# I am the Watcher. I am your guide through this vast new twtiverse.
#
# Usage:
# https://watcher.sour.is/api/plain/users View list of users and latest twt date.
# https://watcher.sour.is/api/plain/twt View all twts.
# https://watcher.sour.is/api/plain/mentions?uri=:uri View all mentions for uri.
# https://watcher.sour.is/api/plain/conv/:hash View all twts for a conversation subject.
#
# Options:
# uri Filter to show a specific users twts.
# offset Start index for quey.
# limit Count of items to return (going back in time).
#
# twt range = 1 6523
# self = https://watcher.sour.is?uri=https://lyse.isobeef.org/twtxt.txt&offset=2134
# next = https://watcher.sour.is?uri=https://lyse.isobeef.org/twtxt.txt&offset=2234
# prev = https://watcher.sour.is?uri=https://lyse.isobeef.org/twtxt.txt&offset=2034
@darch I just sent you a merge request that fixes the typos I spotted.
Now to one very severe security flaw, the filesystem traversal attack. You must never ever trust user input. Never. Ever. Not in a hundred years. Or the devil himself will kidnap your kids, your wive and yourself to steal their souls, rape and then painfully kill all of them.
Back to the user input. This also goes for the filename of the submitted file upload. You either have to sanitize it or even better, just generate a new one, you know is safe. Currently you just use the user's filename, replace spaces with hyphens, convert it to lowercase and prepend the date. So basically, doing nothing in terms of sanitizing. But if the filename contains slashes, you're basically fucked. Imagine a user-supplied filename of ../../../../../etc/passwd or something similar. It will then override system data or any of your scripts or whatever, if the user running the PHP script has sufficient permissions. Which it often has to at least override your own PHP scripts. So you should at least extract the submitted filename's basename at the very bare minimum. That would result in passwd on the example above. Maybe there are even more PHP-specific things to keep in mind, I don't know.
Okay, granted you check for the existence of the final file and abort, but it still would be possible to sneak files into places, where they truely do not belong. Like optional configuration files an application would read if present but ignore if missing.
Also checking the file extension to determine whether a file is of a certain type doesn't really work. You can just lie about the extension.
I'm heading to bed now. Happy fixing my friend! :-)
@fastidious I finally had to fast forward. That, erm, techno pop – or I have no idea what you call it – was too much for me. Couldn't handle it. ;-)
@darch Hehe! ;-) It's always refreshing to look at a raw feed. Yarnd in the default theme shows the alternative text in the preview a bit (cuts it off if it's too long) and also when you click on the image to open it in the dialog. That *might* be something to incorporate in your Copenhagen theme.
@darch Yiha! I just explored the code online a little bit. The very first thing that came to mind is that you probably want to maintain a *.gitignore* in your repo and at least add this silly .DS_Store to it, it's of no use. Since git only tracks files and not directories some of the folders would be empty. So they do not exist after cloning the repository. There are two commonly used approaches:
1.) The software just creates the directories, if they're not present. In my opinion that's the best solution in 99% of the time.
2.) Add and commit an empty file, often named *.gitkeep* or something similar.
Also temporary editor files are very good candidates to exclude from git. They of course depend on your favorite editor, I always add *.sw? for Vim swap files and also *~ for good measure. Some editors I used in the past just append a tilde to their temp files, so it's an old habit. Of course, there are plenty of different suffixes, extensions and what not. I tell people to just start out with those the original author uses.
Other than some typos in the README and comments I haven't tried this out. A few years back I made the resolution to never execute PHP code again if I can help it. 8-)
@david This will make history, no doubt about that!
@darch Ooops, that wasn't well thought out on my end. I meant 2022-01-23_logo_03.png 
not sure what I like about it, well, it's taste that works in uncharted ways…
@fastidious Up until the last few songs, that was a really nice collection I have to say.
@fastidious @ionores @jlj Thank you guys! It's a pond or small catchment. This concrete thing in the middle is an escape where the water can flow out and form a little creek. The whole field was full of ravens, like about 100 I reckon, and in the middle strutted a gray heron. But that photo turned out too dark to use. The colors today just made it looking like autumn, also with all the leaves still on the ground. Although we're in the middle of winter of course.
@xuu Oh, alrighty then! That also explains the purpose of the share Unicode art.
Well, @prologic, this statue reminds movq of his old German teacher back in school, who forced him to read shitty books. Of course he didn't want to, because, well, they were shitty, so he also didn't do his homework. Instead, he played computer games and disassembled walkmen and portable radios to learn about electronics, which he was much more into. Then, in the next lession the following day the German teacher always gave him lines when he couldn't show his homework. Since she was also his arts teacher, her favorite and infamous thing was to make her disgraced pupils trace and color portraits of her. One such day movq decided, to let his computer do the extra exercise for him, so he wrote a crude program in BASIC to copy the template photo on his needle printer. To debug the code, he obviously had to look carefully at the photo and study all the details. The rest is history, that's why he always cringes when he sees his old German and arts teacher sitting on this bench at my mountain. You can't blame him for that.
@prologic Thanks. Of course not, absolutely go for it! :-) You're all always welcome to do with them what ever you want to.
@prologic I cannot answer this. I never used them myself.
@sorenpeter I stick to it, number three is still my favorite of all of them. ;-)
@prologic Nah, no worries, mate! Ideed, the discussion was highly productive. We don't have a solution, but I learned a ton of yarnd's internals. So success in my books. :-)
@ullarah Just remove the stickers and reglue them.
@fastidious I just started playing it in the background. Will report back in two hours.
@fastidious Yeah, very nice and well-known wave. I've seen it plenty of times, but I never knew what it was called. Until now.
@fastidious Haha, your suspicion was spot on! ;-) Am I your photo drug dealer now?
We made use of the beautiful sunshine before it will get dull again the next days. After calling it a day at 15:00 my mate and I headed about two and a half hours in the bush. 
Sun shining through the trees, hitting a pond The boiling sun made the 4°C feel quite alright. No wind in the forest, so quite bearable conditions. Four more photos from that trip.
@fastidious Hurray, finally! :-D Yes, that photo also shows the steepness of the mountain quite well. My irony in the hot 5°C was lost in transit. ;-)
@movq Happens to us with Google every now and then, too. But usually after a couple of days doing nothing we're unbanned.
Oh dear, that's a fair point actually. Haven't thought of a cloud connection, but wouldn't be odd at all. This thought is even creepier than that woman statue. Doctor @movq, let me hand you some dissecting instruments.
@fastidious Haha, gracias! I was heavily thinking about which to select as the teaser and wondering whether this time we agreed on one. But I still have to practise. :-) Next time I will bring my towel, one should always carry one anyways, right? @movq I'll measure her eyes as well and then craft a fitting sticker to soften her expression. But I heard you like watching horror movies, don't you?
@movq Thanks. Well, a showing sun was long overdue here. The last three weeks it was just a dark soup.
@prologic If the yarnd you're on doesn't have pulled feed X, you're probably not going to reply and thus to mention that feed X, are you? Unless you've come across feed X somewhere else, I give you that. "Why can't others do this and that what I want them to" is not a helpful argument in my opinion. It just makes people turn away at best. As I pointed out different people on a shared server may just want to use completely different URL schemes. And that's absolutely fine. Just think of feeds for different purposes by one and the same author. So the proposal we're having is not going to work (didn't check my mails yet, so maybe sb. came up with an alternative already).
@fastidious I usually just look at the raw feed before deciding whether I subscribe to a feed or not. Regarding metadata I fully support the simplicity argumentation. description seems to be enough for me (now on a side note tt doesn't even care about metadata at the moment at all, 'cause the twtxt client downloads and processes the feeds, tt is still just a viewer, but it will change).
@stigatle Damn, get well and fingers crossed!
@movq I very much hope that you're right. I'm still using some KDE appliations in my everday use. KMail, Dolphin, Gwenview, Kdenlive (well, not every day), to name the most prominent ones I can think of at the top of my head. Especially migrating off KMail will be hard for me I imagine. But if I have to, I'll try mutt.
@fastidious Haha, I know. I even fully agree! :-D Good news, yesterday I started reading on asyncio to get rid of the original twtxt reference implementation all together. But this endeavor will take some time.
@thecanine Nice idea! The only real issue I have is that the pixel is not placed at the pointer of my mouse but a bit below which makes me misplacing pixels constantly. It drives me nuts, you can imagine! ;-)
@movq Did you restart your bass? :-P
Today I called it a day earlier and enjoyed the 5°C hot sunshine. You will probably notice by now with ease, I went up my backyard mountain again and enjoyed the sunset. The scenery was dimmed by three women who loadly yelled all the time, quite annoying. I had to take the sneaky backpath detour, because the tree service had closed off the main one due to felling activities of dead and sick ashes. Some sections were one thick sheet of slippery ice. But I made it safely. 
Sunset behind some trees The flag disintegrates even further. The more it is ripped apart, the higher the windage is, resulting in a nice death spiral. But this silly, flapping fabric doesn't affect the moods over here as you can see by the two snowmen somebody had built. https://lyse.isobeef.org/waldspaziergang-2022-01-24/
@prologic That forces everybody on envs.net to place their feed at that location. So if Hans decides to rather put his feed at envs.net/~hans/bla/tw.txt, this would not work. My best guess for yarnd it probably this: try to solve this all locally without any remote communication. If the expansion on the follower list does not result in any match, try again with all the feeds known to this yarnd instance. Can't see why this won't work at the moment.
@fastidious Hahaha, I clearly didn't know that term. :-D Thank you for the explanation!
If you really care about it, you should probably put it in the `description`, @<~duriny https://envs.net/~duriny/twtxt.txt>, as it probably won't get picked up by yarnd otherwise, I reckon. I'm not sure whether other clients use the pronouns field, though. And one thing to be aware of is that not all clients support these metadata fields or even metadata fields at all.
@movq Correct. You put it much simpler than I did. ;-)
@movq Ah, I see. Makes sense. Oh my god, that's really cool, I didn't know about ^S and ^Q! I'm sure that will come in handy next time. :-) Thanks, mate! \o/
@movq Ah, I see. Makes sense. Oh my god, that's really cool, I didn't know about ^S and ^Q! I'm sure that will come in handy next time. :-) Thanks, mate! \\o/
@off_grid_living That's a nice king and prisoner story. Yep, for a cat that opening should be plenty big enough. For the breeze to enter anyways.
@fastidious Hm, how would you tell yarnd to HEAD https://envs.net/~duriny/ rather than HEAD https://envs.net/ to look for the HTTP Link header or <link> tag in the body?
@movq That is still on my bucket list. But with that great experience of yours I may end up tackling it even sooner.
@movq Wow, that's a brilliant response time! I'm using a tiling window manager, too, but I'm rarely ^Z-ing. Never grew the habit of doing that. Just two things come to mind: if the console output scrolls too quickly or when the disk space approaches its limit while downloading YouTube videos. Other than that, no need for me to stop a program, I just open a new terminal. What's your use case of stopping programs?
@kayos Exactly, don't waste time on the internet if you're doing real-world stuff. :-) You don't know that you missed important internet stuff, because, well, you missed it. And because you missed it, it's suddenly not important anymore. And if it were truely important, you'd probably notice it later on anyways.
@movq Just a yarnd UI improvement thing as far as I understand it. But, of course can also be implemented in other clients. Although its usefulness is probably very limited. Since traditional twtxt clients can just look at the user's subscriptions to expand the mention to proper twtxt syntax. In yarnd with the discover view you also see twts from feeds you're not subscribed to, so in case you want to reply to them, this "look at the subscriptions to expand the mention" is not an option. Especially if there are multiple feeds with the same nicks.
Hahahaha, @eaplmx! :-D Now I had to go over to twtxt.net to see what kind of emoji that is. I guessed either thumbs up or thumbs down.
To make things clear: I don't have a problem with those kind of replies (especially not if I'm getting trolled). Just wanted to point out why a written reply is usually nicer. However, in that case @eaplmx found an exception or even loophole. ;-)
@eaplmx Bwaahhahahahaaaaa! This is bloody brilliant! I actually can't stop laughing. Very nice job, you definitely made my day! :'-D
@fastidious Sorry my friend, I just couldn't resist. This was just a beautiful forward pass I was not able to miss (not sure whether that saying translates well). My sincere apologies. I'm also very delighted, that you used a good old ASCII smiley. 😘 (Funnily my font supports that emoji, but it's too small to actually identify it. I can just make out a head.) 
kiss
@sorenpeter If it says "pixel", it should make use of a pixel font. To me that would be consistent. Well, at least you chose a monospace font. ;-)
You should get yourself a crystal ball, @fastidious, and work independently! Your prediction is spot on. The game already died for me. I spent a few hours playing. At first just thinking very hard in my head. Then I started cheating by grepping in a dictionary. And then it was over after I went to bed.
@fastidious Nice science experiment, that's for sure. And a tasty one, too.
@prologic So if one just hits a thumbs-up/down/whatever button, there's just the information that the original content pleases/is crap/whatever. Now on a sidenote, interpreting the meaning of the button is not really clear in every case either. Imagine someone telling about a bad thing that had happend to them. What does liking that story mean here? "Oh no, I feel sorry for you", "I experienced the same", "I'm angry about the causes", "I hope this bad luck continues on with you, sucker, you haven't deserved any better" etc. With all the myriad of available smiley reaction thingiess that is a bit clearer, but still can provide tons of leeway for interpretation. Writing a proper reply on the other hand is usually much clearer. Of course, it can be misinterpreted, absolutely. I give you that. Irony and sarcasm can sometimes be hard to get.
Now back to track. When somebody replies with a real, halfway meaningful sentence, the topic can be broadened. Views on certain things be qualified. The subject can change. The discussion can take a turn or even be converted to something completely different. Often it's just a much more valuable and useful conversation. Yes, it's not guaranteed to work out that way. But chances are higher, that it might be. I'm convinced, that's not gonna happen with just "+1", "-1", "lol", "wtf" etc.
Yarnd provides the discovery view where you see twts from all the feeds in the cache, not just the feeds you follow. That way it is a bit more tricky to avoid potential bot spam. You would either have to not visit that view or mute the bots indiviually. Don't get me wrong, I like the discovery view myself a lot. Please keep it. But there's no such equivalent feature in traditional twtxt clients where you just see what you've subscribed to. Well, maybe registries as I just learned the other day. But I don't know of any client that incorporates them.
@sorenpeter This XSS attempt looks very similar to @movq's screenshot in tt: 
HTML "rendered" in `tt` ;-)
@prologic Maybe just "twtxt" as the link relation. No need for a "-uri" suffix in my opinion. But I have to admit, I'm not sure, whether others have such a suffix. To me it sounds redundant since it's a Link header or <link> tag in the HTML.
Thank you, @prologic, usually I hike with rather light gear, though. ;-) @kayos To me it appears, if you get *real* feedback, not just a simple reaction, it's much more valuable. To state the obvious, it feels more personal and thus more connecting. Of course it requires much more time from the commenter, but that's also makes it even better for the one receiving it. And this makes it possible to spark other ideas, discussions, etc. As for bots, I'm 100% with @darch. You just don't follow them. Granted, it *might* be more difficult on yarnd than on traditional clients.
@movq Very interesting ideas! I think this needs to boil a little bit in our heads, before we can come to a conclusion.
@prologic Hmmm, ok. I think you have to elaborate a bit more on that. I'm not sure what the display name will help with. I fear it will cause confusion with the nick and mentions suddenly not working "anymore" as expected by (new) people.
@fastidious Oh no, this plan is severely flawed! You're absolutely right.
@fastidious Hahaha, this is neat! :-) Thanks. @movq Not sure, @xuu told me about it. Haven't heard it before. Other than the classic hangman, of course.
@fastidious How long did it finally take to get your pizza corona?
@prologic Yes, like @movq this is the first time I heard about this. Reading the excerpt, I couldn't care less. This topic doesn't interest me at all. ;-)
@prologic Cool, now even with grid power! Although it seems the inspector's approval is yet missing. Let's move in, anyways!
@off_grid_living Very nice! So what I didn't really get, this small door opening, is this just temporary? So will it be closed in and then be part of the pantry? Or are you going to leave it as a door? Maybe an escape hatch if the kitchen is on fire. :-P
I just measured the doors here, they're 815mm wide. 60cm is quite narrow, but it will work in a pinch. On the other hand, it keeps you motivated not to get too fat. It's a self-regulating system, once you've eaten too much, you can't reach the kitchen anymore until you slimed down. Quite clever. ;-)
@darch Hm? I don't understand this. Like not at all. :-/
@prologic So what's a display name then? The nickname being the username to log in and the newly added display name to be used as the twtxt nick? @thecanine Yeah, including spaces in the nick won't work for technical reasons. The real twtxt mention syntax (not the one yarnd provides as a simpler alternative) is @ < nick _ url > I'm writing it with spaces, to avoid it being interpreted as mention, but they wouldn't be there in real life. However, the underscore _ would be a literal whitespace, so ordinarily space or tab. The whitespace separates the nick from the feed URL. Also see @movq's comment about the problem with that in the User-Agent HTTP request header.
@prologic Thanks, that would be truely awesome! You're absolutely right, a shop is a necessity. I'd sacrifice the living room when the chips are down. Now if I could move the wood shop out of the basement up to ground floor, I'd love to do that. It's much nicer to work in natural light. It also helps with logistics, getting materials downstairs and completed projects back up again turns out to be tricky sometimes. Looking forward to what the builder comes up with! :-)
@movq Hui, that's weird. Nah, I'm still on 8.2.2434.
@movq @prologic No idea about Gopher nor Gemini nor the details of Webmentions, is the concept of Webmentions applicable to these two protocols, too?
@prologic @movq Well, my parser just accepts anything except a space and closing angle bracket in a mention's nick, so this sexy nickname would be completely fine: @<äöü:;,.-_?$§=")$(§@fhttps://example.com> It's pronounced "lol".
Not sure, if we really need to standardize anything. But if you truely want to, how about hyphens and underscores? They're pretty common, too. Just think about @off_grid_living. Actually, I don't follow anybody with a hyphen in their nick, but I'm sure, they're out there. @<~duriny https://envs.net/~duriny/twtxt.txt> uses a tidle, I'm fine with that, too. So probably include tildes as well. The twtxt reference implementation also converts nicks to lowercase. Is that a thing we will keep? Also, why is the slash a problem? Because it's a word boundary?
@prologic @movq Well, my parser just accepts anything except a space and closing angle bracket in a mention's nick, so this sexy nickname would be completely fine: @<äöü:;,.-_?$§=")$(§@fhttps://example.com> It's pronounced "lol".
Not sure, if we really need to standardize anything. But if you truely want to, how about hyphens and underscores? They're pretty common, too. Just think about @off_grid_living. Actually, I don't follow anybody with a hyphen in their nick, but I'm sure, they're out there. @<~duriny https://envs.net/~duriny/twtxt.txt> uses a tidle, I'm fine with that, too. So probably include tildes as well. The twtxt reference implementation also converts nicks to lowercase. Is that a thing we will keep? Also, why is the slash a problem? Because it's a word boundary?
@movq Oh dear, that's indeed very disappointing to include third-party libraries all over the place. My experience is exactly the same, if it works, it will never be touched again. Regardless of the language.
@xuu The wordle.at variant has Backspace and Enter reversed compared to wordlegame.org. Nearly missclicked a few times. And I somehow have to wait for the countdown to reach zero or clear the local storage. :-( Now I have to trade the share unicode block for the instant next game.
DANKE ("thanks"), @xuu, you got me hooked! This third game is dedicated to you. 
Won again!
Whuhuuu, second game worked out! 
Won!
My first attempt of guessing a German word was a close failure: 
Lost!
@fastidious @prologic Hahaha, yeah, that was a truely funny moment in summer 2015. Very lucky that my mate caught this on video. No injuries, it was just very hot. And the lesson memorable, no doubt about that. There are plenty things I can't do, like juggling five balls or more, plenty of three or four ball/club juggling tricks…
Correction: the 1080p version had been MPG2-encoded previously. It's now fixed at 32.1 MiB in size.
@fastidious Now I'm probably being counted, too. Darn it. I was too brave.
@fastidious I suspect – but of course I could also be entirely wrong – that the file extension will dictate whether to render an <img>, <audio> or <video> in yarnd's HTML. Maybe just only for remotely hosted resources in a markdown media link.
@fastidious Regarding licensing, that's exactly what I was thinging right away, too.
@movq Yes, I can't wait to pet this cute little thing! @fastidious I believe so, the cookie overloaded, privacy eroding¹ news site's article on the other hand just mentions "a US manufacturer". Of course they want to use it just for the very best of the good stuff! How dare you!
> […] Equipped with cameras and sensors the remote-controlled robot could explore sites of disaster or crime sites with possible violent crimials, the minister said. Microphonic accessory equipment e.g. allows for reaching victims burried alive and communicating with them. […] Possible uses ought to be examined, even now there are plenty of ideas to this, possibly also for the fire brigade. […]
That's perhaps just a photo for the civilians. According to the article the minister didn't want to settle on a number of robots to purchase yet. A year ago the police in New York also wanted to utilize such a robot, but after heavy critiques of militarizing the police they handed it back later on. Conveniently, the article also links to a report where a sniper rifle is mounted on such a robot. Very confidence-inspiring.
¹ as one would rightfully describe them
@thecanine Ah, interesting. My Windows and macOS workmates never had the issue with the logout. And yes, this 2FA crap also annoys the hell out of me. Doesn't really work every fifth time or so and then I have to enter the fallback nonce after wasting another minute. Best thing is when after the finally successful login the target application says, that now we're in an illegal state.
Haha, profile pictures is another thing, that's not supported on Linux. But actually that's quite good. I don't want to have my face there anyways. So even if it was implemented, I wouldn't use it.
Personalization works super great in Teams. I mean you can decide which of the tabs are visible!@1! Only to get the orange alert box in your face that after some random upgrade the system administrator had reset the tabs for you, you're welcome. Fuck you! Nowadays, I don't even bother hiding all the bloody shit anymore. I let it just keep growing. I resigned. If they want me to be unproductive with a crap UI, so be it.
Oh, one other thing I completely forgot in my previous rant. You can pin contacts, so they're always visible. The upper limit of pinnable chats is? What do you think? How many would you need? Yeah, 15 should be enough for these idiots out there! You're a bloody programmer, especially you geek don't want to talk to anybody anyways, do you!? What a stupid joke. Any kindergarden programmer would have gotten this right.
Another observation is that they mess up upgrades regularly. At least once a month the meeting calls won't work. You cannot join the meeting. You're always getting some kind of connection error "sorry, we couldn't connect you to the call". Obviously, the Retry button doesn't work either.
@prologic @movq Yup, and there's also money burned for shit like that: 
Robot Herbie for the police in NRW At least 60k€ plus licensing fees.
@oevl The crab on the foot?
@thecanine The Linux version also loved to kick one in the balls during ongoing calls by just logging one out. Fortunately, that hadn't have happened for quite some time now. Yeah, you're right, now I jinxed it.
The chat wastes sooooooooooo much screen space, unbelievable. You cannot theme it to make this more efficient. The feature request (in fact several) exist for multiple years.
Notifications don't work reliably at all. Often I get the notification a few hours or even days later, sometimes never. To make it really funny those fuckheads decided to also show notifications about new messages even though I've read them already and – buckle yourself – replied to them. No, messages weren't edited, that feature was turned off company-wide up until recently for legal reasons or I don't know. It's praiseworthy, however, sometimes they're instant.
The Linux version hangs behind several months of development in general. Break-out rooms still don't work. You just remain in the original conference. At most four people can be seen at the same time in a call. Backgrounds cannot be changed or blurred (that's why I built my own wooden background for real). All that functionality was added to the Windows and macOS versions in summer or maybe even earlier last year.
In calls esp. with video the CPU gets burned. That's great fun in summer, I tell you that. But hey, in contrast to Skype I can actually share my screen. This is the future!
@prologic Very nice and congratulations, mate! This totally slipped through.
@fastidious He can't remember exactly but more suspects the reason being complementary colors.
Snow in the trees https://lyse.isobeef.org/waldspaziergang-2022-01-21/ Note that somebody gave the woman a necklace.