Show newer

@thisismissem Yeah, it's just that that assumption isn't part of the spec. 🤷 Probs just an edge case that will happen sometimes that folks don't need to worry too hard about I guess.

@thisismissem By fetching the actor data from their url instead of cache. For example what if you send the update but the server doesn't have your old actor cached already.

This is a new post that's getting sent right into your inbox. Can you see it?

@thisismissem Interesting. So they sign it with the old key instead of the new one? That'll cause some errors for my current setup. 🤔

@thisismissem @joelving Oh one last bit with ActivityPub in particular, you can send an Update activity to people's inboxes which can enable even more aggressive caching while still being able to invalidate the cache when needed.

@cwebber@octodon.social Caffeine: makes you shit *and* post™️.

Reply-guy is out. It's "people with replies" now. Get with the program. 😤 /j

@thisismissem @joelving Every ActivityPub implementation needs to do some variation on this sadly.

@thisismissem @joelving At the moment I'm using HTTP caching mechanisms (E.G. ETAG) to reduce how much data is being re-fetched. So it's a bit better than a one time MITM being able to poison the cache forever and a bit better than fetching for each authentication.

@BigTittyBimbo We need more Non-binary drone operators! More transmac cops!

@jeremy_list Oh wow. What environment are you in that you had to make your own JSON parser? 🤯

I hate it when you follow a link to a really great blog post and you're two paragraphs in thinking oh my god this is really good but then a modal popup window from substack asks you to subscribe to this newsletter and you have to hit "continue reading" to finish and then you wonder if this great blog entry will last on someone else's service that may not be around in a few years

Some of you are wondering how the cars collect and share this if they have no internet connection. A lot of this data is actually collected through other means, and when you are in touch with a dealership. So it’s direct contact but also info they proactively collect through social media (not kidding! I just read Nissan’s privacy notice again) and credit reporting entities. If you have downloaded one of their apps, the internet connection is right there.

Of course, a lot more cars than you imagine have internet connections, and cars have had some sort of onboard computer since the 1970s. A lot of data is stored until it can be accessed or uploaded. And you often don’t even have to press buttons for something to be logged. Sensors are always on, marketed as making you safer, but also saving data to be sold to third parties.

So car companies may also combine information collected about you from your car with personal information they get from third parties. Then they can share (or even sell) that information, and any “inferences” they made based on it, to all kinds of businesses

And here’s another kicker… just by sitting in a vehicle that uses NissanConnect services, you agree to have your data collected by Nissan. So if you hitch a ride with a friend’s Nissan, you are on Nissan’s radar. The privacy policy makes it the responsibility of the owner to disclose this to anyone travelling in their car.

https://foundation.mozilla.org/en/privacynotincluded/articles/what-data-does-my-car-collect-about-me-and-where-does-it-go/

One nice thing about the battery life on my steam deck is that if it gets to the low 20's I know I've been staring at my screen for too long and should switch it up.

@thisismissem Neat yeah. I like the use of linking to profiles with the SubjectAlternativeName field in the certificate. Still wishing we had the future where we used client certs for auth. 😩

OIDC makes sense given the larger "identity" industry. Agree it can be annoying though. So many little pieces to keep track of.

@thisismissem Mind linking to a TLDR for how that works? Solid is defs something I'm interested in.
Is solid-tls the tls client certificate auth? I was ranting about how it sucks that isn't used more a few months ago :P

Sadly I couldn't get it working on Linux with chromium or firefox so I gave up on pursuing it further.

@thisismissem Yeah! That's what I meant about being overly dependent on DNS. If you can't trust an HTTPS request the whole thing breaks.

Show older
Mauvestodon

Escape ship from centralized social media run by Mauve.