2023/01/24

@jrconlin Still too new

@toolbear This seems like a pretty rad idea!

@toolbear It's like a handcrafted artisanal roguelike 😁

@schlink Yeah, it seems kinda thrown in there but ughhh

@f00fc7c8 FWIW, I'm kinda working on this sorta thing

@f00fc7c8 Oh, yeah, it can all run locally. It connects out to a Mastodon instance like an app and the search UI is just a web server on my local network.

@danhon :oof: We've had to write a few of those. It's... gross.

Toddler time again, all I want to do is stay up late and watch awful movies.

Tinkering with another search indexing bot, over on one of my personal instances. Intent is to only index mutual follows. When followed, it auto-follows back.

But, for lots of good reasons, there's no such thing as an "unfollowed" notification - so the bot can't auto-unfollow. Could possibly scan through follows for non-mutuals, but that's not great.

If you block the bot after following, it stops receiving toots. So, that's an option. Thinking I might have it watch for an "unfollow" DM to unfollow.

@dominik Well, this is a Mastodon API bot, not a full activitypub server. Mastodon doesn't pass unfollows through in notifications, as far as I can tell.

Also, to be clear, this thing is currently only indexing toots from a few of my own accounts - because I'm the only one who's followed and been followed by it.

Also seems like the user stream topic doesn't include toots with at-mentions of other folks. Doesn't show up in the bot's home feed either. Probably just how federation is working 🤔

https://yesindex.glitch.me/?q=tinkering

@dominik I do also want to get a standalone activitypub server of it going. Felt lazy and made a mastodon bot first though 😅

@welshpixie I have absolutely been here many times.

Also, installing a thing like Skyrim and spending time getting a pile of mods working, only to get just past the title screen and go "well that was something" and leave it untouched thereafter until I need the space back in a few weeks

@tedivm "follow bot" is a thing that's been around for years on the fediverse, especially for new and sparsely connected instances.

Problem is generally the automated, unsolicited follows by a bot designed to increase discovery & distribution of content. Implicit in that is the understanding that most folks have their follows open and such a bot can scoop up a lot of accounts and content - unless those accounts say no.

This, as opposed to a bot that does nothing unless it gets a positive signal to follow - i.e. explicitly solicited to engage. I think a lot of folks have made it clear that this is a baseline for acceptance.

@maddiefuzz I WANNA KNOW

This meeting could have been an email that I didn't have to read and you wouldn't have shown up to 20 minutes late

@earthshine I've got no need for it myself, but dang that's a neat device

These days, whenever I see something called a "whitepaper", I smell bad cryptocurrency vibes. Kind of like how cryptocurrency squatted on the term "crypto".

Like, publishing an explanation of a thing is good. But it seems like the explanations called "whitepaper" tend to describe undesirable things these days.

@cogspace @JosephMenn IMO, it's the "undetected" part that's real trouble.

Like, yes, duh, engineers in a system can access and manipulate things. But along with that, there should be audit logs and more than a single engineer's eyes on actions.

I'm not really seeing whether or not that sort of thing exists for the "GodMode" described in the article. But it does sound like there's been a lot of shenanigans around dodging such observability, according to the story.

@cogspace I've personally worked on plenty of systems where I can see, change, delete, act-on-behalf-of for data belonging to users & customers. But, in most of those situations, I've been pretty aware that what I'm doing is logged & observed & noted. That's part of the tool.

In my current job, I have to explicitly fill out a form describing my purpose before temporarily acquiring elevated permissions - I assume from that point on, my every button click and setting change is indexed by what I stated in that form. If something goes wrong later, it'll come back to me and my stated reason will be examined.

If I worked to circumvent that stuff and traded tips with coworkers on that, I'd be in a decent amount of trouble

@drwho As long as it's in written form and not recited in a live meeting

@earthshine holy crap, that's epic and sounds painful and yet also I'd've done that

@alexch @cogspace Yeah, re: the "performed by user postgres" thing - most times I never get access to the actual production credentials or servers when I need to reach into production.

I get something like temporary credentials to a special proxy or limited-expiration VPN access to something all watched over by paranoid machines. There might even be an announcement in an ops chat channel somewhere like "LMORCHARD HAS ENTERED THE SERVER" and folks ask me what I'm up to.

It's been a very long time since I was at a company where I as a random engineer had quiet solo access to anything important

Alright alright, I guess I'll try this @ivory thing the kids are all hyped up about

@jrwren Yeah, I think many fidonet accounts could also receive email via some gateways.

I did at one point sorta abuse that when I discovered FTP-by-email and requested a bunch of Amiga software, the transfer of which pissed off a whole chain of sysops between me and the email gateway.

Whoo this is a noisy lil app innit? It's like playing with a busybox

Hmm, rather difficult to tell my accounts apart in Ivory though

@mhoye@mastodon.social "there are two dick wolves" "inside of me?" "What? No, globally. we need better specificity"

@craigmaloney @mdhughes @thegibson @drwho @maddiefuzz @ajroach42

🤔 On one hand, I'm like... that's a lot of money for an app. On the other hand, I'm like... haha, no it isn't.

fediverse search (i built another thing)

Speaking of apps, ill-advisedly, I'm touching the hot stove of fediverse search again with a bad prototype.

This is a bot that aims to only index toots from mutual follows. Anything more than that is a bug to be fixed.

You follow it, it follows you, it saves toots for search. You block it, it no longer sees toots.

I want it to auto-unfollow when unfollowed and delete the saved toots, but that's currently complicated (unfollow notifications are not a thing in the Mastodon API, AIUI). As a hack, I might have it honor an "unfollow" and/or "forget me" in DM as the signal of withdrawn consent and to purge.

If/when I rewrite it as a native activitypub server - rather than a Mastodon API bot - I think that comes with proper unfollow messages? Still, best to have more options to accept signals of positive & negative consent

https://yesindex.glitch.me/?q=app