Notices by Erin 💽✨ (erincandescent@akko.erincandescent.net), page 5

After spending years on here its easy to forget that other social networks don’t have (convenient) ways for users to mark their own images as sensitive

Well, until you’re scrolling your BSky feed and get faceblasted with uncensored yiff (because nobody bothered to train the ML porn classifier on murrsuits, of course)

(To be clear: the image isn’t the problem. the fact that its dangerous to open my feed in a place where someone might see my screen is!)

(seriously how did nobody train the porn classifier on e621? do these people have no furries working at them?!)

In a way, it’s a bit harder for me to talk about the values and design goals of ActivityPub. It happened in a larger standards group and involved a lot of passing of hands. I think if I were to be robust about it, I would also ask Evan Prodromou, Erin Shepherd, and Amy Guy to weigh in, and maybe they should; I think it would be nice to hear.

The goal of ActivityPub to me, only partially realised in the decade since, was to function as a substrate to enable multiple social applications to exist within a single social graph; so that we could experiment with ideas other than (and perhaps radically different from) Twitter clones.

In some ways I felt that the C2S API was more important than S2S - the original drafts of the spec made S2S optional, but mandated C2S. Its funny and in some ways unfortunate how that flipped.

@cwebber

RE: https://social.coop/@cwebber/113647109852249805

The other day I discovered that Sentry - the error reporting tool - are doing their own Spotify Wrapped thing.

I think we can safely say that this trend is now, mercifully, deader than disco

@natty everyone wants to write fediverse servers in Rust or Go and I feel both of these are among the languages where you have to… just go and ignore most of the conventions of the language to deal with inherent duck typing of AS2

@cwebber Some notes:

(Also choosing sha256 over sha256d, there’s maybe the question of length extension attacks, but I suppose the parsing of the document means this is maybe not a problem, I’m not sure.)

So a fun thing amout merkle-damgård hash functions is that they’re only subject to length extension attacks if used at full length. If truncated they’re not vulnerable. So SHA-256 and SHA-512 are vulnerable, but SHA-224 (which is SHA-256 with different constants and truncated to 224 bits) and SHA-384 (which is SHA-512 with initial different initial constants and truncated to 384 bits) are not. Back in 2012 NIST standardised SHA-512/224 and SHA-512/256 which are similarly truncated versions of SHA-512 with different initial constants which also sidestep the length extension attack issue.

Anyway this is to say that because they truncated the hash in did:plc identifiers (to a level which feels unwise to me too!) they’re immune to length extension attcks.

@trwnh I think I’ve said it before but: a quote is just a louder reply

If it starts M, its almost certainly ASN.1 DER starting with a SEQUENCE. If it starts MI its probably an X.509 certificate (its a biig sequence).

LS0t is the base64 encoding of --- which is the start of a PEM block. It’ll probably be followed by LS(something) because there are five dashes to a PEM block.

dW5kZWZpbmVkCg== is just undefined and that one is in my brain as the result of an append only database, a buggy JavaScript frontend and a backend with insufficient validation at a previous job…

MI, LS0t and dW5kZWZpbmVkCg== truly are some of the most recognisable base64 prefixes/strings of all time

Half Life 2, the first game I ever pre-ordered, is 20 today.

Please excuse me while I go and shrivel up into a cabbage.