Aaron Parecki

Andrew Kan https://twitter.com/AndrewKanFilm

Idea for #YouTube let us set a Superchat/Sticker/Thanks goal on our channel, so our audience can know what we plan to do with the content. This could help us be transaprent and also help our audience be apart of the progress towards goals. What do you think about this?

Portland, Oregon • 41°F

Fri, Feb 25, 2022 7:22pm +00:00 (liked on Fri, Feb 25, 2022 5:59pm -08:00) #YouTube
Vittorio https://twitter.com/vibronet • Feb 25
Yesterday I was attending a 350ppl Zoom meeting while driving.
The car in front of me made me miss a green light🚦, & I let out a scream of pure, unadulterated rage😡 .
The presenter suddenly stopped and everyone in chat wondered what made Vittorio so upset. I was unmuted 😅 oops

It was frankly an unforgettable moment 😅

Portland, Oregon • 43°F

4 likes

Fri, Feb 25, 2022 5:33pm -08:00
Vittorio https://twitter.com/vibronet

Yesterday I was attending a 350ppl Zoom meeting while driving.
The car in front of me made me miss a green light🚦, & I let out a scream of pure, unadulterated rage😡 .
The presenter suddenly stopped and everyone in chat wondered what made Vittorio so upset. I was unmuted 😅 oops

Portland, Oregon • 44°F

Fri, Feb 25, 2022 9:19pm +00:00 (liked on Fri, Feb 25, 2022 5:33pm -08:00)
WTF OAuth https://twitter.com/wtf_oauth

I still can't believe my bank uses OAuth for authentication. I mean, they are the bank. They should be able to trust me.

Portland, Oregon • 44°F

Fri, Feb 25, 2022 11:24pm +00:00 (liked on Fri, Feb 25, 2022 5:32pm -08:00)
9:38pm
Asleep

5:30am
Awake

7h 52m
Slept

24m
Awake for

Portland, Oregon, USA

Fri, Feb 25, 2022 5:30am -08:00
PhotoJoseph https://twitter.com/photojoseph

Why do brands reach out with “sponsorship” offers then later say “we can only sponsor with a free ($100) product”. That is not a sponsorship.

Portland, Oregon • 30°F

Fri, Feb 25, 2022 2:13am +00:00 (liked on Thu, Feb 24, 2022 9:10pm -08:00)
How DO you pronounce Kyiv, anyway? - YouTube (m.youtube.com)

Thu, Feb 24, 2022 9:04pm -08:00 #kyiv
Mary Louise Kelly https://twitter.com/NPRKelly

For those asking, @npr goes with Ukrainian spelling & pronunciation (not Russian) wherever possible when reporting on Ukraine.

Kyiv not Kiev. KEE-eve not KEE-yev.

Hat tip: @michelekelemen @wexler_m
#Kyiv #Ukraine

Portland, Oregon • 30°F

Mon, Jan 24, 2022 3:46pm +00:00 (liked on Thu, Feb 24, 2022 9:00pm -08:00) #Kyiv #Ukraine
Well that's quite the sentence:

"Facebook has built its empire on the ability to acquire intimate details about user behavior across the internet"

https://9to5mac.com/2022/02/24/app-tracking-transparency-harmful-says-facebook/

Portland, Oregon, USA • 30°F

1 repost 2 replies

Thu, Feb 24, 2022 8:58pm -08:00 #facebook
Understanding Video Compression Artifacts - Component (blog.biamp.com)

Thu, Feb 24, 2022 8:08pm -08:00 #video #compression #h264
Faruk 🚀 ᴵᴾᴴᴼᴺᴱᴰᴼ https://twitter.com/iPhonedo

I wonder how stupid we look from space.

Portland, Oregon • 32°F

Thu, Feb 24, 2022 6:23pm +00:00 (liked on Thu, Feb 24, 2022 7:39pm -08:00)
WTF OAuth https://twitter.com/wtf_oauth

I still remember the first time I used OAuth 2.0. It was so easy and fast that I thought it was a joke.

Portland, Oregon • 32°F

Thu, Feb 24, 2022 10:24pm +00:00 (liked on Thu, Feb 24, 2022 7:37pm -08:00)
https://events.indieweb.org/2022/03/micro-camp-2022-IW2Qp3ygHike

I'll be there for the second half of the day! Looking forward to it!

Portland, Oregon, USA • 33°F

Thu, Feb 24, 2022 7:30pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
Arguably, tho, PKCE and putting a client secret into a SPA are orthogonal. It's conflating two things that work differently. Poor devs can't understand those differences.

The error should be "we see you sent a client secret and an Origin header. is your client a SPA?"

I totally agree, this error message makes no sense. I'm going to file a ticket tomorrow internally to fix it.

Portland, Oregon, USA • 33°F

Thu, Feb 24, 2022 7:18pm -08:00
Hirsch Singhal https://twitter.com/hpsin_ • Feb 25
Helps prevent devs from putting their client secrets in a web page to perform the client creds flow, yep. When AAD enabled this, we definitely got a couple support calls on that. This was how we ratcheted forward PKCE use from suggested to required as well.

yep you guessed it! misleading error message but that's exactly what was going on.

Portland, Oregon, USA • 33°F

2 replies

Thu, Feb 24, 2022 7:07pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
Ah, good question -- I didn't notice that. I bet their client config is misconfigured then.

Yep, I confirmed my suspicion. Misleading error message. Will post details on the github thread.

Portland, Oregon, USA • 33°F

1 like

Thu, Feb 24, 2022 7:03pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
People are asking, when using standards compliant OIDC client libraries:

https://github.com/authts/oidc-client-ts/issues/395#issue-1149525542

why does that example have the browser sending a client secret in the request? That seems odd. Happy to continue this over on the github thread.

Portland, Oregon, USA • 34°F

2 replies

Thu, Feb 24, 2022 6:58pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
It's confusing as hell, and I'm confused by the implementation -- on the token endpoint if Origin is present, you require that the authz used PKCE? That's about the only valid approach to that I can imagine.

Yeah that's right. I agree it's super confusing and has caused some tricky issues before. It may be different in the new platform but I'd have to double check

Portland, Oregon • 34°F

4 replies

Thu, Feb 24, 2022 6:53pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
Hey @aaronpk, can you explain this help article? It makes no sense to me. TIA

https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en_US

Oh yeah, I remember this one. I don't remember if this is still current behavior, but basically Okta is tying to prevent browsers from using anything other than the authorization code PKCE flow. It does that by detecting the Origin header which isn't sent by server apps.

Portland, Oregon • 34°F

1 like 11 replies

Thu, Feb 24, 2022 6:50pm -08:00
Indie bookshelves - macwright.com (macwright.com)

"Check out all the stuff that Aaron Parecki has implemented to run his website. That isn’t a home on the internet, it’s a full-fledged castle. It’s damn impressive."

Thu, Feb 24, 2022 11:47am -08:00 #indieweb

older