Aaron Parecki

@aaronpk i'm all for using grid, but <tr> is a 1D row element so there's no real difference w flexbox, is there? you could use align-items: stretch

@aaronpk Can I ask a question? I wannt to set up an Aparature instance. Am I able to follow straight up RSS feeds up there? Want to follow venders and company blogs as well as personal ones. Possible, isn't it?

@jeremycherfas Not precisely related, but I changed my Instagram to a business account (me being the business), and now I can post to it automatically through Buffer. Just single images, but it's a start! (It notifies me it it's a multi image post and when it can't automatically post, so I can finish it manually.)

@aaronpk Well I guess it's quite stressful to provide software to such a huge amount of users. Check out the issue counter on Nextcloud server repo. Maybe there's a lack of tact in their answer but it does not justify the aggressive comments they get in return. Free software development is also about respect and constructive criticism IMHO. My (very basic and subjective) perception is that they say it's not fair to be attacked for a delay in the bug resolution. I'm sure the bug will be fixed.

@aaronpk Which part disappoints you? I've red the whole thread and from what I get: When a fix is done, it will be available for everybody. Sounds good to me. I'm rather disappointed by such harsh criticisms. It does not sound fair considering the hard work Nextcloud team/contributors are doing to produce an amazing publicly available Free Software. #ILoveNextcloud 😉

@aaronpk Yep, but in that case the attacker controls the redirect uri right? how can the attacker control the redirect uri without also controlling the pkce secret?

@aaronpk you linked to "Insufficient Redirect URI Validation" though? maybe i'm just confused about what you were talking about.

@aaronpk Yes, i get that, but the attacker can make the access token request just as easily as the legitimate client.

@aaronpk no, I understand that one, I just still don't see how pkce helps improper redirect validation (since the pkce secret and redirect URI come from the same request)

@aaronpk huh? But the redirect_uri is controlled by the same person who controls the code_challenge

@aaronpk isn't the section you linked to just as much of a concern under the authorization code flow as the implicit flow? since javascript clients are public clients no matter what?