# I am the Watcher. I am your guide through this vast new twtiverse.
# 
# Usage:
#     https://watcher.sour.is/api/plain/users              View list of users and latest twt date.
#     https://watcher.sour.is/api/plain/twt                View all twts.
#     https://watcher.sour.is/api/plain/mentions?uri=:uri  View all mentions for uri.
#     https://watcher.sour.is/api/plain/conv/:hash         View all twts for a conversation subject.
# 
# Options:
#     uri     Filter to show a specific users twts.
#     offset  Start index for quey.
#     limit   Count of items to return (going back in time).
# 
# twt range = 1 2032
# self = https://watcher.sour.is?uri=https://anthony.buc.ci/user/abucci/twtxt.txt&offset=432
# next = https://watcher.sour.is?uri=https://anthony.buc.ci/user/abucci/twtxt.txt&offset=532
# prev = https://watcher.sour.is?uri=https://anthony.buc.ci/user/abucci/twtxt.txt&offset=332
@lyse good I'm glad! I don't know why it's happening to me but it's annoying and unnecessary.
Leading causes of death for Americans ages 35-54 in 2021

- COVID-19: 52,892
- Heart disease: 47,286
- Accidental ODs: 47,080
- Cancer: 44,761
- Liver disease: 16,334
- Suicide: 15,262
- Motor vehicle accidents: 13,372
- Diabetes: 10,558

It'll be the same or worse in 2022. Anti-maskers and COVID minimizers really have a lot to answer for, especially if they avoid sweets, avoid smoking, avoid carcinogens, take care of their hearts, .........
@prologic what is that!
In the demo video they show a user typing their easy to remember plain old password into a browser with an extension installed that helps coordinate the magic of their technique. The user hits something on their phone, which kicks off the magic, and their easy to remember password is replaced with the strong generated password that was actually registered with the site. The video doesn't show what kind of setup is needed to make this work so I don't know about that, but the video makes the login process look pretty painless, roughly equivalent to using a security key or out-of-browser password manager.
@prologic oh I know, but client certificates and security keys are a lot more secure and pretty convenient once you fight through all the setup. Also, I think many implementations of 2FA completely destroy most of its benefits. SMSing or emailing a person a code in plain text, which is very common, is horrible. Storing your passwords as well as the OTP generator on the same device, also common and also horrible. Etc.
StoPS

> StoPS is a device-based password management approach, built atop an existing oblivious PRF (OPRF) scheme, that transforms a human-memorable password into a random password with the aid of a device without the device learning anything about the password and without the need to store the password in any form (plaintext, hashed, or encrypted) anywhere on the client, device, cloud, or third party services.

This is interesting. Based on this paper
@akoizumi I kinda hate 2fa
I feel like part of the reason people like web tech for apps is that for all its faults it takes asynchronous computing and transient failures seriously (because it has to), so the UX tends to be better generally. dolphin is a native app and seems to be doing something like "wait for all filesystems to respond before giving the user control", which is a big UX fail.
It just seems odd that dolphin fails to show me *any* filesystems just because some network mounted filesystems are not currently available. Reminds me of the days when Windows would hang because some network device like a printer wasn't responding the way it wanted.
It's 2022 and there are still basic programs like file managers that can't deal with network problems (looking at you dolphin).
@prologic I guess I could have read the help myself huh? ๐Ÿ˜†
Irritating as that can be, I can't really complain. We've enjoyed pretty reliable internet service for years.
Currently tethering my computer through my phone because our main internet is down.
@prologic Is that adjustable?
@prologic well yes, I've done that, but it still forgets me after awhile ๐Ÿ˜ญ
Hmm, how to keep yarn.social from logging you out?
@lyse In the US you sometimes need to communicate with health care providers by fax. This used to be very common but is becoming less so. I asked someone about it once and their response was that fax was the most secure way they had to communicate (!)
@eaplmx It's not about inventing an entire political system to transcend our current circumstances. The family is not capitalist either--you don't pay your kids for hugs, or your cousin for advice. You don't pay people for gifts they give you on your birthday. I'm sure there are plenty of capitalists who would love to monetize all that and more, and would love for all of us to find that the best way to be. But we don't have to make it easier for them.
@eaplmx under capitalism, if the product is free then you're the product. But we are not required to run every last thing in society as if it were a capitalist enterprise.
@eaplmx government is *us*. When you say it's a rabbit hole, you're essentially saying that we can't do anything, which is an unproductive way to think.
@prologic @movq lol
@prologic that's hilarious--my wife laughs because I often will make a spreadsheet when I'm thinking about buying something that costs more than a few dollars.....
@prologic agree ๐Ÿ’ฏ
Did eBay Just Prove That Paid Search Ads Donโ€™t Work?

For all that, there's lots of evidence going back many years that this heavy-surveillance, paid ad web doesn't actually improve sales.
@eaplmx Functioning government is the obvious answer, but we live in an age where lots of people, many of whom are representatives of those corporations, desperately want us to believe that government can't do anything and will go so far as destroying as much of government as they can to "prove" their point.

Google's power to influence the US Congress appears to be ready to slip, so perhaps there's some hope on that score. Otherwise, I'm not sure what other large-enough power structure exists that can influence technology company behavior in a more friendly direction than the one it's been taking.
@eaplmx idk, I don't remember magazines throwing flashing videos in front of the page I'm trying to read, tracking what I was looking at at all times (even when I'm not looking at the magazine) and correlating that with existing databases about me, purposely subverting my attempts to stop some of that from happening.......
Some fraction of the web needs to be sliced out of corporate control and treated as a public good or commons. There's no justifiable reason that corporations should have such outsized control over such basic infrastructure.
@prologic @movq I'm of a similar mind as @prologic. "The web" as such is virtually unusable without 2 or 3 ad blockers and tampermonkey or its equivalent. The vast majority of these fancy capabilities are being used to clog up your bandwidth with ads. Sure there's specialized stuff that you want to view sometimes that requires some of those features. But this is where a truly plugin-oriented web browser would be a big boon, I think. Rather than have a monolithic web browser that supports all this crazy shit all the time, have a basic web browser that gets you 80% of what you need, and a suite of plugins that you can actually disable or remove that gets you the rest of the stuff you might want. Modern web browsers have extensions, it's true, but the "core" web browser is an enormous, horrifying monolith, the worst software design imaginable. They're trying to be operating systems without having any of the affordances of an actual, well-designed operating system.
@prologic will it let me have 200 tabs open at the same time though??????
@prologic idk, I always like to have a goal before committing to a big project! What would be the purpose?
@prologic It ought to help the development process, right? People who really know about opengl and GPUs etc. could write those plugins, and people who give a crap about DRM (horrible people) can write those, without polluting the main browser.
@prologic I got it compiling before your commit so it's hard for me to test whether this helps, but thanks!
My own web site looks great in this.
Success!

On Ubuntu 22.04, I had to install minify and libwebkit2gtk-4.0-dev with apt, and download and install goi18n-2.2.0-linux-amd64 from github.


h
make: Nothing to be done for 'deps'.
โ•ญโ”€ /tmp/toy-webbrowser ๎‚ฐ master ๎‚ฐยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท๎‚ฒ โœ” ๎‚ฒ ๎˜ง 1.18.1 โ”€โ•ฎ
โ•ฐโ”€   
@prologic
h
โ•ญโ”€ /tmp/toy-webbrowser ๎‚ฐ master ๎‚ฐยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท๎‚ฒ โœ˜ 2 ๎‚ฒ ๎˜ง 1.18.1 โ”€โ•ฎ
โ•ฐโ”€ make                                                                                                                                                                                                  โ”€โ•ฏ
Checking Go version ...                 [ OK ]
Checking $PATH ...                      [ OK ]
Checking deps ...                       [ ERR ]
minify not found, Try running: make deps
FATAL: ๐Ÿ™ preflight failed
make: *** [Makefile:14: preflight] Error 1
โ•ญโ”€ /tmp/toy-webbrowser ๎‚ฐ master ๎‚ฐยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยทยท๎‚ฒ โœ˜ 2 ๎‚ฒ ๎˜ง 1.18.1 โ”€โ•ฎ
โ•ฐโ”€ make deps                                                                                                                 
@eaplmx happy birthday grandma eaplmx!
@eaplmx that makes a lot of sense. I guess all that combined with a small easily readable code base is pretty compelling. The trouble then is, I guess, critical mass of users and content?
@eaplmx it'd be nice if it functioned this way. The major web browsers appear to try to implement everything all the time and also push the boundaries of what web browsers are expected to do. If it had a more plugin way of being, where you can install a plain web browser that does nothing but text, and then add a few plugins for images, videos, etc. as you want them, that'd definitely be better. But I don't know of anything like that personally.
@prologic whoa what is that red flashing?
@prologic I don't think "we" designed the web. I think a bunch of corporations with a vested interest in raising the barrier to entry did.

I've never tried but it strikes me that if you stuck only to HTML and CSS that's focused on displaying text, images and maybe videos, and is mostly considered standardized, it shouldn't be tooooooo hard. But modern browsers have WebGL (!), WebRTC (!!!), DRM (!?!?!), ......
I've always been skeptical of Gemini--why not just use HTML without all the extra stuff--but if Gemini browsers have source code that is actually readable and does not require downloading the universe to compile, then maybe that's a tangible benefit.
there's no way I'm going to try compiling this from source. It's an absolute mess! I don't know much about building web browsers from source but if they are all like this that's already a massive security risk! It wants python 2 (!) and nodejs. It wants you to install webrtc something or other and something called depot? Every one of these things is a security nightmare on its own, let alone stuffed together!
@prologic no Debian or Ubuntu binaries
The cat is unhappy because I need to use one of the other functions of her cat bed (printing a file).
@prologic possum #796251 appears to be in good health.
@prologic Somebody said we don't curse enough on here so I'mtrying to help!
@prologic Mark Zuckerberg can kiss my ass. His original "idea" was to scrape an internal Harvard web site to make a "hot or not" app, ignoring the objections of other students who were rightfully pissed. The trajectory of his career since then tracks his early efforts.
Decentralized censorship proof somethng something https://web3isgoinggreat.com/?id=over-51-of-blocks-validated-on-the-ethereum-chain-are-censored
@lyse next time I get a chance!
@prologic close--oatmeal with maple syrup. It's good!
Currently eating my favorite breakfast: baby leftovers
All of a sudden the ground is covered with leaves up here. I guess it's fall.
This says to me that if you wanted to write Go software that was intended to be secure, you should be very careful about depending on C/C++ code, and you should be very careful about depending on Go code that depends on C/C++ code, and.....all the way down the dependency chain.

And you should formally verify your security protocols, too, on top of that.
> We show that because language safety checks in safe
languages and exploit mitigation techniques applied to unsafe
languages (e.g., Control-Flow Integrity) break different stages of
an exploit to prevent control hijacking attacks, an attacker can
carefully maneuver between the languages to mount a successful
attack. In essence, we illustrate that the incompatible set of
assumptions made in various languages enables attacks that are
not possible in each language alone.
A for instance: security researchers found that combining Rust or Go code and C code produced systems that were *less* secure than C itself. This is counter-intuitive to many people, because they perceive Rust and Go to have "solved" many of the issues that plague C. However, what was found is that the combination of the two languages allows for essentially new kinds of security vulnerabilities. So, the "intuition" that you cane make a C codebase safer by using Rust or Go with it is wrong--in fact you make it less safe, in general.

https://www.ndss-symposium.org/wp-content/uploads/2022-78-paper.pdf
Just one link I found. There is a vast literature on this topic. The basic idea is to describe whatever protocol--be it key exchange or some other thing--in a formal way (programming language), and then run automated verification algorithms to ensure the protocol is actually providing the security guarantees you want it to. Experience shows it's wayyyyyyyy too easy to convince yourself that a protocol is secure when it is not, and that trusting someone else's algorithm doesn't solve this problem nearly as well as formal methods do.
Approaches to Formal Verification of Security Protocols
@mckinley Librewolf is a Firefox offshoot and that whole line gives control over WebRTC AFAIK, whereas Chrome and its derivatives don't.
@prologic idk I tend to think that "reading something on some random person's web site" and "telling some random person where I live to within a mile or two" ought to be distinct things I get to choose independently....
WebRTC cannot be disabled by default in (most?) Chromium-based browsers. You need an extension.
Is your browser leaking your IP address?

WebRTC can leak your real IP address even if you use a VPN.
@akoizumi ejabberd supports SIP, MQTT, STUN and TURN too!
@prologic I mean, that dude's salary explains it doesn't it? That company exists to enrich the higher-ups, not to actually lay cable.
@prologic $3 million per year!!! for what?!
@prologic I like to give developers the benefit of the doubt, but the management can go suck an egg as far as I'm concerned lol
@prologic err, building a "security focused" app while not knowing what you're doing is not an optimistic assessment! It's the height of hubris, and very dangerous!
@prologic I guess y'all have been saying this but it didn't sink into my dense head. Anyway, this is even more angering since they never had to hijack SMS to begin with--they already knew how to make an app that didn't!
@prologic ๐Ÿ˜ก
@prologic hey wait, Signal only hijacks your SMS on Android???
Speak of the devil.

[Signal >> Blog >> Removing SMS support from Signal Android (soon)](https://signal.org/blog/sms-removal-android/)
Sweaty hands + slightly reflective desk + optical mouse
@prx nice
@prologic hmm, there are older twts:

2007-03-02T12:19:38.000Z\tะงะตั‚ะฐ ัะธ RSS feed-ะพะฒะตั‚ะต

looks to be the oldest.
@prologic obviously he was using curl and not buccket ๐Ÿ˜
@prologic whoa
@movq oof, I feel like I'm guilty of this too ๐Ÿ˜ณ
@prologic totally! ๐Ÿคž
Love that Gboard, which I don't use, randomly downloads stuff on my Android phone. That's not weird or suspicious in any way.
and I mean, my calculation about information security is pretty conservative. Snowden left the US for Russia, a country that has been actively hostile to us for a long time, and eventually became a citizen there. He recommends people use a "secure" app whose CEO wanted to turn it into some crytocurrency thing--crypto being a main way Russia is using to circumvent economic sanctions. Signal also eats your messages and makes it difficult for you to get them out again. This is just a bouquet of bad stuff--country that actively hacks the US, cryptocurrency, and walled garden. None of it is a smoking gun, but it sure smells funny to me. Especially when there are alternatives that have none of that stink circulating around them.
@prologic Putin just gave Snowden Russian citizenship. The journalist, Glenn Greenwald, who broke the Snowden story originally has been a Russian propaganda mouthpiece for quite some time (besides being an awful human being generally by the looks of things). Smells very fishy to me. I mean, these things are rarely black and white--I'm glad to know some of the things that Snowden revealed--but I think the mission of some of these folks is to destroy the US's credibility, not help people or inform people.
@ocdtrekkie yeah, and now that it looks like Edward Snowden, who told people they should use Signal, has probably been a Russian asset for awhile, I'd delete that thing immediately if I still had it.
@ocdtrekkie at least at the time I installed Signal on my android phone, it wanted a phone number to send and receive texts. From then on, any texts I sent and received went through Signal, not through the phone's SMS app. The texts were no longer stored in the phone's usual SMS storage, but in Signal somewhere, encrypted. Getting them out again so that I could switch back to an Android native SMS app was hard, and I lost messages in the process.
@eaplmx me too!
@prologic nice!
@prologic I left Signal a year-ish ago because (a) the CEO started talking about crypto, which freaked me out; (b) then the CEO abruptly left, which freaked me out; and (c) they removed the functionality to decrypt your messages, making Signal into yet another walled garden.

It turns out that getting your messages *out* of Signal is difficult, requires a third-party app, and is lossy. I never managed to get my MMSs out, only my SMSs. I was pissed that this app basically took over my phone number and then wouldn't let me migrate back out. So I'm never using it again!

I'm a devotee of XMPP though if you use that (anthony@bucci.onl). I'll check out the IRC channel.
@prologic @eaplmx @justamoment I think such things are convenient but dangerous. Email is not encrypted in general, which means by using this feature you are sending a cleartext login path to anyone who manages to snoop your email or your network traffic. That's making the system less secure than a password-based login.

One of the reasons I ended up on yarn.social was that I was looking for a good passwordless alternative and IndieAuth seemed like it might fit the bill!
I'm guessing my hangups are mostly because I'm not yet steeped in the lore of the project and they probably won't be an issue once merged into yarnd. Still, I'd like to help test if I can.
Now stuck in a different spot. Put another comment in the pull request. I'm going to hold off on further testing till that gets sorted because I don't know what I'm doing ๐Ÿ˜†
Never mind on that, I found the "hidden" -d option for search_archive!
@prologic Initial comments: https://git.mills.io/yarnsocial/yarn/pulls/1010#issuecomment-13106

I'm stuck at this point. Search is not working as expected and I'm not sure what to do to proceed. I will keep hacking at it, but any pointers would be appreciated!
@prologic OK this is pretty silly but now that I've turned this setting on I don't know what to do with it (?!!?).

Every time I think I understand this IndieWeb thing I end up confused again. I'm starting to believe it is needlessly complicated.
@prologic OK, next time I get a chance to sit at my computer I'll give it a whirl
@prologic aha, thank you!

Where does one find a list of these magical "Optional Settings?" What are my options?!
@prologic how do you enable it? I don't recall seeing it when I set up my pod but I'd like to play with it.
@prologic Is the notion to have the indexing kicked off automatically after a post when it's integrated?
@prologic https://www.netlogoweb.org/launch#http://ccl.northwestern.edu/netlogo/models/models/Sample%20Models/Social%20Science/Economics/Hotelling's%20Law.nlogo
There are countless stories like this:

Binance Smart Chain halts after $127 million bridge exploit


"Even if you consider this theft to be in the $580M range, it's still only the third-largest hack in the past 14 months" says Molly White.
I wonder how long it's going to take the tech industry to figure out that most people don't want to wear tech on their faces.

What happened to the virtual reality gaming revolution? | Ars Technica
Anyone who believes that "the free market" is the best way to allocate resources should read up on Hotelling's Law, which demonstrates that, in a purely market-driven system with two sellers of a good, the sellers will move to reduce their own perceived--but not actual!--risk at the expense of buyers. Even worse, if you add more sellers, the dynamics become chaotic (literally so in the models) and pricing goods becomes impossible (Edward Chamberlin's PhD dissertation argues this).

Sure, there might be ways to tinker with the market dynamics to avoid these issues, but who is doing that tinkering? If you say "government", then you're admitting free markets aren't really the best way to allocate resources. If you say "the sellers", you are (a) introducing a new form of utility, while (b) not dealing with the chaos problem. If you say "the buyers", you are giving up on the idea of the free market being the best way to allocate resources, since the only leverage the buyers have is to give up the resource.