1791
Andrei O.

@andrei0x309 #1791

Software developer, open source enthusiast, privacy advocate. Clear Wallet Open-source privacy focused wallet: https://clear-wallet.flashsoft.eu/
2903 Follower 759 Following
Donate to @yesyes's crowdfund "Helping farcaster grow by looking at Farcaster's data"
Added some new changes on fosscaster UI.

- improved mini apps actions add/remove notification
- added ability to upload videos if your account is allowed
- added URL for triggering compose cast with predefined text and embeds, if the user is not logged in a login modal will be shown (URL schema exact as Warpcast)
- added ability to open mini app by special URL /~/mini-apps/domain (domain dots are replaced with dashes example: https://fosscaster.xyz/~/mini-apps/fosscaster-xyz )
Is miniapps user owned by the team?

I ask because miniapps page does not use the `~` character pattern so trying to view miniapps user page will open the miniapps page instead, this breaks search functionality as if you try to search miniapps and click on the user you'll get to the miniapps page.

cc: @gabrielayuso.eth
Another small bug, the turn off / on notification menu should appear only if the app is already added to favorites, there is no reason why that option should appear to non-favorited adds as it will always fail.

@gabrielayuso.eth
https://imagedelivery.net/BXluQx4ige9GuW0Ia56BHw/fa510fe4-dba3-471e-e387-bdf0c0655f00/original
Opening an open-source client UI in itself as a mini-app works to do infinite nesting until the UI is not usable or you run out of memory.
https://imagedelivery.net/BXluQx4ige9GuW0Ia56BHw/3195a66e-e382-4961-9117-2d551d207c00/original
/dev
Did another batch of changes on fosscaster.xyz

Mainly focused on adding more functionality and refactoring the responsive design to make sure it works well on all screens.

Also added mini app reordering and specific local client settings per user.
The web wallet is a pretty good improvement, especially because it imported the same embedded wallet.

I guess for sign-in to work, the user will need to add the Warpcast wallet address later as an Auth address.

There are some design questions here:

1 Will auth be done automatically since Warpcast holds the custody key, or user will be prompted if he wants to be more in line with the user's choice?, and not to use the PK of the user without consent?

2 Since the user can authorize any address(except the custody since that's already authorized) for better UX sign-in should work with both the embedded wallet and external wallet there's no reason why an external wallet would not be supported for auth in this case.

3 IMO 7 days session days will just create frustration, users are used to the long-term session that practically never expires, the session expiration should match the auth token expiration, but users should be able to log out of the embed wallet for security reasons.
Found this gem was second on Product Hunt: https://capjs.js.org/

Already made a PR, it uses POW and WASM to protect specific requests against automated traffic instead of browser tests and metadata.

Game change for privacy, I do really hate with passion Cloudflare Turnstile which fails 90/100 when you use anti-fingerprint techniques and a low IP score, I raised that with the Cloudflare team when this product was not rolled out many months ago, and their answer: Turn off Anti-fingerprint.

That is not an option internet privacy should be a human-protected right, and more legislation is needed to prevent all these intrusive tactics.
/dev
@gabrielayuso.eth Warpcast mini apps API crashed it seems... :|
https://imagedelivery.net/BXluQx4ige9GuW0Ia56BHw/c10b703d-0562-4ba6-2248-626bff35d000/original
Wrote this open-source web reimplementation of web Warpcast.
Still, many features are missing, will write an article( about ~3 years' worth of FC UX) and will add other features later.

But it has basic support for:
Multi-account
Log in with an external wallet
Sign up with an external wallet
Animated avatars
Casting
Direct casting
Bookmarks
Mini Apps
Minimized Mini Apps
Commit attestation so you can 100% match the source code

Planning to add much more stuff, although I'll not implement the 500+ endpoints that Warpcast now has, aiming to implement around 300

Just made the source public a few minutes ago.

https://fosscaster.xyz
The question is rhetorical at this point because a bet was put on a specific design that requires the creation of a wallet.

The app could have used an external wallet for full user control but that ship has sailed.

The real question is why there was no offer of bringing your own wallet.

A lot of decisions have been forced upon the user we won't know how many users were lost because they didn't want to be forced to create yet a new wallet.

Web3 means to authenticate with your own wallet but Farcaster doesn't know if it's Web3 or not, one day it pushes hard on Web3 concepts the next day pushes hard on Web2 concepts, and it says both are important, but not every concept is compatible.

If somebody wanted to be cynical would see a plot unfolding where the reason was to only allow specific wallets, maybe even fees involved, not at all a good medium to create and promote the best UX.
Loading...
Loading...
2
Varun Srinivasan
@v·15:43 23/04/2025
Swaps in the Warpcast Wallet are not working right now due an issue with an API provider.
I find the implementation very good.

It is much better and is very similar to how is how I described it in the first place, simpler with an agnostic `farcaster://` deep link so it can be picked up by any client, with no centralized server and support for both auth key, and custody key, this is the correct open/permissionless implementaion previous one had a lot of issues, that would have created roadblocks for potential non-warpcast clients that want to implement SIWF.

The only thing missing is some concrete dates to avoid breaking changes, it would be better if the old SIWF(Warpcast links) would also be kept a bit for backward compatibility until people migrate, 1-2 months IMO would be enough for most people that use this.
3621
horsefacts 🚂
@horsefacts.eth·15:32 23/04/2025
Just updated the "Auth Addresses" FIP with a more detailed plan for implementation. We can introduce auth addresses without any changes to the existing contracts or new deployments.

If you use SIWF, build a client, or use mini app auth, you may be interested!

https://github.com/farcasterxyz/protocol/discussions/225
Deprecated NPM `farcaster-hub-utils` in favor of `farcaster-snapchain-utils`

This library allows you to easily do actions with many signers, and in general, allows a simple interface to a snapchain node read/write, primarily a single class abstraction over node actions.

Features:
- works default with public node (provided by pinata)
- works with Neynar node provided you use Neynar API key( you can use the free tier)
- works with your own node
- allows changing the node of the instance
- allows changing the signer of the instance
- can be used in read mode without a signer
- simplifies getting bulk data
- can do most write-actions that the protocol provides
- has a docs website
- bundled with bun for node/bun env

Tested with Snapchain version `0.2.7`(was released very recently) first that didn't have any issue with the library tests.

Made it primarily for myself but might be useful for other people too.
https://www.npmjs.com/package/farcaster-snapchain-utils
I noticed that `hub-grpc-api.neynar.com` still points to a hub(by checking `getInfo`), do anyone knows when that DNS will point to a snapchain node instead of a hub?

For context I asked the guys from /pinata and they also said that thier address will point to a snapchain.

The switch should already be possible so that's why I am asking.
/Neynar
Rather impressed with the new UI of @scoutgamexyz

I used all my airdrop down to 0 to do 44 bids in 10 minutes, which was pretty fun.

Plus, the fee on base right now is $0.000059 to bid TX.
https://imagedelivery.net/BXluQx4ige9GuW0Ia56BHw/53cb987d-4cdf-4496-0a19-8a956f531400/original
What is the plan with hub-grpc.pinata.cloud?
You'll just point the address to a Snapchain node?

Hubs will be deprecated and I was curious what is the plan with this public hub, as this hub is probably the most used public hub since there are so few.

cc: @stevedylandev.eth
It's free but heavily limited, under 10 msg per day, and might be even lower.

But still, 2.0 has incredibly huge free limits, did an automated test once more than 300 messages per day.

I agree it looks like Google has a leg up in many ways, huge context window, its own hardware architecture, huge amounts of data, and huge amounts of computing available, even though in the beginning they were lagging off by a lot, now IMO they are a frontrunner.
Loading...
It was not down for long, anyway, I did set up a public page for the status of warpcast API.

Also, since so much data that's not on protocol resides on Warpcast API could we enable CORS, to truly make it public as per docs?

ATM is not usable in a browser without a proxy/extension/modified-browser, which sucks, there are many valid reasons to access API outside of server/proxy.

https://warpcast-api.betteruptime.com/
834
Gabriel Ayuso
@gabrielayuso.eth·00:04 18/04/2025
Sorry everyone, I moved fast and broke things 😅

Warpcast API status

Welcome to Warpcast API status page for real-time and historical data on system performance.

warpcast-api.betteruptime.com
Probably never Snapchain is just a publicly distributed fixed schema database with a whitelisted set of consensus write nodes.

To be able to make smart contracts, you would need a Turing-complete environment, which has no reason to be implemented.

The only real link to blockchains is its use of blocks to write data, making it Turing-complete is a task which IMO is impossible to imagine done anytime soon or ever.
1214
df
@df·10:01 17/04/2025
how long before smart contracts on snapchain?
The risk applies to all platforms that give full access to your account,
that includes Twitter, Bluesky, Threads, etc

Most social apps allow full account control and have the same risks.

So what am I not getting here?

I agree that OAuth is easier for users than adding signers.

But I don't think we should put farcaster accounts on a pedestal, is just a social account like any other, its only worth is derived exactly as the other social accounts from the user that uses that account.

I mean sure it has a 2$ signup cost but you probably won't be able to resell it anyway.
Loading...
Sure crypto economy mirrors the trad economy, there's no disagreement there.

But I would not fall into the trap, and hype that what happens on the blockchain is decided democratically and transparently, that's false and is still decided most of the time by capital, high stakeholders, and C-level meetings, advertising otherwise for me is just hype and false advertisement.

Like 90%+ of crypto activity is served and created by common companies(a bit less regulated) it's not like DAOs have much relevance anymore today, they never had relevance past the hype.

And I don't think it's cynical is just reality, crypto today without these CEXs that are all extractive would have almost no relevance.

And what is a CEX if not practically a bank? The whole idea when crypto was born was to get away from banks not embrace them.
240932
Monteluna
@monteluna·14:18 16/04/2025
I feel like crypto folks shouldn't be so cynical. Idk if most people here worked in tradtech, but every single organization you work for will have greedy, monopolistic, extractive, elitist people.

That's just life.

The issue is on the blockchains, you can see it and more people can participate, whereas for larger organizations, most of that is hidden in board or c-level meetings.
It has been 10 minutes and Spotify is still down...

At first, I thought there was a problem with my mode, but no, the issue is with the whole service.
https://imagedelivery.net/BXluQx4ige9GuW0Ia56BHw/b424183a-2dc6-4390-80de-6eb43ab32f00/original
Is it still the case that removing a signer key will also remove all content created with it?

Or has that changed?

In my opinion, this design is quite poor, as no user expects or wants that. Technically, it should be possible to keep the content, so that's why I am asking to know if anything has changed on this front.
Never used icons, doc is configured to hide with db-click.

Generally, I launch any program from the keyboard, I assume most people do that, I always use the same shortcut in Linux & Win to launch any program: alt + space, which I believe is the default one.

I have 30+ million files on this machine and hundreds of apps installed but daily I only use a small percentage of installed software.
https://imagedelivery.net/BXluQx4ige9GuW0Ia56BHw/3101d64b-af45-4653-08f6-cc52e8af7d00/original
Loading...
Can we enable CORS on api.warpcast.com ? As per docs, it says public API, can't be public without CORS enabled, there are cases where in mini-app or in a client environment you would want to do a request.

And the only way to do that is to use a proxy that degrades performance.
New minor bug discovered on web Warpcast.

if you load something from drafts and then you want to delete previews is not possible anymore:
IMO, Bun bundler is rather mature to build a library, yet there are no lib templates out there that work.

I haven't found one that works including on Windows, so I made one myself so I can start using it for simple libraries.

It has a few features, like type declaration generation with rust, autofill package exports, degit command included, release command included, and other features, plus what I might add later.

A few notes about Bun Bundler:

It mainly supports 3 modes, browser, node, and bun, it only supports ESM mode, also for types declarations because they aren't supported by Bun, and because rust tooling only supports `isolatedDeclarations` ATM you need to do all types explicitly( in your lib code), maybe at some point later I would also add tsc as a config option in case you don't want to do explicitly all types at the cost of some marginal loss in performance when generating types.

https://github.com/andrei0x309/bun-lib-template-starter
/dev
@deodad @horsefacts.eth @gabrielayuso.eth

Warpcast client hotlinks splash images.

So they won't be rendered if you use hotlink protection.

If you use Cloudflare, you can place your splash in a folder called /hotlink-ok/ to allow the splash to be hotlinked if you don't want to create a specific configuration rule.

This should be mentioned in docs.
The profile card shown is from the frame host, not from the frame itself(by calling the SDK/ parent frame through postMessge).

What you want means implementing somewhat of a full client inside the rewards frame.

Nobody stops implementing a client inside a frame, but I would rather have multiple web clients than people implementing clients inside frames.
Loading...
FFS...

It could be worse: "How is the war affecting you, aren't you like close?"
Loading...
Dropping starter-kit repo made with SvelteKit for frames2(rebranded as mini-apps).

This SveleKit repo is optimized for most scenarios, much faster, and lighter on dev resources than a Next template.

Also, optimized for Netlify/Cloudflare Edge potentially serving millions of requests free.

Will drop an article tomorrow.

https://github.com/andrei0x309/frames.flashsoft.eu
This week, I'll finish the second book on this year Tomorrowville by David T. Isaak. It's shaping into an enjoyable read, but I'll leave a review on Goodreads later.
Warpcast CSP frame policy is
Content-Security-Policy: frame-ancestors 'self';

This means if you have an Iframe in your frame it will fail to load, I don't understand why is that many commenting systems on websites are loaded with iframes that will fail when the website is opened in a frame.

But in this example, maybe the frame is loaded from 'self' or in another way, BTW probably the frame-ancestors CSP should be dropped to allow better compatibility with websites.
Loading...
This week I'll release a V2 frames to claim your merkl LP rewards, will make the repo public would be useful if anyone wants to make a frame V2 using svelte kit.
It's super crazy that with a request header from the client, you could bypass the Next Auth middleware, and for so long.

This magnitude of vulnerability from such a popular framework is completely unacceptable.

If you are using Auth Middleware in Next.js patch your next version or manually patch your middleware.

https://www.youtube.com/watch?v=JbF_8g1EXj4
/dev
In addition to logging in on Warpcast with the wallet and SIWF, I added generating JFS to Clear Wallet.

You can now generate arbitrary custody JFS from Clear Wallet, FID detection is done automatically based on your selected wallet.

Right now mostly useful for frames V2 account association but you can sign any kind of JSON not just {"domain": "DNS"}.

Also, changed the QR scanning to use the native browser when possible this will ensure a high rate of decoded QRs.

These features are available in version > `1.4.17`.
It depends on the blockchain, there are some(albeit in the minority) that support private data eg: Secret Network.

Plus a lot of scammers just send encrypted data to cheap blockchains for data exfiltration.

Also in most cases, you can make some data not permanent(still public) even if the history of the transactions/actions in most cases is permanent or at least held for a very long time.
Loading...
On a desktop, it would be possible to sign in using any wallet if it has imported the custody account, unfortunately, they don't want that, and since the custody account is only imported on your mobile phone that's why you see this annoying screen and forced to use mobile.
Loading...