S-tier: PeerTube A-tier: Misskey, Pleroma B-tier: ... D-tier: Against all odds, *Mastodon* actually does something more or less what you're supposed to do. (Go figure.)
Mastodon probably does it correctly because Rails has facilities that automatically do this because collectively, bullshit feature-factory startups have decided to outsource things like "Read a few paragraphs to understand this plain-text protocol that took off precisely because it's so easy to understand and work with" to framework authors. Don't fall for it, just read the RFC, it's easy, I swear: https://datatracker.ietf.org/doc/html/rfc2616 . (Honk is absent from the list because Honk has yet to cause any problems.)
I'll usually put something on while I eat, watch a little TV and chill, you know? So over the course of a few days, I re-watched this speech Woz gave in 1984 about the early history of Apple and I've seen it before, but the thing that stood out this time was his account of how he designed the floppy drive controller. He sat down, he studied the Shugart specs, he applied what he knew about those and parity bits and he came up with a design that required five chips, at a time when most of them used 10-50; he joked that he didn't know enough to make one that took 50 chips. (Eventually they did custom silicon and moved all five chips onto one chip: https://en.wikipedia.org/wiki/Integrated_Woz_Machine . It would have been prohibitively difficult to integrate a 50-chip design.) This is several miles from the "I slapped the codebase with dependencies it until it worked" style of development most people do: if your codebase acts like you've been getting drunk and battering it, usually it's because you have. (I love you all but please have some goddamn pride as engineers and study the things you have to implement.)
And that concludes a post I am likely to regret because it will upset someone that I don't want to upset and will also come back to bite me when someone has to debug their code and it turns out that the source is a fuckup I have made with Revolver. The former may not occur, but the latter definitely will, with as much certainty as the spelling mistake you will make when criticizing someone else's spelling mistakes (though a spelling mistake in a post someone makes does not tend to result in having to debug your code and then make your code jump through hoops because the bug is in another codebase).
Firemen have to connect lengths of hose together, and they are trained to have one hold the hose and turn his head away, while the other does the connecting. This is because if they're both looking, they'll both move the hose around, and it will take longer to connect than if one holds still, and even if you're trying to hold still, you'll involuntarily move to "help". (Also it saves additional time because if they make eye contact when connecting their hoses, they always stop to say "nohomo".) So if a UA asks for the thing that exists at a given URL, you should give it that thing instead of trying to guess what it actually wants; if the client tries to guess and the server also tries to guess, that the client and the server are at odds.
Anyway, UA-based content transformation was discovered to be a bad idea in the 90s, it is still a bad idea for the same reason it was back then.
> everyone who opens the link in the browser should get a 406?
See, the problem starts when you're trying to detect whether the UA is a browser or not and deciding what to display based on a bad guess (any guess is bad), but most browsers will include "*/*" in the Accept: header anyway. You go down the priority list, match it against what you can send back, and show them the best match for that (though the UA can't rely on that). If it's a redirect, you can't vary that based on the Accept header; a 200 has to be a 200, a 301 means that resource is elsewhere. The entire idea is that this is a resource, it's at this URL, and the server will pass back a representation of that resource. (It's also supposed to be a 405 with an Allow header if they try to use a method not supported by that resource, so "GET /inbox" shouldn't just pass back index.html and "POST /objects/whatever" shouldn't 404.)
@p@NEETzsche so since we can't redirect everyone without an accept header and can't guess who is a browser by ua, everyone who opens the link in the browser should get a 406? or am I missing something?
> If no Accept header field is present, then it is assumed that the client accepts all media types
The field *is* present, but in this case that should be treated like "Accept: */*". This means that the JSON should be spat back out: that's the only representation offered by the server. Attempting to guess if a UA's a browser and redirecting depending on the guess, that's worse than doing nothing.
What Pleroma should do is represent the resource or toss a 406. "Redirect or load the webapp" isn't either of those, that should not happen.
@NEETzsche Pleroma and Misskey both look for a magic value in the header and if it's absent, they guess (incorrectly) that you are a browser and they redirect you. PeerTube doesn't appear to even parse the header, it's an exact match or nothing.
@p > (I love you all but please have some goddamn pride as engineers and study the things you have to implement.)
I don't know how time management goes with open source projects, but at least at work I can definitely say that this is an issue of just not getting enough time to read into anything. The code at my job is a fucking mess and it's taking months and months and months for me just to slowly get one component properly sorted out, and then it usually just becomes shit spaghetti after 2 weeks anyway because "bossman wants a thing". Compared to that, everything I write at home looks like a work of engineering art.
Funniest thing is, my own projects tend to develop faster and stay more stable despite the fact that I work on them like 6 hours a week tops.
It's actually very similar to JSON. However, a certain webserver responds with this format, and not JSON. I'm supposed to parse that. With JavaScript.
You think I don't know the flaws of things like blockbots, but I do. I just choose to not deal with them until they become an issue. Because literally every day I'm always dealing with something that is a problem right now. And most of the time it's things that are totally out of my control.
> The Ruby scripting language serializes "Hashes" -- a form of associative array
I have sent you Ruby code that I wrote, we've talked about Rails, I know what Ruby is and what a hash table is (and I wish Ruby didn't call the class "Hash" but that's a Lesser Crime).
> However, a certain webserver responds with this format, and not JSON. I'm supposed to parse that. With JavaScript.
I read this article years ago that the Internet is, in practice, just duct tape and elbow grease and it's totally true. I'm totally unsurprised to hear these kinds of details. I deal with plenty of them in my professional life. You wouldn't believe the ridiculous shit people stuff through that Ethernet pipe boyo, that I'm expected to deal with. Actually, you probably would.
@NEETzsche Actually, I mean, for user accounts what Pleroma does is just send you index.html (with some ridiculous <meta> tags tacked onto the front) and load a web application that eventually loads the user in question.
>Pleroma and Misskey both look for a magic value in the header and if it's absent, they guess (incorrectly) that you are a browser and they redirect you. PeerTube doesn't appear to even parse the header, it's an exact match or nothing.
> just not getting enough time to read into anything
That's why I said it's a problem caused by feature-factories. The environment encourages producing more things instead of good things. That's why it's important to read up on this stuff: if you can do a good job quicker than most coders can do a bad job, then the world is better.
> Compared to that, everything I write at home looks like a work of engineering art.
Almost everywhere I've ever worked. It's frustrating. Usually if you have this kind of problem, adding a test that fails if there's a fuckup will help discourage fuckups, or the person fucking up will comment out the test.
> Funniest thing is, my own projects tend to develop faster and stay more stable despite the fact that I work on them like 6 hours a week tops.
Sometimes it's "because of" instead of "despite". :putin_wink:
I attended a talk by Evan Phoenix, and he said that before he did Rubinius, his first attempt at implementing Ruby was to start with the parser, which took him a year and was never completed. He eventually restarted and decided to just steal the MRI parser and he had a working implementation in no time.
If it's just a Hash, that's not too hard, but I don't envy anyone attempting to parse Ruby from JavaScript, especially if their shit's that haphazard. (Just wait until they do something that eventually results in `{a: 1/0.0}.to_s`. At least `{a: 1/0.0}.to_json` throws an error. Ha, or `{a: Date.today}.to_s #=> "{:a=>#<Date: 2022-07-25>}". It's really nice to be able to have mixed-type hash tables but if they're sending them over the wire, there's no telling what you'll have to try to parse.)
> Implement a Ruby interpreter in Python. Implement a Python interpreter in Ruby.
_why's unholy project would probably be a better approach to this. Compile to bytecode -> translate bytecode -> decompile in target language. :bruceforsythe:
The data type is literally `application/json`, too. I've been tempted to just try to parse it as JSON and strong-arm the subject with them: "Um, sweaty, no, just no, this isn't JSON."
But I think there are reasons why the other team won't budge (likely just incompetence)
@yes@fristi Unit tests suck, you get better mileage the more you try to maximize coverage from functional/integration tests, especially if you do fuzzing (never do it if you can make a robot do it) and replays of production traffic.
This pisses off the unit-testing cult, because any process cult gets furious when you point out that their process is a net drag. But there's no getting around it: if something breaks a unit test without changing the output of the system when the entire stack is tested, then the unit test didn't matter. Conversely, replays of production traffic will show you really quickly if something that you do has broken something that is actually in use, and you will find out in a hurry if something you've done has broken something important or slowed it down significantly.
i agree with this tbh. full integration tests and fuzzing are just more effective unit tests as it tests the whole including cases you didn't know exist. the outcome is the same but the difference in effort is noticable.
@p That's interesting, I don't think I landed on that yet, probably could fix it in the relevant place for Pleroma, can you send something like a bug report?
There is way worse for Accept header stuff btw, we should have proper parsing and handling of it while there is things that just do a string comparison (I think lemmy did that but I might remember badly, there is way too many implementations out there).
The gitlab 500s for me when I try to use it logged in, but the quick version is the same thing I've been complaining about a while, essentially /notice vs. /objects, and what you get back if you GET /users/p.
These already work correctly and do more or less what you want:
* "Accept: application/json" returns JSON * "Accept: application/ld+json" returns JSON * "Accept: application/activity+json" returns JSON * "Accept: application/activity+json;q=0.9, text/html;q=0.1" returns JSON * "Accept: application/activity+json;q=0.1, text/html;q=0.9" results in an attempt to load the webapp
These are the cases that are upsetting:
* "Accept: application/json, */*" results in an attempt to load the webapp * "Accept: application/activity+json;q=0.9, */*;q=0.1" results in an attempt to load the webapp * "Accept: application/*" results in a 302 * "Accept: */*" returns an attempt to load the webapp
I don't think it's possible to get a 405 or 406 out of Pleroma. I don't think it should be the case that it attempts to *just* load the webapp, I think it should return HTML with the content on the page and the script tags that load the webapp, that way the resource is at least represented.
Right now I'm just parsing JS but I plan to parse HTML (so as to make it easier for this to work properly: https://www.infoq.com/presentations/web-api-html/ ; I've done that kind of API before and the result is exceedingly pleasant).
> There is way worse for Accept header stuff btw
That is why PeerTube got S-tier. I played "Guess the magic string" for a while and then made a ranty post.
@pleb@NEETzsche Pleroma is shitty in this one facet and a few others; overall it's nice. ActivityPub is shitty all over.
I did a workaround and I literally named it "BadAPCope" and it doesn't work for PeerTube so fuck PeerTube; there's a limit to the number of workarounds, I'll just figure out where their project is and file a but when I get to it.
@splitshockvirus@NEETzsche@pleb Ah, I'll probably make it work anyway; everything seems like a huge pain in the ass that you hate right before you sleep.
@NEETzsche The hole was the problem, not the complaints about the hole.
Ignore recommendations by blue team, get embarassed by red team. Ignore red team, receive zerg rush. In this case, I was blue team and red team, and I haven't seen any zergs around but it's a matter of time.
I know you don't like that reasoning, but that's the reasoning, and I'm not participating further. If you prefer, there's the fallback reasoning: I'm evil now and I do what I want. If you don't like that, either, please deposit 1 10grans to continue going down the same road we've been down before.
A lot of civilization, the Internet included, operates on a gentleman’s agreement to just not do certain things even if given the opportunity. For example, I’m not going to rob, kill, or rape anybody even though I have the opportunity to, and can probably get away with it since police are retarded.
>If you prefer, there’s the fallback reasoning: I’m evil now and I do what I want.
Yeah we have. I just got rid of the bot because you voided that gentleman's agreement. It was either that or play a never-ending cat and mouse game with you.