Aaron Parecki

Vittorio https://twitter.com/vibronet • Feb 25
Yesterday I was attending a 350ppl Zoom meeting while driving.
The car in front of me made me miss a green light🚦, & I let out a scream of pure, unadulterated rage😡 .
The presenter suddenly stopped and everyone in chat wondered what made Vittorio so upset. I was unmuted 😅 oops

It was frankly an unforgettable moment 😅

Portland, Oregon • 43°F

4 likes

Fri, Feb 25, 2022 5:33pm -08:00
https://events.indieweb.org/2022/03/micro-camp-2022-IW2Qp3ygHike

I'll be there for the second half of the day! Looking forward to it!

Portland, Oregon, USA • 33°F

Thu, Feb 24, 2022 7:30pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
Arguably, tho, PKCE and putting a client secret into a SPA are orthogonal. It's conflating two things that work differently. Poor devs can't understand those differences.

The error should be "we see you sent a client secret and an Origin header. is your client a SPA?"

I totally agree, this error message makes no sense. I'm going to file a ticket tomorrow internally to fix it.

Portland, Oregon, USA • 33°F

Thu, Feb 24, 2022 7:18pm -08:00
Hirsch Singhal https://twitter.com/hpsin_ • Feb 25
Helps prevent devs from putting their client secrets in a web page to perform the client creds flow, yep. When AAD enabled this, we definitely got a couple support calls on that. This was how we ratcheted forward PKCE use from suggested to required as well.

yep you guessed it! misleading error message but that's exactly what was going on.

Portland, Oregon, USA • 33°F

2 replies

Thu, Feb 24, 2022 7:07pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
Ah, good question -- I didn't notice that. I bet their client config is misconfigured then.

Yep, I confirmed my suspicion. Misleading error message. Will post details on the github thread.

Portland, Oregon, USA • 33°F

1 like

Thu, Feb 24, 2022 7:03pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
People are asking, when using standards compliant OIDC client libraries:

https://github.com/authts/oidc-client-ts/issues/395#issue-1149525542

why does that example have the browser sending a client secret in the request? That seems odd. Happy to continue this over on the github thread.

Portland, Oregon, USA • 34°F

2 replies

Thu, Feb 24, 2022 6:58pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
It's confusing as hell, and I'm confused by the implementation -- on the token endpoint if Origin is present, you require that the authz used PKCE? That's about the only valid approach to that I can imagine.

Yeah that's right. I agree it's super confusing and has caused some tricky issues before. It may be different in the new platform but I'd have to double check

Portland, Oregon • 34°F

4 replies

Thu, Feb 24, 2022 6:53pm -08:00
Brock Allen https://twitter.com/BrockLAllen • Feb 25
Hey @aaronpk, can you explain this help article? It makes no sense to me. TIA

https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en_US

Oh yeah, I remember this one. I don't remember if this is still current behavior, but basically Okta is tying to prevent browsers from using anything other than the authorization code PKCE flow. It does that by detecting the Origin header which isn't sent by server apps.

Portland, Oregon • 34°F

1 like 11 replies

Thu, Feb 24, 2022 6:50pm -08:00
Aaron Parecki https://aaronparecki.com/ • Feb 23
Do I know anyone involved with @LoginDotGov? I found a few (minor) issues with the OAuth/OpenID docs there https://developers.login.gov/oidc/

I didn't realize before, but their docs are open source! I just sent them a PR to fix it!

https://github.com/18F/identity-dev-docs/pull/235

Portland, Oregon, USA • 29°F

8 likes

Wed, Feb 23, 2022 11:25am -08:00
DoctorMac https://micro.blog/DoctorMac • Feb 23
@aaronpk you would use this mechanism: 18f.gsa.gov/vulnerabi...

"We accept and discuss vulnerability reports on HackerOne, via email at tts-vulnerability-reports@gsa.gov, or through the form"

HackerOne is the preferred reporting.

Thanks, it's not a security issue, just some misleading wording in the docs. I sent them a PR to fix it!

Portland, Oregon, USA • 29°F

Wed, Feb 23, 2022 11:24am -08:00
Jason Garber https://twitter.com/jgarber • Feb 23
18F manages the app. Main source repo is here: https://github.com/18F/identity-idp

Not sure if the docs are generated from there, though.

oh awesome, their docs are on there! I will just send them a PR then!

https://github.com/18F/identity-dev-docs

Portland, Oregon, USA • 29°F

1 like 1 reply

Wed, Feb 23, 2022 9:47am -08:00
Nils https://coolworld.cc/@n • Feb 20
@aaronpk Lawyer up and hit em hard. False DMCA claims are no Kavaliersdelikt (there‘s one for your German lessons).

Thankfully the place I licensed the songs from has a team of lawyers on it now!

Portland, Oregon • 40°F

Sun, Feb 20, 2022 7:42am -08:00
Raphael Lullis https://mastodon.communick.com/@raphael • Feb 20
@aaronpk Aaron, so many popular youtubers dealing with bogus copyright claims now... what is missing on the open source video streaming platforms for them to make the
switch? Is it "just" a matter of network effects?

Yeah there's a lot more to it than just pushing out a video stream. Discovery and payments are the two big reasons to use YouTube/Twitch.

If you stream on your own website, nobody will know unless you tell them thru some other network. If you also want to monetize that you have to sell your own ads.

Portland, Oregon • 41°F

Sun, Feb 20, 2022 6:16am -08:00
Vittorio https://twitter.com/vibronet • Feb 20
Any day now

Me picking out new kitchen appliances

Portland, Oregon • 46°F

1 like

Sat, Feb 19, 2022 10:24pm -08:00
Sara Dietschy 🍑y https://twitter.com/saradietschy • Feb 20
How do yal spend your Saturday night 🙃

I mean, since you asked... https://twitter.com/aaronpk/status/1495218082461011969

Portland, Oregon • 46°F

Sat, Feb 19, 2022 8:15pm -08:00
Anandkar https://twitter.com/anandkar1987 • Feb 20
I want to buy this course. Is there any coupon code?

Yeah! Udemy runs coupons on it pretty often! I don't know the exact schedule, but check back again every week or so and you'll probably find it discounted!

Portland, Oregon • 46°F

Sat, Feb 19, 2022 8:14pm -08:00
Aaron Parecki https://aaronparecki.com/ • Feb 19
anyway, if you want to hear me rant for an hour about what I'm dealing with trying to fight this obviously invalid (i'm being generous here) Content ID claim on some of my YouTube videos, join me tomorrow at 10am Pacific https://youtu.be/OLK2re0LfrQ

oh no oh no it gets worse... I literally just got an email saying they rejected the dispute. They are obviously wrong about this and anyone at YouTube with half a brain can tell you this, but how am I supposed to get someone at YouTube to care??

Portland, Oregon, USA • 46°F

3 likes 4 replies

Sat, Feb 19, 2022 8:02pm -08:00
Gary https://twitter.com/every_daydad • Feb 19
Finally had to pull the safari bandage off.

Fully using firefox on both windows and apple now.

if there's nothing else that we've come to expect from you, it's drastically changing up your tech preferences every month or so

Portland, Oregon • 47°F

6 likes 2 replies

Sat, Feb 19, 2022 7:03pm -08:00
Aaron Parecki https://aaronparecki.com/ • Feb 19
this system is inherently rigged to the advantage of copyright holders, except it's also extremely easy for a supposed copyright holder to be malicious, or at best just be wrong or make a mistake, and there's very little a content creator can do

anyway, if you want to hear me rant for an hour about what I'm dealing with trying to fight this obviously invalid (i'm being generous here) Content ID claim on some of my YouTube videos, join me tomorrow at 10am Pacific https://youtu.be/OLK2re0LfrQ

Portland, Oregon, USA • 47°F

2 likes 1 reply

Sat, Feb 19, 2022 6:23pm -08:00
Aaron Parecki https://aaronparecki.com/ • Feb 19
So I've been spending my Saturday night preparing for tomorrow's livestream by reading up on all the details of YouTube's Content ID system and reading the licenses of various royalty free music sites, and all it's doing is making me more and more angry about the whole system...

this system is inherently rigged to the advantage of copyright holders, except it's also extremely easy for a supposed copyright holder to be malicious, or at best just be wrong or make a mistake, and there's very little a content creator can do

Portland, Oregon, USA • 47°F

5 likes 2 reposts 1 reply

Sat, Feb 19, 2022 6:07pm -08:00

older