54°F

Aaron Parecki

  • Articles
  • Notes
  • Photos
  • Dima Postnikov https://twitter.com/dima_postnikov
    Great article by @aaronpk on why you should never roll your own authentication.
    https://aaronparecki.com/2020/05/31/30/the-real-cause-of-the-sign-in-with-apple-zero-day
    #cybersecurity #datasecurity #privacy #authentication #consumerdataright #openbanking
    Portland, Oregon • 50°F
    Mon, Jun 1, 2020 8:18am +00:00 (liked on Mon, Jun 1, 2020 6:31am -07:00) #cybersecurity #datasecurity #privacy #authentication #consumerdataright #openbanking
  • fluffy šŸ’œ https://twitter.com/fluffy
    There is something very surreal about watching a live news event on TV while also hearing it outside your window.
    Portland, Oregon • 60°F
    Mon, Jun 1, 2020 3:00am +00:00 (liked on Sun, May 31, 2020 8:08pm -07:00)
  • šŸ‘©‍šŸ’» DynamicWebPaige @ 127.0.0.1 šŸ  https://twitter.com/DynamicWebPaige
    I can't stop thinking about this picture, and this reality: safely barricaded from protests, spectating and not engaging, continuing with brunch as usual.
    Portland, Oregon • 62°F
    Mon, Jun 1, 2020 2:01am +00:00 (liked on Sun, May 31, 2020 7:05pm -07:00)
  • Chris Aldrich https://boffosocko.com/
    The overall idea to make it easier to subscribe to a personal website is certainly a laudable one.

    Sadly the general concept presented here, while it sounds potentially useful, is far too little and misdirected. Hopefully better potential solutions are still not too late.

    First, let’s step back a moment. The bigger problem with feeds was that website designers and developers spent far too long in the format wars between RSS and Atom while the social media giants focused on cleaner and easier UI. This allowed the social silos to dramatically close the gap in functionality and usability. While website owners were spending time on formats and writing long articles about what RSS was, how it worked, and how to use it, the public lost interest. We need something really dramatic to regain this ground and /feeds just is not going to cut it.

    The first problem I see with this is that on it’s face /feeds both looks and sounds like code. No user really wants to interact with code if they don’t have to. Why not simply have a page or button called something much more user friendly like ā€œsubscribeā€ or ā€œfollowā€? Almost every major social silo has a common pattern like this and has a simple ā€œfollowā€ button on every user’s page. A quick click and one is done with the transaction!

    Instead the solution offered here is to have not only yet-another-page but one that needs to be maintained. (As good as the /now idea may seem, the fact that it needs to be regularly and manually updated makes it a failure out of the gate. I’ll bet that less than half the /now pages out there have been updated in the last 6 months. I know mine hasn’t.) Worse, suppose I click over to a /feeds page, as an average person I’m still stuck with the additional burden of knowing or learning about what a feed reader is, why I’d need or want one, and then knowing what RSS is and how I might use that. I might see a one click option for Twitter or Mastodon, but then I’m a mile away from your website and unlikely to see you again in the noise of my Twitter feed which has many other lurking problems.

    One of the best solutions I’ve seen in the past few years is that posited by SubToMe.com which provides a single, customizable, and universal follow button. One click and it automatically finds the feeds hidden in the page’s code and presents me with one or more options for following it in a feed reader. Once I’ve chosen a reader, it remembers my choice and makes the following pattern easier in future transactions. This is a far superior option over /feeds because it takes away a huge amount of cognitive burden for the user. As a developer, I’ve got a browser bookmarklet that provides this functionality for sites that don’t provide it for me. How nice would it be if browsers went back and offered such a one button collection mechanism?

    Want to give this a try? I’ve got a ā€œFollow Meā€ button in the side bar of my website. And if that doesn’t float your boat, I’ve tinkered with other methods of subscribing to my content that you can find at my subscribe page. Some developers might not be too scared of what’s on my subscribe page (a /feed page by a slightly friendlier name), but less technically minded people are sure to have a dramatically different perspective.

    The other piece here that I might take umbrage with is the offering to provide feeds to subscriptions to alternate services like Twitter and Mastodon. (This doesn’t take into any account that RSS feeds of social services are positively atrocious, not to mention that attempting to access Marcus’ Twitter feed in RSS Box returns the interminable error message: ā€œThere was a problem talking to Twitter. Please try again in a moment.ā€)

    Ideally I see a future in which every person has the ability to own both their own domain name and their content in a simple manner. If this happens and it’s easier to subscribe to the sites of my friends, then I don’t need corporate social media to intermediate the transactions on my behalf. I also don’t need them to intermediate what I’m actually seeing with their blackbox algorithmic feeds either. Friends, family, and colleagues could simply come to my website and subscribe to all or portions of my content in which they’re interested. While I still presently syndicate some of my content to silos like Twitter and Mastodon for the ease of friends or family who don’t know about the technical side of potential solutions, I post everything on my website first where one can subscribe in a feed reader or by email. Subscriptions in Twitter or Mastodon, while nice to have, are just a poor simulacrum of the real things being served by my site in better ways with more context and a design that better reflects what I’d like to portray online. A /feed page is going to be a failure from the start if you’re going to cede all the subsequent power directly to Twitter, Mastodon, and others anyway.

    While I like the volume of the reactions to the post (indicating that there’s not only a readership, but a desire for this sort of functionality), I’m disheartened that so many designers and developers think that the idea of /feeds is ā€œenoughā€ to stem the tide.

    For those who might be truly interested in designing our way out of this problem, I’d recommend looking at some of the design and development work of the IndieWeb community which is trying (slowly, but surely) to improve these sorts of technical hurdles. Their wiki has large number of examples of things that do and don’t work, discussion of where problems lie, and a community conversing about how to potentially make them better through actual examples of things that are currently working on peoples’ websites.

    A good example of this is the increasing improvement of social readers that allow one to subscribe to a variety of sources in a reader which also allows one to respond to posts in-line and then own that content on one’s website. If I can subscribe to almost anything out there in one interface and sort and filter it in any way I’d like, that’s far better than having twenty different feed readers named Facebook, Twitter, LinkedIn, Instagram, Soundcloud, etc. which I have to separately and independent manage and check. Now I’ve yet to see an IndieWeb reader with a one click SubToMe-type of solution for adding feeds to it, but I don’t think it will be very long before that’s a reality. The slowly improving Microsub spec that splits some of the heavy lifting needed to build and design a stand alone feed reader is certainly helping to make some massive headway on these issues.

    Maybe we’ll soon have an easy way for people to post who they’re following on their own websites, and their readers will be able to read or parse those pages and aggregate those followed posts directly into a nice reading interface? Maybe someone will figure out a way to redesign or re-imagine the old blogroll? Maybe we’ll leverage the idea of OPML subscriptions so that a personal blogroll (maybe we rename this something friendlier like a following page or personal recommendations, subscriptions, etc.) can feed a person’s subscriptions into their social reader? There are certainly a lot of solid ideas being experimented on and in actual use out there.

    We obviously still have a long way to go to make things better and more usable, not only for ourselves as designers and developers, but for the coding averse. I feel like there’s already a flourishing space out there doing this that’s miles ahead of solutions like /feeds. Why don’t we start at that point and then move forward?

    Portland, Oregon • 64°F
    Sun, May 31, 2020 5:26pm -07:00 (liked on Sun, May 31, 2020 5:32pm -07:00) #feedreaders #Microsub #OPML #OPMLsubscription #RSS #socialreaders #UI #webdesign
  • Hans Zandbelt https://twitter.com/hanszandbelt
    So at first Apple shortcutted OIDC protocol steps in SIWA which rendered them insecure, after fixing that they went on to add extras on top of OIDC which now renders them insecure again. It should be clear to everyone now: don't roll your own. #openid #siwa
    Portland, Oregon • 60°F
    Sun, May 31, 2020 6:43pm +00:00 (liked on Sun, May 31, 2020 12:47pm -07:00) #openid #siwa
  • Dieter Bohn https://twitter.com/backlon
    When writing headlines, use the active voice and clearly identify subjects. https://www.theverge.com/2020/5/31/21276044/police-violence-protest-george-floyd
    Portland, Oregon • 57°F
    Sun, May 31, 2020 5:06pm +00:00 (liked on Sun, May 31, 2020 10:53am -07:00)
  • Tony Jordan šŸ˜¹šŸ‘€ https://twitter.com/twjpdx23
    This is a great illustration of how much space cars waste!

    They say that up to 230 cars will be able to fit in the stadium to watch the movie. 230 cars in the whole damn stadium.

    If this is the future, I don’t wanna be in it. https://www.miamiherald.com/miami-com/things-to-do/article243003896.html
    Portland, Oregon • 57°F
    Sun, May 31, 2020 5:27pm +00:00 (liked on Sun, May 31, 2020 10:30am -07:00)
  • Kate Efimova šŸ’« https://twitter.com/kefimochi
    Being sick of politics AND having an environment where you can stop thinking about current state of the world is called PREVILEGE.

    YOU HEARD IT!
    Portland, Oregon • 56°F
    Sun, May 31, 2020 3:28pm +00:00 (liked on Sun, May 31, 2020 10:08am -07:00)
  • ziwe https://twitter.com/ziwe
    there are two americas: one fights for black lives and the other fights for brunch
    Portland, Oregon • 56°F
    Sun, May 31, 2020 3:39pm +00:00 (liked on Sun, May 31, 2020 9:59am -07:00)
  • Torsten Lodderstedt https://twitter.com/tlodderstedt
    Another remark: this issue wouldn’t have allowed account takeover at the RP if the RP would use iss+sub claim to identify the user account instead of relying on the email address (potentially even without scoping it within the particular IDP). Poor coding practice too.
    Portland, Oregon • 54°F
    Sun, May 31, 2020 2:44pm +00:00 (liked on Sun, May 31, 2020 7:57am -07:00)
  • Barbara Schachner https://twitter.com/barschachner
    Fully agree to that šŸ˜€

    Just looking also at examples like https://insomniasec.com/blog/auth0-jwt-validation-bypass or https://threatpost.com/microsoft-oauth-flaw-azure-takeover/150737/.
    o/c they are different + very individual, but if already the big players have such issues, how much more can go wrong on RS side where devs are usually not Auth experts.
    Portland, Oregon • 54°F
    Sun, May 31, 2020 1:41pm +00:00 (liked on Sun, May 31, 2020 6:43am -07:00)
  • hedonometer https://twitter.com/hedonometer
    Yesterday was the saddest day in the history of @Twitter
    Portland, Oregon • 54°F
    Sat, May 30, 2020 4:51pm +00:00 (liked on Sun, May 31, 2020 6:35am -07:00)
  • Dominick Baier https://twitter.com/leastprivilege
    The protocols are not the most complicated typically (not saying they are ā€˜easy’ either). But business requirements on top make things complicated.
    Portland, Oregon • 54°F
    Sun, May 31, 2020 1:00pm +00:00 (liked on Sun, May 31, 2020 6:00am -07:00)
  • Marco Arment https://twitter.com/marcoarment
    Agreed. I feel deeply sad and infuriated, yet paralyzed by how broken my country’s culture is. I want to help, but I also don’t want to inadvertently help ā€œwrongā€.

    Tweeting isn’t much, and my votes in NY mostly don’t count. What ELSE should I do? Good organizations to donate to?
    Portland, Oregon • 54°F
    Sat, May 30, 2020 3:07pm +00:00 (liked on Sat, May 30, 2020 10:26pm -07:00)
  • shereen https://twitter.com/shereeny
    why is the active voice used for protestors (ā€œprotestors struck a journalistā€) but not for police (ā€œa photographer was shot,ā€ ā€œa reporter was hitā€)?
    Portland, Oregon • 54°F
    Sun, May 31, 2020 3:39am +00:00 (liked on Sat, May 30, 2020 9:29pm -07:00)
  • Jeff Bercovici https://twitter.com/jeffbercovici
    Boy you’d think a country that can equip every cop like a soldier could equip every doctor like a doctor
    Portland, Oregon • 54°F
    Sun, May 31, 2020 4:00am +00:00 (liked on Sat, May 30, 2020 9:25pm -07:00)
  • Not Fake Adam Kalsey https://twitter.com/akalsey
    When I was a kid, my mom said she was going to slap me into next year.

    I called her and asked if the offer was still available.
    Portland, Oregon • 54°F
    Sun, May 31, 2020 4:18am +00:00 (liked on Sat, May 30, 2020 9:22pm -07:00)
  • Akasha of Thorne https://twitter.com/AkashaThorne
    HOT TAKE: the tooth fairy myth teaches children that it’s normal to give away pieces of themselves for money.
    Portland, Oregon • 54°F
    Sun, May 31, 2020 3:56am +00:00 (liked on Sat, May 30, 2020 9:15pm -07:00)
  • jk https://twitter.com/karabaic
    Yeah, there it is, in print. @ohmydollar @anomalily
    Portland, Oregon • 62°F
    Sat, May 30, 2020 9:21pm +00:00 (liked on Sat, May 30, 2020 2:43pm -07:00)
  •    sonicrocketman https://pine.blog/u/sonicrocketman

    Pine.blog can now help you add Webmention support to your personal blog! Let's move the Open, Indie Web forward. No matter where you host your blog, you can have mentions and even replies powered by Pine.blog! Check out the announcement blog post to learn more

    Portland, Oregon • 63°F
    Sat, May 30, 2020 8:58pm +00:00 (liked on Sat, May 30, 2020 2:04pm -07:00)
older

Hi, I'm Aaron Parecki, Director of Identity Standards at Okta, and co-founder of IndieWebCamp. I maintain oauth.net, write and consult about OAuth, and participate in the OAuth Working Group at the IETF. I also help people learn about video production and livestreaming. (detailed bio)

I've been tracking my location since 2008 and I wrote 100 songs in 100 days. I've spoken at conferences around the world about owning your data, OAuth, quantified self, and explained why R is a vowel. Read more.

  • Director of Identity Standards at Okta
  • IndieWebCamp Founder
  • OAuth WG Editor
  • OpenID Board Member

  • šŸŽ„ YouTube Tutorials and Reviews
  • šŸ  We're building a triplex!
  • ā­ļø Life Stack
  • āš™ļø Home Automation
  • All
  • Articles
  • Bookmarks
  • Notes
  • Photos
  • Replies
  • Reviews
  • Trips
  • Videos
  • Contact
© 1999-2025 by Aaron Parecki. Powered by p3k. This site supports Webmention.
Except where otherwise noted, text content on this site is licensed under a Creative Commons Attribution 3.0 License.
IndieWebCamp Microformats Webmention W3C HTML5 Creative Commons
WeChat ID
aaronpk_tv