Jons Mostovojs @jonn@social.doma.dev

Working hard on #doauth being privacy-preserving. API first, backend later.

Invites work! #doauth

Managed to write a count-based invite system full implementation with #doauth as a library takes 111 LoC.

Going to write tests tomorrow and start looking into integration with mastodon 🎉

Another milestone for #doauth!

Invite functionality is implemented, now it's basically #clubhouse.

Hot take: tonsky has such obnoxious website design because he doesn't want anyone to read his stuff using a web browser, but rather RSS or Mozilla's "read" feature.

Example:
https://tonsky.me/blog/font-size/

Getting sleepy...

I wonder if I'll manage to implement limked lists for verifiable credentials as seen in #doauth, thus implementing everything needed for the quantity-bound invite protocol.

People who call quarantine hotels "concentration camps" are, as a rule of thumb, the reason why we need these hotels as societies in the first place.

BTW, quarantine hotels and vaccine passports are messed up practices I can't wait to go away.

I'm kind of behind the curve when it comes to OWASP for web, compared to #phoenix authors, but it seems like my header-based MITM / replay prevention called Chappy does the same thing as the CSRF-mitigation.

I'm such a "not invented here" guy, holy shit.

Patch, demonstraing this functionality:

https://git.sr.ht/~doma/do-auth/commit/21d3273710381f8c59949a76b98df6a9334cf8cf

I can't wait to speed-run invite system imlpementation and start integrating it with #mastodon!

Another milestone in #doauth's history: JS client verified its first credential!

Dont @-me, I'm just following verifiable credentials spec, which kindly tells me to figure out how to attach proofs and what to cover with proofs myself, while imposing JSON schema on me.

Honestly, sometimes I'm apalled by JSON world. It's better than XML, but still doesn't address any of its issues. If we only had better editors for binary formats, we would have lived in a much better worlds. Now I really do understand why architects when I was in my early twenties were so eager to use protobufs...

Wait, JSON spec says that JSON is unordered. How come it is possilble to sign it then?

Is it just me, or from the standpoint of conventional cryptography shit like JWS doesn't make any sense?

T-Bone Burnett, who, amongst other things, starred in one of my favorite weird American sitcoms "The Larry Sanders Show", had some of his music uploaded to YouTube, including my favorite of his albums "the true false identity".

https://www.youtube.com/watch?v=LZ1M9JSGTLk&list=OLAK5uy_mAv4FUNl4lZ_mpQmxgbHG2e9E1PHEac_E

"Machines always do what you tell them to do, as long as you do what they say", 2006, mind you.

Thanks to @phryk I've learned that there's a FOSS version of that old Macromedia's animation software.

https://rnd.phryk.net/mirror/enve

https://github.com/jedisct1/libsodium.js/tree/abc0e40a95b8a2874533c626bd7d2a5aad5e65e5/wrapper/symbols

#cheatsheet #libsodium #cryptography

#аквариум concerts are something I passionately miss...
Especially this one. It was absolutely insanely amazing.

https://www.youtube.com/watch?v=Yp4FGvOfvOM

Ok well anyway, test your code, kids.

Here's a screenshot of sodium.js producing the same key as #doauth #Elixir server.

Ah, #JavaScript, I just started to like you.

(Razer sharp languages are so razer sharp).

We are getting places with #doauth cryptography in browser.
Can't wait to polish the second prototype and start integrating it with services, looking at OIDC compliance, etc.