Lady @Lady@cat.family

@mariusor @noracodes there is a lot more handshaking which needs to happen with pulls also because replay attacks are much more dangerous. if someone replays a push then the server just gets notified of a status twice. but if someone replays a GET then they could have access to all the content that other user saw.

@mariusor @noracodes HTTP signatures do allow for signed pulls, but there is no standardized mechanism for specifying which user is making the pull (which isn't a problem for pushes; it’s in the payload). without knowing which user is making the request, it's impossible to know how to respond correctly (and obviously you don't want user A to be able to sign a request by user B).

mastodon could probably hack a de-facto solution to get around this (maybe it already does; it's been a while since i looked at the HTTP signatures code) but it wouldn't be standardized; the bigger issue though is definitely the fact that there is no real motivation to do so. it's one thing to go through all the posts a user has made and filter them by “does X have access?” but an outbox should properly also include favourites and other kinds of actions the user has made, which sounds expensive to me :P .

footnote: HTTP signatures is not a GREAT auth mechanism regardless, on account of the fact it is currently undergoing IETF standardization and the current HTTPbis draft is very different from the one mastodon implements. that's not really an argument for or against them for this use-case, but it is annoying.

✨Gen II✨

the glitch was really obvious because the lower half of the screen was replaced with repeating question marks but amazingly after exiting the game, transferring the mon, and reopening the game itself seems to have recovered fine

this is mildly disappointing but also: lol

Pokémon Crystal glitched while saving my mons and now two of them won’t transfer to Bank, four transferred but with no name, another four transferred with part or all of the name of a different pokémon, and one transferred but its name is just one or more spaces

it’s almost november and most of the leaves are still green

YES this means nothing i make with this library will be usable in the phones of people who refuse to update their iOS for years, but thankfully custom elements can be designed with graceful fallback mechanisms

the work i’m currently doing absolutely depends on static class initialization blocks, which are implemented in WebKit main but haven’t yet made it to a Safari release, and i’m very impatient about it

in a couple decades do you think there will be people trying to reappropriate minions memes the way today we have people trying to reappropriate garfield

@noracodes the most important thing to understand regarding push/pull on the fediverse is that we don't have GREAT auth mechanisms across servers, which makes it hard to ensure that the people pulling are actually the people who should have access to the posts. this basically means pull-only solutions would only work with public content and not anything with a limited audience.

ignoring theory and just focusing on what is practically featured in mastodon today, pull isn't implemented at all, you have to do push

edits should produce pushes of an edit activity though; remember activitypub federares activities, not posts, and an activity can be whatever you want it to be

do i have it in me to make this code work today

i mean… the opposite of “individualist” is “communist”… you know?

#Ao3TagOfTheDay: Unfinished, and no i'm not finishing it

i'm not complaining about foxes but i also don't understand