8organicbits

Why GitHub Actions?

Are you sure you're offering a competitive salary?

Would changing your usercontent.css or uBlock Origin filter to set all select appearance attributes to auto help? There are some challenges, like the custom style could hide elements, but I think that should give fall-back equivilent styling.

Notifications struck me as odd. I aggressively disable notifications in my apps because they are often just ads or engagement focused. But as a developer, it would be cool to have a way to notify an iOS user other than building a native app and paying the iOS tax. There's a bunch of utility apps not getting built because of this limitation.

I know kagi doesn't do it, but it is possible to specify language in the feed (xml:lang) such that a feed reader can filter languages the user doesn't understand out of multi-language feeds. One challenge is that lots of bloggers forget to add that tag.

Very cool.

Crawling related sites for tags could work (open graph tags on the website are another good source). I'm wary of mixing data across contexts though. A blog and a Mastodon profile may intend to present a different face to the world or could discuss different topics.

I think the problem is that it's hard to curate feeds in a language you don't understand. I've been building an uncurated index of OPML blogrolls, with no language restriction. The OPML blogrolls are curated by their owners, so someone decided they met some inclusion criteria, but the overall list is uncurated.

https://alexsci.com/rss-blogroll-network/

Can you not check the RFCs?

Reminds me of https://notes.pault.ag/tpl/

The tag cloud part may be a challenge. Web feeds don't always tag their content.

I have a blog filter that does something similar (https://alexsci.com/rss-blogroll-network/discover/), but the UI I ended up with isn't great and too many things are uncategorized.

One objection I have to the kagi smallweb approach is the avoidance of infrequently updated sites. Some of my favorite blogs post very rarely; but when they post it's a great read. When I discover a great new blog that hasn't been updated in years I'm excited to add it to my feed reader, because it's a really good signal that when they publish again it will be worth reading.

Is there a good free-but-subscriber-only solution for blogs? It seems like a contradiction, but in practice it may be manageable.

I think you are hung up on the word "leak".

Putting a secret subdomain in a DNS query shares it with the recursive resolver, who's privacy policy may permit them to share it with others. This is a common practice and attackers have access to the aggregated datasets. You are correct that third-party web servers or CDN could share your HTTP path, but I am not aware of any examples and most privacy policies should prohibit them from doing so. If your web server provider or CDN do this, change providers. DNS recursive resolvers are chosen client side, so you can't always choose which one handles the query. Even privacy-focused DNS recursive resolvers share anonymized query data. They remove the source IP address, since it's PII, but still "leak" the secret subdomain.

Any time you send secret data such that it travels to an attacker visible dataset it is vulnerable to attack. I call that a leak but we can use a different term.

There's a lot of online documentation about passive DNS. Here's one example

> Passive DNS is a historical database of how domains have resolved to IP addresses over time, collected from recursive DNS servers around the world. It has been an industry-standard tool for more than a decade.

> Spamhaus’ Passive DNS cluster handles more than 200 million DNS records per hour and stores hundreds of billions of records per month, providing you with access to a vast lake of threat intelligence data.

https://www.spamhaus.com/resource-center/what-is-passive-dns...

No man-in-the-middle is needed, DNS queries are often collected into large datasets which can be analyzed by threat hunters or attackers. Check out passive DNS https://www.spamhaus.com/resource-center/what-is-passive-dns...

You'd need to check the privacy policy of your DNS provider to know if they share the data with anyone else. I've commonly seen source IP address consider as PII, but not the content of the query. Cloudflare's DNS, for example, shares queries with APNIC for research purposes. https://developers.cloudflare.com/1.1.1.1/privacy/public-dns... Other providers share much more broadly.

Ah you're right, they are always wildcard certs. I think I was mis-remembering https://news.ycombinator.com/item?id=15826906, which guesses names based on CT logs.

In either case, the subdomain you use in DNS requests are not private. Attackers can collect those from passive DNS logs or in other ways.

~As far as I know, bucket names are public via certificate transparency logs.~ There are tools for collecting those names. Besides you'd leak the subdomain to (typically) unencrypted DNS when you do a lookup and maybe via SNI.

Edit: crossout incorrect info

These days people are fearful of their work ending up in LLM training datasets. A private, but static hosted website is on a lot of people's minds. Most social networks have privacy setting these days, which feels like a missing feature of standard, static blogs.

That should scale pretty well. The HTTP fetch of posts/index.json could use conditional get requests to avoid downloading the body when there are no changes. Static files are dirt cheap to serve.

The commit you listed was merged upstream.

https://github.com/zigimg/zigimg/pull/313

You don't need to explain RSS any more than you need to explain SMTP or HTTP. A product that uses RSS could gain traction without the user ever knowing it uses RSS. Products like Google Reader prove that is possible.

I made a web-based speaking clock: https://alexsci.com/time-at-the-tone/

I had been doing lots of time-based work for a blog post and ended up annoyed that so many clocks around me were visually out of sync. Especially my microwave and oven clocks. Using the tool I got them synced up beyond what I could perceive.

There's a few messages it can show:

      const msgs = [
        `Yes, we know ${country} exists. We're very proud of you.<br><br>This site is about US address forms — the ones that make <em>Americans</em> scroll past Turkmenistan 200 times a year. You have your own postal code problems. We believe in you.`,
        `We see you're visiting from ${country}. Welcome. We regret to inform you that this rant is specifically about American address forms, which are — and we cannot stress this enough — <em>unbelievably bad</em>.<br><br>Your country probably has its own postal code horrors. We'd love to hear about them: <a href='mailto:shame@zipcodefirst.com'>shame@zipcodefirst.com</a>`,
        `Hello from across the pond (or whichever body of water separates us from ${country}). This is a US ZIP code website. We are aware that other countries exist. We just have 160 million addresses and a 50-state dropdown to be mad about first.<br><br>Your frustrations are valid. Your postal codes are also useful. Put them first too.`
      ];

Have you seen UUIDv3/v5 used there though? I've seen lots of md5 historically and sha variants recently, but not the UUID approach.

It can be, but you should prefer UUIDv4 if you do that. One problem is that UUIDv8 does not promise uniqueness.

> UUIDv8's uniqueness will be implementation specific and MUST NOT be assumed.

Here's a spec compliant UUIDv8 implementation I made that doesn't produce unique IDs: https://github.com/robalexdev/uuidv8-xkcd-221

So, given a spec-compliant UUIDv4 you can assume it is unique, but you'd need out-of-band information to make the same assumption about a UUIDv8.

I wrote much more in a blog post: https://alexsci.com/blog/uuid-oops/

The question evaluates different skills when you solve it in Java. If you allowed XML, you'd see Java candidates reach for the standard library, as it has a built-in XML parser. Using plain text responses was a good fix, as the candidate can focus on concurrency, networking, and error handling, which is probably what you were trying to assess.

> mastodon feeds are prone to shameless promotions, scams, and attention whoring

My mastodon feed contains only the users I follow. If they post unwanted things I unfollow them. Mastodon doesn't force you to see content from people you don't follow.

The sfba trending list has engagement-bait, but you shouldn't look there (on any social media site) if you don't want that sort of content.

If you don't want to choose, install the official mastodon app. It should direct you to create an account on mastodon.social, unless you go out of your way to pick something different.

I suspect the sign up flow has changed since you last tried.

You're talking about the hash-based UUIDv3/v5? I haven't found examples of those being used, but I'm curious.

Using MD5 or 122 bits of a SHA1 hash seems questionable now that both algorithms have known collisions. Using 122 bits of a SHA2/3 seems pretty limited too. Maybe if you've got trusted inputs?

No, UUIDv8 offers 122 bits for vendor specific or experimental use cases. If you fill those bits randomly, you get the same amount of randomness as a v4. The spec is explicit that it does not replace v4 for random data use case.

> To be clear, UUIDv8 is not a replacement for UUIDv4 (Section 5.4) where all 122 extra bits are filled with random data.

https://www.rfc-editor.org/rfc/rfc9562.html#section-5.8-2