adactio's dashboard

Done. Anywhere that you see an RSS feed, you can now also get an XSPF file (just change the URL from /rss to /xspf):

http://huffduffer.com/new/xspf
http://huffduffer.com/popular/xspf
http://huffduffer.com/tags/TAG/xspf
http://huffduffer.com/USERNAME/xspf
http://huffduffer.com/USERNAME/tags/T...

I reckon that's doable. I'll get working on that.

I've tweaked the way that the icon gets pulled in. It used to be that checked first for a matching username (on Twitter, then Flickr) before resorting to checking for an account using the same email address (on Twitter, then Flickr). I've flipped that 'round now so that it first checks for a matching email address before checking for a matching username.

Now your Flickr icon is showing up correctly.

I've changed the main tag page to sort alphabetically:

http://huffduffer.com/tags

...but I still think it makes more sense for the smaller tag "clouds" (on the front page and on user profiles) to be sorted by popularity to give that at-a-glance indication of popularity.

Supposedly the current player should be able to support playing just one stream at a time but for the life of me I can't get it to work (and it doesn't help that the documentation is hard to find). I'll keep trying though.

That's an excellent first step to archiving this stuff permanently. Thank you, Mike. Thank you, Ben. Thank you, Tantek!

I concur. If there's any way to avoid link rot (even some kind of quick'n'dirty permanent redirect), that would be great.

I wish I could. Alas, I know nothing about creating this kind of tools. I'll read up about it but in the meantime, if anybody out there can help, please chime in.

You're quite right, Scott. I really don't mean to come across like I'm dogpiling all this on you guys. Sorry if it came across that way. – adactio, on November 24, 2008 19:48

You're right, Lane, and I hope I don't mean to come across like I'm piling it on you guys. Like I said, you guys—Ted and Scott—have done great work with technologies like OpenID, hCard and OAuth and you are absolutely deserving of the benefit of the doubt.

Sorry for coming on so strong. – adactio, on November 24, 2008 19:46

But of course! I'm upset at the bad practice, not at you guys personally. You guys are teh awesum! :-) – adactio, on November 24, 2008 19:42

Scott and Ted, I'm kind of surprised by the push-back from you guys. As your rightly pointed out, you have done *excellent* work on implementing OpenID and hCard subscription in your sign-up process so I would have that the negative effects of the password anti-pattern would be self-evident to such savvy developers.

I can't provide you with too many examples of direct phishing attacks based on the password anti-pattern. Here's one:
http://www.codinghorror.com/blog/arch...

Then there are the less extreme cases like the MyNameIsE example mentioned above:
http://getsatisfaction.com/e/topics/a...

That was an example of (mild) identity theft rather than direct phishing.

But as so many have already pointed out, the real problem isn't direct cause and effect phishing, it's the message being sent out that it's okay to hand out passwords from one site (Twitter) on a completely different site (Get Satisfaction). If—or should I say when—this practice becomes commonplace then phishing and identity theft become so much easier ...even if it remains hard to measure directly.

Right now, Get Satisfaction are basically aligning themselves with sites like this: http://twitterawesomeness.com/
(though this is done as a joke whereas Get Satisfaction are doing it in all seriousness).

Now, the usual response to pleas for removing the password anti-pattern (e.g. Slideshare, Pownce, LinkedIn) is that they desperately need to be able to import people's address books. In the case of Get Satisfaction, you aren't even trying to do that! All you want to do is allow people to post a message to Twitter. For that, you *do not* need anybody's password.

Ted, you asked me to provide a solution. I made very sure to do just that in my original post. Simply make your "Twitter this" an actual URL that points to http://twitter.com/home passing it a query string with a variable called "status" pre-populated with the message you want to post.

The current solution isn't just bad practice and bad for the web, it's kind of over-engineered, don't you think?

P.S. to everyone else who is rightly upset by this, please remember: Ted and Scott really are top-notch developers who have done great things with OpenID support and hCard subscription.

Um... shouldn't *you* stop playing one audio file before playing another?