There are certain things about programming language design that aremore or less solved problems, where we generally know what the goodand bad approaches are. For example, over time we've wound upagreeing on various common control structures like for and whileloops, if statements, and multi-option switch/case/etc statements.The syntax may vary (sometimes very much, as for example in Lisp),but the approach is more or less the same because we've come upwith good approaches.

I

When I wrote about how SAML and OIDC differed in sharing information , where SAML shares every SAML'attribute' by default and OIDC has 'scopes' for its 'claims', Isaid that the SAML approach was probably easier within an organization,where you already have trust in the clients. It turns out that there'san important exception to this I didn't realize at the time, and that'swhen programs (like mail clients) are using tokens to authenticate toservers ( like IMAP servers

The normal authentication process for OIDC isweb-based and involves a series of HTTP redirects, interspersedwith web pages that you interact with. Something that wants toauthenticate you will redirect you to the OIDC identity server'swebsite, which will ask you for your login and password and maybeMFA authentication, check them, and then HTTP redirect you back toa 'callback' or 'redirect' URL that will transfer a magic code fromthe OIDC server to the OIDC client (generally as a URL queryparameter)

Suppose, not hypothetically, that you have a relatively modern Dovecot server and a shiny new OIDC identityprovider server ('OP' in OIDC jargon, 'IdP' in common usage), andyou would like to get Dovecot to authenticate people's logins viaOIDC. Ignoring certain practical problems , the way this is done is foryour mail clients to obtain an OIDC token from your IdP, provideit to Dovecot via SASL OAUTHBEARER , and then for Dovecotto do the critical step of actually validating that token it

So what happened is that Mike Hoye had a question about a perfectlyreasonable ideas :

Question: is there wiki software out there that handles tags (date,word) with a reasonably graceful URL approach?

As in, site/wiki/2020/01 would give me all the pages tagged as 2020and 01, site/wiki/foo/bar would give me a list of articles tagged fooand bar.

I got nerd-sniped by a side question but then,

Over on the Fediverse, I tried out a thesis :

Thesis: most desktop GUIs are not opinionated about how you interactwith things, and this is why there are so many GUI toolkits and theymake so little difference to programs, and also why the browser isa perfectly good cross-platform GUI (and why cross-platform GUIs ingeneral).

Some GUIs are quite opinionated (eg Plan 9's Acme) but most arebasically the same. Which isn't necessarily a bad thing but it creates

Suppose that you want to restrict access to parts of your Apachebased website but you want something more sophisticated and modernthan Apache Basic HTTP authentication . Thetraditional reason for this was to support 'single sign on' across all your (internal) websites;the modern reason is that a central authentication server is theeasiest place to add full multi-factor authentication . The two dominant protocolsfor this are SAML and OIDC .There are commonly available Apache authentication modules for bothprotocols, in the form of Mellon ( also )

Recently, I got involved in a discussion on the Fediverse over whatI will simplify to the desirability (or lack of it) of cross platformtoolkits, including the browser, and how they erase platformpersonality and opinions. This caused me to have a realization aboutwhat web browser based applications are doing for me, which is thatbeing browser based is what lets me use them at all.

My environment is pretty far from being a significant platform; Ithink Unix desktop share is in the low single percent under the

I wrote a while back about how my desktop screens now had areasthat were 'good' and 'bad' for me ,and mentioned that I had recently noticed this, calling it a storyfor another time. That time is now. What made me really notice thisissue with my screens and where I had put some things on them was ourcentral mail server (temporarily) stopping handling email because itsload was absurdly high .

In theory I should have noticed this issue before a co-workerrebooted the mail