# I am the Watcher. I am your guide through this vast new twtiverse.
# 
# Usage:
#     https://watcher.sour.is/api/plain/users              View list of users and latest twt date.
#     https://watcher.sour.is/api/plain/twt                View all twts.
#     https://watcher.sour.is/api/plain/mentions?uri=:uri  View all mentions for uri.
#     https://watcher.sour.is/api/plain/conv/:hash         View all twts for a conversation subject.
# 
# Options:
#     uri     Filter to show a specific users twts.
#     offset  Start index for quey.
#     limit   Count of items to return (going back in time).
# 
# twt range = 1 2172
# self = https://watcher.sour.is?uri=https://twtxt.net/user/mckinley/twtxt.txt&offset=672
# next = https://watcher.sour.is?uri=https://twtxt.net/user/mckinley/twtxt.txt&offset=772
# prev = https://watcher.sour.is?uri=https://twtxt.net/user/mckinley/twtxt.txt&offset=572
@mutefall I don't think a lot of people realize just how much power Cloudflare has over the Web. Even we probably can't imagine the extent of it. @prologic, thank you for turning that off. It was even [email protecting][email protecting=][email protecting][email protecting=][email protecting][email protecting=][email protecting][email protecting=] version numbers at the bottom of the page.
@mutefall I don't think a lot of people realize just how much power Cloudflare has over the Web. Even we probably can't imagine the extent of it. @prologic, thank you for turning that off. It was even \n\n\n\n version numbers at the bottom of the page.
@mutefall I don't think a lot of people realize just how much power Cloudflare has over the Web. Even we probably can't imagine the extent of it. @prologic, thank you for turning that off. It was even \n\n\n\n\n\n\n\n version numbers at the bottom of the page.
@mutefall I don't think a lot of people realize just how much power Cloudflare has over the Web. Even we probably can't imagine the extent of it. @prologic, thank you for turning that off. It was even [email protecting][email protecting=] version numbers at the bottom of the page.=
@mutefall I don't think a lot of people realize just how much power Cloudflare has over the Web. Even we probably can't imagine the extent of it. @prologic, thank you for turning that off. It was even [email protecting] version numbers at the bottom of the page.
@mutefall I don't think a lot of people realize just how much power Cloudflare has over the Web. Even we probably can't imagine the extent of it. @prologic, thank you for turning that off. It was even \n\n version numbers at the bottom of the page.
@mutefall I don't think a lot of people realize just how much power Cloudflare has over the Web. Even we probably can't imagine the extent of it. @prologic, thank you for turning that off. It was even [email protecting][email protecting][email protecting][email protecting][email protecting][email protecting][email protecting][email protecting] version numbers at the bottom of the page.
@slashdot Kick and scream all you want, but you can't take down my local degoogled copy of pre-NYT Wordle with the post-NYT word list.
Ah yes, \n\n, my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.
Ah yes, [email protected][email protected=][email protected][email protected=][email protected][email protected=][email protected][email protected=], my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.
Ah yes, [email protected], my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.
Ah yes, \n\n\n\n\n\n\n\n, my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.
Ah yes, [email protected], my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I didn't volunteer, the owner of the website did.
Ah yes, [email protected][email protected=], my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.=
Ah yes, [email protected][email protected][email protected][email protected][email protected][email protected][email protected][email protected], my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.
Ah yes, \n\n\n\n, my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.
Ah yes, [email protected]\n[email protected]\n[email protected]\n[email protected]\n, my favorite Salty user. What is the actual goal of Cloudflare MITMing everyone to censor websites? If the owner of a website chooses to publish an email address, why can't he? If it gets scraped by bots and the inbox gets ruined forever, that's on him. Is it just to get people used to this sort of "voluntary" MITM attack? I put "voluntary" in quotes because I, the victim of this MITM attack, didn't volunteer, the owner of the website did.
@prologic I tried both views in Settings and still couldn't make much sense of it. I'll check them out later tonight.
There are too many threads going, I can't keep up. Can someone catch me up on what's been going on here since last night?
I have a very weak understanding of cryptography, I'm sure there's something I'm missing.
If a username and a private key is all that's needed to sign in and there is no username/password/TOFU then an impersonation attack like that would be equivalent to the attacker grabbing an OMEMO private key from a trusted device, is it not? Point #1 would effectively become irrelevant, right? Plus, how many people are *really* meeting up in person to verify their OMEMO keys?
If a username and a private key is all that's needed to sign in and there is no username/password/TOFU then an impersonation attack like that would be equivalent to the attacker grabbing an OMEMO private key from a trusted device, is it not? Point #1 would effectively become irrelevant, right? Plus, how many people are *really* meeting up in person to verify their OMEMO keys?
@prologic I do the same with SSH keys and share that exception. I would also prefer to have a separate IM account for work. The only advantages I can think of to a device key setup are as follows:
1. You can verify that a device key belongs to the person to whom you mean to send messages. If you verify the keys with someone in person and suddenly start receiving messages from their account with a different key, you'll know something's going on.
2. It's easier to register new clients, because you can just type in a username and a password.
@prologic Wait, I've been assuming that one account = one private key. Is that not your intention? If the same private key is used on all devices, a new client should be able to see old messages. That's not the model of XMPP+OMEMO, and it may be a challenge to use mobile devices as well as "real" computers with the same account, but it wouldn't be insurmountable. If one account = one private key it makes the private JSON store much less complicated. It would streamline group chats as well, which is a problem for XMPP+OMEMO.
@prologic Wait, I've been assuming that one account = one private key. Is that not your intention? If the same private key is used on all devices, a new client should be able to see old messages. That's not the model of XMPP+OMEMO, and it may be a challenge to use mobile devices as well as "real" computers with the same account, but it is a possibility. If one account = one private key it makes the private JSON store much less complicated. It would streamline group chats as well, which is a problem for XMPP+OMEMO.
@prologic The way I picture this, and I may be way off from where you are, the client needs to be able to make the following requests for messages:
1. All messages from and to all users sent after X date (when starting up)
2. All messages from and to a specific user sent before Y date (when viewing history)

All of this would need to utilize pagination so we aren't sending 500 messages to a client all at once.
These query options could be added to the JSON object store I'm proposing, but I don't see how they might be used outside of storing messages.
@prologic The way I picture this, and I may be way off from where you are, the client needs to be able to make the following requests for messages:
1. All messages from and to all users sent after X date (when starting up)
2. All messages from and to a specific user sent before Y date (when viewing history)
All of this would need to utilize pagination so we aren't sending 500 messages to a client all at once.
These query options could be added to the JSON object store I'm proposing, but I don't see how they might be used outside of storing messages.
@jsreed5 (200ms read)

Agreed.
@the-lunduke-journal-of-technology Oh, this is really cool. I definitely need to get one of these at some point. Normally I would avoid being on the bleeding edge of hardware like this, but the DevTerm is fully upgradeable. You can even buy a Risc-V DevTerm kit and swap in an ARM based core module later, which absolutely blows my mind.
@the-lunduke-journal-of-technology Oh, this is neat. I definitely need to get one of these at some point. Normally I would avoid being on the bleeding edge of hardware like this, but the DevTerm is fully upgradeable. You can even buy a Risc-V DevTerm kit and swap in an ARM based core module later, which absolutely blows my mind.
@prologic Yes, but I was thinking more along the lines of auxiliary data like contact lists. Message history might be better off with its own system that provides more powerful query options and pagination.
Do you think it would be feasible to encrypt the private object names as well?
@prologic Re: Chat system, What if the base specification included a system for per-user arbitrary JSON storage on the server? Kind of like XEP-0049, but expanded upon. Two kinds of objects: public and private. Public objects can be queried by anyone, private objects cannot and must be encrypted with the user's private key. Public keys could be stored there, as well as anything else defined by extensions. Roster, user block list, avatar, etc.
The server operator should be able to blacklist certain hosts as well as disable s2s connections entirely if they don't want federation. If a client can POST inboxes without a broker in the middle of the chain, it's too easy to automate and too hard to prevent spam.
The server operator should be able to blacklist certain hosts as well as disable s2s connections entirely if they don't want federation. If a client can POST inboxes without a broker in the middle of the chain, it's too easy to automate and too hard to prevent spam.
@prologic I'm glad you found my idea compelling. I agree that the broker and client specifications shouldn't be lumped together. I also think there should be a clear separation between client-to-server and server-to-server connections. The distinction between sending a message (POST http://montague.example/api/v1/post) and delivering a message (POST http://capulet.example/api/v1/inbox) should absolutely be enforced by the specification. I didn't see that last night, but it became clear after thinking about it.
@prologic I'm glad you found my idea compelling. I agree that the broker and client specifications shouldn't be lumped together. I also think there should be a clear separation between client-to-server and server-to-server connections. The distinction between sending a message (POST http://montague.example/api/base/v1/post) and delivering a message (POST http://capulet.example/api/base/v1/inbox) should absolutely be enforced by the specification. I didn't see that last night, but it became clear after thinking about it.
@prologic 30 seconds is reasonable. Even a little more would be fine, I think. It's only really annoying when someone's time is set so far into the future that it's effectively a "sticky" post at the top of the Discover feed for a while.
@ullarah That's definitely the best minifigure-scale model of a real car I've seen. I might have to go find one of those.
@prologic As long as people's complete post history is stored in their twtxt file(s), anyone with a client that isn't yarnd can see old posts. They can even reconstruct old conversations. There is no plausible deniability there, unless you're proposing we remove the non-cached posts permanently. I'm definitely not a fan of that.
@prologic Oh, that's clean. Nice setup.
@mutefall Oh, I see. Glad it made you smile.
@mutefall Ah, yes. Glad it made you smile.
@prologic It's right under your nose. :
@prologic It's right under your nose. :
@prologic It's right under your nose. :
@carsten It's not a weekly thing. I'm not experienced making these as you can see. I just thought it would be fun. :
@carsten It's not a weekly thing. I'm not experienced making these as you can see. I just thought it would be fun.
Base64 hints if you want them
For @ullarah: VGhlcmUgaXMgYSBwYXNzd29yZCwgYW5kIHRoZXJlIGlzIG9ubHkgb25lIGZpbGUgaW4gdGhlIGFyY2hpdmUu
For @prologic: VGFrZSBhIGxvb2sgYXQgdGhlICJGb3JlbnNpY3MiIGNhdGVnb3J5Lg==
I definitely made this one too hard. If you want to try some easier ones, take a look in the JavaScript console of CyberChef. There's a whole series of these challenges made by the developers. :
@mutefall I'm sorry, I have no idea what you're talking about.
@prologic It was really cool clicking on the link to the netbros.com pod and seeing my 28 second old post on twtxt.net at the top of the feed. That WebSub thing is great!
@prologic No worries. It doesn't affect me much, I'm just curious.
@prologic CyberChef is a tool that does all kinds of file conversion and you can make "recipes" that perform several operations in a row on the input. That string in the root post, which is exactly the twt length limit of this pod, is a string of text that has gone through several reversible CyberChef text operations. If you want to give it a try, you need to use the hints I've given in this thread, the tools available in CyberChef, and any information you uncover along the way to deduce the original string. To get you started, the first format is base64. :
@prologic I didn't know the rotation was already implemented in yarnd. Is there a way to see the full history of a feed? I don't see a prev metadata tag on yours.
Is anyone interested in the puzzle? Is it just too difficult?
@tkanos See https://dev.twtxt.net/doc/metadataextension.html
This is a very direct and understandable answer to the question, from both of you. At risk of irony, I think one of you should copy this thread and host it somewhere permanently so we can reference it later. I would, but I wasn't involved in the conversation.
@prologic The existence of XEP-0277 doesn't make XMPP a good platform for microblogging. Likewise, I don't think twtxt will make a good chat system. What if yarnd and a separate federated chat server could (optionally) share account information so your Yarn account credentials are used for a Matrix or XMPP account on the same server?
@tkanos I don't use the Brave browser but I use Brave search and I like it a lot. I don't think it tracks clicks like DuckDuckGo does and the results are usually quite good.
@adi Think outside the comment box:
https://gchq.github.io/CyberChef/
Remember: The wizard can help you with his Magic.
QlpoOTFBWSZTWZ2nUDIABZGYAEAAf+BAApobcrGsBqn6mZMqgaeiKemqBKeomU8qBCVNRtSLkDdmOX8OlBGoLAJRMH7fXW16tnPgRvc2t+0fmJGieqJppQmDRzB3Q/uwMaNJVl0cIxi73fTwurfumuAkLyiFx0GuWd0uVRglLjjXHPs1zd8RovGKK9G1tyC+5ZdZsLFxzvAjitTqY7egud6+umJGGxLZfrlqNROT5zuW89T+fkiEYHGQi2Rv08mJp8lUWVIc9CHon9NFKUtJkoxk+/O+3N3zl6Hyfe+44XFXASrtkDay5hg0OYQYGZgCWDxf1EhbF5Wbc593enxYYn6PHMkdwG2DSmhpxRc+fe+fe8idu/TX4MpJlIE2kxCaEGNOa8+vbX3LVOfxcivGMAoQ30ZQF4s27+03het+1MKYkwBbQr8nJm3xS8sfo2IFhE7Cxn013R1mK/LEKCNJGb96vTA9KdIBIoRVFB8njWtN37pmrA6HvOHYJkp8VE4iFEQVBCxEkKrFEglKkRS1NMJQDBK0rIIh/CgJALIiCeSiGRAD/F3JFOFCQnadQMg=
@prologic @tkanos With this crowd, how can you post some seemingly random data and expect people *not* to get curious? :)
@tkanos So it was encrypted data. I was close, but context was on my side. No need to apologize, welcome to twtxt.net!
My best guess is a base64 encoded encryption key of some kind.
@test_feed What is this? I've spent several minutes on CyberChef trying to figure it out and I haven't gotten anywhere.
@caesar We absolutely need a mandatory class on what computers do, what the internet is, etc.
@caesar Schools, at least here in the States, don't bother teaching people anything about computers. I took a "Computer Tech" elective, the only computer-related class available, in high school and it was just a digital art class. I would go across the hall from my graphic design class and do the same thing for another hour. An absolute waste of my time.
@carsten What's the point of a powerful desktop chip in such a locked down device with nothing but a touch screen and an optional keyboard? At least my Panasonic Toughbook CF-19 has the terrible keyboard built in and lets me install whatever operating system I want.
@prologic I love seeing Yarn.social improve. Great addition!
@movq That's awesome, I might need to give it a try.
@movq What window manager is that? I like it a lot.
@screem I don't know how far you want to go with the Web DE thing but you might find it simpler to use :target.

<style>.select{display:none}.select:target{display:block}</style>
...
<a href="#option1">1</a> <a href="#option2">3</a> <a href="#option3">3</a>
<div id="option1" class="select">...</div>
<div id="option2" class="select">...</div>
<div id="option3" class="select">...</div>
@prologic It definitely has its problems, but I can't find a better alternative for my use case. I can give you a hand configuring Prosody if you'd like.
@prologic It can :)
The Soviets started building a second one in the 80s for their space program but they lost the war and the Buran program was canceled before it was completed. The first was modified for cargo transport, and the second was kept in storage. There have been some attempts to finish it, but the demand isn't there. The first one only made about 20 trips per year and the Antonov CEO has said it's just not economically viable to finish the other one.
> Russia has destroyed our "Dream", but the dream of a Ukraine free from the occupier cannot be destroyed. We will fight for our land and our home to a victorious end. And after the victory, you see, we will definitely finish our new "Dream", which has been waiting for this in a safe place for many years. Everything will be Ukraine!

I hope the second Myria will retain the yellow and blue stripes.
The parent company of Antonov made a statement insinuating that they plan to finish the second AN-225 airframe. Even if Kyiv falls, I think it'll be finished anyway. There's a place for the AN-225 in the market, just not 2 of them.
Read 'em and weep.
🟩⬛⬛🟨🟨
🟩🟩🟩🟩🟩
Fair enough. Its's not on Homebrew, but it is on MacPorts if you use that. https://ports.macports.org/port/NetSurf/
@prologic The home page mentions OS X, maybe you need to compile it.
@prologic Here's the screenshot gallery on their website demonstrating all the platforms it runs on. NetSurf is awesome! I'm surprised you haven't heard of it. It's a truly independent Web browser that uses its own custom rendering engine and focuses on portability and low resource usage. It supports most of HTML 4.1/CSS2 plus it has experimental JavaScript support.
@prologic This is the Mozilla blog post I heard about it from. I can't help but notice they spend more time talking about Chrome than Firefox here. https://hacks.mozilla.org/2022/02/version-100-in-chrome-and-firefox/
The Chrome hack is supposed to be a backup plan. I think it's more than likely they'll just tack the digit on like you'd expect.
Apparently Google is thinking about freezing their version number at 99 and putting the "real" 3 digit version in the minor version slot in their version numbering scheme. Why might they do this? You guessed it! User agent parsers! The History of the browser user-agent string will definitely have to be updated if this ends up happening.
@david I didn't say that. Corporate media organizations on all sides are guilty of this.
@david Joe is the alternative to corporate propaganda. His show is about having longform, genuine conversations with people and allowing the viewers to make their own decision, and there's a great deal of intellectual diversity in the guests. CNN brings a guest on for 30 seconds to agree with whatever the host just read off the teleprompter.
@adi @thecanine Check out the Ultimate Oldschool PC Font Pack. Pixel-for-pixel recreations of any text mode PC font you can think of, and some of them include (custom) extra Unicode characters. The author claims that his work is transformative since none of these fonts were ever originally distributed in modern font formats. They are all licensed under CC-BY-SA.
@slashdot Owned by a 5 eyes-based company that is snapping up VPN services and review websites like Microsoft and video game studios. Proprietary client. Falsely frames what VPNs actually do. Don't fall for this. Subpoenas are mightier than hackers, anyway.
Correction: iVPN has Australian server. Singular. It's in Melbourne. If that's an important factor for you, I would go with Mullvad.
Correction: iVPN has Australian server. Singular. It's in Sydney. If that's an important factor for you, I would go with Mullvad.
I can't reply on #aam37tq for some reason, sorry for splitting the thread like that. I don't know how the speeds compare between them, but I just tested 133Mbps down and 12.4 Mbps up without a VPN and 78.3/11.9 with a nearby Mullvad server.
I can't reply on #aam37tq for some reason, sorry for splitting the thread like that. I don't know how the speeds compare between them, but I just tested 133Mbps down and 12.4 Mbps up without a VPN and 78.3/11.9 with a nearby Mullvad server.
@deebs Watch out for websites reviewing VPNs because many of them are owned by the same companies that operate the VPN services. I use Mullvad and I've heard good things about iVPN. They're very similar. Both have Australian servers. Neither of them require any personal information. Both accept cryptocurrency. Both claim they don't keep logs. Both have GPLv3 official clients but support standard OpenVPN or Wireguard clients. Both also support port forwarding. Mullvad is a bit cheaper unless you pay for long-term service with iVPN's standard plan.
test
@prologic Best of luck to you. I hope things continue to get better.
@prologic Good for you, man. Are the mandates loosening up in your neck of the woods?
@prologic I knew their stock price was down, but I didn't know it was that sharp of a decline. Where's the champagne?
@prologic I've been well, thanks. Been spending a lot of time trying to airlift people off of centralized, proprietary communication services. It is not an easy task. I'm glad to see that Yarn is still growing, congratulations on getting on the Vultr Marketplace. How've you been?
Hello all, I haven't been here in a while. What's going on?
@prologic Terrific video!
@prologic It's the best thing I've read all week, hands down.