Email or username:

Password:

Forgot your password?
3,363 posts total
dansup

Regarding the new @pixelfed Recovery service, @thisismissem pointed out that this could be a possible vector for abuse.

We're working on an even more advanced and abuse-resistant implementation!

That being said, I implemented some safeguards for the time being:

- Limited to accounts pixelfed.social knows
- Partial fuzzy matching
- Rate limited (5 reqs/min)
- Only pixelfed account results
- Access is limited to requests with a valid API key (which only our app has)

github.com/pixelfed/recovery/b

Regarding the new @pixelfed Recovery service, @thisismissem pointed out that this could be a possible vector for abuse.

We're working on an even more advanced and abuse-resistant implementation!

That being said, I implemented some safeguards for the time being:

- Limited to accounts pixelfed.social knows
- Partial fuzzy matching
- Rate limited (5 reqs/min)
- Only pixelfed account results
- Access is limited to requests with a valid API key (which only our app has)

dansup

Here is a demo of the other recovery screens and the login screen.

I'm not finished the account registration redesign yet, but it won't take long - the APIs and UI already exist, it's just a matter of reorganizing them.

Super pumped to ship this!

Passionately pioneering pixels is the game, @pixelfed is the name 😎

dansup

✨ Sleek and Streamlined Onboarding, you have to see this!

To prepare @pixelfed for the masses, we're making it even easier to use!

Shipping soon 🚀

Show previous comments
Yaqub. M

@dansup @pixelfed like the new look but its a bit laggy on my android

kalou

@dansup @pixelfed Why copy instagram's decor when you could stand out with Pixelfed? Too bad, it's a great Pixelfed project and I'm delighted to be using it.

Adrian Morales

@dansup @pixelfed 👋 Could you please help me with something? My friend was hit with this warning message:

dansup

As I finish the new @pixelfed app onboarding screens, there are a few places where I want to make it easy for users to contact instance admins via email.

This would require all @pixelfed instances to set this field in the admin dashboard so its available via the instance endpoint, but would only work if they all did this.

Maybe I could make this a requirement (for our app), and verify it periodically by sending an email to the address and unlisting servers that don't comply.

Thoughts?

Show previous comments
jstm@sos:~$ :blinking_cursor:

@dansup @pixelfed On paper it's a great idea, but maybe they (for some unknown reason) don't want to share an e-mail address they should not be forced to do so. It's like "hey do this or get effed up" which is not great.

YHSI 🦇

@dansup @pixelfed I think making an email address mandatory (and verifying it, maybe with a magic link now and then) to be listed in an onboarding dialog is okay. But if you (as server admin) care for a more private space you can simply skip this at the cost of not being listed during onboarding with your instance. Since every responsible service provider should share a way to be contacted (my personal opinion) there would be no harm in making this way visible.

Dallas Groot

@pixelfed @dansup what about self hosted instances where there isn’t sign up?

dansup

Nostr is nice, but total decentralization isn’t user friendly.

Federation allows some centralization, and that’s crucial, not only for UX but also scalability and more.

Big instances are not ideal, but are better than a near empty ecosystem.

Why is Threads adopting ActivityPub and not Nostr? 😉

Show previous comments
Anton 🇺🇦🇪🇺

@dansup IMO decentralization is the ultimate solution, but federation is a very good tradeoff while we wait and hope for decentralised tech to mature.

Decentralisation does not mean that you can't subscribe to a federated moderator. It just means you can choose not to, and for other things like resiliency, it has many advantages.

Danie van der Merwe

@dansup probably not the reason, but ActivityPub was recently declared a W3C open standard for social networking. I do like that #Nostr is an evolving protocol like XMPP is as well.

flaeky pancako

@dansup in terms of scalability I definitely cannot scale my mastodon instance because I can't afford to , at the very least p2p would be a great way to offload storage costs on federated servers.

dansup

Alright, so I had an idea to improve onboarding further by creating a "Pixelfed Passport" service.

Basically, users would be able to link Pixelfed accounts to a central passport.pixelfed.net account, and use that one account to easily log in to others.

This is primarily geared towards new fediverse users who can't remember their server, allowing them to use a single email/password to access their accounts easily.

Will be opt-in, open source, and auditable. Thoughts? #feedbackWanted

Show previous comments
Peter Toft Jølving

@dansup
I think I'd prefer each instance being an actual OIDC IdP and having the client (app or browser extension) provide the sign-in endpoint for redirection.

David Fleetwood - RG Admin

@dansup This is almost what I was hoping for. I'd suggest though making the auth hub it's own identity/service so that it could more easily be stood up by site builders who are looking for SSO to multiple services on the same domain, ie: I'd like to sso pixelfed.domain.tld/firefish.domain.tld/friendica.domain.tld and have something like passport.domain.tld

Ideally the account itself should be portable to another auth instance as well, say someone is going offline.

Vint Prox

@dansup

All complications and misunderstandings start with Passport-like services...

dansup

Some spam reports make me laugh, like know your demographic 😂

Thankfully it was caught seconds after it was posted and hidden from timelines before any users seen it - gosh I can't stress enough how easy the Autospam detection makes my moderation duties 😎

George Lund

@dansup how is it spam if a company posts on their own timeline??

dansup

I did build a LinkTree like service for the fediverse, mostly for @pixelfed, and was really close to shipping it until IG announced multiple bio links and it made me question why Pixelfed only allows 1 link.

Now I'm working to add support for custom fields, like Mastodon.

I may still launch this, not sure, I should do something with the fedi.bio domain 🤔

Show previous comments
Luttyz :ms_awoo:

@dansup do you plan on having this be self-hostable? i'd love to use this, it looks awesome! :blobfoxwhoaa:

Sascha Foerster :bonndigital:

@dansup @pixelfed I am using this as a Linktree replacement and very happy: focus on Pixelfed would be lovely! :) linkstack.org/ 🙊

pinage404.rss

Hello @dansup,

Is the service released ? If yes, where ?

Is the code open source ? If yes, where ?

dansup

Btw, I started a lil side project that allows you to create "links" to fediverse profiles and posts that can be easily opened in the app of your choice.

I plan to add more apps, launch this under fediverse.info and publish the source code so anyone else can run this!

#fediverse #apps

Ellis 🇳🇱 🐕 🌍 💚

@dansup
@jeroen

Jeroen: engels+technisch+’n onderwerp waar ik niet al te veel van weet is teveel , kun jij vertellen waarom dit ok is?
dat Daniel de Fedi-versie van IG ontwerpt is leuk [IG ken ik] maar wat er met de anders apps moet/kan/hoe te gebruiken ??

dansup

Boom! ✨

The Recovery Service is now live and the source code is shipped!

github.com/pixelfed/recovery

recovery.pixelfed.org

dansup

Ever since I added dark mode to the @pixelfed app, the light mode just doesn’t look right.

I’d love to get basic statistics on stuff like this to get a better idea of how people are using the app and what I should focus on, but only if it’s privacy friendly and anonymous.

Will think more about this and organize a community vote if I want to move forward. The final decision I’ll leave to the community, the stats aren’t worth losing your trust!

Show previous comments
Just another rakyat 🇲🇾

@dansup @pixelfed My phone switches automatically between light and dark mode depending on the time of the day, so it’ll be nice if the app theme follows the system default.

dansup

I’m not happy with the current @pixelfed app on-boarding, so I’m taking another stab at it 😉

Show previous comments
Brendan Jones

@dansup @pixelfed the lovely thing about fiddling with app onboarding is that it’s the one app feature for which you never (or barely) get any complaints from existing users, because they already signed up. 😄

dansup

This is the happiest day of my life!

New Burial + Kode9 AND I was able to get a limited edition copy 😁 😁 😁

dansup

I added a setting to the recent @pixelfed build to disable haptic feedback, forgot to mention that in the release!

dansup

I've been working on a new @pixelfed API for mobile app settings to store app preferences in the backend so they can be used across devices and sessions!

I'm working with the @PixelDroid developer on this to support 3rd party apps too!

I know it's not that flashy, but it's a pretty handy feature and yet again we're pioneering a new standard that we hope will be replicated in other #fediverse projects 😎

Alexander Thompson

@dansup @pixelfed @PixelDroid oh man that's such a cool concept! Would the settings be tied to individual accounts that you make or to the device that you're using? Or is that still on the drawing board?

dansup

Btw if I don't respond to your comments or DMs is not because I'm ignoring you, I try to respond to every one but I get a lot of notifications and it's hard to keep up sometimes 😅

Bragg

@dansup curious why you have favourite notifications enabled, with posts that often get traction I’d have thought it would be beneficial to disable them.

Celinho :catjam:

@dansup Look at me there, now I was surprised that even the former Dev from Telegram is also here.

Expert Plus🍀 📷

@dansup Oh. I were wondering why don't you respond to me, now I know.

dansup

I know centralization is the anti thesis to federation, but when it comes to abuse and spam detection/mitigation, I think the fediverse needs an optional centralized and trusted service to share abuse/spam intelligence across instances so admins can better moderate their services

I hate spam, I’m totes up to the task to build this and make it available to other projects too

FediDB could be the perfect home for this, any fedi devs that want to work with me on this, send me a DM

Show previous comments
Mike Fraser :Jets: :flag:

@dansup Why don't we start with Mastodon support for captcha first....

Lewis Cowles

@dansup what if the structure & data were singular (for a distribution), but distributed like torrents. Contributions via source-control. Any folks could PR / MR changes to an upstream and torrent out local copies. That way it's still not centralised as such.

Claudius

@dansup essentially what wordpress did with the kismet spam detection Plugin for comments.

dansup

You know what's more concerning than Meta/Threads joining?

Bots, like/follow rings, and spam.

See, even though Threads doesn't federate yet, they painted a big red target on the fediverse by announcing future support.

Those annoying twitter crypto bots and "I made $750 via cashapp" spam on IG are likely going to make there way here.

We need to prepare.

I'm building a @pixelfed service similar to Akismet to share intelligence in a privacy friendly way, will share more deets soon 😎

Show previous comments
FlyingMana

@dansup @pixelfed they already are, already were before the announcement.

but for now they are often blocked very fast on instance level.
And with this, and the potential of many instances with public registration might deploy spam detection, they will go below the profitability threshold fast enough

Adrian Lansdown

@dansup @pixelfed do you currently do anything or have ideas on how to stop/limit scraping of data/images?
Like the suggestion that must of Flickr has been scraped ignoring any licenses.

dansup

I know it may seem trivial

"it's just a login page"

But these small details are more impactful than you may think

The subconscious and emotional context of interfaces like these are fascinating to me, and I sometimes obsess over them

The backend refactor is pretty neat, moving 2FA to the new login logic means we can remove a middleware (on all routes) that will improve performance throughout!

dansup

Spent tonight refactoring the @pixelfed login UI

I wasted more time than I'd like to admit trying to work around chrome auto-fill to focus the input (and style it) only to discover that it's not possible because its a security risk 😑

Anyways, this is my 3rd login refactor and it will be shipping despite the slight UX "bug" of Chrome requiring user input or interaction for auto-fill

And don't worry, this will also work with password managers 😅 #pixelfed

EighthLayer | Jamie

@dansup @pixelfed Out of curiosity, what’s the purpose of websites asking for just an email first, rather than asking for email and password at the same time? I’ve noticed it more and more recently.

dansup

Login v2 vs v3 design

The v2 design was more bold and distracting, I decided to start from scratch using a similar layout to the existing design for v3 to keep the focus on the intent/action

v3 uses animations and loading indicators when applicable and is overall a better UX IMO

Password resets and 2FA is also much better in v3

Go Up