Custom mini-client-apps

Waiting with bated breath to see what @mundmc was trying to post.

In the meantime, I have come to a few conclusions, based mostly on authentication credential handling. Specifically, there seems to be only one way to keep a password hidden.

• If I use the RESTful API directly, the credentials are contained right in the URL and are sent over the net in plain text.
• If I use the RESTFul API with digest authentication, I can hide the credentials over the net, but they are still in plain text in the Shortcut. And, the Shortcut is quite complex.
• Using Pythonista has the same problem, clear text in the python script, but encrypted on the net. However, it looks like there is a way to get a password from the keychain using the keychain module provided with Pythonista. One complication, it looks like Pythonista itself must store any passwords it will later retrieve. So, that will require a separate means to enter the password the first time.
• So, at least for now, that leaves @mundmc's SSH script method. This approach hides the password locally and over the net. The only downside is that it seems to operate a little more slowly. Probably because it must first establish the ssh connection and then execute the command.

For those who are interested, here is my version of @mundmc's shortcut with two additional steps which cause the shortcut to close and return to the home screen after operating. Note this requires the installation of the Launcher app. By the way, it would be possible to just execute the RESTFul URL directly with launcher. But, then you are back to having the password in clear text locally and on the net.

IMG_A50E5A506EC4-1.jpeg (184.67 KiB) Viewed 1916 times

• If I use the RESTful API directly, the credentials are contained right in the URL and are sent over the net in plain text.
• If I use the RESTFul API with digest authentication, I can hide the credentials over the net, but they are still in plain text in the Shortcut. And, the Shortcut is quite complex.

Actually, even with "basic" authentication, the credentials are base-64 encoded when sent over the net, so they're not in plain text. But they're not encrypted either. They're also not in the URL, but in the request header. The placement in the URL in the browser or client is purely a convenience for the user. They're stripped and placed in the request header as part of the HTTP protocol.

Waiting with bated breath to see what @mundmc was trying to post.

It was this:

Code: Select all

http://emoji.tapatalk-cdn.com/emoji2938.png

...It was this:

Code: Select all

http://emoji.tapatalk-cdn.com/emoji2938.png

Closer. But, in safari, that url results in

Code: Select all

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>C488256B94385B9E</RequestId>
<HostId>
t4hQUHv6k5mmIojgHgPTbTv04Ao7zmzJ0wcnaRjz4Tpi96g6OO6rE953Mj5f8CR6AP9lAFvu2TY=
</HostId>
</Error>

Why Tapatalk isn't serving the emoji image, I have no idea!

Why Tapatalk isn't serving the emoji image, I have no idea!

Well, thanks for trying. You can go back to your milk

Unknown.jpg (6.72 KiB) Viewed 1891 times

Waiting with bated breath to see what @mundmc was trying to post.

It was this:

Code: Select all

http://emoji.tapatalk-cdn.com/emoji2938.png

I was TRYING to post this:

Code: Select all

http://iCannotTellIfTapatalkIsScrewedUp.or?itIsMyOwnIncomptence&dammit