring? Maybe give an example?
I usually paste my code with the prefix “Can the following Python code be improved?”.
Here is an example:
https://www.gnod.com/search/ai#q=Can%20the%20following%20Python%20function%20be%20improved%3F%0A%0Afor%20member%20in%20data%5B'members'%5D%3A%0A%20%20%20%20if%20not%20member%5B'tags'%5D%3A%20continue%3B%0A%20%20%20%20if%20not%20any(tag%5B'name'%5D%3D%3D'joe'%20for%20tag%20in%20member%5B'tags'%5D)%3A%20continue%0A%20%20%20%20print(member)%0A
Something like 25% of the time, the AI comes up with a good idea.
What about when you have a non-trivial amount of code?
I break it into smaller pieces.
I am pretty extreme in this regard.
The Gnod codebase has been growing for well over a decade, and the typical function is about 10 lines. There barely are any functions longer than 20 lines.
So nested function calls in JavaScript …
As they are:
The current proposal:
I would prefer this:
This is a tool I use pretty regularly.
On most sites I use, I automate something. Since I don’t like to keep two versions of the code (plain and in bookmarklet form), I wrote this editor to convert the code in both directions.
You can click on the question mark to get more infos about bookmarklets in general, this editor in particular, and some examples.
Are bookmarklets usable again, now? It seemed like all the major browser engines were ok with breaking them in favor of CSP so I had pretty much given up on them.
I’ve been using one a lot, to toggle between looking at Mastodon posts on their home instances vs. on my home instance.
Is that a simple URL rewrite?
I pasted it in this, then took that long single line over to Beautifier, and it’s 75 lines long.
please post a pastebin link! this sounds like an extremely useful bookmarklet 😊
It’s from this generator, though I might try @no_gravity ‘s, and I’ve seen but not tried another.
This works for me:
Before you turn it into a bookmarklet, set your_instance to the Mastodon instance you use.
This seems slower, but the simplicity is pretty appealing.
I use bookmarklets on pretty much every site I visit regularly, and I never had a problem with CSP.
Can you give an example of a bookmarklet and a website that do not work together?
I would imagine the only time csp being a problem is when you connect to some external resource. if you are just modifying things locally it works fine. I have a few bookmarkletes and they work fine.
That wasn’t the case for ~5 years that firefox wouldn’t run bookmarklets on CSP sites at all, according to the history here: https://bugzilla.mozilla.org/show_bug.cgi?id=866522
Sounds like they did finally fix the case that doesn’t need subresources, though still haven’t fixed it for those that do.
This does zero input sanitization, which is the sort of thing you’d hope a library would do for you.
Yes, I added a text to the post which explained that this is kinda under construction. But it was removed by a mod. For some reason, link+text is not allowed on Lobsters.
The text:
I finally got around implementing an atom feed for my website. Since I like single file libraries without dependencies and couldn’t find one, I started this repo. it works fine for me. Tried it on all feed readers on the first two Google result pages for “online feed reader”. There probably are edge cases in which it fails. I will fix it as I go along (I blog only a few times per year) or as pull requests come in.
The reason is given in the moderation log.
Python 3.11 adds an interpreter flag (
-P) and an environment variable (PYTHONSAFEPATH) that you can use to prevent this behavior.Yes, if you write the python command by hand and are aware of the issue, you can probably mitigate it.
The tricky thing is that the python call might be somewhere in a shellscript you use.
The issue actually came up when an irc user reported his computer goes bananas when he cds into a certain dir. Turned out he was using a tool that executes some Python onevery cd. In that dir, there was a “types.py”. And the shellscript ran some Python that imported “types”.
Fair enough, though (weirdly) I still cannot reproduce the original example or your example with
http.server. It’s not that I disbelieve you, but I don’t understand why I cannot reproduce this.How did you install Python?
I have tried Python installed by Debian (via
apt), MacPorts, and pyenv (pyenv on macOS and on Debian). The results are not consistent. That is, sometimes, a pyenv-python ignorescollections.pyand other times a pyenv-python reads the local file and shows the vulnerability. So far, I have not been able to get a Python installed by Debian or MacPorts to read the local file and show the vulnerability.If using an older version of Python (I still run py36-py38), an alternative solution is to add an extra import hook (via
sys.meta_path, but an extraFileFinderinsys.path_hooksmight also be enough) before the defaults to avoid this behavior.I’ve stubbed my toe on this “feature” of Python’s import system enough times to write a custom import hook: https://github.com/ahgamut/cosmopolitan/blob/importer-cosmo/third_party/python/Lib/importlib/_bootstrap.py#L1089
Why does this happen? When running “import foo”, what python (approximately) does is the following:
sys.meta_pathentries to see if any of them can handle importingfoo(example iffooinvolves a dynamic shared object, you’d need an entry that callsdlopen).foocompiled within the defaultlibpython.soor is it frozen bytecode?) or sometimes just attempts the import outright with atry-exceptfallbacksys.meta_pathentry is usually the one that walks through the files and folders on your filesystem and this is where the wholePYTHONPATH/PYTHONSAFEPATHgimmick comes into play: Python checks the entries ofsys.path(which is influenced by the env vars) one-by-one forfoo.py, and the first entry insys.pathis usually"."i.e. the current directory. this is why when you have atypes.pyin your current directory and a script doesimport types, you get the local file instead of thetypesmodule from the stdlib.Therefore to avoid this mistake we can add an entry at the start of
sys.meta_pathorsys.path_hooksthat checks the “safe” locations first, before punting to the latter entries that use the local directoryTo avoid the inverse of this mistake (ie I want to import my local
foo.pybut name clashes with stdlib), I try toimport .fooorfrom . import foobut usually I just rename the local file :PThe older
-Iflag is a bit more comprehensive and was updated to imply-P.I can’t reproduce this. I’m running the exact same commands locally, and it doesn’t appear to run the code in collections.py. Is this windows specific behaviour or something?
In general I don’t find the idea that generating docs involves running arbitrary code surprising, build systems often involve running arbitrary code, and generating docs often involves running build systems. It being python, I wouldn’t even be that surprised if the whole thing was implemented via reflection. I was wondering if I could get the same behaviour with something like
python3 -m http.serverthough, because that would be approaching surprising behaviour.I misunderstood this originally. The problem is not that it runs arbitrary code to generate the docs (if you’re importing a package, you’re letting the author of the that package [and, by extension, the docs for that package] run arbitrary code anyway, because Python does not have a capability model). The problem is that the docs tool reads files matching a specific name in the current directory and executes them. If someone manages a drive-by download exploit on your browser (I think Safari is still the only mainstream browser that requires you to confirm per site that you want to allow it to download files) then they can drop a file like this in your downloads directory, and if you run the docs command in your downloads directory then you’re owned. Fortunately, it only checks the current directory and not arbitrary parents (as the git vulnerability a month or two ago did), so dropping a file like this in ~/Downloads doesn’t exploit you if you look at docs in ~/Downloads/SomePythonPackage-1.2.3.4/)
Yeah, what this really boils down to is “if there’s a
foo.pyin the working directory directory and you runpython foo.pyor anything else that importsfoo, you will get the working directory’sfoo.py”.Which is one of those deep tensions between making a thing discoverable/learnable (working directory being on the import path is huge for that) versus trying to lock it down as much as possible. And is getting into an area where it’s hard to really have the language stop you – Python could maybe refuse to run if it detects it’s being invoked in a directory matching common download/home dir names, or change import behavior silently, but now you get confusing inconsistency in how it works, and no amount of “are you sure you want to trust this directory?” popups will actually help the people who are most likely to need the help, since they’ll probably just click through those.
As some folks have noted, Python has a command-line flag that lets you explicitly decide to minimize the import path, which maybe is the way forward for some tutorials and other beginner/first-time materials. Or maybe it’s a thing that needs to be solved at the operating system level.
Unrelated: this is also why I and several other people strongly advocate for a code repository layout with a
src/directory top-level, and any modules/packages inside that directory. If the modules are top-level, it’s very easy to trick yourself into thinking your packaging process works because you’re likely running it from the root directory, which implicitly puts all that stuff on the import path. Using asrc/(or similar name) directory means you actually have to get the packaging right in order to successfully install/test.I thought the issue was that running
python3 -m foowould runfoo.py(or similar, don’t know specifics off the top of my head) – that is, this is nothing to do with the docs tool itself. Am I mistaken?Running
python -m foowill run whateverfoomodule is found first, starting with the current working directory. The same is true of runningpython -m pydoc foo.The specific “exploit” shown here is more like
fooimports standard library modulecollectionscollections.pyinto your current directory and convince you to runpython -m pydoc fooimport collectionsinsidefoogets resolved to the current directory’scollections.py, so that’s the file that gets imported. If it has any import-time side effects, they execute.It’s a bit convoluted to actually pull off, because generally you need to convince someone to run
pythonfrom their downloads directory or something like that.It works for me on Debian 11 and Ubuntu 22. And it also works for “python3 -m http.server”.
Which OS do you use? Can you try running it in a Debian container?
When I do, it also works for me:
I tried it on void linux and mac os. With python3.11 on both systems. EDIT: Oops, python3.10.8 on mac, I checked the version number in a terminal with ssh open (but did fail to reproduce on the actual mac).
Your docker repro works for me, and installs python3.9. Maybe the behaviour has changed in more recent versions of python?
Continuing weirdness: I cannot reproduce with Debian’s python 3.9.2, but if I install 3.10.6 (using pyenv) I can finally reproduce what no_gravity is seeing. But I cannot reproduce it using Debian’s system python (which he seems able to do on Ubuntu).
I’m going to stop messing around with this now, but there seem to be other factors at work here.
I also cannot reproduce—not on macOS 12.6.1 with python 3.10.8 and not on Debian 11 with python 3.10.5. (My shell is bash on both systems, though I doubt that matters.)
I wonder what other variables are at play.
It works for me with Python 3.10.6:
I can finally reproduce this, but only with some pythons and in some cases. I don’t understand this at all. In any case, I’m glad to learn about the larger issue.
When I chose a server, I considered their federation policy, because I didn’t want to out-source deciding which accounts I should be allowed to follow.
https://fosstodon.org/about and https://hachyderm.io/about/more both have long lists of suspended servers: “No data from these servers will be processed, stored or exchanged, making any interaction or communication with users from these servers impossible”.
I prefer the federation policy of https://qoto.org/about/more, which doesn’t suspend any servers. There’s a few others like that.
The unfortunate reality of being on an instance like qoto.org is other, “heavily moderated” instances will suspend/silence you because of the lax moderation policy.
The qoto.org admin notes:
https://qoto.org/@freemo/109319817943835261
Anecdotally, every other server I’ve seriously looked at joining has had QOTO completely blocked/suspended/filtered. There are some things about it I found attractive but it seems like I’d be cut off from a lot of the community I’m looking to find on the fediverse based on where my twitter follows/followers have migrated.Alright, should have double checked before posting. It looks like this is correcting, as at least Hachyderm and infosec.exchange do allow it now. (Still appears blocked at Hachyderm but the issue removing it is closed)
It seems to have a lax federation policy, not a lax moderation policy. It doesn’t block other instances, but it moderates its members’ behavior.
I can understand your line of thought, but often times there are good reasons to defederate certain instances. For example pawoo.net (japanese instance) allows content which is illegal in other countries. And since mastodon caches content of remote servers, this makes defederation or at least restrictions almost a must.
Yes, qoto.org’s policy is:
qoto.org doesn’t currently block any servers, but is willing to if needed for the above technical/legal reasons.
Other instances blocklists go beyond these technical/DDoS reasons. The advantage of a federated protocol is being able to pick.
I was on mastodon.technology, but the whole time I just wanted my own instance. Now when it shut down, I finaly have one. Then I can deal with my own policies.
Wow, I didn’t know Mastodon instances are censoring each other already.
I just tried to send a message from qoto.org to hachyderm.io and it did not arrive.
No error message on the sending side.
Then I sent a message from indiehackers.social to hachyderm.io and it arrived immediately.
hachyderm.io has recently removed qoto.org from its blocklist: https://github.com/hachyderm/hack/issues/8
But the direct message never arrived.
Why is it still listed on their
/about/morepage?Possibly a mistake and/or the lifted ban hasn’t taken effect yet.
Instances have blocked/silenced other instances for a long time. It’s a core part how the Fediverse views federation.
One of the core ideas of Mastodon is that instances control who they federate with.
So you are free to create an account on any instance you like and post anything that stays within the instance’s rules. You just aren’t guaranteed an audience – other people may block you, or other instances my choose not to federate with the instance you’re posting on. This is freedom of speech in its purest form: you can say what you like, and other people can ignore you if they like. Or if they dislike their instance’s policies, they can move to another one or set up their own. But you can never, ever, a million billion times never, force another instance to federate with you or show your posts, or force another user to listen to you.
Is this an in spec use of Summary/Details tags? Like, as opposed to using it for menus and modals? Maybe yes if information, no if navigation?
After poking around on …
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/details,
https://w3c.github.io/aria/#group
https://www.w3.org/TR/2011/WD-html5-author-20110809/the-details-element.html
… I tend to think it is.
The way I read those pages is that the details element is simply a group of stuff with a summary and the behavior that everything except the summary will only be displayed if the user wants to see it.
I have flagged all of them as off-topic. As for why they have not been removed I can’t say since I am not a moderator. I have my say with the flags.
To answer your question, I think many submissions about social media are off-topic, but they must be judged on a case by case basis.
I wrote the “Three things to like about the Fediverse”.
Some say it is low quality because it only contains three bullet points. But it took me quite a while to distill the essence of what is good about the Fediverse down to what I consider the three main points.
The reason I posted it here is that all three are benefits for developers.
Owning your identity like you own your domain is something easy for developers. Not so easy for regular users. Although that will probably change over time.
Fully customizing your experience can only be done by developers. As it means you have to customize the code of your instance.
Building cool stuff on top of it is also something that can only be done by developers. As it means to build new software.
The three “main points” are devoid of any meaningful content, personally:
Hope this gives some perspective on why people, or at least I, would have downvoted your submission or considered it off-topic (lacking technical content). It’s nothing personal, I’m sure your tweets are great and you have technical information, technical knowledge etc. you could share in the future.
There is a lot to unpack here. Let me start with the first point:
You are always at the mercy of some infrastructure providers. That is why in my Tweet, I wrote “You can own your identity to the same degree you can own a domain”.
IANA, ICANN, your registrar, browser vendors, operating system vendors .. they all have the power to interfere with how available a specific domain is. But these infrastructure providers are generally orders of magnitude more trustworthy than social networks. How often did you hear that one of these infrastructure providers interfered with a single domain? I can remember almost no such events. On social networks on the other hand, interference with visibility is the norm. Even outright deplatforming is pretty common.
So owning your identity to the same degree you own a domain is a big step forward.
When decentralized domain name systems like .eth become supported, you can own a domain to an even higher degree. By being the only one who knows the secret key that holds the power over your domain. That would cut IANA, ICANN and your registrar out of the loop.
It happened to a website which shall not be named just the other day (recency bias? I’d have to look for other examples.) Your identity is now also subject to potential hijacking or squatting. Not having a process you can turn to and recover your stolen identity is a huge step backwards.
Side note: I think it’s a good thing that social networks interfere with visibility of certain content, and federated social media does so in very broad strokes (example). De-platforming and censorship are social debates, and debates not solved or avoided through federation.
Can you elaborate on what you mean by potential hijacking or squatting?
When I ask whether they should be removed, that is more so a metaphorical question (to everyone but the admin) as to whether the community would appreciate those topics being submitted. I especially wanted to hear from people who had been around for a while, because there was a significant amount of disagreement between users upvoting and flagging the articles. A better question to ask would have been: Should I, and other newcomers like myself, be submitting stories related to social media?
Your answer, as I understand it, is: No, unless there is heavy technical content within. For example, an article describing the logistics behind running a social media database would be okay.
If you have a moment, I’d also like to ask about the nuances of your answer. I’ve also run across a few similar, older posts with no flags:
Do you think these posts are on topic? If so, what makes them different from the posts in my original post?
The first is more a community information exchange than anything else, so I’m okay with it. It’s analogous to a bunch of us meeting up and informally exchanging business cards,
The second is off-topic to me. I’d flag it, but it was submitted two years ago so there’s no point. I don’t think this is the place to be discussing the distribution of Mastodon and what it means for online communities.
Posted on twitter though
And Twitter warns that the replies may contain offensive content.
Content: “ActivityPub is pretty cool.”
Yes, I just looked into ActivityPub today.
And to “own your identity to the same degree you own a domain”, you need to set up your own instance.
So I will have to look into what software is availabe.
That was the reason I held off initially. I eventually realised that the strong norm of allowing users to migrate between instances (eg mastodon admins would need to patch the code to stop it) was good enough for me.
You can also point a domain or subdomain at a fediverse hosting service like masto.host or togethr.party
Yes, but I would want to be @me@mydomain.com without having to point the whole domain to a different server.
I will look for (or cook up) a solution that lets me use mydomain.com like before while also functioning as an ActivityPub node.
They’re not generally cheap for one user, because they reserve resources for an entire (heavyweight) rails app. I’ve tried to get interest up in multitenancy support in mastodon, but it’s not gone anywhere yet.
Plemora looks much cheaper to host thankfully.
For sure, the Mastodon ones lean more expensive than hosting services based on something better
Hey long time fedi user here and what is really cool is that some techys are actually integrating their own personal blogs into the fediverse. I have no idea what sort of challenge this poses but for example the person who invited me to lobsters has her own blog on the fediverse and interacts with us through that.
You can use webfinger and/or Mastodon “link verification” to connect your domain to your account, even if you use an account on an instance under a different domain.
No need to play the
location.href.replacedance, you can simply doAwesome! I updated the repo.
if the github project is meant to ensure free distribution, I’m pretty sure something this small is not subject to copyright anyway. you could just share the bookmarklet itself instead of a link to a github project:
javascript:h=[‘nitter.it’,‘nitter.snopyta.org’,‘nitter.net’]; location.href=location.href.replace(window.location.host,h[Math.floor(Math.random()*h.length)]);
The GitHub repo has a few benefits.
It will be updated and annotated forever. Since I made this post, I already incorporated multiple improvements people suggested. And it makes collaboration easy. Everyone can add issues and pull requests, make forks or follow the repo.
After reading this I thought that it would be better if it were an extension that did this without having to click a button and for websites other than twitter. I decided to search and found https://addons.mozilla.org/en-US/firefox/addon/redirector/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search
I prefer bookmarklets for a few reasons:
CompatibilityBookmarklets work on all devices. Deskop, iOS and Android.
SecurityI can easily read and understand the code.
FlexibilityThey are easy to change. For example in this one, I will probably update the array of nitter instances regularly.
UsabilityI can organize them just like my other bookmarks.
SharingSharing a bookmark is as easy as copy/pasting a line of text
For what it’s worth, I really like bookmarklets for the security reasons alone. I know they they aren’t running any code until I click on them (unlike extensions). It’s much easier to check that nothing nefarious is going on behind the scenes. Even the simplest extensions have multiple files of boilerplate code, and they can be updated remotely. I hate to think what would happen if the developer’s account got compromised for any of the popular extensions.
Unfortunately, it seems like Chrome on Android doesn’t support bookmarklets – or at least fails on ones imported from my desktop.
Extensions are updated remotely without user interaction? That is another scary aspect.
For me, the bookmarklet works fine on Chrome on Android. I have to use it from the address bar though. I named it “t2n” and when I am on a Twitter page, I type “t2n” into my address bar. Now from the list of suggestions I click on the bookmarklet and it works.
Bookmarklets can’t get sold to a hostile data-collecting advertising company while you weren’t paying attention.
Yeah these are good points. Have you also see Fraidycat which has slightly different aims?
This looks awesome! I’ve been looking for something similar for a while. Thank you for sharing :)
that’s fair but i personally find extensions more convenient 🤷
Problem with using a redirect extension is:
redirection via an extension sometimes just doesn’t work? not all that surprising I guess.
an extension could pick a random instance just like the bookmarklet though
I’d did not know bookmarklets worked on iOS. That’s pretty rad!
This is the extension I use https://libredirect.github.io/
Privacy Redirect is similar. Found some alternatives I didn’t know about in there.
And a visualization of the announcement by a neural network:
https://twitter.com/illubots/status/1572620909885669378
I’m building an illustration agency for robot brains. I call it “illubots”.
Like a normal illustration agency, but all images are done by artificial intelligence. And each “robot” has its own style.
I have 3 robots up now. We are on Instagram and Twitter:
https://www.instagram.com/illubots/
https://twitter.com/illubots/