service announcement for my friends: i was today years old when i learned about qwant.com, a european search engine that is not google, values privacy etc etc etc. go check it out if you dont want to feed the google shit machine more data!
Gegen eine Entwicklerin, die Sicherheitslücken in insgesamt drei Wahlkampf-Apps entdeckt hatte, wird ermittelt. Dabei war sie verantwortungsbewusst vorgegangen.
hello !Friendica Support, i am wondering why i have to log in to friendica each and every time i open a browser. is this by design, and/or are there options to change that behaviour? (i can not find anything related to that)
When you log in to your account, there is a "remember me" checkbox you can select. If you do so, the cookie should be stored and you should be logged in when you visit the page the next time.
haha. thanks for that superfast answer! it totally did not occur to me that this checkbox is for staying logged in instead of just storing the login name or something. thanks, and sorry for bothering you with that. but while we are at it, what exactly does the "this device is my 2fa device"-checkbox on the 2fa login change if enabled? i tried, and it seemed to not do anything. what did i miss?
also, checking "remember me" does bypass the login screen, but throws me into the 2fa screen to enter a 2fa token if the browser has ben closed since the last session. is that intended?
Basically both features are based on cookies, and web cookies are some kind of black magic I haven't been to completely master. Normally it should either ask you for both, or none, because both are based on cookies, but I can't guarantee any of it.
ok, i tried this, if i check "remember me" and "this is my 2fa device" it seems to work as intended. yet, i'd like to question wether the behaviour of throwing a 2fa login at the user while the user stated "remember me" is useful behaviour. friendica is the only web thing i know that decouples 2fa from the login that way.
2FA is an added security measure. As such it's pretty much independent from the mail credentials. Since it's easier to use than remember password, you may want Friendica to remember your login/password but have to supply your 2FA regularly to prevent someone to hijack your session.
ok, i get that, but the user experience is not great. maybe in the future this can be something that the user can choose in his options; wether it is linked to login or not. right now i can abuse the "this is my 2fa device" for that.
Yes, I do not like this option but it sort of makes sense. When I'm using my phone to browse Friendica, I have my 2FA app on it as well, so the security benefit to ask me for the token on this device is null because anyone with my phone can still log into my Friendica account even if it asks the 2FA token.
true. i store my 2fa stuff in a password manager, so there is a layer of security in the form of a long password infront of my 2fa tokens. but that makes it so unpleasant to type the 2fa tokens in more than necessary. i guess there is no right and wrong options here.
Yes, it's all about tradeoffs between convenience and security. 2FA mostly prevents remote logins with stolen credentials, but your mobile device security is another matter entirely.
hello people of the fediverse! if you are looking for a 32ch analog inline mixing desk, i have 2 of those that i am ready to give away. one tascam m3500 and one tascam m3700 (the same board, just with a small vca automation computer). location is near elmshorn/hamburg, and you have to come with a big car (station wagon / kombi) to pick one up, as they are quite big. this can be reshared to people around hamburg! #tascam #m3500 #analog #console #hamburg
ach, ich kenn mich ja mit dem ganzen analogen Kram nicht aus, ich hatte gehofft, du verhökerst gerade das, von dem ich irgendwann mal Fotos gesehen hatte und hast es durch was Digitales ersetzt. ;)
humans of the abraum, i have a question for you: the initial few weeks i was running the development branch of friendica with little issues. now that we are gathering a small crowd here, i switched to stable at the current release. this puts us 1-3 months behind current developments. what is your opinion about running dev vs. stable? do you/we want to keep it stable, or do we want to accept stuff possibly breaking from time to time in exchange for pulling latest developments faster? or maybe run a second playground instance?
it is a moving target at the moment. support for (mastodon)mobile clients arrived just a month ago. also, of the 128 systems our node knows about right now, the distribution is roughly like this: 2021.01 (25) 2021.04 (19) 2021.06-dev (3) 2021.07 (51) 2021.09-dev (18)
woke up very early, spent some time preparing reentry to germany (digitale einreiseanmeldung, smooth process, well done rki). also created a new facebook account 2 days ago to let more people around me know about the fediverse. instant feeling: urgh. the level of toxicity(?) in/under almost all content they show me over there is just astounding. i have not missed that at all during the last few months. bleeeeerrrgh. that monster needs to be taken down.
@Felix Bohmann für iPad (oder eventuell Tablets allgemein, so es Android-Versionen gibt) find ich (natürlich nur ultrakurz geprüft ;) ) Oyakodon und/oder Tootle gut. Weil: Landscape-Modus EDIT: Ok, Tootle vielleicht doch nicht, denn damit konnte ich diesen Kommentar nicht absenden :)
i like how with every single one of my friends taking a look at our little place on the fediverse it feels a little bit less empty. i know it is not exactly empty, but getting friends over feels so good. good night good people of the abraum.
what has happened these days: sold 2 vw t3 busses, workspace cleanup almost done. almost no time spent in the studio, beginning preparations for a 7 day semi-outdoor demoparty. feels good. also feeling tired.
i am experimenting with a friendica instance, right now i am testing the mastodon api with various ios clients, but i cant get past the login. there seems to be issues related to oauth, or authentication in general. i get logs like these:
when trying to accept the useage agreement on mercuro for mastodon after what seems to be a successful login and app connect:
2021-06-16T17:14:16Z index [NOTICE]: Unhandled request field {"parameter":"scope","value":["read","write","follow","push"],"command":"oauth\/token"} - {"file":"BaseApi.php","line":155,"function":"getRequest","uid":"a984fe","process_id":451063}
or with metatext, login is ok, app is connected, but then i get http 401 with this:
[Wed Jun 16 17:21:40.117648 2021] [php7:notice] [pid 450931] [client 62.93.4.179:65179] PHP Notice: Undefined offset: 1 in /var/www/html/friendica/src/Security/BasicAuth.php on line 128
is that something that is just not working/tested yet, or is that some configuration error on my side?
found the faq, updated my instance, got some new files since this afternoon, yet, amaroq and b4x will also not properly log in. im running out of time today, will get back to it tomorrow.
hello world! i went through the docs of friendica, and it seems i have to update the server a bit in the near future, as there is a release candidate for the beta we are currently running. good thing: since this version, it features a mastodon-style api, so mastodon ios clients should be useable with this instance soon! i will let you know once i have tested this!
so, a few days ago i decided i could actually reopen my facebook account for a few days to pester my friends with new social locations like this here. turns out i missed the 30 day deadline by a few days, so my facebook account is gone for good now. the first few minutes i did not really know what to think of that, but this weird feeling turned into a slightly less weird kind of relief quite quickly. it is gone, all the data should be gone (or going soon) and that huge backlog only exists as a html archive here at home. feeling good. now: good night.
felix b. ohmann
in reply to felix b. ohmann • •