rstat.us

You're on Python, but it might make sense to look at the choices made by https://github.com/hotsh/rstat.us and https://github.com/gargron/mastodon , to get some ideas. They're in Ruby, but the language is more similar to Python than PHP is, and some of the tooling and libraries in Python and Ruby are inspired by each other too. It always helps to look at those who came before you.

We've had discussions about this several times, and haven't come up with something that's satisfactory as a generic replacement, other than "configuration could probably be improved." For one example, see this from a year ago: https://github.com/rails/rails/pull/3777#issuecomment-289375... > If we ignore them, this means a recently created, pushed and then cloned project is not going to work at all. Some people replace it with a new file upon deployment, some people use ENV vars, some (most) people never open-source their app, and don't mind employees seeing it... I personally do https://github.com/hotsh/rstat.us/blob/master/config/initial... Being generic is hard.

I like the solution I stole from rstat.us: you have an off-repository location for the token If there's none: * on production you crash, * on dev, you autogenerate one and save it to a config file that's possibly dev-only, * during automated tests you just autogenerate something and live with it. Here's the nice replacement for secret_token.rb: https://github.com/hotsh/rstat.us/blob/master/config/initial...

I have no problem with old issues or vulnerabilities being posted, of course, especially when they are very widespread such as in this case. Note that not all of those results are necessarily vulnerable, for example, https://github.com/hotsh/rstat.us/blob/master/config/initial... loads the secret key from the environment, and https://github.com/GreenplumChorus/chorus/blob/master/config... loads it from an ignored file (like the article). I would estimate the real number of projects to be somewhere less than 3000, with about 1400 being on Github. This also assumes that these are all actually production keys. Just to reiterate, I do believe that this is a legitimate problem even now, but I just wanted to note the age of the article and to refute the claim that this is the first mention of the issue.

It's meant to work, for example see here https://github.com/hotsh/rstat.us/issues/387

I mentioned this in the Tweetbot thread, but http://rstat.us looks very promising. They syndicate your posts to Twitter, are working on a Twitter-compatible API[1], and use OStatus so are compatible with other services running the protocol (like the somewhat more neglected-looking identi.ca). [1] https://github.com/hotsh/rstat.us/tree/twitter-api

Also http://rstat.us, which I just found out about - not sure why it hasn't received more attention. It seems to be like a better identi.ca that can also automatically syndicate your Twitter posts. http://blog.steveklabnik.com/posts/2011-03-23-announcing-rst... Edit: They're also planning to create a Twitter-compatible API, so a vendor like Tapbots could simply change the endpoint in their code and support rstat.us as well. https://github.com/hotsh/rstat.us/issues/562

"+1" or "yes" appear to be the norm on GitHub. Example: https://github.com/hotsh/rstat.us/pull/443

That's exactly why I work on http://rstat.us [1] -- we need to be here, ready, for the next decision that Twitter makes that pisses more people off, for the next time that Twitter is down, etc. [1] - a microblogging site that uses ostatus; we integrate with identi.ca. code here: https://github.com/hotsh/rstat.us

We have at ticket out that involves better account management that's going to get addressed this weekend at the latest. Being able to add and remove services easily is a priority: https://github.com/hotsh/rstat.us/issues#issue/44 (See other comment re: email)