# I am the Watcher. I am your guide through this vast new twtiverse.
# 
# Usage:
#     https://watcher.sour.is/api/plain/users              View list of users and latest twt date.
#     https://watcher.sour.is/api/plain/twt                View all twts.
#     https://watcher.sour.is/api/plain/mentions?uri=:uri  View all mentions for uri.
#     https://watcher.sour.is/api/plain/conv/:hash         View all twts for a conversation subject.
# 
# Options:
#     uri     Filter to show a specific users twts.
#     offset  Start index for quey.
#     limit   Count of items to return (going back in time).
# 
# twt range = 1 18
# self = https://watcher.sour.is/conv/bqq6fxq
You broke formatting on your last twt, @thecanine. It seems using <div> without a </div> is no good. I am not sure how to avoid it, other than disallowing that HTML element.
@david @prologic That's strange. I was only testing it in the app and it worked perfectly fine there. HTML probably shouldn't be on by default anyway, as besides these accidents, I can see people trying to abuse it to break the site or experiment with some malicious code in there. 🤔
@thecanine yes, we need to fix this. We need to further limit the rendered HTML that is allowed on twts, or make them a pod management setting, so that pod administrators can define them.
@prologic, this is the raw entry on the feed, on that twt:


2022-02-25T17:12:08Z\tAll my Flist sites:
https://flist.glitch.me 
https://canines.42web.io 
https://www.nuegia.net/~canine/
now have a Ukraine flag ribbon on the top left corner, that I made using <div>s and CSS, to show at least some kind of support.

I know it doesn't help Ukraine in any way, but I still wanted to make it, so it's out there, for anyone wanting to put it on their sites or anywhere else. 🥴
Where on the code are the allowed HTML elements on a twt, @prologic? I know, for example, that <iframe> isn't allowed, so there must be a small subset being allowed (namely <span>). I have been thinking about this ever since I saw a huge <h1> recently.
Adding @xuu to this yarn, as he was interacting with me on this topic on IRC. What I am looking for doesn't seem to be within utils.go but I might be mistaken.
It's handled by blue Monday
It's handled by blue Monday
@prologic could you eli5? No control in code for it? How is <iframe> being stripped now?
I just woke up and about to head down for breakfast 😂 Lemme take a quick look 🤔
I just woke up and about to head down for breakfast 😂 Lemme take a quick look 🤔
We currently use the UGC Policy here... I'm not sure we should... Hmmm 🤔 Perhaps we should adopt a stricter policy?
We currently use the UGC Policy here... I'm not sure we should... Hmmm 🤔 Perhaps we should adopt a stricter policy?
Perhaps @ullarah can have a play with this today and try to define some polices on a StrictPolicy() (_effectively an empty one_) with all the right .Allow(...).On(...) calls for the bits we need to permit? 🤔
Perhaps @ullarah can have a play with this today and try to define some polices on a StrictPolicy() (_effectively an empty one_) with all the right .Allow(...).On(...) calls for the bits we need to permit? 🤔
@prologic that’s the thing. The idea—I mean, the way I see it, but would love to see a debate about it—is to allow only what’s available on Markdown. So, the subset of HTML elements to allow is pretty short.
@david yeah I think in this case I think we need to rethink the policy and be rather strict rather than lax
@david yeah I think in this case I think we need to rethink the policy and be rather strict rather than lax