Code push - tomorrow (April 26th, 2020) at ~1PM Pacific / 2000 UTC

[mark]

This is a codepush announcement.

Tomorrow around 1PM Pacific / 2000 UTC, we will be updating Dreamwidth to the latest committed code. The short summary of the main changes:

• We continue to iterate on the Quick Reply form, improving its usability/consistency across all platforms and cleaning up the hideously bad code that used to live under it. This particular update includes the feedback from the last update, so many of your thoughts/suggestions have been incorporated!

• A number of improvements in how we render things for mobile devices. Not all of these will be immediately live, but stay tuned to dw_beta if you'd like to turn them on and give us feedback.

• Improvements to Markdown rendering (in particular, the code that turns \@mark into mark should do it more correctly/in fewer places).

• Finally, major changes to how we store passwords in our database (we won't anymore). This will break Semagic and other clients, but there is a workaround: Please see the workaround at the bottom of this post.

For more details, see the relevant posts in dw_dev:

• Code Tour 2020-04-20
• Code Tour 2019-12-14
• Deep dive on authentication changes

We'll update this community and our dreamwidth as we push code out, as per usual. See you then!

Comments

[turlough]

Good luck!

[kengr]

I'm one of those folks using Semagic and I look forward to the instruction on what I need to do.

I will note that semgaic is already somewhat broken with regards to DW. It can't fetch user and community info the way it can on LJ. Alas, I'm not enough of a programmer to figure out what needs fixing.

[tozka]

Updated code is always exciting! I look forward to the Markdown improvements in particular.

[madfilkentist]

Not storing passwords in the database is an excellent idea!

[torylltales]

Good news!

Will the Quick Reply updates include formatting buttons?

[zhiva]

> Finally, major changes to how we store passwords in our database (we won't anymore).

This sounds like you stored them in plain text previously.

[mark]

Yes, that's correct.

For historical context, this is how LiveJournal (which we're a fork of) stored passwords (and presumably still does, since they still support MD5 hash based logins, which would require them to have the raw password I imagine).

We are now modernizing this part of the codebase to be in line with modern best practices, which of course results in breaking some things (hence needing migration steps for Semagic users).

[darjeeling]

Do you know if the new password protocols will affect LJLogin/LJJuggler? (Which, despite their names, are the login switching extensions most of us use for switching between accounts on DW.)

+1

[mycenae]

Not the biggest deal in the world, but that is a looming inconvenience I'm also worried about.

+2

[slurm]

Same tbh.

[madfilkentist]

That would explain why everyone who was on LiveJournal for many years got an email saying "I caught you watching porn" and sending their LiveJournal password as "proof." If only irreversible hashes are stored, or the authentication system otherwise avoids storing passwords or anything that can be turned back into the password, this can't happen even if the database is breached.

Fixing that was long overdue, but I'm glad it's being fixed.

[hudebnik]

"Code Tour 2020-12-14"
I think you mean 2019-12-14...

[momijizukamori]

It will - you'll either have to update your account configurations with an API key in place of a password, as explained, or wait for the LJ Juggler dev to accept the pull request I made with a fix or publish a new version.

(users of LJLogin will have to switch to API key, as to my knowledge development has been dead for close to ten years now)

[frau_kali]

One of the LJ Juggler devs here (kind of, I wrote the dark theme and import/export in the most recent version), we're working on it.

[momijizukamori]

The power of open source! /jazz-hands

[sisterofbloomerjunior]

Mark and Denise are Time Lords.

[mark]

Hahaha, I wish.

The first version of this post said 2012. Then someone pointed out it was wrong, so I fixed it to 2020. Which was still wrong.

Years are hard apparently.

[frau_kali]

Yesh! Btw we're talking about your pull request and changes we have to make now, going to work on it in an hour or so.

[darjeeling]

Thank you so much to both of you for working on this! It's really appreciated!

[tetsab]

In case you missed it since it's tucked under a link:

Ok, so to use Semagic (and other clients), you will need to:

1. Navigate to the Mobile Post Settings page.
2. Click the Generate New API Key button in the Manage API Keys section.
3. Copy the API key that was generated.
4. Change your Semagic password to the API key you copied.
5. That's it, have fun!

ljArchive stopped working

[akatsija]

Looks like ljArchive stopped working after the last change. Was there any change in the way how login credentials are presented to the server?

--
А.Кац и Я

[bluerosedreams]

Is there any way to get back the browse button as an actual button? I understand this is sleek and cool, but my eyes pass over it way too easy when it's the icon. :/

[quipsandthwips]

Thanks for the updates! The profile pages for accounts seem to have been made a bit topsy turvey by the push, unfortunately...! I tried to fiddle with it but it just seems to mash everything together. Just wanted to give the heads up, hope that's something that can be adjusted to function a bit more smoothly.

[mark]

Can you say more/link to a profile and let us know what it's doing and what you expected it to do?

[chardismastic]

Question - is the "random icon" button meant to be nixed from anything other than the "more options" screen?