Notices by alva (alva@beach.city)

And to think GTK is considered heavyweight.

Currently the RAM consumption of my Mastodon client and that of the web browser process running the Mastodon web client differ by two orders of magnitude.

@lerk With the Mastodon API, it seems like app registration can be done programmatically. So I suppose in this case, there's a third option: register a "new app" for each user.

The GNOME Guix package is a bit outdated :\

@pandora_parrot Thanks :)

@pandora_parrot Get an auth code for the client I'm writing. I found the OAuth docs. :)

@lerk They only display the app information, and I guess leave it to users to determine if it's legit or not. https://developers.google.com/identity/protocols/OAuth2InstalledApp#step-2-send-a-request-to-googles-oauth-20-server below that table is a note about the secret.

@lerk Yeah. There's two proper ways to do it with OAuth, as far as I know: each client has its own backend service, that handles all communication which reqiures the secret. The other way is to not require secrets. :)
Some OAuth implementations, including Google's, opt for the latter. I implemented the latter option at a big music streaming service, since everyone was leaking their secrets anyway, but it seems like it wasn't launched.

@lerk You can get them as easily as running strings(1) on the binary and greping for things that look like secrets. I've done this with several official clients. Some try to obfuscate it, but at some point it will exist in memory unobfuscated on my computer, and I can grab it.

@lerk It only makes sense for server-to-server communication. To make this "secure," one would need to request an auth code, send that to a backend, which in turn makes a request to the Mastodon instance with the code, client_id, and client_secret. Nobody does that, and so we end up with the current situation, where clients embed the credentials, and anyone can extract them.

@lerk But so can anyone else. I can take the secret and ID from another client, and use it in mine, so I don't see the point.

@lerk But what is it for, when it can not identify any particular client?

I see that it requires a client secret. But secrets aren't secret if you have them client-side.

Never mind, I think I found it.

What is the Mastodon URL that my client should open in order to obtain an authorisation code from the user? Can't seem to find it.

Another one that was in this batch, a highly unofficial Twin Peaks print

@kiilas Wow ⇔ true

@multiple_creatures I block them and it doesn't help. Smartphones are just bad. (My main, non-smart phone lasts at least a week, though.)

A trans guy telling me it took him longer to figure things out and transition because (paraphrasing) how could he be one of *them* is all I need to know to decide whether I want to participate in masculinity/man-bashing.