Show newer

Imagine, an online space that's for chill hangouts with your buds

Hypercapitalists: BUT DOES IT SCALE

Show thread

Mastodon 4.x tip: disabling 'trends' at least gets rid of the public /explore page your instance shows to all unauthenticated users

at least it gives me plenty of time budget to do my own replacement, i guess. can't get much slower l m a o

Show thread

mastodon 4.x really is just misskey huh, loading times and all

if pixie.town goes down today it'll be because of a local power outage, there's a big fire in the substation 😬 👁️

putting my plushies in placement groups across washing cycles so my load balancer (bed) always has a solid comfort uptime

If you take the "c" and "x" off the ends of "cardboard box", you're left with a perfectly repeating ardbo-ardbo

tl;dr 

basically, "secure mode" isn't, which i already knew, but it's becoming even less useful

#MastoAdmin

Show thread

frustration, #MastoAdmin, AUTHORIZED_FETCH, DISALLOW_UNAUTHENTICATED… 

github.com/mastodon/mastodon/p (part of the Mastodon 4.0 release) breaks AUTHORIZED_FETCH aka "secure mode" intentionally, by allowing the instance's REST API to be used even if you're not authenticated. Eugen did this because even the logged-out views of, for example, individual posts, are backed by the REST API in 4.0.

(presumably AUTHORIZED_FETCH still works for the ActivityPub API or it'd be entirely pointless?)

unfortunately the new behavior allows way more than just loading individual posts. for example, unauthenticated users can now call the search API. it doesn't seem to allow full-text search, but i cannot work out why (it doesn't throw an explicit error and i haven't yet found relevant access control code).

it definitely allows searching for local and remote users, searching for hashtags, viewing hashtag timelines if you know the hashtag, not sure what else might be useful to scrapers and federation mappers.

there's now a completely undocumented (outside of this PR) environment variable called DISALLOW_UNAUTHENTICATED_API_ACCESS that restores the behavior of AUTHORIZED_FETCH to what it was supposed to do… at the cost of breaking public/unlisted posts and user profiles. given how Mastodon doesn't fetch context for threads very well, sometimes the only way to load a whole conversation is for users to try to open a post on the original instance, so this is not great.

i want to write an article on how much Mastodon leaks but really i should red team this shit so i have specific scenarios to walk through. go write that spambot i was joking about. resume work on that scraper. or i could go touch grass.

#MastoAdmin

obviously the best part of being an "adult" is that you can buy all the plushies you want

obviously the best part of being an "adult" is that you can buy all the plushies you want

:RSS: Never forget Google Reader
:BlobCatKnife: Never forgive Google, reader

also with me, you get my love of caching everything in sight. that status? cached. your account? cached. your nan’s cat? cached.

Show thread

If you've called yourself a "refugee" because you clicked a few buttons to move from one social network online to an other, not only is that extremely poor taste, you should donate to Refugee Action and sign up to their newsletter:
refugee-action.org.uk/

Show older
Pixietown

Small server part of the pixie.town infrastructure. Registration is closed.