Why Spanish tools are often ignored by French teams?

[arbocenc]

@poka

Why assume that if we highlight a particular tool, it’s for racial, ethnic, or national reasons? That’s ridiculous, don’t you think?

Yes, @poka , I think it IS ridiculous. Maybe national reasons are not the reasons, maybe just tech. preferences. Maybe developer egos…

But you, as Gecko developer (main developer? project leader?) are on your right to prefer girala.net or Gchange, or Gecko vs Superbot, etc.

BUT, when the community tools like the French Forum or Telegram Channels (in minor part, because their fragmentation) endorse one wallet / marketplace and just FORGET the others, users can not choose following their preferences because they don’t know about alternatives!!!

Take a look at these messages of a French user, from a French Telegram group:

EN : Yes and i desagree the french communication about the différents applications. I often asked « Why french doesn’t show the whole applications to let the user choose the application he like best at least ? »
I was desapointed because at the begining of V2, The communication was always for gecko at first. But, as i used G1nkgo already in v1, i knew this application is well made, and easy to used.
The same for G1bot which is nearly absolutly unk’own in France. Just the french which had going in Spain know it.

FR : oui, j’ai remarqué et je ne suis pas d’accord avec cette façon de communiquer. J’ai souvent demandé pourquoi on ne présentait pas toutes les applications pour laisser le choix aux utilisateurs plutôt que nous choisissions pour lui ? » j’étais ennuyé car au lancement de la V2, la communication mettait toujours en avant Gecko alors que moi qui utilisait G1nkgo depuis la V1, je savais que c’était un outils qui valait la peine de le faire connaître.
Idem pour les paiements par G1bot qui sont presque totalement inconnus en France sauf de quelques uns.

and

L’utilisateur ne peut pas faire de remontée si on ne lui propose pas toutes les applications et si c’est toujours la même qui est mise en avant, voir une communication qui dit qu’une seule application fonctionne bien comme j’ai vu.
C’est aux communiquants de présenter de façon équitable pour que l’utilisateur puisse faire son choix (un peu comme en politique, celui qui a le plus de média et celui qui est élu)

About the example with girala.net and Drupal. Or the tech. used by Gecko, Gchange, Superbot, Cesium, etc. Aren’t they useful tools?? Haven’t they their strong points, their adventages (and weakeness / disadventages)?? Then? What’s the matter about your preferences or my preferences??? When giving information to the community, we just should list ALL them!! (except a good reason to not do it, for example not open source, etc.). Like here: Matrix.org - Clients

For example, Poka, when Superbot wallet appears, a new alternative! we all, at Spanish community, specially between “promotors” are happy!! Because it has strong points vs Cesium (but Cesium has still strong points, just depending of your user case, user profile, user preferences). So we spread the word and, since then, list Superbot besides Cesium. And the same when Ginkgo was released.

But, meanwhile, French community (most of it, even now!!) haven’t hear about Superbot. How the hell is it possible??

That’s what I’m talking about,

I’m not very interested in ridiculous nationalism nor chovinism. I bet here in Spain people know about Gecko more than French know about Superbot. Where are then the ridiculous situation??

PS about the screenshot: it’s just a TAGS list. The post talk about software mostly unknown at France, so G1nko and girala.net are examples…

An example, outdated, when v2 doesn’t exist, the Catalan website tools section:

Eines | Moneda Lliure G1

You have Cesium, and also the other 2 existant wallets, Superbot and G1nkgo.

You have Gchange and Airb’n’june (2 French projects) and Girala.net

Is it enough clear? I suspect it is not for you, but I hope it is for some

[poka]

I’m really looking forward to hearing @kapis’ thoughts on this on how arbocenc is pitting France against Spain and turning them against each other. What do you think?

Given how we’ve been able to work together for years?

Back when there weren’t any developers in the Spanish Junist community yet, which is why I set up and hosted the Spanish forum, and continue to do so, and we helped the community create the moneda-libre website at their request, and we’ve always been there for them. And I still host thses 2 tools for you!! All the feedback I’ve provided on g1Superbot since its early days. I appreciate it, but I still consider it a centralized solution,n not on the same level as a decentralized, trustless solution, though I do find the service excellent.

I have no problem praising the merits of G1Superbot, and honestly, I would list it on the Gecko website if it were a decentralized solution that didn’t require trusting a third party to manage our private keys for us.
In fact, I believe cryptographic solutions exist to help G1Superbot evolve, allowing users to delegate control of a key without actually handing over the private key.

But that’s a topic that can only be resolved through technical discussions, free from any personal feelings or emotions.

We all have our own lives, Kimamila, Vicente, and myself included; everyone, in fact. I don’t see why I should put one person’s situation on a pedestal compared to another’s.
What exactly is the point of all this maneuvering?
Why don’t you address the specific technical objections and stop sidestepping everything that bothers you, instead of pitting people against each other?

None of this bodes well for the future.

---

@arbocenc

An example, outdated, when v2 doesn’t exist, the Catalan website tools section:

Eines | Moneda Lliure G1

Am I crying because Gecko isn’t listed there? Seriously? Outdated? …

---

@elois already answer to you, all your tools are already listed here from day one: Duniter | Software !

So what’s the point??
What is the purpose of this thread if not to pit different cultures against each other?

We never did this here, never. You did. Bravo.

[arbocenc]

What’s the point? Poka, read it again. They are not my words, but the words a French member I don’t never speak with:

@arbocenc

EN : Yes and i desagree the french communication about the différents applications. I often asked « Why french doesn’t show the whole applications to let the user choose the application he like best at least ? »
I was desapointed because at the begining of V2, The communication was always for gecko at first. But, as i used G1nkgo already in v1, i knew this application is well made, and easy to used.
The same for G1bot which is nearly absolutly unk’own in France. Just the french which had going in Spain know it.

FR : oui, j’ai remarqué et je ne suis pas d’accord avec cette façon de communiquer. J’ai souvent demandé pourquoi on ne présentait pas toutes les applications pour laisser le choix aux utilisateurs plutôt que nous choisissions pour lui ? » j’étais ennuyé car au lancement de la V2, la communication mettait toujours en avant Gecko alors que moi qui utilisait G1nkgo depuis la V1, je savais que c’était un outils qui valait la peine de le faire connaître.
Idem pour les paiements par G1bot qui sont presque totalement inconnus en France sauf de quelques uns.

and

L’utilisateur ne peut pas faire de remontée si on ne lui propose pas toutes les applications et si c’est toujours la même qui est mise en avant, voir une communication qui dit qu’une seule application fonctionne bien comme j’ai vu.
C’est aux communiquants de présenter de façon équitable pour que l’utilisateur puisse faire son choix (un peu comme en politique, celui qui a le plus de média et celui qui est élu)

Is it not clear for you? “Si cal que t’ho expliqui perquè ho entenguis, per més que t’ho expliqui, no ho entendràs”

PD the Catalan website is outdated (last edited at 2024), when Gecko is not released. Come on Poka, don’t cheat us

I’ve finished about it. If you understand from me the point is Spaniards vs French genetic aptitudes, I’m sorry about it

I really don’t know why the situation is like the quote above. I prefer don’t speculate about it. I will be happy if in the future the French promotors do the best for non-French projects are as well known by the community as French projecxts like Gecko are at Spain, for example

[poka]

@arbocenc

I’ve finished about it. If you understand from me the point is Spaniards vs French genetic aptitudes, I’m sorry about it

Nope. That’s not the point.

And that’s not at all what you explain in your blog post. So you’re going to have to be very clear about your intentions.

You claim that there’s a conspiracy among the French to avoid talking about Spanish tools. Is that really what you mean?

But I’ll say it again: that’s absurd and untrue.
There are tons of French tools that I haven’t listed on the Gecko website. So at this rate, what conclusion do you draw? That there’s discrimination against Spanish tools, PLUS certain French ones? Is that right?

And once again, for heaven’s sake, you’ve never once mentioned the fact that your tools are indeed listed on the Duniter website, as well as in the v2 update announcement! Ginkgo was listed everywhere, despite the fact that this tool isn’t secure because it doesn’t prompt users to enter their recovery phrases for member accounts. And this point is not new, we said that tones of time. It’s a deliberate choice.

Despite that, since it was popular, we listed it on the same level as Gecko and everything else, the v2 update committee can attest to that. So I’ll say it again, and you’re not going to get away with this after all these false accusations: What is the point of this whole circus?

[vjrj]

Talking about circus and accusations:

@poka

this tool isn’t secure because it doesn’t prompt users to enter their recovery phrases for member accounts

“This is false” says Claude (Opus 5):

Translated from its Spanish response:

In Ğ1nkgo, you cannot be a member with an unprotected account. In contact_page.dart:192, Web of Trust actions—certifying, renewing, creating an identity, and confirming it—are only available if isPassProtected is true. If the account is v2PasswordLess, a single entry appears instead: “To use identity features, your account must be protected with a pattern or password.” Upon upgrading to a protected state, the mnemonic is stored in encrypted form (shared_prefs_helper_v2.dart:693), isLocked() begins returning true, and signing operations go through walletAuth, which requires unlocking or biometric authentication. Additionally, there is a time-based re-locking mechanism when returning from the background (main.dart:1583).

Good night, have fun.

[elois]

@arbocenc

I’ve written a little post in the girala.net blog about this topic:

Thanks @arbocenc for sharing your concerns with us and for trying to improve the situation.

I read your post on girala.net, and I want to respond to this part:

@arbocenc

Et cela n’enlève rien au fait qu’il y a beaucoup de développeurs, en fait la majorité, qui n’ont pas eu cette attitude […]. Je dirais que c’est plutôt un groupe très réduit de développeurs et, peut-être plus grand, de promoteurs de la G1 en France où cette attitude s’est manifestée.

From what I can see, I get the impression that this is only Poka’s position. It seems to be more of an issue with the way he communicates, as well as with some of his criteria, which do not appear to be shared by the other French developers or by me.

I believe @poka is right about a few things, especially the security issues regarding Ğ1nkgo. But that doesn’t justify the way he speaks, nor does it excuse his behavior regarding everything else.

Regarding Girala, I see no reason not to mention it on official websites such as duniter.org. A merge request on the website repository to add Girala is more than welcome: https://git.duniter.org/websites/duniter-website-en-v2. We’ll be happy to merge it if everything looks good.

@vjrj

Is Girala left off the list because of some unknown security issue?

No, it’s not. Girala was not mentioned simply because nobody took the time to add it to the websites, as almost nobody maintains them. It’s more of a maintenance issue on our side.

EDIT:

@vjrj I opened an issue on the Ğ1nkgo repository to explain our concerns about the recovery phrase and suggest how to fix them:

Verificar la frase de recuperación antes de unirse a la WoT / Verify recovery...

[poka]

@elois

I get the impression that this is only Poka’s position

@elois

I believe @poka is right about a few things, especially the security issues regarding Ğ1nkgo. But that doesn’t justify the way he speaks, nor does it excuse his behavior regarding everything else.

Ahaha

I’m really looking forward to seeing how this conversation unfolds, it promises to be truly exciting.

You’re going to have to start pointing out specific problematic statements I’ve made; otherwise, these would be baseless accusations, just a vague impression, and I’m sure that’s not your style.
I mean, what could justify such a strong reaction, proportionally speaking.

And you’re going to have to explain why my actions alone warrant such a strong reaction that it reflects on an entire nation. Thank you.

Is it because I’m the only one who says the important things, even if they’re uncomfortable? If so, I accept that role because it’s necessary.

Please don’t tell me it’s just a matter of form. It’s simply a matter of saying things, or not saying them.

While always sticking to the facts. Remember, we’re on a technical forum.

To be honest, I’m quite flattered, but that’s too much praise for me.
Let’s go !

[vjrj]

@elois

I opened an issue on the Ğ1nkgo repository to explain our concerns about the recovery phrase and suggest how to fix them:

Thanks indeed for filling the issue @elois. As the issue itself describes, it’s a “Minimal proposed change”. In fact, I was expecting some feedback like this at some point, given that in the past Cesium1 used to ask questions about the G1 license, etc. and G1nkgo is not doing it. I’ll put attention.

Returning to the topic, a simple example:

SSO has been supported by G1nkgo for a month now, just a few days after Gecko added it. This happened because @Chiara07 requested it on the G1nkgo telegram french channel and shared the main thread with me; otherwise, I still wouldn’t even know it existed (thanks indeed @Chiara07, quite collaborative, and respectful too).

Yet, as the days go by, I still don’t see a “Log in with your wallet” option anywhere that would allow for integration with Cesium, Gecko, G1nkgo, or whatever else. I only read Gecko.

Is there some security issue in G1nkgo SSO auth I’m unaware of that prevents this from being displayed across the sites starting to support it?

jiyujin:

https://forum.monnaie-libre.fr:

You might tell me to just submit a Merge Request or an issue to this or that repository, but that is exactly what @arbocenc is complaining about.

And honestly, something smells rotten in Denmark when things like this keep happens (and not only with Spanish tools, also we can include Cesium2 here), and when people reply like this or write in bold false security accusations about G1nkgo.

BTW I didn’t asked to add G1nkgo to Duniter | Software . It was kindly added 3 years ago by Hugo.

And here we are discusing about small things (links, buttons, etc) instead of pushing to the same direction or goal in a respetful way and without cancelations.

[poka]

@vjrj

Is there some security issue in G1nkgo SSO auth I’m unaware of that prevents this from being displayed across the sites starting to support it?

No, none at all, since you prompted Claude to precisely replicate the documentation I set up for that purpose, which I publicly announced on the Duniter forum, as you point out, without any conspiracy. It’s not my responsibility to go knocking on the doors of every wallet developer to suggest they implement the latest protocol I’ve just proposed.

Because we all have a current life and family situation, childrens, ect

I think my approach is completely clear:

@poka

Le repo contient des docs utiles que j’ai fait traduire en français et en anglais pour que ce soit accessible.

Hormis le protocole en lui-même, l’une des docs qui devrait le plus vous intéresser est celle qui explique comment intégrer cette fonctionnalité dans votre app wallet Ğ1 via le schéma deeplink g1://sso-login : Making sure you're not a bot!

But in terms of intent, instead of continuing to copy what the lib durt2 does (I saw your commits, me), you could very well have started working on integrating it into G1kngo, and even contributed to it to meet G1kngo’s specific needs, provided feedback, and helped me.

That would have allowed us to

@vjrj

pushing to the same direction or goal in a respetful way and without cancelations.

And to work together, hand in hand, with joy, respect, and good cheer.

---

Once G1kgo has demonstrated that it addresses the security vulnerabilities that have been reported since the beginning, then we can consider including it among the various SSO tools.

But in any case, it already works, the links are in the g1// format, which isn’t specific to Gecko; it’s just a matter of updating the display.

And people which ask my by MP about anything, I answer without any problem, whether you’re French, Spanish, or Pakistani…

@fdrubigny

Est-ce que tu peux me confirmer les informations nécessaires et, une fois que nous aurons défini le callback, enregistrer le client ?

@poka

Salut,

C’est enregistré, le service tourne déjà avec ton client.

Garde ce secret dans la config serveur de Jiyūjin et nulle part ailleurs : il ne doit pas se retrouver sur un fil public, dans un dépôt git ou dans du code qui part au navigateur. Si jamais il fuite, dis-le moi, je t’en génère un autre.

https://jiyujin.g1.lu sert de lien « retour au site » sur la page d’approbation, et Jiyūjin est maintenant listé sur la page d’accueil de connect.monnaie-libre.fr.

Les trois endpoints :

autorisation : https://connect.monnaie-libre.fr/oauth/authorize
token        : https://connect.monnaie-libre.fr/oauth/token     (POST)
userinfo     : https://connect.monnaie-libre.fr/oauth/userinfo  (GET ou POST)

Quelques points à garder en tête côté backend :

La redirect_uri est comparée octet pour octet, à l’autorisation comme à l’étape token où tu dois répéter la même valeur. Aucun joker, aucune tolérance sur le slash final, https uniquement. Si tu veux aussi une URL de staging, donne-la moi et je l’ajoute à la même entrée.

Il n’y a pas de PKCE : l’authentification au token se fait avec le secret, en en-tête Authorization: Basic ou en champs de formulaire client_id et client_secret, les deux sont lus. Envoie un state aléatoire lié à la session du visiteur et vérifie-le au retour, c’est ta protection contre un callback forgé.

userinfo ne renvoie aucune adresse e-mail. Accroche le compte Jiyūjin sur le champ id (idty:<index>), qui survit à un changement de clé de portefeuille. username est le nom d’identité Ğ1, très bien pour l’affichage et comme pseudo par défaut, il ne constitue pas une clé de compte.

L’instance applique la politique « membres de la toile de confiance ». Un portefeuille sans identité membre est refusé après que l’utilisateur a approuvé dans son portefeuille, donc annonce-le sur ta page de connexion pour que personne ne le découvre à la dernière étape.

Les durées : le code d’autorisation vit 120 secondes et est détruit au premier usage, l’access token 300 secondes, et il n’y a pas de refresh token. La session qui suit est la tienne, à tes conditions.

Le reste des détails (erreurs, limites de débit, exemples) est dans docs/fr/SITE-INTEGRATION.md. Fais signe quand ton flux tourne, je testerai une connexion de mon côté.

Bon courage sur Jiyūjin.

@fdrubigny

Le système est en place !
Les premiers tests sont concluant, mais j’attends encore le retour des premiers utilisateurs membres certifiés…
Ensuite, je supprimerais la possibilité de se connecter via phrase mnémotechnique qui est une erreur de sécurité de ma part même si le serveur et le navigateur ne garde pas la phrase…

Tu peux tester la connexion sur Jiyūjin, petites annonces en Ğ1

Merci pour ce travail que tu as fais avec Ğ1 SSO, c’est le top !

@poka

Oui je me suis inscrit avec Gecko et ça fonctionne

Il faut juste que je change les wording sur l’écran qui s’affiche dans gecko pour ne plus préciser forum monnaie libre, mais récupérer le nom du service en question.

So many baseless accusations here…

---

@vjrj

And here we are discusing about small things (links, buttons, etc)

Reminder: YOU started this thread by immediately accusing the French of plotting against the Spanish. It wasn’t me, nor was it anyone else.
So it’s up to you to justify this approach, instead of simply opening up new issues or politely asking what the problem is if we see a communication issue, without making such accusations right off the bat.

So we need to stop shifting the burden of proof. I didn’t ask for anything in the first place, you’re the ones attacking. That seems pretty clear to me. I’m just defending myself, but I shouldn’t be the only one, given that you’re accusing the entire French community.

---

So please, start by apologizing for such accusations like a responsible person, admit that you were wrong about the intent, and then we can probably start over on a healthy footing.

[elois]

@vjrj

jiyujin:

@vjrj

You might tell me to just submit a Merge Request or an issue to this or that repository, but that is exactly what @arbocenc is complaining about.

I opened an issue on the jiyujin repo so you don’t have to: https://git.duniter.org/marketplace/jiyujin/-/work_items/1

@fdrubigny, peux-tu regarder ce ticket ? Merci d’avance

[fdrubigny]

Salut,
je viens de lire ton issue, effectivement ce n’est pas clair que l’on peut aussi utiliser G1nkgo pour se connecter…
Je suis pas mal occupé sur un projet personnel (il faut que je mange aussi) mais j’essaie d’apporter ces modifications rapidement, peut-être Dimanche.
Merci de m’avoir notifié.
Belle fin de journée.
PS : je ne lis pas ce sujet en entier car je ne parle pas Anglais ni Espagnol…

[HugoTrentesaux]

@elois

G1nkgo and the Telegram Superbot are properly mentioned on the official Duniter website: Duniter | Software

Regarding Girala, IIRC, the issue was that we asked for Girala’s source code and never received an answer.

Ok, I’ll add https://codeberg.org/calbasi/girala.net to the software list.

@arbocenc

and Superbot is not under maintenace, it could be altogether with the other “mature” wallets

I’ll add it too.

@arbocenc

I’ve written a little post in the girala.net blog about this topic:

You take time to write a blog post but not to make a merge request on Duniter websites to add Girala to the list? It’s as simple as a markdown file matching this template: https://git.duniter.org/websites/duniter_website_fr_v2/-/blob/master/content/logiciels/TEMPLATE.md.

---

The rest of this topic isn’t really helping much

[poka]

Yes, I think we can close this topic, it’s pointless.

[poka]

Good job!
I move your message in new topic about it, and close this one because it’s a new subject.

[vjrj]

Don’t break threads, please.

[poka]

I didn’t break the thread, is it ok for you?
As we discuss in private staff section, we can close this actual topic.

[vjrj]

No. It’s not ok for me. You ocult the fix.

You have one job, and It’s not this.

[italpaola]

Bonjour @arbocenc
Je comprends que tu souhaites que le site Merchants and proffesionals who offer services in free currency | Ğirala.net soit mieux référencé, et c’est tout à fait un point qui peut être discuté (sur un nouveau topic ?).

En revanche, les généralisations sur les « équipes françaises » et la référence à un « pattern » donnent au sujet une dimension de reproche qui n’est pas nécessaire. Une simple demande pour ajouter Girala au site aurait permis de poser directement le problème.

Plusieurs réponses apportées dans ce topic, notamment celles d’Elois aux messages 4 et 7 et suivants, apportent des éléments concrets sur les choix techniques et les critères de référencement. Je pense qu’il est préférable de revenir à ces éléments plutôt que de généraliser.

Je ne pense pas qu’il soit pertinent d’interpréter ces différences de référencement comme une discrimination volontaire des outils espagnols. La communauté est internationale et fonctionne largement grâce au travail bénévole des personnes qui n’ont pas toujours le temps ou les informations nécessaires pour tout mettre à jour (et j’en fais partie !)

Le plus important est donc de rester sur les faits : quels outils doivent être référencés, où, et selon quels critères communs.

Pour cette raison, je pense qu’il serait préférable de modifier le titre du topic afin qu’il ne présente pas comme un fait établi - alors qu’il s’agit d’une interprétation subjective - que « les équipes françaises ignorent les outils espagnols ». Cela permettrait de recentrer la discussion sur des critères vérifiables, sans opposer les communautés entre elles.

Merci pour ton intervention et pour le travail réalisé autour de Girala. J’apprécie les discussions constructives et respectueuses entre développeurs et utilisateurs de la Monnaie Libre. Et je peux t’assurer que je passe du temps à diffuser tous les outils/contenus/projets/… de la Ğ1

Désolée, je ne parle ni anglais ni catalan : please you can translate with IA. Je ne le mets pas ici pour ne pas alourdir le topic.

Edit : peut-on rajouter ton nom donc pour girala sur ce post ?