NewsWaffle VS amfora

I've built search engines, servers, clients, a Wayback machine, and other things in Gemini, so I have a better-than-average informed view of the protocol. Many of these observations are wrong or don't matter in practice. (Paraphrasing Daniel)

> Short-lived TLS connections bad!

Content served over Gemini doesn't cause a cascade of requests like HTML does. You don't download a page, close the connection, and immediately need to fetch something else. A subsequent request, if it happens, is dozens of seconds later.

> No TLS resumption

This is false. Many servers support TLS resumption, using the typical. Usually you just get this with the TLS library. or even use TLS/1.3 with 0-RTT resumption options. In fact, here is a service that tests if your client is using TLS resumption:

gemini://gemini.thegonz.net:1956/

> TLS client certificates (!) for keeping state between requests

This sounds odd to something who knows Client-side certs from HTTP. Think of them as unforgeable session identifiers that you the user are control in. Want the server to know who you are between requests, you client generates a cert and its hash is used to uniquely identify you. Someone rigged up a cool service where you can play Zork and other text adventure games, and the server know what game to send you to based on that certificate hash. Don't want it anymore? Delete the cert. It's like opt-in cookies.

In practice, very view parts of Gemini use Client-side certs (primarily forums). My latest crawls shown less than 0.01% of all URLs in Gemini space use a client-side cert.

> No inline images

This isn't a thing in practice. For most clients, when you click on a link to the image, they display the image inline. Here is Lagrange, perhaps the most popular client, displaying an image inline from a Wired article:

https://github.com/acidus99/NewsWaffle/raw/main/imgs/newswaf...

Oddly Daniel is taking a positive and framing it as a negative. What the positive here is is that Gemini clients don't automatically request anything unless you click it. So there is no way to have a tracking pixel or anything where you are automatically making a request to another, external system. That's a GOOD thing.

> URLs are ambiguous

In practice, this isn't an issue. I run a Wayback machine for Gemini (named Delorean) which has 3M URLs captured. The only odd/malformed URLS or content I've ever encountered are super super old servers, from late 2020 when the protocol was still being developed that send a tab instead of a space in the response line.

> Proxying can't work

This is false. It does! I built and run a Gemini-to-HTTP(s) proxy, lets you. It fetches HTTP(s) content. It converts HTML on the fly to gemtext, RSS into links, and proxies all other content. Duckling Proxy is another popular proxy.

gemini:/gemi.dev/stargate.gmi

> The Gemini protocol reeks of GOPHER and HTTP/0.9 vibes. Application protocol style anno mid 1990s with TLS on top. Designed to serve single small text documents from servers you have a relation to.

Yeah. Exactly. Why are using using italics like this is a bad thing?

> TOFU and scare questions about how certificates are stored in a multi-user system

They are stored just like any other data is stored in a multi-user system. Most client's use a dot directory in the user's home. I seriously have no idea why someone like Daniel thinks storing a the TLS fingerprints for a few thousand certificates is hard.

> I strongly suspect that many existing Gemini clients avoid this huge mess by simply not verifying the server certificates at all or by just storing the certificates temporarily in memory.

I have literally never encountered a client that doesn't verify server certificates. Clients aren't just storing them in memory temporarily. Personally my client stores them in a Sqlite database in a dot directory of the user's home folder.

Overall, I think Daniel is missing the point. Gemini isn't an HTTP replacement. These are systems that don't need to scale to solve the C1M problem, or even the C10K problem. I run some of the more popular services and a few hits per minute is a busy time for me. These are fun, hobbyist systems, playing with a protocol that isn't economically practical to commercialize and hence doesn't have to deal with ads, tracking, etc. Stop thinking about it so hard. It's just for fun.

Gemini is a joke. The main proponents like Drew Devault chuck a tantrum when browsers allow users to optionally show favicons https://github.com/makew0rld/amfora/issues/199

https://github.com/makew0rld/amfora/issues/199

You'll need a different web browser since Firefox and Chrome based Browsers all only support HTTP/HTTPS afaik. I suggest using deedum if you're on Android, if you're on windows I suggest installing this browser, it's a more or less simple graphical Browser written in C# so it should work. Just download the release zip and extract, you can probably go from there., if you're on Linux, I suggest Amfora it's a text based browser but it has served me well.

And that's the caveat with SourceHut and the current discussion around it. While I respect Drew and his work, he isn't exactly the most approachable person in OSS.

If you and several other people happen to have a hard requirement for a specific feature that he (or his buddy Simon) don't see fit for, you won't get that feature, even if you volunteer to implement and maintain it. The only thing you're left with is basically to fork SourceHut, host it yourself and maintain your feature all by yourself, dealing with continuously patching a very much still-in-development (and therefore ever changing) software. That is something you're probably not going to do, especially considering SourceHut's architecture and way of doing things.

SourceHut isn't exactly extensible/pluggable and hosting it as a one man show or even a small company becomes a huge PITA, as soon as you diverge from the holy grail that is Drew's way of doing things (Alpine, no containers, no good config management, no easy way to scale things, and the dedication to invest your blood and tears into maintaining this thing).

Hence I really cannot comprehend the current trend that is "let's all dump GitHub for this, and that, and SourceHut". So far, SourceHut really hasn't made an effort to prove itself worthy of the influx of OSS projects. And while I do see Drew commenting here, reassuring folks he won't ban anyone over any internet disagreement, reading the public mailing lists of the SourceHut repos doesn't really show much of a welcoming behavior either. I mean, he's the person behind what has become one of the most popular Gemini servers, and as soon as that was the case, he began threatening client apps to arbitrary block them for doing things that don't align with his values (in this case, [showing a favicon](https://github.com/makeworld-the-better-one/amfora/issues/19...)). And the cabal of elite internet Amish, that have been on SourceHut since its early days and that makes a large portion of the platform, aren't that different either.

I do agree with GitHub being the wrong place for OSS projects, but I don't agree with SourceHut being the right one. At least for as long as it doesn't become obvious that its founder and the community around him has changed and started to genuinely appreciate people for the work they're doing, regardless of their own ideological beliefs.

I use Sway and I pay to host my code on SourceHut. I admire Drew and I think he is making invaluable contributions to FOSS.

That said, he has a history of... rash? impulsive? reactions to situations that might have been resolved with less bad blood if he had stepped away from the keyboard until he was less upset. The classic example is when he got upset about people wanting to unofficially add favicons to the Gemini protocol, and he threatened to blackhole any IP address which requests a favicon. https://github.com/makeworld-the-better-one/amfora/issues/19...

I do not know if there is some specific recent event triggering vitriol, but the way this post is written, it sounds like Drew thinks it is resulting from less recent actions like the favicon threat.

In Drew's defense, he has made (limited) apologies and I do believe he is trying to do better. https://drewdevault.com/2021/04/26/Cryptocurrency-is-a-disas... has a note at the bottom, saying:

> I realize that my blog has been a source of a lot of negativity in the past, and I regret how harsh I've been with some of the projects I've criticised. I will make my arguments by example going forward: if I think we can do better, I'll do it better, instead of criticising those who are just earnestly trying their best.

But it is also true that many people will not be quick to forgive him, and some people never will. It will take him time to undo the negative image he has created with some people, but after seeing Linus Torvald's positive changes, I am optimistic that Drew can change for the better if he wants to, and help create a welcoming community for everyone. If he doesn't give up first.

amfora gemini client

Should be able to run a basic gemini client just fine, maybe even amfora?