Post by @MaddieM4@raphus.social

2026-10-24 23:39 UTC

I wanted to let that simmer a minute and give people a chance to think about it. But I think the classroom will be roughly divided into two camps. 1. People who are working it out purely from clues, and learning by logical extrapolation how Modern Webapps delegate client apps the power to act on a user's behalf. These are the students getting the most out of the Socratic method, and taking their time quietly to work it out from scratch. 2. People who already know a bit too much about OAuth2 and need to be told, "yes yes, I see you, put your hand down."

Replies (2)

@MaddieM4@raphus.social 2026-10-24 23:51

It's easy to forget long since setting up this or that client, but generally speaking, here's something you probably experienced when you were setting up any client other than your instance's built-in Mastodon frontend. 1. You told your preferred frontend, "I'm on domain such-and-such!" 2. It sent you to a special page on your home instance, which asks, "Using an alternative frontend is a big commitment. Do you really want to grant it all these permissions?" 3. You said "I do!" 4. Your instance said "Well if you're sure, alright then!" and sent you back to your new frontend client, possibly by a redirect, or maybe by showing you a token that you needed to copy and paste into your client. CLI frontends like `madonctl` work like the latter. Well, notice in step 2 that Mastodon phrases the ask like: "Are you sure you want to trust ${appName}?" Hmm.

Open ##5390436
@djsundog@fedi.reclaim.technology 2026-10-24 23:43

@MaddieM4@raphus.social group 2 probably needs to sit with the implications of how this works despite ostensibly knowing how it works since the effects often reach farther than any given member of group 2 has thought through, since it gets knocked so readily into the “best practices” pile these days. having this to sit with, they can keep quiet and leave group 1 to their further exploration.

Open ##5390438