Notices by Erin 💽✨ (erincandescent@akko.erincandescent.net), page 14

@trwnh @evan anyway I like mutual TLS in theory but in practice there’s the problem that most instances are running behind TLS terminators so they don’t necessarily have access to their own TLS keys

Gleason walked into the SocialHub to drop his latest innovation and I’m sitting here trying to work out whether he just proudly announced that he introduced a security bug into his own software or not

Specifically the key ID isn’t signed so if you’re sharing private keys, someone who captures a signed message can just swap key IDs

Capturing a signed message sounds hard but if you do manage to do it you can probably e.g. read private posts accessible to anyone on your instance

So its probably not an issue for mostr because that’s a bridge to libertarian hellscape where everything is public all the time but in general I dunno the security calculus is nontrivial

@neil @laird it got reduced. 256 subnets is still a gargantuan number for an end user

@mia @SylvieLorxu @privateger Vesa does makes lots of their standards free behind “just” a login wall, particularly those which are software related.

Not ideal but certainly better than most

but why

@natty @T0xF03AE @gavi (semantically: as:alsoKnownAs != xrd:alias; the latter is an exact equivalent, the former is a pointer to an alternate account)

@T0xF03AE @gavi @natty Ah, this is gleason code, that explains a lot :neocat_googly_woozy:

@natty @gavi @T0xF03AE IMO implementations should normalise handles based upon the webfinger response

…also why is my old account in aliases. my old account is not an alias. puts investigating this on todo list

@gavi

https://ns.erincandescent.net/ap#Scream - Activity, represents that the actor is screaming

Properties:

• as:target: Optional, indicates the target that the user is screaming at

https://ns.erincandescent.net/ap#Void - Special purpose Object, representing the Void. When used as the target of a Scream activity, indicates that the user is screaming into the void

(This is a shitpost, but if someone actually implements it I will setup ns.erincandescent.net to serve an Owl ontology…)

@disarray have you seen Dutch?