Aaron Parecki

Ben Werdmüller https://werd.io/profile/benwerd • Oct 9
Cursed thought: what if I built a new community platform, written in Node or Go, that could import data from Known and which supported ActivityPub and web3 natively.

Don't buy in to the web3 hype!

But I'd also choose Go since you can distribute binaries that don't require someone sets up an entire dev environment to run

Portland, Oregon • 46°F

Sat, Oct 9, 2021 8:39am -07:00
Brad Fogle https://twitter.com/foglebr • Oct 9
Pretty sure Gary will never go full time YouTube. I know how cushy the benefits of his day job career are. 😉👍

same tbh 😅

Portland, Oregon • 46°F

2 likes

Sat, Oct 9, 2021 8:39am -07:00
Gary https://twitter.com/every_daydad • Oct 9
Well crap, just learned about a work trip coming up next month.

So let's make sure we synchronize calendars before doing any sort of Apple event.

I'll have my staff call your staff.

I can't believe you still have a full time job and haven't gone full time YouTube yet 😅

Portland, Oregon • 45°F

6 likes 3 replies

Sat, Oct 9, 2021 6:40am -07:00
Gary https://twitter.com/every_daydad • Oct 8
How did people remove blemishes for YouTube thumbnails before Photoshop?

I also hate that I know how to do this 😅

I mean, Photoshop had already existed for 15 years before YouTube, so... they didn't? 😁

Portland, Oregon, USA • 59°F

10 likes

Fri, Oct 8, 2021 5:03pm -07:00
Chloe Condon https://twitter.com/ChloeCondon • Oct 8
I miss being a kid afraid that Y2K will mess everything up. 💻🔥

Instead I'm over here in my 30s worried that climate change will destroy the planet and genuinely concerned if I'll ever actually get to use my 401k because the earth will be destroyed. 🌍🔥

Don't worry, 2038 is just around the corner and is going to be way worse than the Y2K bugs.

Portland, Oregon • 42°F

5 likes

Fri, Oct 8, 2021 7:19am -07:00
@goto https://twitter.com/samuelgoto • Oct 8
Ah that's indeed a reasonable distinction. Still seems like solvable? Like Signal that uses a master identifier and then ephemeral (yet stable) ones?

Maybe, but at the end of the day I would assume any crypto will eventually be broken, so it's a game of picking good enough algorithms to avoid correlation in a timeframe that would be a problem.

Portland, Oregon • 46°F

1 reply

Thu, Oct 7, 2021 10:10pm -07:00
@goto https://twitter.com/samuelgoto • Oct 8
Sure. I'm sure one could find a hashing function that would age well (I'm making an assumption :) but a lot of stuff breaks if one doesn't :)).

But there's a big difference in relying on a specific hash function for something that won't matter a day from now (validating an ID token) vs something that can be correlated years later (hashed identifiers in logs)

Portland, Oregon • 47°F

3 replies

Thu, Oct 7, 2021 9:47pm -07:00
@goto https://twitter.com/samuelgoto • Oct 8
LMK if you run into a good formulation.

FWIW email may be a good analogy and source of inspiration. In browser land, SHA256(user + RP)@idp.example does the trick.

Relying on sha256 as the end of the story seems like a thing that also won't age well. It's only a matter of time until we see sha256 the way we see md5 today.

Portland, Oregon • 47°F

5 replies

Thu, Oct 7, 2021 9:44pm -07:00
tim cappalli https://twitter.com/timcappalli • Oct 8
That was fast @aaronpk. Welcome :)

I actually thought I had already joined, but I haven't yet actually joined a meeting. It's a lot to keep up on with all the other spec work I'm in the middle of 😅

Portland, Oregon • 47°F

1 like

Thu, Oct 7, 2021 9:42pm -07:00
Aaron Parecki https://aaronparecki.com/ • Oct 7
Oh yeah, that's intentional. It'd be interesting to explore what it could look like otherwise tho.

I'm actually really interested in this particular problem right now since Sign In with Apple is probably the biggest example of differing IDs per RP yet the first thing the RPs want to do is resolve that back to an identifiable user.

Portland, Oregon • 47°F

4 replies

Thu, Oct 7, 2021 9:32pm -07:00
@goto https://twitter.com/samuelgoto • Oct 8
No, in the sense are these designed such that two different RPs get the same global identifier for the same user?

Oh yeah, that's intentional. It'd be interesting to explore what it could look like otherwise tho.

Portland, Oregon • 47°F

1 like 19 replies

Thu, Oct 7, 2021 9:27pm -07:00
@goto https://twitter.com/samuelgoto • Oct 8
"Because these URLs rely on the public web and DNS, they are guaranteed to be globally unique." -- ugh, is this a feature or a bug? I feel like this isn't going to age well :(

Do you mean when there's a viable replacement for DNS? We can cross that bridge when we come to it.

Portland, Oregon • 47°F

21 replies

Thu, Oct 7, 2021 9:24pm -07:00
@goto https://twitter.com/samuelgoto • Oct 7
Ok, I did look into this more carefully and I remember running into this earlier.

How does this relate to OIDC? Is it fair to characterize it as an alternative to it that operates on the same level/layer (e.g. both are extensions to oauth?)?

There are definitely some similarities since they are both adding an identity layer on top of OAuth. IndieAuth is a much smaller surface area tho and does less stuff. Some more details here: https://indieweb.org/How_is_IndieAuth_different_from_OpenID_Connect

Portland, Oregon • 48°F

23 replies

Thu, Oct 7, 2021 9:20pm -07:00
@goto https://twitter.com/samuelgoto • Oct 7
@aaronpk on a related note: does any part of IndieAuth break when browsers block third party cookies?

No, none of it relies on third party cookies thankfully, it's closer to plain OAuth in that sense.

Portland, Oregon • 48°F

1 reply

Thu, Oct 7, 2021 9:17pm -07:00
Roberto Blake 🇺🇸🇵🇦🗽Creative Entrepreneur https://twitter.com/robertoblake • Oct 7
For those who have renovated a basement for YouTube or streaming, about how much was the total project?

I do not want to add it all up

Portland, Oregon • 43°F

6 likes

Thu, Oct 7, 2021 6:34am -07:00
@goto https://twitter.com/samuelgoto • Oct 7
Is there any existing mechanism (even if not widely deployed) that would allow a user to use an IDP with an RP dynamically (i.e. without a pre arrangement between the RP and the IDP)?

Dynamic Client Registration, but afaik no major provider supports this because they *want* RPs to have a pre-established relationship.

We built IndieAuth to avoid the need for any client registration and it works great for that use case: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

Portland, Oregon, USA • 51°F

1 like 1 reply

Wed, Oct 6, 2021 7:49pm -07:00
Aaron Parecki https://aaronparecki.com/ • Oct 6
At the end of the day, OAuth is just a way to communicate between services and users, and as such it's easy to grasp and non-controversial.

OAuth solved a universal problem – signing into a web site – and, in doing so, created a new problem: how does a site know it's really you?

Follow @wtf_oauth for your daily dose of OAuth humor, which will be funny to approximately 0.0001% of you

Portland, Oregon, USA • 52°F

8 likes 1 repost

Wed, Oct 6, 2021 7:23pm -07:00
John Allsopp https://twitter.com/johnallsopp • Oct 7
what I usually say to speakers is a rough title and 3-4 bullet points of what you want to cover as a start-I think why it's challenging is folks try to "sell" the talk from the get go, rather than refine the focus, then worry about selling it

here you are trying to be actually helpful and I've just gone and set up a new parody twitter account @wtf_oauth

now back to work, let me actually read this now 😅

Portland, Oregon, USA • 52°F

2 likes

Wed, Oct 6, 2021 7:20pm -07:00
Gabe Cohen https://twitter.com/_gabecohen • Oct 7
https://www.copy.ai/

I think copy.ai has it out for Khan Academy

"I want to start a company based around making great educational content on truly complex concepts like OAuth. Think Khan Academy but also feel like you're talking with an expert."

Portland, Oregon, USA • 55°F

2 likes 1 reply

Wed, Oct 6, 2021 6:21pm -07:00
Jesse Vincent https://twitter.com/obra • Oct 7
Write the full talk, then train a neural net to summarize the transcript.

That would very likely get me a better result than feeding this AI 3 sentences and having it come up with comedy gold like this:

"OAuth is like having the Facebook app on your phone, but you are using the same password that you are using for everything else."

Portland, Oregon, USA • 55°F

2 likes

Wed, Oct 6, 2021 6:18pm -07:00

older