Show newer

putting my plushies in placement groups across washing cycles so my load balancer (bed) always has a solid comfort uptime

If you take the "c" and "x" off the ends of "cardboard box", you're left with a perfectly repeating ardbo-ardbo

tl;dr 

basically, "secure mode" isn't, which i already knew, but it's becoming even less useful

#MastoAdmin

Show thread

frustration, #MastoAdmin, AUTHORIZED_FETCH, DISALLOW_UNAUTHENTICATED… 

github.com/mastodon/mastodon/p (part of the Mastodon 4.0 release) breaks AUTHORIZED_FETCH aka "secure mode" intentionally, by allowing the instance's REST API to be used even if you're not authenticated. Eugen did this because even the logged-out views of, for example, individual posts, are backed by the REST API in 4.0.

(presumably AUTHORIZED_FETCH still works for the ActivityPub API or it'd be entirely pointless?)

unfortunately the new behavior allows way more than just loading individual posts. for example, unauthenticated users can now call the search API. it doesn't seem to allow full-text search, but i cannot work out why (it doesn't throw an explicit error and i haven't yet found relevant access control code).

it definitely allows searching for local and remote users, searching for hashtags, viewing hashtag timelines if you know the hashtag, not sure what else might be useful to scrapers and federation mappers.

there's now a completely undocumented (outside of this PR) environment variable called DISALLOW_UNAUTHENTICATED_API_ACCESS that restores the behavior of AUTHORIZED_FETCH to what it was supposed to do… at the cost of breaking public/unlisted posts and user profiles. given how Mastodon doesn't fetch context for threads very well, sometimes the only way to load a whole conversation is for users to try to open a post on the original instance, so this is not great.

i want to write an article on how much Mastodon leaks but really i should red team this shit so i have specific scenarios to walk through. go write that spambot i was joking about. resume work on that scraper. or i could go touch grass.

#MastoAdmin

obviously the best part of being an "adult" is that you can buy all the plushies you want

obviously the best part of being an "adult" is that you can buy all the plushies you want

:RSS: Never forget Google Reader
:BlobCatKnife: Never forgive Google, reader

also with me, you get my love of caching everything in sight. that status? cached. your account? cached. your nan’s cat? cached.

Show thread

If you've called yourself a "refugee" because you clicked a few buttons to move from one social network online to an other, not only is that extremely poor taste, you should donate to Refugee Action and sign up to their newsletter:
refugee-action.org.uk/

euro truck simulator 

following the age-old adage “No cop No Stop”

holy shit EMFcamp just donated 150 euros to the [GoToSocial opencollective](opencollective.com/gotosocial)

friends, queer.party has been updated to fix those awful new captive links - right clicking the timestamp of a toot will once again give you the toot’s canonical URL instead of a URL that keeps you on queer.party.

the patch in question is located here if you’re an instance admin familiar with applying patches to mastodon and you also don’t like the twitter-fication of mastodon.
commit.pup.cloud/maff/queer.pa

really unexpectedly liking euro truck simulator a lot. it's still an active thing to do, but uses a completely different part of my braincell

re: euro truck simulator 

yay only 43k in debt now

Show thread
Show older
Pixietown

Small server part of the pixie.town infrastructure. Registration is closed.