• 0 Posts
  • 9 Comments
Joined 1 year ago
cake
Cake day: June 13th, 2023

help-circle



  • I want to be clear, that I disagree with his “federation is stupid” point, but email has problems right now.

    Theoretically it’s federated, theoretically you can spin up your own mail server and self host.

    But even if you do that absolutely perfectly (SPF, DKIM, DMARC etc), you can falsely end up on spam list, that effectively block delivery of your email to large segments of the network for days if not weeks.

    Whilst theoretically federated, email falls under the broad dominion of google, microsoft and a couple of other large players.


  • JavaScript (TypeScript) has access to cookies (and thus JWT). This should be handled by web browser, not JS. In case of log-in, in HTTPS POST request and in case of response of successful log-in, in HTTPS POST response. Then, in case of requesting web page, again, it should be handled in HTTPS GET request. This is lack of using least permissions as possible, JS should not have access to cookies.

    JavaScript needs access to the cookies, they are the data storage for a given site.
    To protect them, the browser silos them to the individual site that created them, that’s why developers haven’t been able to easily load cross domain content for years, to mitigate XSS attacks.
    The security relies on the premise that the only valid source of script is the originating domain.
    The flaw here was allowing clients to add arbitrary script that was displayed to others.
    You’re dead right that only the way to fix this is to do away with JavaScript access to certain things, but it will require a complete refactor of how cookies work.
    I haven’t done any web dev in a few years, this might even be a solved problem by now and we are just seeing an old school implementation. 🤷


  • Threads will mainstream threads.
    Any good content here will be available to the Threads users, who will be oblivious to where it is coming from.
    Eventually, Meta will take steps to break compatability, and lots of the most prolific contributors from here will move to Threads exclusively (for a host of valid reasons).
    When it is no longer in Meta interest to federate, they will stop.

    The fediverse will continue, but it will be weakened by it’s temporary reliance on Threads (who could afford to host large images/videos/etc, have lower latency, etc etc).




  • Absolutely possible.
    The key to simple self hosting is to have a dns record that points to your externally accessible IP, whether that be your real one or an external one hosted at a VPN provider.
    If that IP changes, you’ll need to update it dynamically.

    It’s becoming increasibly common to be a requirement to do so as CGNat becomes more widespread.

    One of the newer ways to do that is with a Cloudflare Tunnel, which whilst technically is only for web traffic, they ignore low throughput usage for other things like SSH.