Terence Eden. He has a beard and is smiling.

Terence Eden’s Blog

Theme Switcher:

An open(ish) redirect on Mastodon

· 1 comment · 950 words · Viewed ~265 times

Cartoon of a tusked mastodon holding a phone.

I've responsibly disclosed a small security issue with Mastodon (GHSA-8982-p7pm-7mqw). It allows a sufficiently determined attacker to use any Mastodon instance to redirect unwary users to a malicious site. What do you think happens if you visit: https://mastodon.social/@PasswordReset/111285045683598517/admin? If you aren't logged in to that instance, it will redirect you to a 3rd party site.…

This blog is now on the Fediverse!

· 6 comments · 700 words · Viewed ~578 times

Setting screen showing the blog being enabled.

You can now have this blog federated to your social media site by following @blog@shkspr.mobi If you're on Mastodon, it should look something like this: You should be able to follow it on Lemmy, kBin, PixelFed, and some cool social network I've never heard of. How This blog runs on WordPress. Thanks to the tireless work of Matthias Pfefferle, there's now an official WordPress ActivityPub…

Federation is pretty cool, but kinda confusing, and maybe a little scary

· 5 comments · 400 words · Viewed ~696 times

Otome-chan says: "See here. you can see this mastodon user's post (which to them looks like a regular tweet on twitter does) ends up in our random microblogs section. We can also view their profile directly as well as follow them to have their posts appear in our microblogs (as well as threads if they go out of their way to make one). It seems kbin microblogs appear as threads/comments to you on lemmy. so I have to imagine mastodon posts might be similar?"

Last week, this strange mention appeared on my Mastodon feed. After a bit of clicking around, I figured out what had happened. A user on the Kbin social network had linked to my Mastodon profile. Thanks to the magic of the ActivityPub protocol, it filtered into my mentions - even though I've never even heard of Kbin. That's pretty cool! A user on one social network can mention a user on a…

How do you decentralise emergency alerts?

· 5 comments · 750 words · Viewed ~705 times

Cartoon of a tusked mastodon holding a phone.

Twitter's decision to hobble its API has meant that a number of useful alerting bots might no longer function. Your local subway might not be able to Tweet each morning about delays on the line, nor will a tornado warning be displayed as you scroll through photos of brunch, and forget about flood alerts between your memes. In one sense, this is sad. A set of useful public services are being cut…