arcanicanis

Just a profusely verbose fediverse interloper

Public Key

npub1pmt6lj9sff80t4fvzn75d3j7g5kk9jjs537keafg0mfgykndymms5wd4ts

NIP-05 Address

Profile Code

nprofile1qqsqa4a0ezcy5nh465kpfl2xce0y2ttzefg2gltv7558a55ztfkjdacpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsqafld0

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1pmt6lj9sff80t4fvzn75d3j7g5kk9jjs537keafg0mfgykndymms5wd4ts

Show more details

Last Notes

2026-03-09 09:01:49 GMT

- reply

It's also conversely weird where people hold the belief that if they were insanely rich, that their life would be substantially better.
Yes, you would no longer have financial stressors (then again, if you're not stupid and blow it all and end up broke..), wouldn't have an obligation to work, but then some people also start to lack finding purpose or function in life on their own. You've 100%ed the game, what objectives are left?
But even moreso is all the fake people. That you could be a center of attention to a crowd, but where it's not genuine. It's not where [at least most] people even actually care about you personally, and are more interested about being in your proximity just for your status and money. If you're too notable, you can't live as a nobody anymore. You're also a magnet for the occasional crazy person that you've never met.
I remember there being a news article about one notable figure that had made it very big, that they felt essentially alone and depressed. There was such a condescending public response, of people mocking said person, as if it's like impossible to be a multi-billionaire and also be depressed, even as a genuine person (not like someone that faked their way and used people to get to their status, whereas in that case, it'd certainly be due).

2026-03-08 09:50:59 GMT

- reply

As is the situation of hitting OOM whether you have swap or not. Swap just slows down the time of getting to the threshold of the OOM killer being invoked. If you're pushing into the situation where you "need" swap, it's usually going to saturate swap too, unless you have like a +8 GB or so swap volume or something, whereas as far as I'm aware, most people only have a 1GB swap by default.

2026-03-08 09:30:46 GMT

- reply

Let the kernel kill a process in an OOM situation and continue to run just fine? Use a userspace OOM killer earlier before the kernel has to step in?

2026-03-08 08:27:16 GMT

- reply

I love swap completely slowing down the process of reaching the threshold to trigger the OOM killer to be invoked (if at all, and hopefully not stuck in the limbo in-between), thrashing my NVMe or SSD with useless activity for several minutes into hours, to sit and watch a system be so dogged down, that you can't even log into a virtual tty without it timing out (all while the kernel is actually responsive to immediately respond to magic SysRq keycombos). It's great.

2026-03-02 08:17:59 GMT

https://arcanican.is/blog/2026/no-fun.php
Had a stream of thought that I needed to get written down, as presented above. Just expressing a mix of thoughts I've had in recent years, and not to seek out sympathy or anything. I'm sure there's some other folks involved in hobbies or communities that feel the same.

2026-02-09 20:55:42 GMT

@nprofile…nptm Possibly to your interest, if you haven't seen it already: https://autocrypt2.org Apparently only 25 pages long, with seemingly clear and specific steps and some code examples (at least in cursory skimming): https://datatracker.ietf.org/doc/draft-autocrypt-openpgp-v2-cert/

2026-01-17 00:28:28 GMT

- reply

The gTLD expansion [lottery] itself is practically like AOL keywords, just with an extra word needed, given companies can just own their own brand TLD now e.g. .google, .microsoft, .netflix, .pfizer, .scjohnson, .skype(?), .toshiba, .vanguard, .vistaprint, and so so so many more)

2025-12-25 08:02:33 GMT

- reply

I guess that also serves as punishment for a particular VR platform forcing EAC, just to auto-moderate against ALL forms of client modding; while the better alternatives openly allow modding (as long as it's not for malicious purposes).

2025-12-24 10:38:26 GMT

I guess I don't really know what I want anymore.
Despite having all the simple necessities, as well as plenty of positive social interactions and other things lately (even much more social/active than I normally am), I still don't feel 'completeness'?
For 'career', it gets draining at watching much of it being rotted out for exclusively overseas hiring, much of it being oversaturated by the MLM and 'get rich quick' types running it, and very little of anyone caring anymore.
Finding some Significant Other or "gf" or whatever is something that's barely on any list of priorities, just something to only cause more problems, I haven't cared about it (nor bothered) at all far beyond a decade now, and I only see plenty of divorce and separation now. Add to the fact that Gen X usually characterizes it like they were lucky, "like getting on the very last helicopter out of 'nam."
It'd be cool to make more friends, but online there's a sizable portion that refuse to associate if you don't adhere to like 95% of their political platform, others that feel 'walled off' by being opaque and always distant, or those that just want to fuel division/drama and 'whisper networks' (sometimes even over people they haven't even talked to...)
Usually my lead motivating force is making demonstrable progress in my professional/hobby projects, but now I'm sputtering out. I had made a stint on some fun creative side projects, but that doesn't help get the important work done. Social activity isn't filling the gap either.
I guess in the worst case, if I continue to feel some level of incompleteness or mood fluctuation or whatever, that I could maybe finally get around to having some blood work tests done, just to make sure it's not neurochemical antics.
I usually try to avoid touching any sort of "self-pity" subjects, given that social media is a TERRIBLE enabler of creating professional victims/whiners. Of course I'm highlighting plenty of the negatives, but there are also plenty of positives too.
"It is what it is" or whatever.

2025-12-24 08:52:49 GMT

- reply

I thought that was the whole point of everything being dumbed down even further to Passkeys? (at least per my rant at https://were.social/notice/AxdaKM2AnM2pEVU8SO )
https://passkeys.dev/docs/reference/terms/#synced-passkey
But at the same time, I've given up really digging into the details anymore, given I've been trying to advocate real (not just "send you an SMS/email") two-factor auth since like 15 years ago, and it still barely ever having traction in any form.

2025-12-19 09:53:46 GMT

I keep building a pile of side-projects, and I'm sure that probably dries people's patience/hopes on earlier projects getting done (but I definitely will return to doing more ActivityPub and XMPP stuff again soon).
I guess I have a clearer set of ideas and design choices to make something more worthwhile to compete, for one niche that needs to be filled, and finding a decent middle-ground in expectations. Here's the design constraints/ideas I have:
Some video/voice conference system, reachable by some URL permalink, as a WebRTC web application, but intended for social/gaming use (not a formal 'professional' presenter-led conference system)
Real-time chat would be completely ephemeral and there would be no concern about enforcing log retention at all (maybe past 60 messages at most)
Instead, when there isn't a call, the same URL would serve as effectively a "sticky note board" where folks within the group would leave comments of when the next hangout is, or for folks to leave comments of not being able to make it next time, or that they'll be a little late, etc
Could also have basic polls or go in deeper extremes like offering a 'mutual date/time planning' calendar system (timezone aware), for planning the next meetup time
It would NOT intend to be another thing to add to the list of applications you keep open 24/7, and would by design be something you'd intend on peeking in at on occasion, usually where some reoccurring event/hangout/meetup is the foundation to a group
This could also serve in auxiliary function to things like tabletop sessions (or VTTs, like Foundry) and alike too
Or completely absent of using the video/voice call system, could be for in-person meetups also (and still provide a platform that someone could 'conference in')
There could be an out-of-band notification system (email, instant message, etc), to ping about announcements or provide reminders, but meant to be infrequent and not spam your inbox
This is to avoid creating another catch-all, please-all, multi-purpose do-everything chat system that nags your attention and expects you to "just install the app" to maintain functional usefulness of it.
And more importantly to help keep folks together, to actually be doing stuff together, and not adding to the pile of messenger crap they have to 'maintain' attention on.
Would there be anything else worth adding, or existing ideas to refine further?

2025-12-18 01:21:14 GMT

- reply

Here's some test fixtures you can play with:
https://arcanican.is/fedi/tests/25/timestamp-good
https://arcanican.is/fedi/tests/25/timestamp-bad
Try manually pulling each URL using the 'search' of your instance. First should work, the second is the date you describe. The latter fails on Pleroma apparently, as @nprofile…pvqa had mentioned.
I also have a query tool at: https://arcanican.is/tools/activitypub.php

2025-12-17 23:48:43 GMT

- reply

I guess by which context (server/client)?
At least from what I remember, most things are pretty tolerant. Sometimes shown in the order it was discovered in (at least in a timeline).
You can always toy experimentally with this by just static files of the JSON-LD context, as long as the correct media type is served. Mastodon (out of all other implementations) just tends to be the most fickle, expecting WebFinger resolution and a few other prerequisites (in terms of "test labbing" with static JSON files), while most others just simply need a resolvable actor object.

2025-12-17 06:39:23 GMT

Uh-oh, I guess my fate is sealed: apparently I've been a wirehead for a sizable portion of my Steam activity this year.
https://were.social/media/433b970d3edf1573d3f1deb7ced23790db55d03d73c8538b1e12a7d3e1a2ca8b.png
https://were.social/media/9f6e3f71acf4ad50a95894530e53b84c308861ac96c2a1505e76a4615b0af4c7.png

2025-12-16 08:24:00 GMT

- reply

I just gave up on Minecraft entirely after the forced Microsoft account migration. That's after having bought it in probably early 2011, and probably at least 400+ hours into it.
I've ended up just using Luanti with VoxeLibre to satiate my periodic itch for it at times, and it's rebuilt everything I remember of it, plus plenty of the newer content that I hadn't ever experienced in Minecraft itself after ditching out.
I think it's been substantially more performant, and also modding as a first-class citizen (you can even just join a server, and it can auto-download the mods or custom assets used).

2025-12-16 05:09:55 GMT

- reply

And oops, I hope I didn't ruin that for you >.<
No, it's fine. I just mean in terms of 'spoiling' it for myself by leaving it up to being an open world sandbox, not knowing the mechanics or sequence of events in advance.
Even just intentionally avoiding referencing a map (externally) can add to the humoring experience, because now you're completely lost, in middle of nowhere, sometimes in the dead of night, and having to unravel yourself from a pretty basic everyday mess. And that's what I appreciate about the game, is that it goes in the opposite extreme away from 'convenience' of a lot of modern games.

2025-12-16 05:02:20 GMT

- reply

I understand. I just generally had treated it as a blind experience, trying to avoid finding any methodical guides or tutorials; only digging into surface level details at first to maybe get a little bit further without 'spoiling' much.
Even just starting with the moped at the beginning was also an exercise.

2025-12-16 04:56:19 GMT

- reply

Old mansion, for skipping ahead and getting tires quicker on a fresh run. There are ways to handle the bees, just sometimes a little finnicky; or also I think time-of-day stuff, but I can be impatient. Invariably, it's still all a humoring experience anyway.

2025-12-16 04:51:39 GMT

- reply

I still haven't even fully finished the first game still, after about +68 hours of playing only permadeath mode. :P
Perhaps I should return to trying to pull that off yet. Those heckin bees in the abandoned shed though..

2025-12-16 04:47:18 GMT

- reply

Oh nice. I guess I'll have to plan on not getting as much work done in late December/early January then.

2025-12-16 04:36:20 GMT

- reply

Ooo, I am genuinely eager for the [eventual] release of My Winter Car. It's very rare to find the folks that appreciate obscure titles like MSC.

2025-12-16 02:02:32 GMT

- reply

But the long-term plays out a whole lot differently than you expect from the short-term you envision.
Even if say such an incident happened, how do you hold with such certainty that no force is going to sweep in, use the 'opportunity' as an excuse for something even more of an 'authoritarian' powergrab, 'fascism', or some of the like?
There are plenty of examples in just the few recent decades of how an incident can be weaponized into something else.
I don't know. I don't have any single person I could name that warrants any sort of termination, and usually it feels like a warning sign of someone not seeing the broader sociology of things, or being constantly fed an extremely tilted worldview, especially when they're gauging someone solely by public appearances, of the snippets they see. Even in partisan politics, there's still nobody on "the other side of the fence" that I'd be cheering for the fatal demise of.
I hold a great disdain for mainstream media, and their capacity to grossly distort, mischaracterize, and even flip public perception on situations (e.g. like "the repeat felon that curb-stomped babies is actually the real victim here" kind of crap). Even in my most dark psychopathic fantasies, I still cannot logically see any situation where some 'politically-motivated assassination' turns out to a net-positive, because there's all that capacity to turn it into a weapon that can be used back against you with even far greater force.

2025-12-16 00:02:22 GMT

My Modus Operandi
I'm probably not a socialite nor a regular to social media, most of my interaction occurs through chat or other realtime mediums instead (I should be 'approachable' on any platform regardless). I can be totally silent here for weeks, while still actually being here almost daily. I don't know the 'unwritten rules' in microblogging, so I'm sure I break supposed decorum plenty.
I'm very selective in who I follow, typically only following "low frequency posters", while I do very much manually navigate interesting "high-frequency poster" accounts periodically, by checking their posts [anonymously] directly on their instance. If you're a high-frequency poster on an instance that prohibits anonymous viewing, then you're unfortunately invisible to me.
While I may carry a negative sentiment towards specific subsets of people, it does not mean I carry those sentiments towards individuals (e.g. while I hold a disgust towards, say---Microsoft, it doesn't mean I automatically hate your guts if you're a Microsoft employee/contractor).
Debates/arguments are emotionally compartmentalized. If I'm arguing over something, or if you piss me off, it's almost never held against you. Sometimes my writing might read a lot more charged than what's intended. You can be diametrically opposed to me on almost every belief, and I can still be mutually friendly, as long as I'm not being routinely dragged into every "whataboutism" of the day, or expected to act as the spokesperson to every clickbait headline.
I usually don't try to initiate interaction with people across instances, unless it's clearly some informational prompt that I might be able to assist in. Otherwise if it's just social, I usually keep my distance: because there usually seems to be a hidden "social barrier" of being walled off from others, that I usually don't bother much anymore.
I am vulgar, but I will sometimes try my best to match the respective tone. If it's a professional context, I'll try to remain professional. If you're a bad actor just trying to play an optics game, I will just inherently be a dick back.
DO NOT ever try to control who I'm "allowed" to communicate with, what I'm allowed to participate in, etc. Sometimes I do have a hidden motive of trying to lead people away from dark places, meanwhile people aimlessly trying to disrupt that in some 'social justice!' agenda just end up f'ing it over entirely, and just produce a net-negative outcome all around. Invariably, expect that I may periodically jump in on some 'colorful' discussions, or interact with unusual characters.
I am fairly hard to 'weird out' (where it could almost be a sport in itself), so don't worry too much about impressions, if you reach out. You could literally come out of left field, talking about what my blood type is, life history, etc, and I'm not going to panic or anything. I have/had folks that could be categorized as stalkers (locally), and I manage to befriend those too. Just don't be the type to be showing up at the home of any of my family/relatives; nor just be some coomer seeking out someone to RP with (or something?) at all costs, with no substance in even basic conversation (as I've encountered when I had a character...).

2025-12-15 22:13:34 GMT

- reply

I have a different tilt on this subject, but I'll address the foreground points first:
Yes, FOSS is just as prone to supply chain attacks as proprietary software is, though I argue you still have more transparency than a proprietary project
OpenSSL had very plenty of folks arguing the project was an unmanageable mess (for all the #ifdefs everywhere; sometimes even nested by several levels) long before Heartbleed, just nobody bothered to back any alternatives, I assume just because nobody'd back something "not as popular" as OpenSSL?
I hold plenty of spite with some of the PR around Signal, as well as sentiments by Moxie Marlinspike, or even the latest "but we 'NEED!' AWS, why can't people understand this..." cope post; but that's probably a separate dissertation entirely.
I have annoyances with the Signal client itself, of how rapidly they shove out updates (I assume bumping library versions, etc), that I doubt I'd have the patience to keep up, if I wanted to pull the fools game of completely picking it apart (and I doubt anyone defending it has audited it for themself).
I just prefer small, minimalist solutions, and where libs are only imported unless absolutely necessary, and where there's not more risk in creating an ad-hoc in-house counterpart (e.g. I probably wouldn't trust myself to safely implement ECDSA sign/verify myself, maybe)
Culturally the parts that piss me off with open source and free software (but not anything to make me forego or stop supporting it):
It's almost all about "free as in [free] beer" now, people generally don't care about the "freedom" part in it anymore. Corporate influences are also obviously trying to steer people away from free software licenses too.
A lot of big projects now are just effectively as indistinguishable from proprietary software in terms of modability. Even sh't web applications like Mastodon, as far as I understand, require a rebuild of the software just to change a favicon even, and sometimes made very specifically to prevent you from making deviations.
Much of it's in corporate style development practices, of such class-heavy design patterns, like the design patterns you'd use to dumb something down enough to throw at an army of code monkeys to chug through writing, rather than something focusing more succinctness, minimalism, etc.
The "I'm going to shut off my brain, and import any lib, that solves my problem, without having to exert brain power". Queue the memes of someone importing a Nodejs module to uppercase/lowercase-transform text. This is the crap that exacerbates sourcing attacks, as aforementioned. It's even hilarious when people import something for a role, having zero idea of the capabilities of said thing. Wait a minute, you say Markdown supports inline arbitrary HTML? Surprise! You now probably have an XSS vulnerability you weren't expecting, because you didn't read the freaking tin.
The weird sort of monoculture that people try to force. People will actively try to talk you down over making a competing open source project, because "Z exists, it's already 'good enough', why are you bothering?" Same also with the herd mentality of people only clinging to whatever is "the most popular", viewing anyone that uses something else as weird, even if there's a broad divide where alternatives carry far more meritocratic value than the "most popular" option.
BUT MOST IMPORTANTLY ABOVE ALL:
How utterly, thoroughly, lazy and apathetic people are now to just writing any code at all (outside of career), and all the people that are so eager to be backseat project managers who probably have barely even written any code at all.
The bar is so, SO low for anyone to start poking around with software development, but they don't.
People may complain about some project lacking a feature or functionality, or some way to do something different, but they will NEVER ever take any actionable effort to actually doing anything. They've uttered it, they've snapped their fingers at someone, and that's all the exertion they will do, ever.
A high school aged kid in present time could trivially make a Discord replacement with video/voice WebRTC calling, with all the resources and existing backend tools that exists, pieced together, with a little bit of code glue here and there, but people don't. You might see one or two projects pop up (a la Revolt, etc), but everyone will just be sideliners, observing from the outside, but never take action themselves, but always armchair critique instead.
I don't know if it's just the constant supply of all these VC startups with introductory "free" offers, that have made people so grossly entitled, to just sit back and expect everything to just 'appear' for them, with no effort, but it's depressing how unwilling people are to MAKE things anymore. e.g. I can find plenty of chats with protocol discussion, but no action on implementation, almost ever.

2025-12-15 21:18:26 GMT

- reply

As in to just traverse their outbox and save all the posts in bulk (with/without attachments); that should be a trivial one-day project. Unless you mean storing the HTTP Signature also, now that's a separate story.

2025-12-11 20:48:19 GMT

- reply

I'll probably draft something then, post it for something to sit around for 2-3 weeks for comment, and if no complaints, "formally" submit as a FEP draft then.

2025-12-11 01:51:29 GMT

@nprofile…d3ed Are there any FEPs for object expiry? Had some ideas recently, while also peeking at Nostr, which has their counterpart: https://nostr-nips.com/nip-40
There would be no expectation as some privacy/'security' feature, as it would be MAY rather than SHALL, and generally just to keep databases from permanently storing superfluous ephemeral events. This would be in scope primarily with servers and not so much with affecting client behavior.
This specifically would be ideal for things of short-term or instant messaging contexts with ActivityPub; perhaps also outlining some recommended defaults. e.g. instant messages that have an expiry of 30 days, music/game scrobbling events of a 5 day expiry, etc.
Nonetheless it would help cut down clutter and make it less painful for using ActivityPub as a transport for ephemeral content too.

2025-12-08 01:39:51 GMT

I guess one effect I still miss from the Beryl/'Compiz Fusion' era of Linux compositors, was being able to use Ctrl+Scroll to adjust the transparency of a window. So I could have a movie playing, drag a terminal over top, make the terminal semi-transparent, and be able to mentally switch focus between the two, without having to look between screens.

2025-12-04 23:54:29 GMT

- reply

I worry that you might be trying to force a conclusion to prove an argument point; but also, trying to narrow to only two 'extremes' being possible.
The reason 'why' a person wouldn't go "all-in" (assuming that's what's implied) is: because it's fun. If the measure of your results in a creative project is assessed only by the quality of it's outcome, then you've already killed some of the fun of it.
(queue the Mr Rogers snippet that people usually reshare https://www.youtube.com/watch?v=w7hT_VlIyiE )
In fact, I've even been drafting a little short story since about 2 weeks ago (which came completely out of nowhere), also poking a little on some of these subjects (I can PM if desired), and for context: I don't even read fiction, I haven't even written anything remotely fiction in probably +15 years (back to the forum days), and my work is probably rife with errors, but I don't care: I had plenty of fun and a momentary 'escape from reality' in making it.
Similarly with artwork: I have a whole graveyard of projects that never see the light of day, primarily including a lot of Blender sculpts, but I think some of it's getting better over time. Some of it also leads down other paths, like just yesterday I was trying to 'Frankenstein' different portions of skeleton models together, and warping and shifting things to meet more neatly, to see if I could make a believable canid taur skeleton (and probably even go deeper) for shape reference. But again, this isn't seen, because it's usually small [often unfinished] concepts.
Meanwhile, in respect of generative AI and such tools: I argue that there's the capacity to use it in an augmentative fashion; where you're not necessarily "replacing" people (maybe freeing up some people from 'bitchwork', for certain grindy tasks), but letting an artist speed up certain portions of a commission. Where is the ethical/moral qualms in: 'training' some tool on your lineart style, and then using it to speed up lineart work, as long as it's clearly disclosed and agreed with the commissioner first?
Also I struggle with some aphantasia sometimes as I can vaguely mentally visualize things, but it's usually a narrowed focus and not a holistic picture. Unless I can layout a very specific color/detail reference, I'm probably going to end up driving the artist goddamn insane (e.g. my last commissioned work). Whereas if I can generate some more specific mocks, wasting AI's time instead of the artist's time and patience, I'll opt to save the artist's time. (I am also texture painting a taur model to try to settle on a final coloring; I can also feed it through img2img and perhaps get a better preview of the colors and fur/scales pairing; to then finally settle on commissioning a new character sheet)

2025-12-04 22:20:17 GMT

- reply

For the design of the format itself, or just simply the user experience (e.g. not universally supported in all OS-provided image viewers)?
Nonetheless, at least JPEG-XL is getting hopefully another chance.

2025-12-04 22:13:42 GMT

- reply

Oh it has for keyboards? That's neat. I probably wondered about that too, but never really dug on it.

2025-12-04 22:11:50 GMT

- reply

Speaking of Wacom and mice: I'm still idly curious why nobody's bothered to make a "pressure-sensitive" mouse (e.g. with soft actuation, and the pressure would be measured like pen tablet input), for cases where breaking out a drawing tablet might be excessive (e.g. some Blender sculpting tasks). I wouldn't be surprised if Wacom (or somebody) sits on a weird patent for something like that.

2025-11-30 07:43:40 GMT

- reply

I think some of the argument could be constructed off of not pinning down specific styles, LoRAs or other factors, and just generally prompting it broadly. Because without that, you're probably just getting the full "sum average" of all styles blurred together, in a way. Also considering the "guidance" control (where you control the dynamic of: either sticking to prompt as tight as possible, versus having liberty to add variety, chaos, or wandering off just a little)

2025-11-24 13:58:31 GMT

- reply

I think part of that could also be because of some of the earlier stuff might have been by folks more familiarized in publishing, given a lot of the pre-internet fandom stuff was actually through "zine" culture, of folks sending in their artwork (by physical mail), someone compiling the submissions into a publication, and publishing essentially an art-centric indie magazine. But of course, a lot of that's far before my time.

2025-11-20 00:00:40 GMT

- reply

Honestly, the more I look at this listing, the more it pisses me off:
2-4 years of 'relevant' experience Knowledge of sysadmin and Linux skills
Contrast that to US job postings, for substantially lower entry-level positions, you'd typically be seeing memes like "4-year college degree, 10 years experience in X, 5 years experience in (technology that's just 2 years old), at least these 3 certifications (that cost like $600 each, to take)"

2025-11-19 23:54:34 GMT

- reply

So while Cloudflare had their latest hiccup, apparently a customer wants to use Backblaze instead; so I do a quick query: https://job-boards.greenhouse.io/backblaze/jobs/4771111008
Uh yep, I guess they'll just hire someone from there, to one of the higher privileged roles in that company.
Then a local friend that apparently holds a head IT position in a local regional chain of hospitals/clinics: apparently all their coworkers were just laid off and replaced with outsourced 'talent'.

2025-11-18 20:35:57 GMT

- reply

I'm pretty certain my XMPP server has far more uptime than Discord has had, my fedi server has more uptime than X has had, and my self-hosted email more than O365/Azure has had, all by just not using Cloudflare and just running on a basic VPS.

2025-11-18 20:30:59 GMT

- reply

I love the irony of the situation so profoundly more, because of the dumbest exchange I've had with a customer, in this week, and later hearing today of Cloudflare go down just warmed my cold, dark little heart:
A vendor wanted an arrangement for handling backups for their webserver, for all their hosting customers. They mentioned their concern, specifically highlighting about all the recent cloud outages.
I offered a plan of $40/month of managing backups for the whole server (meanwhile, they currently charge their customers ~$100/month, each; of approx 40 customers so far; that's ~$4,000/month revenue they get, with just hosting; and they pay for just one $24/month Linode VPS, as their costs) for a max of 500GB. They didn't want that, they clarified that if I physically possess the server (or they physically possess it), "then it's not a real backup".
Instead, they wanted to find "the cheapest" cloud storage, and despite heavily warning and prefacing the ways that object storage can be mishandled and other risks, that Cloudflare R2 could be one option. However, I will not give any uptime/availability/warranty assurances to the service if it's on Cloudflare or other providers (because I don't run Cloudflare, I don't run Cloudflare's servers) instead of my infra, but apparently that's not good enough of an agreement and they'll be finding an arrangement elsewhere.
I'm so tired of trying to negotiate, with people that have such irrational logic, that also charge an extraordinary amount to their customers, reselling off of someone else's platform for cheap, and then turn around and nickle-and-dime me over anything I offer.

2025-11-15 03:23:30 GMT

- reply

Retvrn, with SerenityOS
https://were.social/media/d451c423708df4e0cb247c2e019040d521e65bd3e56f466ecebd29f5d31079c5.png

2025-11-14 06:39:52 GMT

That could be an interesting concept/trend: hosting providers where the users of a hosted service could just directly donate towards the provider (on behalf of the hosting customer), while having some mechanism for attestation on-platform that they were the donor of said funds.

2025-11-12 02:06:13 GMT

I was recently contemplating ways to get a person's "currently playing" info (given there's no local API to query that directly from the Steam client, for example), then it crossed my mind that a Steam game's AppId might be passed through launch arguments, and apparently that's the case (for example, ATLYSS):
somebody 576533 0.1 0.0 29480 23876 ? S 20:40 0:00 /bin/sh -c /home/somebody/.steam/debian-installation/ubuntu12_32/steam-launch-wrapper -- /home/somebody/.steam/debian-installation/ubuntu12_32/reaper SteamLaunch AppId=2768430 -- '/home/somebody/.steam/debian-installation/steamapps/common/SteamLinuxRuntime_sniper-arm64'/_v2-entry-point --verb=waitforexitandrun -- '/ext/SteamLibrary/steamapps/common/Proton - Experimental'/proton waitforexitandrun '/ext/SteamLibrary/steamapps/common/ATLYSS/ATLYSS.exe'
somebody 576534 0.1 0.0 29004 5756 ? S 20:40 0:00 /home/somebody/.steam/debian-installation/ubuntu12_32/reaper SteamLaunch AppId=2768430 -- /home/somebody/.steam/debian-installation/steamapps/common/SteamLinuxRuntime_sniper-arm64/_v2-entry-point --verb=waitforexitandrun -- /ext/SteamLibrary/steamapps/common/Proton - Experimental/proton waitforexitandrun /ext/SteamLibrary/steamapps/common/ATLYSS/ATLYSS.exe
somebody 576843 10.3 0.1 232648 60504 ? Sl 20:41 0:00 /home/somebody/.steam/debian-installation/ubuntu12_32/gameoverlayui -pid 576734 -steampid 3248 -manuallyclearframes 0 -gameid 2768430
Then I was having a concern of whether I'd have to query third-party platforms (e.g. SteamDB), just to infer the info about a game, from just it's AppId, but I guess there's actually an open, unauthenticated JSON API to query that data directly from Steam: https://store.steampowered.com/api/appdetails?appids=2768430
So as it stands, it wouldn't take much for a person to write a plugin to whatever XMPP (or etc) client, to push out that data, for those that want that visible.
Meanwhile, for open source launchers (e.g. Lutris), I'm sure someone could probably devise some userspace D-Bus API or something that a person could push that info locally (versus having to infer it off of running processes and their args).

2025-11-09 10:03:29 GMT

Just doing some restructuring and refinement of my personal website thing, and got around to writing out one article I've been meaning to for a while now: https://arcanican.is/blog/2025/toxic.php
Title: The Catch-All Brain Shutoff Word: Toxic

2025-11-08 19:50:17 GMT

- reply

I wouldn't even say it ends with switches to macOS/ChromeOS. I'm saying the people that claim to holdout on their 'preferred' version of Windows, it always ends up like: "oh shoot, my computer died, and I needed to 'be able to get work done', so I had to get a new computer with $NEXT_WINDOWS_VERSION (or sometimes it can be as shallow as some new game release that's not supported by their holdout option)
Usually it's the people that don't make that claim, that usually will simultaneously pursue other options (macOS/ChromeOS/Linux/etc), before any sort of disruption or whatever. Whereas for the other type, the "I'm holding out longest I can", will virtually ALWAYS compromise on their claim, as an ever-continuing cycle, whether its from Win7, Win10, etc

2025-11-08 19:33:28 GMT

I think the most consistent lie I've heard over the years is "yea, I'll holdout on my current copy of Windows until it's no longer viable, then I'll switch to Linux".
Adding to the broader subject: I don't even know what barriers are left for Microsoft to cross to alienate it's customer base that it hasn't already done. I think the only thing left they haven't done yet is just blatantly turn into ransomware, demanding you to do some action in limited time, or else face total data loss.

2025-10-30 06:52:49 GMT

Had to update a few things
https://were.social/media/3bb059d735489bde8751ab702f7fb9d227681dff2f6f96908d7ab7c022a18754.png

2025-10-25 00:51:32 GMT

- reply

Server-Sent Events For the ActivityPub API
Introduction The ActivityPub API is a RESTful interface for social networking servers. (...)
Oy, that is such a horribly summarized description that it's painful to read, especially as some W3C spec draft.

2025-10-25 00:19:34 GMT

Just me hangin with the usual crew on fedi
https://were.social/media/b9115e08828a7dd5a67cc1a93978f721c5bc48e17b386885c3105a9b81a1dd1b.webm

2025-10-20 02:01:41 GMT

Great, the "non profit" ICANN is opening up another gTLD expansion in 2026, for companies to ~buy~ "bid" more new TLDs for possibly a couple million dollars each (if I'm not grossly misunderstanding or skimreading it).
https://newgtldprogram.icann.org/en/application-rounds/round2/agb
https://newgtldprogram.icann.org/en/application-rounds/round2
https://were.social/media/de6cb5ef2ce5eb9b32232c14fa8df4a1df3f9b4dc8fa73b9ea38887159e232c7.png

2025-08-16 06:39:21 GMT

Alright fedi, I think I have an idea. Since fedi tends to be a relatively chaotic lawless space, perhaps it might be fitting to claim some spot in international waters as a drawspace for the fediverse.
Just to mark a random starting waypoint: https://wplace.live/?lat=40.823054967578614&lng=-173.87094759697266&zoom=12.584444460111722
As a forewarning though: the platform disgustingly only permits Google or Twitch as login providers (and prohibits accounts that are 'too new'). It at least assigns a randomized handle rather than publicly showing the account you authenticated under.
It doesn't seem to be as tedious as previous public canvases; I'm able to draw 60 pixels right away, and supposedly refills at 1 pixel each 30 seconds.
I'll actually screw around with it further if there's some mutual interest out there.

2025-07-12 00:56:45 GMT

- reply

I used to avoid KDE back in the day given it used to be very unstable, especially at the initial introduction of Plasma, and used to tolerate GNOME 3 for quite some years. But obviously everything's flipped and it was a mistake to prop up GNOME 3.
I understand the point with GNOME 3 was that you generally had a clean slate to build your own preferred desktop using extensions, rather than just using it solely as-is. But it gets straining when you lose all your customization any time GNOME crashes and disables all the plugins, and makes it virtually unsupportable for any normie users (especially if they're relying on things like Dash to Panel).
Also doesn't help when it probably adds another GB of RAM to implement the concept of window previews, in JavaScript, for things like Dash to Panel; when all of that is provided out-of-the-box in KDE far more performantly.
Also discovered in the past year that "Wobbly Windows" effects and such as still supported out-of-the-box in KDE's compositor, and of course I'm a sucker for those dorky effects.

2025-07-12 00:30:55 GMT

- reply

I understand they're a large contributor to GNOME, and employ a few developers to contribute to it. But it's a bit of a regression from offering KDE back in RHEL 7, but removing it in later releases when it's the far more stable and reliable option over GNOME (especially in a Wayland context).

2025-07-12 00:21:35 GMT

Why does RedHat have to keep sawing themselves off at the legs? Was going to do an RHEL 10 workstation install, but apparently the ability to install KDE has been removed since a few releases ago (as a first-party option; not talking EPEL). This also makes it a bit ironic, as RHEL 10 is to be "Wayland-only", and if they don't ship KDE as a first-party supported option, then that means a GNOME Wayland-only desktop, which is probably the worst possible option.

2025-07-10 17:49:54 GMT

It's almost astounding how much time that so many people will dedicate to arguing about management and direction of open source projects, by people that never write any code for any of those projects or anything even tangentially related.
You could probably find 10,000+ people with an opinion on how X11 or Wayland should be developed, but probably only 15 people that'll even work on either field of projects, all while everyone else talks like they're a developer in that field.

2025-07-05 19:52:20 GMT

I think any curricula solely focused on just teaching someone a programming language, is kind of pointless.
I think for some real-world objectives to actually learn how things work, be more well-rounded, and understand how simply some things can be implemented, could be objectives like (after getting the basic concepts would be):
Develop something that can read/write a particular file format
Develop something that implements a network protocol
Write a basic parser (JSON, XML, etc), as bonus points
Some examples being: a primitive HTTP client, a basic IRC bot, an SMTP client, read an ODS/XLSX spreadsheet (with an XML lib), a PKZIP or tarball reader/writer, etc.
Projects like that would be astronomically more empowering than the ridiculous joke of what I see with people doing college courses, such as prompts like "write a C# class for calculating the total price of a sale at a lemonade stand (using floats even...)"

2025-06-30 20:02:18 GMT

- reply

There’s Gajim, Kaidan as well, and they are both broken, unable to make audio calls work in my tests.
For both sides of the call, did the servers (used in the test) have properly deployed STUN and TURN servers? Because if those aren't available (deployed on each server, of each recipient of a call), you're likely not going to have proper call connectivity.

2025-06-30 04:53:22 GMT

- reply

Any of the Half-Life titles are stupid cheap, if for some reason you don't already have them. Even HL1 still holds value today despite age.
Darkwood ($3.74 instead of $14.99) Very atmospheric (especially the ambient audio and music) and detailed top-down survival horror. Despite the style (top-down) it can actually put you more on edge than the Penumbra/Amnesia games (at their peak, when survival horror wasn't an oversaturated genre), as it seems a little more dynamic, and just the general theme of the game.
Rain World ($8.74 instead of $24.99) Generally focused on intuitive puzzle solving around platforming, can be pretty challenging/unforgiving (but not to the caliber of things like Super Meat Boy or whatever), also heavily focused on some survival elements. The interest is the discovery and exploration of it's unusual world, biomes, and ecology. It has some extremely detailed simulation mechanics to the creatures in the game (and how they interact). It's a game where you generally discern things for yourself, versus things being outright told to you (there is almost no text at all in the game, aside from the beginning intro).
Fallout New Vegas ($4.99 instead of $9.99) Probably one of the most universally liked Fallout titles
West of Loathing ($3.40 instead of $10.99) Point-and-click adventure, has quite a bit of playtime in it; can actually be entertaining despite impressions from static screenshots
TIS-100 ($3.49 instead of $6.99) Unusual programming game with a basic Assembly-ish language, odd constraints, unusual fantasy hardware platform
POSTAL 2 ($0.99 instead of $9.99) Edgy open world first-person shooter game with a day-by-day mission checklist structure
Antichamber ($4.99 instead of $19.99) Neat non-euclidean puzzle game
Psychonauts ($1.99 instead of $9.99) Sort of toony platformer adventure game
Getting Over it With Bennett Foddy ($1.59 instead of $7.99) If you're a mental masochist (rage games), this might fit. Ironically I can find it moderately "relaxing" in some contexts. Originally I didn't really care for difficulty and challenges in games (in general) as I'd usually lean more towards story-driven or exploration-oriented games, but this game serves as a fair challenge and exercise into preserving through a basic adversity, and makes a fair critique against games becoming grossly 'over-accessible' and the watering down of any sort of commendable challenge in games anymore.
(yes, I stole a few recommendations from @nprofile…yr5d 's list)

2025-05-28 19:09:02 GMT

- reply

Whichever amount makes sense (3 is fine; or front and back isometric flats for coloration, 3rd for angled perspective of standard posture or something). Normally I dump at least $350+ equivalent on character sheets, so whatever would be fair in that budget.

2025-05-28 18:37:31 GMT

- reply

I do have a character sheet commission that I would likely take you up on that offer (when open), whenever I get to a more complete idea (still trying to fine-tune details on color pattern and palette; but generally it'll be some form of a scalie canid, which there aren't too many of)

2025-05-28 18:22:40 GMT

- reply

I don't care if a commissioned artist leans on AI for insignificant details (e.g. background details, basic pose, etc), it's more about whether: they're reachable outside of sh't platforms (e.g. not staying exclusive to FA notes for commissioning or something similarly absurd), they have an art style I hold interest in, and they accept some form of semi-anonymous payment (e.g. not PayPal, whereas most cryptos would probably be fine).
It's generally the last detail that's the primary blocker of why I don't commission much anymore.

2025-05-13 17:46:41 GMT

- reply

I assume it's probably some over-/misapplication of it, of companies trying to use it as an 'every' tool, spammy notifications/reminders, various integrations of counter-productive value, and probably a boat anchor to self-host (for those that do anymore, given it sounds like they've cornered everyone into their SaaS offering).
But this is just my second-hand interpretation of what I passively observe off others, I don't interact with it myself either.

2025-05-08 05:06:26 GMT

- reply

I assume Owncast doesn't have any sort of functionality for seeding streams between viewers yet?

2025-05-04 02:15:05 GMT

- reply

The "insult to injury" in all this, is that I just want to write a plugin for Cockpit that's visually consistent with the Cockpit itself.
But I also can't use the Cockpit's copy of PatternFly, because they keep switching between versions, and evidently it's just 'too hard' to simply ship separate major versions as separate files; ergo you can't use Cockpit's copy, you have to ship your own. Originally on v3, then v4, v5, and now it's moving on v6.
They even complain about breakage within a major version, but yet this is all entirely within the same company (RedHat): https://cockpit-project.org/blog/cockpit-221.html
Instead of writing my plugin, most of the time will probably be wasted with just dealing with the CSS UI framework itself.
And of course when I do npm install on the demo plugin, it pulls in 214MB for effectively a "hello world" project.

2025-05-04 02:04:30 GMT

..."modern" CSS frameworks feel like a mental illness.
https://were.social/media/696e314d7e046d8f2b84859b5ec3a4802dfe9baafff3d4ab429b9ca48b94c393.png

2025-04-30 17:16:54 GMT

- reply

I guess I'll participate:
https://were.social/media/69b17df4ffc35768902431ff24549f971ce0238e872622cff7cfdea5a715dda0.png

2025-04-24 03:36:37 GMT

- reply

I mean even with FrontPage you at least had some direct correlation with the output HTML (aside from the extra cruft it'd add), versus this present day of people that call themselves web designers that don't even know what HTML/CSS even is, and scoff at the idea of ever learning any of it. Or those that cannot solve anything without some framework to 'think' for them.
I started poking around with HTML when I was like 9 years old, using a site builder program that was preinstalled on some early WinXP-era HP prebuilt, that tries to funnel you into using Tripod/Lycos as a hosting provider at the time.
The difference is that I grew up and I always seeked out new things to learn, and to expand deeper into learning anything I can in any of it. Meanwhile most of this damn present-day 'web design/dev' industry is people still riding around with toddler training wheels, solely to stay within their comforts, and they somehow manage to be taken seriously.
There's another local that is trying to run a webhosting company (that they bought out), effectively treating it like no more than a free money machine, and they don't even want to try running a homelab server to try to learn any entry-level Linux sysadmin stuff. It's so demoralizing when this is all I'm surrounded with.

2025-04-23 19:42:36 GMT

It's exceptionally vile how saturated the tech industry is with people that have no idea what they're doing, that act as if they're a "pro!", when they are the very reason there's major security incidents, or end up as another statistic of a botnet.
Everything is entirely about comfort to them, they don't want to adapt or learn, they just want to slap everything together with options that make them feel comforted and empowered, and never call in specialists where necessary.
Just as how dangerous a point-and-click Windows sysadmin with heavy Dunning-Kruger effect is, there's very much the same counterpart with the average idiot calling themself a web design agency because they know how to install WordPress (if at all, if they don't lean on something else to do that for them).
For something that could be done effectively in 50 lines of code (or sometimes basic sysadmin knowledge), they will instead go out to find a scatter of 3 different plugins to accomplish the same task, of dubious authors/quality.
Because they don't know how to code, and because the built-in block-based visual editor is "too confusing" for them, they will instead install a whole suite of another entire visual editor (Beaver Builder or Elementor), all entirely around their comfort. This crap can take up to 1GB of RAM to fulfill one web request, and they never see this as an issue (contextually: 1GB to generate +150KB of output).
Latest exhibit is an unfinished e-commerce website, that's had two other contractors they went to first, whereas after each contractor they'll pull me in solely to be the janitor and clean up others' work, usually starting as a call in middle of the night (phone ringing at 11pm/midnight in US Central), but they'll always cancel any subsequent work that needs to be done, and go with someone else instead.
Same thing happened again: they call me in to be the janitor in the middle of the night, they can't even be bothered to remember my email address (and ask for it to be spelled out for the +10th time over the phone), and when I check out the same project now, it's even exceptionally worse.
First time I've had to "fire the client" (after 2 years of this across other situations), and here's a video meme I've made of the actual plugin list they've amassed for a site that's supposed to be 'trusted' to process credit card information. (For context, only ~5 plugins would be necessary, if done competently. One plugin name is censored, because it has a contractor's name)
https://were.social/media/e87c52060981a1a3611c9c7d79e41b9c1de63e0e63a2f803677ac1e18b71ec8b.webm

2025-03-03 20:45:15 GMT

- reply

Just even the state of boot firmware on mobile devices is insane.
Imagine if new desktop motherboard's firmware were hardcoded to ONLY directly boot Windows 11, ONLY in a very specific partition layout, specific to that motherboard (at least in the case of a prebuilt). Antitrust enforcement would probably be all over Microsoft on that; meanwhile this is the state of mobile devices, and Apple/Google get a free pass (presumably because it's a duopoly and not monopoly).
And I'm not even speaking about SecureBoot, I'm saying the boot firmware of these devices are specifically that: just an OS bootloader right in the firmware; no configurable MBR/UEFI pre-boot environment anywhere.
Free market would allow someone to make something better, but either everyone's spineless or careless, or perhaps Google contractually obliges handset vendors not to (in exchange for Google Play Services licensing or certain logo certifications).

2025-02-19 05:16:57 GMT

Just as I was rotating keys, I peeked around and noticed this is a currently ongoing project: https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/

2025-02-18 00:39:30 GMT

- reply

Yes, that would be an option, but I lean more heavily towards "less is more" and minimalism. A drawing canvas is generally like one of the beginner textbook example projects for HTML5 canvas stuff. The only possible source of complications is UI accommodations for mobile.
Maybe 480x360 might be more workable for a canvas, as drawing to a square might be weird.
I think just a flat non-layered raster is all that's needed. A bonus feature could be some basic animation option (like up to 10 frames or something) that'd maybe export to an APNG or whatever format is stable/workable (or just plain ol GIF), which I'm sure would be like crack to animators (given Flipnote or whatever was popular in previous years for that).

2025-02-18 00:11:16 GMT

- reply

I mean more in regards of the design considerations:
Should it be raster or vector?
Anti-aliased brushes or not (or both)?
Full color or pallettized to a specific set of colors?
Should there be a standard resolution or a resolution limit?
Option to import/remix other folks' drawings, etc
Because otherwise a basic thing could be done in like <100 lines of JavaScript and <canvas>, meanwhile the selection of design choices either makes or breaks it.
I live too deep under a rock to know how Miiware or other successful social stuff was designed.

2025-02-17 23:18:45 GMT

- reply

What would be some worthwhile constraints and features, if it did?

2025-02-17 19:38:18 GMT

- reply

Or mentionably the stance is even far beyond Stallman himself: https://stallman.org/stallman-computing.html
As for microwave ovens and other appliances, if updating software is not a normal part of use of the device, then it is not a computer. In that case, I think the user need not take cognizance of whether the device contains a processor and software, or is built some other way. However, if it has an "update firmware" button, that means installing different software is a normal part of use, so it is a computer.

2025-02-17 19:24:19 GMT

- reply

After all, there are a lot of things that could be confused for an autism diagnosis
https://were.social/media/eec8baf51b980c3e526032e3d8230c2ed35a574c2111bf00118c46565524d5f3.png

2025-02-17 19:14:45 GMT

- reply

The subtext is: "trusted" sources haven't published much on this topic yet, so don't believe info from any of the independent results in the void of that.
I can't remember if they play the same games as they do on YouTube for 'news-related' searches, of pinning results from a hand selected set of establishment media outlets at the top, ahead of the organic ordering.

2025-02-11 20:00:45 GMT

- reply

'Cogito, ergo sum' or something.

2025-02-10 21:22:10 GMT

- reply

I think that's more about a large amount of fake people that'll say they support or virtue about things they actually don't, just to seek group validation; just like all the people that virtue they 'support' free speech, when they almost never actually do, whenever they're put into a situation that tests it.
Just like all the people that say they support free software, when instead nearly all their 'daily driver' software and OS is something proprietary ("to get the job done"), they never contribute to any of it (labor nor financial), etc.

2025-02-06 21:18:04 GMT

- reply

If government is the Certificate Authority of a cryptographic digital ID system, and if the digital ID is used as an authenticator, then therefore the government can impersonate you, do things on your behalf, and access any resources that are 'protected' wherever the digital ID is relied on as an authenticator. It inherently gives them a backdoor into anything that relies on it, as they can always notarize another ID as you.
There could be ways to mitigate risks, but I highly doubt they'll be considered, since it's always the dumbest of person that any of these systems will be engineered to (just as why authentication with banking is just outright pathetic in a lot of areas, where a vast majority of online banking doesn't even support any hardware token auth whatsoever).
The important part is that digital ID isn't used as a routine authenticator, and maybe only for proving identity ONCE when initially setting up an account, and the onus being on the end user to supply the methods they want to authenticate NOT involving the digital ID as a routine authenticator (password + OTP, user-procured hardware token, or whatever else).

2024-07-08 03:36:27 GMT

- reply

There's one animation skit where the protagonist gets mistakenly flagged as an impersonation attempt on themselves, from a facial recognition unlock feature on their phone, and automatically prompted to defend themself against identity fraud charges: https://www.youtube.com/watch?v=UbXaiqA4ins

2024-07-07 19:09:18 GMT

- reply

I mean, hell, I can just start a managed hosting service (under my pseudonym; I already do such professionally) if there's a market for it on fedi. Just a decade ago it wasn't perceived as that much of a hurdle, as people would pursue through it.

2024-06-11 21:26:22 GMT

- reply

Are all the ports for STUN/TURN open, including the entire ranges for TURN relay (ALL ports from UDP port 49152, to UDP port 65535, as is the default for eturnal and coturn), or if you're using a custom port range, is it enough ports (e.g. at least like ~100 ports or so)?

2024-06-11 18:54:06 GMT

- reply

Is it with calls only between people on the same XMPP server, or is it with calls to users on other servers? To my understanding, each server (for each participant in a call) needs to provide STUN/TURN services.

2024-05-25 17:27:47 GMT

- reply

and what about the servers I've had running for several years, with a very immaculate uptime, and warning you against starting a community on a mega-instance?

2024-04-21 04:53:14 GMT

- reply

or the result when people complain to social media instead of putting the effort into carefully reporting installer issues.

2024-04-15 05:37:29 GMT

- reply

I think it probably got removed from the UI after the last UI revamp of Gajim. Meanwhile Pidgin does (or did) support it as well: https://pidgin.im/help/protocols/xmpp/supportedxep/ (apparently Pidgin is still being developed, as I guess there's a v3.0.0-alpha1 being worked on)

2024-04-13 04:47:58 GMT

- reply

I'm pretty much available for tech support whenever needed for XMPP servers and alike (and there is of course also the respective support MUCs, for each server software). I can also set up cert/uptime monitoring with notifications, from my Icinga2 instance, if desired. I was intending at some later point to deploy a self-serve system for that.

2024-03-27 18:03:07 GMT

- reply

I assume you're referring to GabPay: https://www.gabpay.info/

2024-03-24 00:03:14 GMT

- reply

Much of it's explained later in one of the replies at: https://were.social/notice/Ag9m39s4aWr45TmKdE
Generally trying to build within the capabilities present in PHP 8.0, making use of common first-party binary extensions to PHP first (hence OpenSSL for secp256k1, or else libsodium when I deal with ed25519)
Hadn't known about the IETF publication, I actually had to dig in various forum threads and StackOverflow to find the math on how to accomplish it, as well as work off of other people's notes. The mentioned publication probably would have helped out much more, I'll probably highlight in on any future summary on that.
I do however need to dig deeper on the specifics about low-s with signature creation.
Much of the stuff with Multibase, Multikey, etc I've already read into plenty before when experimenting with Object Integrity Proofs in ActivityPub, just with ed25519 instead.

2024-03-23 18:56:16 GMT

- reply

Sounds like it doesn’t necessarily ease the burden of implementing did:[something] for ActivityPub though. Do you consider it a dead end as far as practical utility goes?
Oh, it absolutely could be used today in FEP-ef61, and the laziest implementations could just lean on querying https://plc.directory/ for every did:plc. A person could just skip all of the above prerequisites, and at minimum [only] be a consumer of that DID method by just grabbing the JSON (or JSON-LD: https://plc.directory/did:plc:s2m7kbq2unki7rager5aw6sw ), and having blind faith that the directory validated it (except it'd only be a one-way relationship).
I did accomplish this with no dependencies (other than OpenSSL and a BigInt math library) in ~400 lines of code from scratch.
The significant issue is long-term trust in that DID platform, as there's no idea how they'll moderate it, if they'll force incompatible breaking changes, lock it down later on (for submitting did:plc identities, or resolving them), or if it'll be shut down some amount of years from now. But at least there's nothing that mandates the use of their resolver, as I'm sure others could launch their own, maybe.

2024-03-23 08:12:34 GMT

I guess I successfully created a did:plc and have it published to (sorta) Bluesky's backend did:plc registry: https://plc.directory/did:plc:b3iyjhbvpeiygj35orqatuqb/log
Instead of endorsing any sort of a ATProto PDS or anything, I instead have it pointing to my ActivityPub (and other) identifiers in varying forms.
I'm probably the only [non-employee] user (or at least: one of very few) on Bluesky's infrastructure that has full custody and control over their own private keys for their did:plc identity, and yet I don't even have a Bluesky account. Unless I'm just uninformed of something buried somewhere allowing you to export at least one of your rotationKeys (not the signingKey, which is just for signing posts, etc). Because without that, you don't really control your identity at all, only Bluesky exclusively does.
Meanwhile, in this endeavor, I "only" had to:
Write a DAG-CBOR and CIDv1 encoder
Write a Multibase and Multikey encoder and decoder
Write a base58btc encoder/decoder
Write a base32 encoder
Write functions to compress and decompress a secp256k1 public key (involves crypto maths, for decompression)
Write some very adhoc ASN.1 DER encoding/decoding functions (just to encode a raw secp256k1 public key into PEM encoding, to feed to OpenSSL; and then extract the r and s values from the outputted signature from OpenSSL)
Write a function to generate a did:plc identifier, from the genesis operation
Write a lot of test code
With how scarcely some topics are documented, and how scattered many tidbits of info is: I swear some of this is almost intentionally a trap to sell consultancy.

2024-03-08 20:46:56 GMT

- reply

If you do rotate the keys to have all users be the same public key, make sure you list both the new and old key in the Update (new key first, which gets stored; old key 2nd/last, which gets discarded), as that's very specifically how the key rotation with Mastodon works (as I also noticed per: https://arcanican.is/excerpts/cve-2024-23832/ )

2024-03-08 20:24:18 GMT

https://seirdy.one/posts/2021/02/23/keeping-platforms-open/

2024-03-08 19:52:10 GMT

- reply

It's all I routinely bitch about:
https://were.social/notice/AfHlGgRYClScNnQFiy
https://were.social/notice/AfYn3Wcauj4nkflBkO
I assume it was originally under an ambitious idea to allow users to have control over their identity by cryptography, but implemented in such a half-baked way that was conceptually flawed, to the point where users cannot export their keys for risk of the entire server: https://github.com/mastodon/mastodon/discussions/22315#discussioncomment-4423581

2024-03-06 01:48:47 GMT

...Why do we have this ridiculous joke of assigning a keypair to every ActivityPub actor (that the user themself can never have) for HTTP Signatures when all remote resources are fetched under the internal actor's key only (and anonymity of who's querying the resource), and therefore be unable to enforce access control on a non-public resource?

2024-02-26 22:18:15 GMT

- reply

There's already been the support in Pleroma for years of presenting an auth script for ejabberd (and derivatives), then on the frontend you just tie in converse.js or other XMPP web clients: https://docs-develop.pleroma.social/backend/configuration/howto_ejabberd/
There's already OMEMO support in conversejs, amongst others.

2024-02-24 04:40:54 GMT

- reply

Firefish is unusual in that it can import posts exported from Mastodon.
You can export/import posts under the Pleroma lineage of server implementations too, I believe even from an export from Mastodon.
A DID is securely associated with a document describing the subject (similar to a user or actor) identified by the DID, but without requiring a single, centralised authority.
I guess I view the DID specification as more of an extensible URL-like format, whereas the DID method dictates the general meaning of the remainder of the identifier. There are some very unusual DID methods listed in the registry that sound very centralized, just like Mastercard's did:id method: https://github.com/Mastercard/did-methods/blob/master/id.md#retrieve
Just like how HTTP is used/abused as an application protocol far beyond the scope it was intended for (hypertext media) just because of the versatility of URLs, I assume DIDs are intended to be a more broadly versatile/extensible format of URI-like identifiers, which could be for anything from identity, down to individual resources associated under that identity.
for example if the instance is offline or the user has been banned. This feature was cited as one of the main reasons Bluesky did not adopt ActivityPub.
I honestly would argue it's just an excuse on their part. I still can't find anywhere in ActivityPub spaces where they even tried talking to developers in the community. Also, you could actually Move your account to another service, while your original server is down, if you had 'your' private key that's used in HTTP Signatures. But because of the present state of how HTTP Signatures are sometimes implemented, servers actually keep you from exporting your key: https://github.com/mastodon/mastodon/discussions/22315
suggested a proposal to implement ActivityPub on top of the AT Protocol
Last I remember reading of that proposal, it felt like an insane idea of just stacking things, and not thinking carefully. I believe much of the same can be achieved far more simply with portable object signatures, and a duality of cryptographic identifiers that can be resolved by from conventional mechanisms (WebFinger-resolved acct: IDs, URLs, DNS, etc that point to a cryptographic ID) rather than one type of identifier only (only cryptographic or only conventional).

2024-02-23 20:37:09 GMT

- reply

I think that's the point to Nostr though: there's not meant to be a lot to it.
Public key is the identity, sign messages to publish under that identity, relays are your inbox/outbox, require proof-of-work as one way to keep spam from overtaking the network, etc (if I understand correctly)

2024-02-23 20:14:53 GMT

Would it be worth anything for me to spend my day writing a light dissertation between ATProto, ActivityPub, Nostr (very lightly, I still need to dig more), DIDs, etc? (and having to re-read much of the specs again)
If so, expect that it'd be at least as long as (if not more) than: https://arcanican.is/primer/ap-decentralization.php
and just to declare: I've only written a full ActivityPub server implementation, meanwhile I have not written an ATProto server nor anything Nostr yet. I believe I have a fairly complete understanding how it ATProto comes together in it's components, compared to a lot of other people that seem to be commenting on it.

2024-02-23 19:36:46 GMT

- reply

One thing I assume will be a sizable annoyance: is that E2EE won't be possible, unless both sides adopt a mutual protocol. Thus it might be the first case to see a push for experimental implementation of MLS (from MIMI), or otherwise bring some Olm/Megaolm compatibility to XMPP, or OMEMO compatibility to Matrix, as I don't know if those can be 1:1 translated back-and-forth. Or just less-sophisticated things like PGP over instant messaging (like PGP over XMPP as transparently facilitated by plugins).
They're both key ratcheting systems, I just don't know how much Olm/MegaOlm differs from OMEMO.
But at least it bridges the communication gap to be able to start reaching people on another sizable federated instant messaging network.

2024-02-23 19:14:31 GMT

- reply

Interesting, there's two different behaviors for bridging account identifiers available:
matrix_id_as_jid: false: Matrix user ID is treated as a JID (e.g. [email protected]); if it can't delivered as an XMPP recipient (if no XMPP service exists as matrix.org, in this example), it then tries via Matrix protocol (as @example:matrix.org)
matrix_id_as_jid: true: a separate XMPP component is used as the identifier for all bridged Matrix users (e.g. Matrix users appear as example%[email protected]).
https://github.com/processone/ejabberd/commit/2b7b92edeef6e413570cafacc392720a2baab23b

2024-02-20 02:28:47 GMT

Ooo, I see the Matrix gateway for ejabberd starting to get mainlined in the Community edition, since about a week ago: https://github.com/processone/ejabberd/commit/f44e23b8cc2c3ab7d1c36f702f00a6b5b947c5d0
According to the file headers, it seems to have been started back in late April 2022.