WordPress Meetup Presentation: Decentralized Social Networking with WordPress

Wpvie Friends

This is the presentation I held yesterday, November 7, 2018, at the WordPress Meetup Vienna about the Friends Plugin.

I created this presentation with Deckset which allows to generate the presentation from a Markdown file.

Veröffentlicht unter web

Decentralized Social Networking with WordPress

Over the past year, I've been working on the side on a WordPress plugin that implements an idea that has been growing in me over the last couple of years. Decentralized Social Networking. The plugin that does it is called Friends.

Starting with the frustration that there are few alternatives for people who use Facebook: if you don't want them to own your data but still want to privately keep your friends and family up to date about your live and discuss what interests you, where do you go?

I realize that many people just switched to instant messaging (like WhatApp) which does allow exchanging private messages (and photos) with your friends, but overall I do like the idea of having a more structured publishing platform. I just don't like a single entity to control it all.

So I realized: We actually had an alternative all along: blogging.

Blogging is decentralized: you decide where you host, you decide which blogs you read and nobody really knows which ones you have subscribed to.

What disqualifies it as an alternative to my wish to keep friends and family up to date, is that it public by default. While there is the option to publish something as „private," there is not a lot you can then do with a privately published post.

So what if you were easily able to give your friends access to your private posts?

Here comes the Friends plugin. And with it, the downside to the solution:

You need to have your own blog to become friends with each other.

Right now, this is only implemented on WordPress, the technology is framework agnostic, though.

Your friends get their own user on your blog. Here my request is still pending.

When everyone involved has their own blogging platform and they'd decide where they want to host, we automatically get a decentralized platform.

The technological ingredients to this are actually pretty old:

  • RSS
  • REST API
  • Authentication via keys

After friendship has been established (this involves both parties accepting friendship and exchange private keys in the background), your server will use that key when requesting your friend's RSS feed which will in turn (since you are friends) contain private posts. And vice versa.

For commenting, you'll go to your friend's blog, it's a one-click-authentication away. This can also eliminate spam if you only allow friends to comment on your posts.

All of this is highly compatible with standard WordPress: if you want to accept a friend request on your mobile phone, use the WordPress iOS or Android app and change that user's role to „Friend."

Chicken-and-egg problem: I use a social network because all my friends are there.

So why use a social network that not all of your friends use (yet)? Because the Friends plugin is actually a pretty decent way to consume RSS feeds.

Since it is based on RSS, it means you can also subscribe any blog or website that offers this well-established way of distributing content.

As you are in control of the server, you can also decide what you're interested in and tailor the feeds to your liking: you can define rules for incoming feed items and ignore posts you know you won't be interested in.

I personally like to consume notifications via e-mail as it provides read/unread functionality and I can sort and categorize e-mails to my needs. You can now also read your friends' posts (or subscriptions) via e-mail. But you don't need to.

Another method to view your friend posts and subscriptions is the „Friends Page," a timeline of friend posts and subscriptions. You can therefore scroll down the list of your friend's posts and subcriptions, just as you see it people doing it all the time on Facebook.

Read your friends' posts on the Friends Page

There is quite a bit more to this, you can Emoji react to a post, recommend it specifically to friends, have sections in your posts for friends/not-friends, and more.

Overall, I see this as a way to take blogging to the next level: Choose your private audience. Choose where you host. Publish publically if it's meant to be public.

It's clear that setting up and having your own blog is not (yet) for everyone. It's more work than just signing up for some social network. Often you'll need to pay for hosting (and domain). But it also gives you the freedom to take your data somewhere else if you want to. Or delete it.

We'll have to see who will use this. As of now, it's for a technical audience but maybe someday there will be dedicated Friends-WordPress hosting?

The Friends Plugin is open source under GPL2. If you have a WordPress blog, try it out, and if you think this could be better, different, enhanced: create an issue, or better: create a patch and send a pull request.

Probably it's not ready for prime time yet, we're at version 0.14. But it's getting there, at least I am already using it daily :) There are many ideas left to be implmented, and these are only mine so far.

Oh, if you happen to be in Vienna coming week, I'm going to talk about Decentralized Social Networking with WordPress at our WordPress meetup on November 7, 2018.

November WordPress Meetup Vienna

Wednesday, Nov 7, 2018, 6:30 PM

CodeFactory Vienna
Kettenbrückengasse 23/2/12 Wien, AT

29 People Attending

Schedule 18:30 | Arrival, Registration 19:00 | Welcome & Introduction 19:15 | Alex Kirk – Decentralized Social Networking with WordPress 19:45 | Break 20:00 | Harry Martin – Hello to 5.0, a first look at the next major release and the new theme Twenty Nineteen 20:30 | Socialising! 21:00 | Leaving CodeFactory, maybe for drinks somewhere close by __…

Check out this Meetup →

Veröffentlicht unter web

Fixing WhatsApp image dates after Android Migration

Recently I've had the issue to have a completely unsorted Photo Library in Android after migrating to a new phone. The reason is that WhatsApp images are copied into internal storage and end up with the last modification date when they were copied, thus conglomerating together when they should be spread out over time.

The problem is not that trivially to solve because you cannot mount internal storage into a computer and then modify the file dates. Thankfully, I was still able to create a viable solution using a bash script.

It all revolves around the Android Terminal Emulator Termux which allows you to execute scripts on your phone.

  1. Install Termux .
  2. Grant Termux access to your storage directories.
  3. Install core tools apt install coreutils
  4. Copy this script into your file tree (for example via Android File Transfer):
for f in IMG-20* VID-20* AUD-20*; do
    [ -e "$f" ] || continue
    NEWDATE=`echo $f | cut -c5-8`-`echo $f | cut -c9-10`-`echo $f | cut -c10-11`
    echo touch -d $NEWDATE "$f"
    touch -d $NEWDATE "$f"
done
  1. Run the script in the directories you need to fix file dates (for example in /storage/emulated/0/WhatsApp/Media/WhatsApp Images)
  2. Delete the data of MediaStorage (and maybe reboot) to make Android re-index the files with the new file dates.
Veröffentlicht unter web

Buchhaltung für EPUs: Bookamat

Eine Sache, die man als EPU nicht gerne macht (zumindest alle, die ich kenne), ist die Buchhaltung. Auch wenn man den ganzen „Rechnungskram" an einen Buchhalter auslagern könnte, so finde ich es für den alltäglichen Betrieb wichtig, die Finanzen im Blick zu haben und die Erfassung der Belege selbst zu übernehmen.

Eigentlich könnte man seine ganzen Einnahmen und Ausgaben auch in einer Excel-Tabelle erfassen. Aber das ist in vielerlei Hinsicht mühsam und unübersichtlich. Also soll eine Software her. Der Markt ist nicht klein, es gibt zahlreiche Software, die Kleinunternehmen damit unter die Arme greifen wollen, aber da gibt es gleich die ersten Fallstricke:

1. Die Software soll für Österreich geeignet sein
2. Das Ganze soll bitte auch am Mac laufen

Die einfache Lösung: eine Web Applikation. Auf dem österreichischen Markt gibt es hier 2 große Player: freefinance und bookamat

bookamat

Mit freefinance sind vielleicht Leute vom Fach zufrieden, für einen Halblaien ist das Interface eine (visuelle) Katastrophe, die ganze Applikation ist voll mit Fachbegriffen frisch aus dem Finanzamt.

freefinance interface

Dagegen ist Bookamat eine Offenbarung. Beim Interface sieht man, dass das jemand macht, der etwas von Webseiten versteht: Patrick Kranzlmüller und Axel Swoboda sind mit ihrer Agentur vonautomatisch vom Fach.

bookamat-neue-buchung

Ich verwende schon mehrere Jahre Bookamat und bei jedem Update sieht man, dass die beiden ihre Software selbst verwenden und immer dort schrauben, wo es noch etwas hakt. Kleines Beispiel aus dem Screenshot oben: Man legt mit der Auswahl des Steuerkontos fest, ob es sich um eine Eingabe oder Ausgabe handelt.

Bei freefinance z.B. muss man erst das richtige Formular aufrufen (also Einnahme oder Ausgabe), und bekommt dann das hier präsentiert:

freefinance-neue-buchung
Die Alarmglocken schrillen schon, wenn man die Hälfte des Bildschirms für Hilfetexte braucht. Bei den Zahlen im Dropdown vermute ich, dass es sich um die Kennzahlen des Finanzamts handelt. Das mag hilfreich sein, aber zeigt wie sehr man sich an der Finanz und nicht am Unternehmer orientiert.

Bookamat hingegen zeigt es auch an, aber dort, wo man sich aussucht, welche Konten man im Alltag überhaupt braucht.
bookamat-steuerkonten

Letztlich bleibt mir nur zu sagen: verwendet Bookamat! Es nimmt der Buchhaltung zwar nicht vollkommen den Schrecken, aber es macht sie verständlicher und erfreulicher. Und das ganze nur für 100 Euro im Jahr, inkl MwSt. (dh für alle die nicht unter die Kleinunternehmerregelung fallen nur 83,33 Euro an).

Veröffentlicht unter misc

Little Snitch und Freewave

Inspiriert von der Anleitung von Freewave, die zeigt, wie man in einem unverschlüsselten WLAN (wie Freewave es an vielen Orten in ganz Österreich anbietet) dafür sorgen kann, dass nicht unabsichtlich Apps mit dem Internet sprechen, habe ich hier ein paar Anpassungen zusammengestellt, um das Gleiche mit SSH und SOCKS zu nutzen.

Wenn man Zugang zu einem Server im Internet per SSH hat (eigener Webserver, Uni-Account), kann man sich einfach eine sichere Verbindung (zumindest bis zu ebendiesem Server, aber es geht ja eigentlich nur darum die WLAN-Signale zu verschlüsseln) basteln.

Man startet ein Terminal-Fenster und gibt Folgendes ein:

ssh -D9999 username@mein.server

Mit dem Schalter -D<port> wird ein SOCKS-Proxy gestartet, der auf localhost:<port>, in diesem Fall auf localhost:9999, lauscht. Man lässt dann das Terminal-Fenster sowie die Verbindung so lange offen, solange man den Proxy verwenden will.

Dann konfiguriert man sein OSX so (in den Systemeinstellungen unter „Netzwerk"), dass es den SOCKS-Proxy verwendet:

socks-proxy

und letztlich passt man dann noch die Regeln an, wie sie in der Anleitung von Freewave gezeigt werden:

little-snitch-proxy

Der Unterschied besteht in der Regel für „Terminal", die pppd und racoon ersetzt. Am einfachsten erstellt man die, indem man die Regel erstmal einfach weg lässt und die „alle ausgehenden"-Regel auf „Nachfragen" stellt. Dann das ssh Kommando ausführen, Little Snitch fragt nach, was es tun soll. Daraufhin erlaubt man die Verbindung für immer und stellt danach die „alle ausgehenden"-Regel wieder auf „Verbieten" zurück. (bei mir gibt es hier 2 Regeln, weil ich je nach Anwendungsfall 2 verschiedene Server verwende)

Ãœbrigens: Ich fand die Bezeichnungen „Ohne VPN" und „Mit VPN" verwirrend, deswegen hab ich die bei mir „Potenziell Unsicher" bzw. „Vertrauenswürdig" genannt.

Insgesamt ist leider schade, dass mit einer solchen Konstruktion die ganzen Regeln, die man mehr oder weniger mühsam unter „Vertrauenswürdig" erstellt hat, nicht gelten, während man „Potenziell Unsicher" aktiviert hat: es geht einfach alles durch SSH, auch was man unter „Vertrauenswürdig" verboten hat.

Veröffentlicht unter misc

SSL Certificate Expiry Warning Script

With the increasing trend of SSL on the web, where Google values SSL sites higher and you can have your site be added to the HSTS preload list (the browser will first try HTTPS before trying HTTP), it is a good idea to start using SSL yourself.

The downside: you need to get a certificate through a (pre-trusted by the browser) CA, or certificate authority. This usually costs money, though there are some services that give you a certificate for free. The free certificates only last for one year or less, this means you need to request and install a new certificate frequently, especially when you have multiple domains.

Now it can happen to anyone, even Microsoft (Windows Azure Service Disruption from Expired Certificate), that you forget to renew (and update) your certificate in time.

There is a nice service called certalert.me (interestingly enough not over HTTPS) that will send you an e-mail when a certificate is due to be updated. But as with any web service, unfortunately you can never be sure how long it's going to live.

So, I have created a script that I run through a cronjob every day that will send me a notification e-mail several times in advance (1 day and 2 7 14 30 60 days ahead), so that you are not dependent on a third party to get notified about expiries. As it is supposed to be with cronjobs, there is no output when there is nothing to report (thus no e-mail).

Here is the script (download warn_about_certificate_expiry.sh):


#!/bin/sh 

CertExpiries=$(mktemp)
for i in /etc/certificates/*.pem; do
	echo $(basename $i): $(openssl x509 -in $i -inform PEM -text -noout -enddate | grep "Not After" | tail -1 | awk '{print $4, $5, $7}') >> $CertExpiries
done

Date=$(date -ud "+1 day" | awk '{print $2, $3, $6}')
Expiries=$(grep "$Date" $CertExpiries)
if [ $? -eq 0 ]; then 
	echo These Certificates expire TOMORROW!
	echo $Expiries
	echo
fi
for i in 2 7 14 30 60; do
	Date=$(date -ud "+$i day" | awk '{print $2, $3, $6}')
	Expiries=$(grep "$Date" $CertExpiries)
	if [ $? -eq 0 ]; then 
		echo These Certificates expire in $i days:
		echo $Expiries
		echo
	fi
done
rm $CertExpiries;
Veröffentlicht unter linux

Stack Overflow: Ways out of the negativity

This is in response to the Stack Overflow Meta question: Why is Stack Overflow so negative of late?

In my opinion the problem that Stack Overflow is currently facing is caused by a lot of new users that are characterized by user Mysticial as "help vampires". They care nothing for the site and just want their code fixed. They don't research (or very little) and provide less than the minimum information needed. Most of the times the questions are very basic and can be answered by an intermediate programmer in a few minutes.

In a normal forum, users would not yield any responses. Not so on Stack Overflow: you get reputation for answering questions and therefore even theses badly researched questions get answers within under a minute. Mystical calls these users "reputation whores".

The problem is that "help vampires" and "reputation whores" create a vicious circle: they both need each other and therefore the circle continues to spin.

The outcome of this situation: the site is flooded with a high number of low quality questions, experienced programmers who are interested in learning something don't see the forrest for the trees. Even though questions can be voted up, they don't stand out enough to gain momentum.

Proposed Solutions

a) Create a "beginners test"

This would create a higher burden for low reputation users before they can ask their question. They need to invest more time and rethink their action before they get to post something.

A few ideas what that could be:

  • The user needs to give 3 search queries that he used either on Google or on Stack Overflow that didn't yield results.
  • If they don't include any code, they must confirm that they are asking a non-code question. See this proposal on Stack Exchange Meta.
  • Specify the time that they took to research the problem (while this can be easily faked, it makes the user reconsider if they had taken enough time for the problem)

b) Have experienced users review a question, before it goes online

There would be a process where a new user asks his or her question, but it doesn't go online. Higher reputation users read the question but are unable to answer it, and give feedback if the question has enough information or has been researched enough. Finally, the question get's thrown into the shark tank.

It would be fine to give these reviewing higher reputation users even more reputation for reviewing this: they are helping to improve the site, this is actually what the reputation system has been designed for: to make the site interesting, not for feeding the "help vampires".

All in all it is remarkable that despite the current situation, Stack Overflow has reached the quality it has. The reputation and badge system has for sure been a very big factor in this but it is very appalling that in order to reach a certain reputation level, you really have to feed the "help vampires".

You can find me on Stack Overflow as akirk.

Veröffentlicht unter web

Fix qTranslate with WordPress 3.9

When updating a blog of mine to WordPress 3.9 the page wouldn't load anymore because of qTranslate not able to cope with the update. In the error log it says:

PHP Catchable fatal error: Object of class WP_Post could not be converted to string in ../wp-content/plugins/qtranslate/qtranslate_core.php on line 455

The error is caused by this change: get_the_date() to accept optional $post argument

There is a proposed quick fix by Saverio Proto, but it doesn't take the problem at its root:

qTranslate registers the function qtrans_dateFromPostForCurrentLanguage($old_date, $format ='', $before = '', $after = '') for the hook get_the_date but it actually only accepts one parameter. With the new update it accepts a second parameter $post, which now wrongly fills the variable $before that is in the process being converted to a string.

So the solution simply is to delete the two parameters that were assigned the wrong meaning and have defaults anyway.

Veröffentlicht unter web