Proper comment privacy! Yay!

Comments

Okay, instead of trying to modify Isso to support thread IDs that are separate from page URIs, I ended up leveraging the way that Publ request routing works and just made all thread IDs consist of a /<signature>/<entry_id> path, where <signature> is computed from an HMAC signature on the entry ID and a secret key. So, now the thread ID is only visible to people who have access to the entry in the first place (as long as my signing key never leaks), and the fact that Isso only uses the thread ID when generating a reply email link isn’t a problem.

So, for example, this entry has an entry ID of 4678, and the generated thread ID is (for example) /890824f4d450d4ac/4678, so when someone gets a reply notification the email will say something like:

such-and-such <foo@bar.baz> wrote:

Good point!

Link to comment: http://beesbuzz.biz/890824f4d450d4ac/4678

which will then redirect back here.

It’s not ideal, of course, but it works well enough.

Of course, to do this I had to migrate all of my thread IDs again, but hopefully this is the last time I’ll have to do that, and it also takes care of all my legacy Movable Type-era thread IDs. It does set a bad precedent that I’ll have to migrate thread IDs more in the future if I ever change my publishing system but the fact I was able to get away with not doing that for so long is a pretty good testament to my laziness, which I ended up having to pay interest on in the future anyway. So, lesson learned.

Also, this approach is even better privacy than what I was hoping to get out of the Disqus method; as it stood before, someone on my friends list (or who saw an Auth: * entry) could have theoretically figured out the way I was determining private thread IDs and used that to explore comments on entries they don’t have access to, and also there was an issue that if I ever took a public entry private, its thread ID would remain the same as when it was public. But this way, it’s unguessable as long as my HMAC key never leaks, and if my HMAC key does leak I can just reset it and regenerate the thread IDs. (Edit from the future: Ha. Haha. Ha hahaha ha haha. Ha.)

This approach is also useful for things other than Publ; my advice to anyone who’s using Isso for comments is that instead of using the actual entry URI as the thread ID, they should have some sort of stable mechanism for forwarding an opaque thread ID to the actual entry, and use that. This just happened to be really easy to implement for Publ since Publ already supports opaque ID chasing.

Read more…

Comment integration blues

Comments

So, there’s an issue with Isso which will require a bit of refactoring/feature work on Isso, which I’d might as well try to do since I can’t be the only one who needs to decouple their thread IDs from their URLs.

Anyway, this’ll probably mean that I’ll have to redo the comment import at some point, so don’t get too attached to anything you’ve posted so far.

Update: Rather than doing the right thing for now I’ve opted to just use the shortlink as the identifier. This means that future site migrations will be more painful, and also I need to do some more work to migrate in the old comments from older entries, but I guess the idea of a single universal migration path is a bit silly anyway.

Moving away from Disqus

Comments

So, Disqus has served me pretty well for quickly embedding comments into my website, but there are a few pretty big downsides to it:

  • No support for private/hidden threads
  • No way to disable random discovery of hidden threads, by design
  • They’re trying to make the whole Internet into their own forum rather than providing “just” a comment system (not that anyone even uses it the way they intend)
  • Their UX keeps getting more and more cumbersome and annoying

I’m going to look into alternative comment systems, ideally ones I can self-host. Isso looks promising, if a bit sparse. So does Schnack. (I’m going to try Isso first because its setup/requirements are far less onerous.)

Anyway, thanks Passerine for bringing the privacy leak issue to my attention. I figured there was probably something like that lurking in the shadows, but I didn’t think it was quite so close to the surface…

Long transitions

Comments

Tonight, my set at Song Fight! Live went really well. There were some rough patches due to the usual nature of the beast but we managed to hold it together and afterwards everyone told me how great it sounded. I’m overall happy with that.

An “interesting” thing has been happening regarding how people deal with my gender stuff lately though.

Read more…

Song Fight! Live 2019

Comments

I forgot to mention it here, but I’m going to be in Madison, WI for Song Fight! Live this weekend! I’ll be performing my set sometime Friday night, and will also (probably) be playing drums for one or two other acts throughout the weekend, and (hopefully) debuting a new song (yet to be written, as I do not yet know the title) on Saturday!

Anyway if you’re in or near Madison and can make it to The Rigby and want to watch me flail in front of a crowd, now’s your chance.

(We’ll also try to have a live stream although right now there’s some logistics to work out on that front, so no guarantees.)

Anyway I’ll also be in Madison until Tuesday and don’t currently have plans for Sunday or Monday, so if I know anyone in the area it’d be fun to meet up and do something I guess? I mean, assuming I don’t get murdered for my anti-Trump song.

Birdsite

Comments

So, my Mastodon instance of choice is having notification/sending/receiving issues again, and rather than doing what I usually do in this circumstance (temporarily switch back to mastodon.social or see what other instances I’ve been on are still around – spoiler: very few of them) I decided to just go without instant-update social networking for most of the day.

But then I still needed that little dopamine rush, and so I decided to try Twitter again (at least, more than my usual “post some stuff and maybe check my notifications” tendencies), and friends, let me tell you… Twitter is awful.

I’d forgotten just how much of a hellhole of advertising, “engagement”-optimizing, outrage-inducing chatter it is.

On the plus side, a lot of people seem to really enjoy the anti-ads I’ve been running for a few weeks (for $1 a day). I think I’ll expand that out into other subject areas.

But what’s even better is just getting unaddicted to commercial social media. Yikes.

Thoughts on quality engineering

Comments

Throughout my career, I’ve noticed that quality/test engineering is usually seen as a bottom-of-the-barrel discipline, something that someone should want to be promoted out of rather than someplace to end up. I find that really strange.

It takes a lot of skill to look at other peoples' code and write tests to exercise it and determine correctness, and to do it well. And to have exacting standards about code quality and testability of the code in the first place.

Nearly everywhere I’ve worked, though, test engineers have been incredibly junior and not particularly skilled. Which made it part of a self-fulfilling vicious cycle; test engineers do poor-quality work (and don’t seem to bring much value to the actual product development), so low-calibre programmers end up being put in those roles, and so then they continue to do poor-quality work. Test engineering seems to be treated as glorified QA in most places.

Read more…

Emojitalics

Comments

Today I discovered, quite by accident, that Safari will happily 😀 italicize emoji. 😆 😆 😆

I wonder if it’ll also boldface 😙 it…

Although strikeout 💔 wouldn’t surprise me at all.

Edit: It doesn’t seem to happen on every browser. Here’s a screenshot of what it looks like on Safari on macOS 10.13:

italicized emoji

Slowcial networking

Comments

Over on IndieWeb Chat, Kevin Marks linked to this wonderful essay about social media that is absolutely worth reading, and examines a part of the “personal social networking” thing I’ve been on a kick about lately but didn’t quite have the words for.

For me, a big part of the problem with social media as it stands today is that everything’s about fast, immediate, in-the-moment dissemination of Hot Takes and viral propagation and so on, and that’s a design that so many of the other indie-focused social networks are trying to replicate. I’m not much a fan of microblogging or protocols which exist to make it the norm (which is why I’m still not particularly interested in supporting ActivityPub natively in Publ!) and I like being able to take some time to expand on my thoughts and not have to chunk things up into 280-to-500-character chunks and worry about fixing my spelling and grammar and phrasing right then and there.

I like being able to sit on things for a few days, and add addendums without it being a whole new post, and I like having feedback come slowly and measured. Yes, I get quick replies and a variety of favorites-like reactions via Webmention and other things, and I do appreciate that in this little nichey corner of the web this is a way that people can interact with me, but I’m not really writing for an audience so much as writing for me and my friends, and hoping that the things I write also maybe resonate with folks who happen to read it.

I still use Twitter and Tumblr and Mastodon quite a lot (much more than I’d like, really) but that’s not how I prefer to interact with folks. I don’t even try to read everything that people post there, and I have no idea how anyone can think of timeline-oriented streams-of-updates services as a place where you’re going to be able to. I just occasionally glance at them to see what’s going on and maybe interact with others in the moment, and spend much more time wondering why the hell I even bother trying to communicate in that way beyond “it’s how everyone else communicates today.”

My big concern about my blogging habits here is that I’m mostly talking about the platform itself. Blogging about blogging is so dreary. Hopefully soon the new-toy shininess will wear off and I’ll get back to using this as a means of talking to my friends about other stuff. I certainly have a lot of other stuff coming down the pike, at least. Hopefully some of it turns out well.

I guess it’s mostly just that what I have to write about is what I’m working on, and this is (mostly) what I’m working on. If I were working on other things they’d be getting posted to other parts of my site.

Not-unrelatedly, I really want to get back into making comics.

Post privacy

Comments

I finally have private posts working in Publ. This is just a test; in particular this post should only appear to people who are not logged in, and should disappear as soon as they do.

Think of it as the sound of one hand yapping.