<ocdtrekkie>
Okay, so, I'm writing a Windows service that calls the Sandstorm API. I wrote the service part first, and now am writing the Sandstorm call. I now realize this was a mistake.
<ocdtrekkie>
...Because the only way to test a service is to install it on your machine. Pain in the rear to debug.
kawaiipunk has quit [Remote host closed the connection]
kawaiipunk has joined #sandstorm
frigginglorious has quit [Ping timeout: 276 seconds]
radley has joined #sandstorm
<ocdtrekkie>
It works though! \o/
<crab>
kentonv: OK, i tried your experiment. uploaded a 4.8MB file to a new davros grain and downloaded it several times. i am typically able to download the whole thing in 80-100s, and even after several attempts it never took 300s+ the way compressed.js from radicale did.
<crab>
and then i went back and tried compressed.js again, and it took ~150s to load.
frigginglorious has joined #sandstorm
nicoo has quit [Ping timeout: 250 seconds]
nicoo has joined #sandstorm
frigginglorious has quit [Ping timeout: 248 seconds]
frigginglorious has joined #sandstorm
frigginglorious has quit [Client Quit]
radley has quit [Quit: bbl]
<ocdtrekkie>
So, okay, I think everything I was writing today actually works now.
<ocdtrekkie>
I am calling it SSCaaS or Sandstorm Cron as a (Windows) Service. Intentionally terrible name, I don't want to use up a good one.
<ocdtrekkie>
It should (in theory) annoy my TTRSS instance more or less similarly to the way I do when I check the app every half hour or so, with some attempt (so far) to emulate good behavior, by making requests somewhere between every 20-30 minutes (the interval should be slightly random), and like I often do with my mobile app, end up checking again a couple times spaced a number of seconds apart, to, in theory, ensure that TTRSS can completely check all of my
<ocdtrekkie>
feeds before Sandstorm shuts down the app again.
<ocdtrekkie>
This was fun for me because I've A. never written a Windows service before and B. never made a request with HTTP Basic Authentication before.
radley has joined #sandstorm
<ocdtrekkie>
It also strikes me that with a little bit of adjustment, this could be a network monitor for Windows PCs.
jemc has quit [Ping timeout: 248 seconds]
harish_ has quit [Ping timeout: 240 seconds]
harish_ has joined #sandstorm
pie_ has quit [Ping timeout: 245 seconds]
xet7 has joined #sandstorm
xet7 has quit [Remote host closed the connection]
xet7 has joined #sandstorm
pie_ has joined #sandstorm
<TimMc>
Heh, fun.
<TimMc>
Oh, on the Chrome extensions thing -- as long as you can still install an extension from disk, fine. I just don't want everything to have to go through Google's app store.
pie_ has quit [Ping timeout: 256 seconds]
pie_ has joined #sandstorm
pie_ has quit [Read error: Connection reset by peer]
pie_ has joined #sandstorm
ocdtr_web has joined #sandstorm
<ocdtr_web>
TimMc: They removed the ability to do that by default :years: ago.
jemc has joined #sandstorm
<ocdtr_web>
The inline install feature they're disabling requires the extensions be listed in the Web Store.
<ocdtr_web>
(Of course, the problem remains that the Chrome Web Store is still a cesspool of malware, and hence requiring extensions to come from there didn't actually reduce malware at all.)
<TimMc>
oh fascinating
<TimMc>
so what you're saying is that requiring them to be "approved" by Google isn't actually much of a barrier at all
<TimMc>
(yet)
<ocdtr_web>
There's no human-involved approval process on the Chrome Web Store.
<ocdtr_web>
I've started to come to the view that the only way to ensure good moderation of online content is to choose a moderation strategy that doesn't scale.
<ocdtr_web>
So if it's something like software distribution, where bad content getting through means malware, you should probably have a human-based approval process.
<ocdtr_web>
Apple and Microsoft's stores have little to no malware at any time, because the cost/effort required to submit malware and get it through approval is nontrivial. One gets through, and delisted, and the attacker is now back at square one. Whereas with Google's auto-approval with some sort of "AI-based" moderation, you can afford to spam out many arbitrary submissions until they get through.
<ocdtr_web>
And once you find a way to circumvent automated detection, it's likely to can reuse it a number of times before it adapts.
<ocdtr_web>
This is presumably why EV certs still work, despite being relatively terrible at actually verifying your identity: When I watched someone whine about the forms of ID that they had to provide that were unverifiable, it became obvious that really all EV cert providers need to do is ensure there's no duplicates.
<ocdtr_web>
If a bad actor gets an EV cert, and it gets revoked, they're back to square one on an annoyingly manual, arduous process.
<TimMc>
True. You can also find EV cert providers who are terrible at their jobs, but it's still a higher barrier to entry.
harish_ has quit [Ping timeout: 245 seconds]
<ocdtr_web>
Also, Google could significantly improve the Web Store's malware issue without requiring approval on all addons. Since it has a permission system, they could only require manual approval for ones with particularly risky permissions.
<ocdtr_web>
The "can view and modify content on all websites you visit" permission is surprisingly pervasive, and incredibly crazy to let random developers' extensions have.
<ocdtr_web>
Since it effectively grants that extension the ability to leak any and all sensitive data you traverse over the Internet.
<TimMc>
Kind of like how you don't need sudo to ruin someone's day.
<ocdtr_web>
Yup. Cloud-to-butt has all it needs security-wise to capture your banking account data.
harish_ has joined #sandstorm
<ocdtr_web>
I really wish Sandstorm had a story for ActivityPub federation. There's so much exciting/neat stuff going on there right now.
<ocdtr_web>
Federated Twitter, YouTube, Medium, Meetup, etc. all using the same federation protocol.
<TimMc>
There's no notion of privacy in it though, right?
<TimMc>
All of those things would benefit from a protocol that allows selection of a subset of the world as recipients.
<ocdtr_web>
TimMc: There's some basic concepts in there, yes. For instance, a Mastodon account can choose to whitelist what federated servers can receive it's updates, particularly private ones.
<TimMc>
But that's only at the server level.
<ocdtr_web>
But private messages are particularly a mostly-bad feature of federated networks. There's warnings in the UI, but essentially private messaging on ActivityPub servers relies on the servers not revealing them.
<TimMc>
No, private messages are a bad feature of ActivityPub networks.
<TimMc>
they're a great feature in federated networks, or just about any social system
<ocdtr_web>
Yeah, I was trying to say, basically, don't use ActivityPub for PMs if you don't have to.
<TimMc>
right
<TimMc>
Mastodon tried to hack in a notion of privacy and it caused huge social problems because other pre-existing implementations didn't know what the hell it was talking about.
<TimMc>
So ActivityPub is great if you want to make blogs, or part of Twitter, or most of YouTube, but it's no good for recreating Livejournal, or the ability to actually send PMs in Twitter, or have private videos.
<simpson>
By absolutely no coincidence, the ocap-ld/linked-data folks have been idling and chatting in #erights over the past few months to try to find better ways to ocap-ify stuff.
<TimMc>
I hope they'll standardize a way to actually make a proper privacy system.
<TimMc>
simpson: Oooh, tell me more, starting with what ocap is.
<simpson>
TimMc: Object-capability security is a way to model capabilities as objects/actors, so that a capability is precisely the ability to send a message to an object.
<simpson>
"ocap" for short.
<TimMc>
What's the basic mechanism -- opaque IDs and lookups, encryption, something else?
<TimMc>
(In an OS you could also use handles, but across a network, you lose that option...)
<simpson>
Usually it's either *unforgeability* (the runtime forbids forging caps arbitrarily) or *unguessability* (cryptography or similar hard problems).
<simpson>
For example, Capn caps are unguessable, which is why one should use TLS with Capn over the network.
<ocdtr_web>
TimMc: IMHO, I am totally cool with "ActivityPub for public social activity, use alternate means for private communication".
<ocdtr_web>
I think we already have a great decentralized tool for private communication, it works on all platforms and you can layer other features or technologies on top of it.
<ocdtr_web>
...It's called email.
<TimMc>
Email is "private" but its unsecured.
<TimMc>
With new systems we have an opportunity to actually ensure confidentiality and sender verification.
<TimMc>
If you want to say that we should have a single platform for private communication, you *might* be able to convince me of that, but not if you say email is that platform. :-)
<TimMc>
(for the record I think email is fantastic -- just not for this)
<TimMc>
I don't think that restricting social activity to public is healthy. People naturally want to talk in small-group settings and it avoids dogpiling, search-based harassment, etc.
<ocdtr_web>
You can layer confidentiality and sender verification on top of email though.
<TimMc>
With PGP?
<TimMc>
I'd even question whether social networks should be public-first.
<TimMc>
Still working up a proper, less-ranty blog post on that, but the tl;dr is that regular human interactions are limited-visibility and not broadcast to the entire world, globally indexed and searchable, or even persistent -- so maybe we should make social media systems that align with the human instincts that are adapted to that.
<simpson>
Sure. Social networks have an inverse Conway's Law kind of thing going on.
<simpson>
(Incidentally, this is why any social network that allows anons to register and gain karma for pretending to behave is inherently planning to be terrible in the future~)
<TimMc>
Can you expand on inverse Conway's Law? I'm familiar with the law, not sure about the application here.
<simpson>
Well, the shape of a social network's software should reflect the kind of community that one wants to attract, right?
<simpson>
All I have figured out is that we're probably doing things wrong.
<TimMc>
:-)
<TimMc>
So, I totally agree that the "shape" of the software affects the community. I'm not sure it's the same "shape" that Conway's Law talks about.
<TimMc>
and I'm not sure if that's what you were going for or not
<TimMc>
Reputation systems are another thing that we're soooo in need of and have basically no progress on.
<simpson>
Well, it's a very abstract concept. I *can* make a formal statement, if you know category theory.
<TimMc>
hehehe
<TimMc>
"assume a spherical, monadic user"
<simpson>
For some model of human society S and computational category C, the set of functors S -> C is Conway's Law, and the set of functors C -> S describes societies which are borne from the inner language of a program.
<TimMc>
I think of Conway's Law as much more specific: Communication barriers affect system design.
<simpson>
This second set shouldn't be "inverse Conway's Law". Bad name. For most programs, they only support the trivial society, with one user. To have something non-trivial, a functor would have to have an *image* of the desired societal structures expressed within C's logic.
<TimMc>
but I definitely agree that the phenomenon you're talking about is a real thing, even if I quibble with the name :-P
<simpson>
Yeah, that's how it started. But it's more general. Examples: White and Asian men write face classifiers; classifiers don't work well on African or female faces.
<simpson>
There's some *really* deep sociological stuff going on under the surface, and we could definitely pay more attention to it.
<TimMc>
sure, yeah
<TimMc>
that more general case of "who writes the software and how" -> "how the software works" -> "the kind of user behavior that is observed"
<simpson>
Yeah. "Who writes the social network" -> "How the social network connects people" -> "How people act under connection"
<simpson>
"How the social network rewards behaviors" -> "How people change behavior"
jemc has joined #sandstorm
isd has joined #sandstorm
nicoo has quit [Read error: Connection reset by peer]
<ocdtr_web>
I just learned something magical for batch files.
nicoo has joined #sandstorm
jemc has quit [Read error: Connection reset by peer]