No matches on LVS
Feb. 14th, 2003 12:42 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
ciphergothAnyone get a match on the LiveJournal Valentines System? I didn't get a match from any of my five nominations, but that's not unexpected, I chose only people who I wouldn't feel comfortable just sending an email saying "hey, I fancy you, fancy a shag" and that's pretty rare. I don't know if any of the people I nominated even took part...
I got three nominations from people I didn't name. Thanks to those people! I'm guessing at least some of you are people who already know very well I have the hots for you :-)
I'm interested in helping![[livejournal.com profile]](https://www.dreamwidth.org/img/external/lj-userinfo.gif)
skx redesign the system for next year. One issue that's come up is authentication. At the moment you can't take part unless you have an un-munged email address in your profile; the authentication token is mailed to that address. This limits the system somewhat.
I thought of an alternative, but it might have evil consequences. When you sign up, the system gives you a token (eg "951m2oGBiqW") which you must include in a public journal entry. It checks for that token in the journal entry, and accepts that the person to whom it gave the token is the legitimate holder of the account if they find it. This is the potentially evil bit: you then offer the choice of just pasting the token in, or copying-and-pasting some HTML including the token, and an image which links to the LVS saying effectively "sign up, I have!".
Does that sound bad and wrong?
Note that the cookie itself won't be visible in your journal no matter which option you choose - it'll be inside an HTML comment, so it'll only show up in the nohtml view of the journal.
Update: this isn't secure. Supposing the system becomes widely used, and I want to pretend to be you to Steve. I set up my own site and encourage you to sign on; the token I give you is the one you need to paste into your journal to convince Steve that I'm you...
One fix would be to include a sitename in the token, and make sure people know not to paste in tokens that they got from sites that aren't named in the token, but I suspect that there are many ways to persuade people to do it anyway, eg include it in a quiz result.
On to Plan B: persuade LJ to accept a patch that directly allows people to authenticate themselves as particular LJ users to third party websites.
I got three nominations from people I didn't name. Thanks to those people! I'm guessing at least some of you are people who already know very well I have the hots for you :-)
I'm interested in helping
skx redesign the system for next year. One issue that's come up is authentication. At the moment you can't take part unless you have an un-munged email address in your profile; the authentication token is mailed to that address. This limits the system somewhat.I thought of an alternative, but it might have evil consequences. When you sign up, the system gives you a token (eg "951m2oGBiqW") which you must include in a public journal entry. It checks for that token in the journal entry, and accepts that the person to whom it gave the token is the legitimate holder of the account if they find it. This is the potentially evil bit: you then offer the choice of just pasting the token in, or copying-and-pasting some HTML including the token, and an image which links to the LVS saying effectively "sign up, I have!".
Does that sound bad and wrong?
Note that the cookie itself won't be visible in your journal no matter which option you choose - it'll be inside an HTML comment, so it'll only show up in the nohtml view of the journal.
Update: this isn't secure. Supposing the system becomes widely used, and I want to pretend to be you to Steve. I set up my own site and encourage you to sign on; the token I give you is the one you need to paste into your journal to convince Steve that I'm you...
One fix would be to include a sitename in the token, and make sure people know not to paste in tokens that they got from sites that aren't named in the token, but I suspect that there are many ways to persuade people to do it anyway, eg include it in a quiz result.
On to Plan B: persuade LJ to accept a patch that directly allows people to authenticate themselves as particular LJ users to third party websites.
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
no subject
Date: 2003-02-14 04:44 am (UTC)no subject
Date: 2003-02-14 04:50 am (UTC)Guilty. ~s~
E.
x
no subject
Date: 2003-02-14 04:55 am (UTC)*looks innocent*
no subject
Date: 2003-02-14 04:56 am (UTC)For some reason my kdenews address started getting spam almost as soon as I created it! I'm sure kdenews aren't selling the addresses, I guess it's a lottery which way the harvesting robots happen to look...
Glad that sounds OK to you. There are details to work out, but it's good to have confirmation that the general plan sounds OK.
Well I tried
Date: 2003-02-14 05:14 am (UTC)That's bisexual faffing for you. :)
no subject
Date: 2003-02-14 05:15 am (UTC)no subject
Date: 2003-02-14 05:22 am (UTC)Cor, you old romantic you. *swoons*
no subject
Date: 2003-02-14 05:23 am (UTC)no subject
Date: 2003-02-14 05:36 am (UTC)no subject
Date: 2003-02-14 05:40 am (UTC)no subject
Date: 2003-02-14 05:40 am (UTC)two down, one to go...
no subject
Date: 2003-02-14 05:41 am (UTC)*sulks*
Re: Well I tried
Date: 2003-02-14 05:45 am (UTC)So if there were any matches, I'm still utterly unaware... *shrug*
no subject
Date: 2003-02-14 05:52 am (UTC)Guilty! :-)
I got a one response from someone I didn't match with.
no subject
Date: 2003-02-14 05:59 am (UTC)no subject
Date: 2003-02-14 06:00 am (UTC)I'm happy to accept help. (Although it could well be the case that I'll have lost interest by next year; ask me a gain in December ;).
I think the idea of a token is a good one, although I think the real solution to the problem is for LiveJournal itself to have hooks for proving that users are who they claim to be.
(I suspect this is unlikely, as even the @LiveJournal.com mails weren't above being bounced/over quote etc).
Despite the implementation deficiencies I'm pleased with the way it turned out more than 700 matches, and many people who were told they had stalkers^H^H^H^H^H^H^H^Hadmirers.
Not bad for a weekends work.
Re: Well I tried
Date: 2003-02-14 06:39 am (UTC)no subject
Date: 2003-02-14 08:51 am (UTC)no subject
Date: 2003-02-14 08:56 am (UTC)no subject
Date: 2003-02-14 09:10 am (UTC)Was named by one other person whom I didn't name.
no subject
Date: 2003-02-14 10:09 am (UTC)Actually, one problem that occurs to me is abuse; people could potentially put people they aren't interested in on their lists purely to find out if said people were interested in them. It's open to this sort of abuse anyway, but people are less likely to abuse it if they only have one opportunity a year to name a limited number of people. You could place a limit on usage, I suppose, to discourage use in anything other than cases where people are genuinely interested, and also to ease the load on the system.
no subject
Date: 2003-02-14 10:47 am (UTC)A few thoughts ..
If it was all year round when would you discover a match, as soon as it was made? Then what - you drop out? or you login and change your choices?
As for the speculatively naming thing, this was mentioned right at the start, and this was the reason for only allowing three nominations. (Although in the end I did give in to pressure and up this limit to five).
Re: Well I tried
Date: 2003-02-14 10:49 am (UTC)Ahh, I updated the page one hour before it was due to close "saying one hour" - then left it for an hour before shutting it all down.
I should have had a countdown, but it didn't occur to me until the last minute, and I had no time to search because real work(tm) interferred.
Sorry!
no subject
Date: 2003-02-14 10:50 am (UTC)What about somebody signing up as a community?
In that case the same token could be posted within the community multiple times but by different usernames.
I guess there would have to be logic to match the poster of the entry along with the name of the journal.
no subject
Date: 2003-02-14 10:51 am (UTC)The code for grabbing email addresses was a little flaky, sometimes it worked, sometimes it didn't.
(I actually got fairly involved with that problem, and it got better as time went on).
no subject
Date: 2003-02-14 10:54 am (UTC)no subject
Date: 2003-02-14 11:13 am (UTC)