While working on porting the Small Technology Foundation web site¹ to Kitten², I took the opportunity to pull out base Model and Collection classes that I’ll likely end up including in Kitten proper:

• Model: codeberg.org/small-tech/site/s…
• Collection: codeberg.org/small-tech/site/s…

To see them in use, here’s the base Posts class (with RSS generation) that extends Collection:
codeberg.org/small-tech/site/s…

And here’s the concrete EventPosts collection class that extends Posts:
codeberg.org/small-tech/site/s…

And the EventPost (showing an implementation of a calculated property):
codeberg.org/small-tech/site/s…

So all this is possible (persisting and reading back typed model collections, etc.) thanks to JSDB¹ (JavaScript database), a zero-dependency, transparent, in-memory, streaming write-on-update JavaScript database I wrote for the Small Web that persists to a JavaScript transaction log and is included as as first-class citizen in Kitten.

codeberg.org/small-tech/jsdb

And if you want to know how the magic mapping of classes happens, see the Database App Module:

codeberg.org/small-tech/site/s…

PS. For a much gentler introduction to persistence in Kitten, see the Kitten Persistence tutorial:
kitten.small-web.org/tutorials…

Enjoy! 💕

¹ small-tech.org
² kitten.small-web.org

#Kitten #SmallWeb #SmallTech #JavaScript #database #JSDB #typeSafety #JSDoc #closureCompiler #TypeScript #workInProgress

New Kitten release

• Fixes redirection from sign-in page when person is already authenticated.

kitten.small-web.org

To learn more about how Kitten automatically implements authentication for your Small Web sites and apps using public-key cryptography (so even your own server doesn’t know your secret)¹, please see the Authentication tutorial:

kitten.small-web.org/tutorials…

Enjoy!

💕

¹ The security (and privacy) of Domain/Kitten are based on a 32-byte cryptographically random secret string that only the person who owns/controls a domain knows.

This is basically a Base256-encoded ed25519 secret key where the Base256 alphabet is a set of curated emoji surrogate pairs without any special modifiers chosen mainly from the animals, plants, and food groups with some exceptions (to avoid common phobias or triggers, etc.) that we call KittenMoji.

…

When setting up a Small Web app via Domain, this key is generated in the person’s browser, on their own computer, and is never communicated to either the Domain instance or the Kitten app being installed. Instead the ed25519 public key is sent to both and signed token authentication is used when the server needs to verify the owner’s identity (e.g., before allowing access to the administration area).

The expected/encouraged behaviour is for the person to store this secret in their password manager of choice.

More: kitten.small-web.org/reference…

#Kitten #SmallWeb #SmallTech #authentication #publicKeyCryptography #web #dev #NodeJS #JavaScript #HTML #CSS

I wrote this five years ago:

“Democracy or capitalism? Pick one.

If, like me, you grew up in the 80s, you probably unthinkingly accepted the neoliberal maxim that democracy and capitalism go hand-in-hand. This is one of the greatest lies ever told. Democracy and capitalism are polar opposites.

You cannot have a functional democracy and billionaires and trillion-dollar corporate interests and Silicon Valley’s Big Tech misinformation and exploitation machinery. What we’re seeing is the clash of capitalism and democracy and capitalism is winning.

Are we past a tipping point? I don’t know. Perhaps. But we can’t think like that.

Personally, I’m going to keep working to effect change where I feel I can be effective: in creating alternative technological infrastructure to support individual freedoms and democracy.

We’ve already laid the infrastructure of techno-fascism. We’ve already created (and are creating) the panopticons. All the fascists need to do is move in and take the controls. And they will do so democratically, before destroying democracy, just as Hitler did.

And if you think the 1930s and 40s were something, remember that the most advanced tools to amplify the destructive ideologies of the time were less powerful than the computers you have in your pockets today. Today we have machine learning and are on the brink of unlocking quantum computing.

We must ensure the 2030s are not like the 1930s. Because our advanced centralised systems of data capture, classification, and prediction plus a hundred years of exponential increase in processing power (note: I do not use the word “progress”) mean the 2030s will be exponentially worse.

Whoever you are, wherever you are, we have a common enemy: the nationalist international. The problems of our time transcend national borders. The solutions must also. The systems we build must be both local and global at once. The network we must build is one of solidarity.

We created the present. We will create the future. Let’s work together to ensure that that future is the one we want to live in ourselves.”

– In 2020 and beyond, the battle to save personhood and democracy requires a radical overhaul of mainstream technology

ar.al/2020/01/01/in-2020-and-b…

And that’s why I’m working on building the Small Web.

ar.al/2020/08/07/what-is-the-s…

With ZERO funding from the EU and multiple rejections from NLNet/ngi (because they still don’t get it).

ar.al/2022/10/20/nlnet-grant-a…

(That’s from 2022. We were also rejected in 2024 for my work on Kitten, Domain, and Place as outlined in my talk, linked below, but I was too tired to write about it again.)

ar.al/2024/06/24/small-web-com…

So for fuck’s sake, if you agree with my vision for a technological (and thus societal) future different from the hellscape we currently inhabit, and want to help us explore one possible path towards it, please fund our damn work. (Because, clearly, the EU is adamant about not doing so.)

small-tech.org/fund-us/

Other ways to help:

- If you know of folks that are ethically compatible who offer no strings funding, please try to secure some for us (my time is 100% spent on coding at the moment).

- If you know of conferences that pay their speakers, ask them to have me speak on the Small Web. It can be as technical or non-technical as you like and I won’t do it for free but I’m happy to accept, within reason, what they can afford (in addition to travel and accommodation being covered) and any fees received go to Small Technology Foundation, our not-for-profit.

- Help share this far and wide.

Once Domain is released and we have the first Small Web host running on small-web.org – hopefully the first of many that will be run by other folks in the future – and we start taking commercial sign-ups for Small Web places, we should eventually have the money problem solved (because apparently that’s a problem you have to solve to gain the privilege of working for the common good in our world because our system is unabashedly shortsighted).

So, yeah, anyway, g’morning! How’s your day going so far? 😀

(You made it this far? You deserve a hug. And don’t worry, I’m just venting. Things will get better. It’s just frustrating swimming upstream all the time.)

💕

#SmallWeb #SmallTech #humanRights #democracy #anarchy #BigWeb #BigTech #capitalism #neoliberalism #technoFascism #technology #fascism #society #freedom #personhood

New Kitten release

• You can now use key paths in the names of your client-side live components and these will automatically be transformed into object hierarchies on the server for you.¹

• Self heals zombie live pages (see Streaming HTML workflow²) if they return to life due to client-side browser cache.³

• Removes htmx⁴ headers from `data` property into separate `header` property in Kitten Page events and the data your Kitten Page message handlers receive.

• Automatically passes references to the live page object (if any) and the request and response objects to the layout templates of Markdown pages⁵ (so you can, for example, check if `request.session.authenticated`⁶ is true from the your layout template and customise the layout accordingly).

kitten.small-web.org

Enjoy!

💕

¹ e.g., See codeberg.org/small-tech/site/s… (markup) and codeberg.org/small-tech/site/s… (handler) and codeberg.org/small-tech/site/s… (model class method).

² See Streaming HTML tutorial: kitten.small-web.org/tutorials… (There’s actually more to it now but I haven’t had a chance to document the new class-based and event-driven live page workflow yet. It’s experimental but working very well for me so far so I will do so shortly.)

³ When a person leaves a live/connected page (a page connected to its default web socket), we clean up and remove that live page from memory. However, browsers being what they are, cache the page on the client. If a person uses the back/forward buttons to return to the page, the browser will serve the cached source from memory, which has the old page ID, for the page that no longer exists in Kitten’s memory. So now we have a problem. The only way to recover from this is to tell the page to reload itself. So we accept the WebSocket connection, send a command to the page for it to reload itself, and then close the socket. That makes the stale page self heal by replacing itself with a fresh one. Yay, go us!

⁴ HTMX: htmx.org

⁵ Kitten Markdown pages reference: kitten.small-web.org/reference…

⁶ See Session tutorial: kitten.small-web.org/tutorials…

#Kitten #SmallWeb #SmallTech #StreamingHTML #WebSocket #HTMX #Markdown #sessions #data #web #dev #JavaScript #HTML

New releases

• Kitten (rolling release)
• @small-tech/https version 5.3.2
• Auto Encrypt version 4.1.3

OCSP support has been reinstated in the server so existing sites with Let’s Encrypt certificates provisioned prior to the removal of the OCSP stapling requirement will not fail to load in Firefox.

Kitten servers in production will automatically update to this version in a few hours. You can also sign in to the Kitten settings page on your server and do a manual update to update Kitten immediately.

Thanks to @stefan and @s1r83r for bringing this to my attention. (mastodon.ar.al/@aral/113969540…)

#Kitten #SmallWeb #SmallTech #AutoEncrypt #TLS #SSL #HTTPS #OCSP #LetsEncrypt #web #dev #NodeJS #JavaScript

Aral Balkan

2025-02-08 17:53:04

Thanks for the heads up, folks.

So, here’s what’s happened:

1. Let’s Encrypt removed OCSP support and started rejecting certificate requests that require OCSP stapling (a privacy feature that Kitten inherited from my Auto Encrypt module) for new server requests and will reject certificate renewal requests starting in May.

2. So I went ahead and removed the OCSP stapling requirement from the certificate requests Auto Encrypt makes to Let’s Encrypt.

3. I also removed OCSP support from the server.

Makes sense, right?

Sure does, until you consider what happens to servers with already-provisioned Let’s Encrypt certificates that have certificates that require OCSP stapling. (kitten.small-web.org’s certificate got renewed four days ago, before I’d released the updates.)

*Doh!* 🤦‍♂️

Seems Safari and Chrom(ium) are fine with letting it pass. However, Firefox, (and correctly too, I might add), refuses to load the site.

So I’m off to update Auto Encrypt to re-enable OCSP support with a note to disable it in May (by which time all certificates will have renewed anyway without the stapling requirement) and then issue new builds of @small-web/https and Kitten.

Kitten servers should automatically upgrade and start working in Firefox in several hours. And you can also manually update them if you want to before then after I’ve announced the releases.

Thanks again for letting me know.

💕

#Kitten #SmallWeb #AutoEncrypt #LetsEncrypt #TLS #SSL #HTTPS #OCSP

I’m in the process of rewriting our sites that use Site.js¹, which has been deprecated for some time now, in Kitten².

In any of your sites use Site.js, I’d highly recommend doing the same thing. This is also a heads up for anyone who uses Site.js to install and run their own Owncast server³.

Site.js will be retired and the web site will start forwarding to Kitten’s at the end of April, 2025.

In May, automatic TLS certificate renewals for existing sites will start to fail.

(Kitten is the spritual successor to Site.js. Or think of Site.js as my first attempt at a Small Web server. I learned a lot while making it and a lot of the components I built for Site.js – like Auto Encrypt⁴, etc. – live on in Kitten.)

💕

¹ sitejs.org
² kitten.small-web.org
³ CC @gabek, @owncast: If Site.js is still listed as a way of installing Owncast, now would be a good time to remove that and to relay this to folks in the Owncast community 😀
⁴ codeberg.org/small-tech/auto-e…

#SiteJS #Kitten #Owncast #SmallWeb #SmallTech #announcement #notice

@small-tech/https version 5.3.0 released

• Uses Auto Encrypt 4.1.1 (removes OCSP stapling support because Let]s Encrypt has removed OCSP support).

npmjs.com/package/@small-tech/…

This module is a drop in replacement for Node HTTPS module that automatically handles TLS certificate provisioning and renewal both at localhost (via Auto Encrypt Localhost¹) and at hostname (via Auto Encrypt with Let’s Encrypt certificates²).

So, this is how you create a HTTPS server in Node.js that uses this module and automatically handles TLS certificate provisioning and renewal for you both at localhost (during development) and at hostname (during production):

```js
import https from '@small-tech/https'

const server = https.createServer((request, response) => {
response.end('Hello, world!')
})

server.listen(443, () => {
console.log(' 🎉 Server running at https://localhost.')
})
```

(Yes, that’s it! I wrote a metric shit-tonne of meticulously-tested code so you don’t have to.) 😀

💡 Note that the localhost certificate support via Auto Encrypt Localhost is 100% JavaScript and does NOT rely on an external binary like mkcert or certutil.

Needless to say, Kitten³ uses this module under the hood and it’s a big part of why Domain⁴ can deploy servers so easily that don’t require any day-to-day maintenance.

In case you’re wondering why I’m spending so much time releasing all these modules, it’s because I believe in sharing every brick of the house I’m building so others can easily build different houses if they want to. I’m not saying that what I’m building with Kitten, Domain, and Place⁵ will be the end all be all of the Small Web⁶ (the peer-to-peer web). And I want others to be able to experiment by building their own tools without having to go through the grueling development process I’ve had to in the past six years to build basic infrastructure.

Enjoy!

💕

¹ codeberg.org/small-tech/auto-e…
² codeberg.org/small-tech/auto-e…
³ kitten.small-web.org
⁴ codeberg.org/domain/app
⁵ codeberg.org/place/app
⁶ ar.al/2024/06/24/small-web-com…

#SmallWeb #SmallTech #AutoEncrypt #LetsEncrypt #localhost #TLS #SSL #HTTPS #Kitten #NodeJS #JavaScript #servers #web #dev #FOSS

Auto Encrypt version 4.1.0 released

• Removes OCSP stapling, as Let’s Encrypt is removing OCSP support.

If you’re already using Auto Encrypt upgrade before May or your certificate renewals will start to fail. Upgrade now if you want to get certificates for new domains as new certificate requests are already failing.

codeberg.org/small-tech/auto-e…

Auto Encrypt automatically provisions and renews Let’s Encrypt TLS certificates on Node.js https servers (including Kitten¹, Polka, Express.js, etc.)

Regular Node.js HTTPS server (without Let’s Encrypt certificates):

```js
import https from 'node:https'
const server = https.createServer(…)
```

Auto Encrypt https server with automatic Let’s Encrypt certificates:

```js
import AutoEncrypt from '@small-tech/auto-encrypt'
const server = AutoEncrypt.https.createServer(…)
```

(Certificates are provisioned on first hit and automatically renewed 30 days before expiry.)

¹ kitten.small-web.org

#AutoEncrypt #LetsEncrypt #TLS #SSL #HTTPS #NodeJS #JavaScript #servers #web #dev #SmallWeb #SmallTech #FOSS

Just released Node Pebble version 5.1.1

• Updated to Pebble version 2.7.0.

• Now also supports macOS and arm64 (because Pebble itself does).

codeberg.org/small-tech/node-p…

Node Pebble is a Node.js wrapper for Let’s Encrypt’s¹ Pebble² that:

• Downloads the correct Pebble binary for your platform.

• Launches and manages a single Pebble process.

• Returns a reference to the same process on future calls (safe to include in multiple unit tests where order of tests is undetermined)

• Automatically patches Node.js’s TLS module to accept Pebble server’s test certificate as well as its dynamically-generated root and intermediary CA certificates.

¹ letsencrypt.org

² “A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production certificate authority.” github.com/letsencrypt/pebble

#LetsEncrypt #TLS #SSL #HTTPS #NodeJS #npm #module #JavaScript #NodePebble #SmallWeb #SmallTech #web #dev

So I guess Let’s Encrypt has decided what I’ll be working on today then…

letsencrypt.org/2024/12/05/end…

(They’re ending OCSP stapling support. I’ll be updating Auto Encrypt¹ to remove OCSP support and then update @small-tech/https, which uses it, along with Auto Encrypt Localhost² to provide seamless TLS support regardless of whether you’re working in development or in production, and then update Site.js³ – deprecated but still used to serve some of our own sites at Small Technology Foundation⁴ – and Kitten⁵, with the latest @small-tech/https.)

¹ codeberg.org/small-tech/auto-e…
² codeberg.org/small-tech/auto-e…
³ codeberg.org/small-tech/https
⁴ small-tech.org
⁵ kitten.small-web.org

#SmallWeb #SmallTech #TLS #SSL #HTTPS #LetsEncrypt #OCSP #AutoEncrypt #AutoEncryptLocalhost #SiteJS #Kitten