IvanTheGeek

While reading the public API source at commit f220a7d9f I collected a handful of tiny dead-code / dead-route nits. None of them are bugs — nothing is broken, nothing is exploitable, and most are already half-flagged in your own comments. I'm dropping...

When you get getWhat:"Pages", only a subset of ref prefixes are accepted: diid:, emburl: (a.k.a. emgurllax:), tyid:, and pageid:. Pass a rid:, extid:, or pagepath: ref and each item comes back rejected with [TyE0EMBURLORDIID]. What makes this a trap ...

Most Talkyard API errors come back as plain text ending in a [TyE...] code, which is easy to parse and branch on. But a few classes of error escape that format entirely, because they're handled by Play (the web framework) before Talkyard's code runs ...

The page-count fields — numOpLikeVotes, numTotRepliesVisible, and the other num* fields — only ever show up when you fetch a page via get. A page object returned from list or search never carries them, even though the field defaults say it should. Th...

In get, the per-item error codes are overloaded to the point of being unhelpful, and a couple of messages leak Scala's case-class rendering. Every per-item page failure comes back as TyEPGNF regardless of cause — including "unknown ref type" and "not...

A few status codes surprised me while probing — enough that error handling around the API can't rely on the code alone. A missing secret on get with getWhat:"Pats" returns 401 (TyE0APISECR_), but a wrong secret anywhere returns 403 (TyEAPI0SECRET01_)...

A cluster of request fields on list, search and the Do API are accepted without error but then do nothing. Because there's no error and no warnings, a caller has no way to tell the field didn't apply — you just quietly get default behavior. These bit...

upsert-simple will happily accept any internal enum value for postType and pageType — there's no whitelist restricting them to the handful that make sense over the public API. The value flows straight into page/post creation, so a caller can create s...

Flagging this one lightly and honestly: I read the comments but did not verify the behavior beyond that, so treat it as a pointer rather than a finding. In the upsert-patch code path there are a couple of validation gaps still marked SECURITY; SHOULD...

A sharp edge for anyone writing a webhook consumer (or polling the list/events API). When a post isn't approved yet, its event payload carries the field unapprovedSource — that's raw CommonMark, i.e. untrusted user input, not the sanitized HTML you'd...

If you self-host and want to point a webhook at anything other than a fully-trusted receiver, this is worth knowing up front. Three facts combine into one gap: Payloads are always rendered as sysbot. A webhook therefore sees activity in private categ...

A defense-in-depth thought for self-hosters who ever do a one-off site import. The POST /-/import-site-json endpoint creates whole new sites from a JSON dump. It has no admin/secret auth wrapper at all — it's a bare action guarded solely by the serve...

This one is worth a look for anyone using embedded-comments SSO (or the upsert-user-and-login flow) on a self-hosted instance. When a PASETO auth token carries an exp claim, the jpaseto library does enforce it at parse time — an expired token cleanly...

Tiniest one in the batch, but I verified it live so here it is. A get request with getWhat: "Posts" returns the not-implemented message: Getting posts hasn'b been implemenetd [TyE02MSRD37] Two typos in one string: "hasn'b" (should be "hasn't") and "i...

Small and already known — noting it here mostly so it's on the list. Re-upserting a category to a new parent (via /-/v0/upsert-simple) messes up the old and new parent categories' topic counts. It's marked BUG // harmless in the source, so you've fla...

The per-webhook retryMaxSecs config is fully round-tripped: parsed, validated, stored, and echoed back on read. But it has no effect. When the sender computes the give-up deadline, it always passes a hardcoded defaultRetryMaxSecs = 3 days, so whateve...

login-with-secret validates its thenGoTo redirect target by feeding it straight into java.net.URI inside isAllowedRedirectUrl. So a thenGoTo value with literal spaces — e.g. ?thenGoTo=/-/search?q=mono mode connect — throws URISyntaxException, which s...

In the Do API, several actions take a whatPage ref — CreateComment and SetNotfLevel's whatPage, and SetVote's whatPage. A diid: (discussion-id) ref parses fine, but then hits a die("TyE404KSR5", ...) in getPageMetaByParsedRef, because that match has ...

In the Do API, CreatePage tags the orig post correctly. But CreateComment accepts and validates tags — a bad tag still aborts with TyENEWCOMTTAG02 — and then never saves them. So an API caller who tags a comment gets no error and no tags: a silent da...

This is the webhook item I'd most want fixed. The admin UI lets you configure custom headers on a webhook — the obvious use being an auth header so the receiver can verify the delivery. Those headers are persisted and displayed back to you as if they...

https://discord.com/channels/1139074016448098375/1139238154445017158/1491174723185410220 https://github.com/JuliusBrussee/caveman

This was a private message to KajMagnus I sent and he replied, and agreed to allow it in public on my site. Could we be working toward the same thing? Hey KajMagnus, I've been using Talkyard as the foundation for a knowledge system I'm building calle...

This is a one-time API smoke test from NEXUS setup.

View on Reddit

https://maximegosselin.com/posts/pull-the-plug-modeling/

https://discordapp.com/channels/1139074016448098375/1141474473539797074/1486724041556496514 Recent red-teaming study against AI agents, from researchers at Northeastern University https://arxiv.org/abs/2602.20021v1 Confirming again, autonomous agents...

https://apioo.de/ https://chrisk.app/ https://typeschema.org/

Context This post captures an architectural decision and the thinking behind it, emerging from an exploration of Autonomi Network, IPFS, and cooperative distributed storage. The question was: where does distributed storage fit in the NEXUS ecosystem,...

This is actually an idea for AI/LLM chat interfaces too. be able to highlight text or even lines or blocks and use an quotes in a replay with one click. Currently have to copy, paste then make quote. have interface where selected text, line or block ...

When copying a PM between myself and Talkyard Dev at the forum.talkyard.io site, I was unable to copy the markdown of his posts. I was able to click edit on mine and get the markdown. Would be nice to have that option. Work around: I had to manually ...

When creating prompts in Claude Code to develop the idea that the Event Model can be done in HTML, I wanted a place to create the prompt that preserves my prompt for history is not lost if the UI crashes or resets this has happened several times wher...

Most basic slice (which is a column): SLICE-NAME-INTENT UI COMMAND/VIEW EVENT Basic CommandSlice: COMMAND-SLICE-NAME-INTENT UI COMMAND EVENT The naming for Slices is likely omitted from the graph as the command is usuaully the intent. Markdown is cau...

WIKI to be curated.

as part of my data ingestion and integrations, the idea would be to have Discord or X or Facebook and pull in these streams to LOGOS. for discord, channels could be used in Talkyard Chats or as discussion topics. it would give a local copy of the dat...

NARRATIVE: I have one board that is my main board. It has all different areas I am using Talkyard for like Software Development, research, networking, NeighborNet, personal, Homesteading, Accounting, etc. I would like to be able to have "sub-sites" w...

Adding topic in one tab is not seen in another tab until navigation or refresh is hit. I might not want it to keep scrolling on new topics as that might be rather jarring, but an indicator comes up that says there are new topics and clicking it then ...

I had 2 tabs open both on the forum. I was creating a reply in the first to one topic. I wanted to search for something in another tab and then wanted to record an idea in a different post. When I clicked Create Topic, it pulled in all the text from ...

need to investigate and experiment with user permissions to see what it can limit hide categories?

When I have been doing updates like category description updates when i flip to another tab with Talkyard open, even clicking around is sometimes not showing the updated text. I am sure it is related to caching, just wondering if that can be improved...

I have a category description set that is a bit longer. Edit the description of the Talkyard category: The place where I record my Talkyard "forum" investigations, experiments, questions, experiences. Being done here to eventually be used to improve ...