Status update, December 2020 December 15, 2020 on Drew DeVault's blog

Happy holidays! I hope everyone’s having a great time staying at home and not spending any time with your families. It’s time for another summary of the month’s advances in FOSS development. Let’s get to it!

One of my main focuses has been on sourcehut’s API 2.0 planning. This month, the meta.sr.ht and git.sr.ht GraphQL APIs have shipped feature parity with the REST APIs, and the RFC 6749 compatible OAuth 2.0 implementation has shipped. I’ve broken ground on the todo.sr.ht GraphQL API — it’ll be next. Check out the GraphQL docs on man.sr.ht if you want to kick the tires.

I also wrote a little tool this month called mkproof, after brainstorming some ways to allow sourcehut signups over Tor without enabling abuse. The idea is that you can generate a challenge (mkchallenge), give it to a user who generates a proof for that challenge (mkproof), and then verify their proof is correct. Generating the proof is computationally expensive and resistant to highly parallel attacks (e.g. GPUs), and takes tens of minutes of work — making it unpractical for spammers to register accounts in bulk, while still allowing Tor users to register with their anonymity intact.

On the Gemini front, patches from Mark Dain, William Casarin, and Eyal Sawady have improved gmnisrv in several respects — mainly bugfixes — and gmnlm has grown the “<n>|” command, which pipes the Nth link into a shell command. Thanks are due to Alexey Yerin as well, who sent a little bugfix with redirect handling.

The second draft of the BARE specification was submitted to the IETF this month. Will revisit it again in several weeks. John Mulligan has also sent several patches improving go-bare — thanks!

scdoc 1.11.0 was released this month, with only minor bug fixes.

That’s all for now! I’ll see you in a month.

...

The secret project has slowed down a bit as we've started on a new phase of development: writing the specification, and new compiler which implements it from the ground up. Progress on this is good, but won't introduce anything groundbreaking for a while. Stay tuned.

⇒ This article is also available on gemini.

Have a comment on one of my posts? Start a discussion in my public inbox by sending an email to ~sircmpwn/public-inbox@lists.sr.ht [mailing list etiquette]

Articles from blogs I read Generated by openring

Command PATH security in Go

Today’s Go security release fixes an issue involving PATH lookups in untrusted directories that can lead to remote execution during the go get command. We expect people to have questions about what exactly this means and whether they might h…

via The Go Programming Language Blog January 19, 2021

Status update, January 2021

Hi all! This month again, my main focus has been wlroots. I’ve focused on the internal renderer refactoring (the so-called “renderer v6"). A lot of the work has now been completed, and all backends now use the new interfaces under-the-hood. With the help …

via emersion January 18, 2021

What's cooking on Sourcehut? January 2021

Another year begins, and hopefully with better prospects for us all. SourceHut has emerged from 2020 relatively unscathed, thankfully, and I hope the same is true of most of our users. A body which, by the way, today numbers 19,647 strong, up 623 from Decemb…

via Blogs on Sourcehut January 15, 2021