I’ve made an app that makes it possible to schedule a post in Lemmy at an arbitrary time. It’s available at https://schedule.lemmings.world and can be used by people from any instance.
Let me know what you think!
P.S. This post is made using the app!
Edit: And it’s open source!
You must log in or register to comment.
How does it work? Can I trust this website?
I wouldn’t trust a website that wants your username and password.
Use a bot account to post if you are worried
I would if it was a bot instead of an obscure service that collects my credentials.
How is that different from any other Lemmy client though?
With a mobile client, for example, you can check if it sends your password somewhere else, there are tools. If you use an open-source client then it’s even easier. Major clients have something that you could call reputation, though I wouldn’t put too much trust into it.
Here I know for a fact that my password goes to a third-party:
I don’t store your password if that’s what you’re asking! I’m planning to make it open source once I make sure I didn’t accidentally leave any production secrets in the code.
Anyway, here’s how it works:
- You log in using your account, the site checks whether it’s a valid account using api and if it is, it creates a JWT token that’s used to authenticate you against Lemmy. At this point your password is already forgotten and the site has no way of getting it.
- The JWT token is effectively the same as having your password - it allows you to do the same things you could if you have logged in normally.
- The JWT token is not stored on the server, it’s only in a cookie in your browser.
- When you schedule a post, the post details, your instance, your username and your JWT token are stored in a job that gets scheduled to run later. This is the only part where any sensitive information (JWT) about you are stored somewhere else than your computer.
- After the scheduled job is triggered, it authenticates as you and creates the post as if it were you, immediately afterwards the job config is deleted, meaning the JWT is no longer stored.
- The JWT is stored in every scheduled post you make, meaning as long as you have any scheduled post, the JWT is stored somewhere. When all scheduled posts are posted, your JWT is no longer present anywhere on the backend.
- Note that due to current technical limitations, even if you cancel a scheduled job, its config (including the JWT) is stored until the original scheduled time. This will be (probably) fixed in future versions when I have some time to work on it.
Hope it clarifies it, let me know if you don’t understand any part of it!
deleted by creator
Yup, that’s right. I don’t do that, though. Which obviously you’ll have to trust me on (or don’t and don’t use it). It has been open sourced now, but that still doesn’t solve it and I’m obviously not gonna go and give people production access to my AWS account.
I’m not saying you must use it, I’m just giving it here in case anyone wants to.
deleted by creator
Do you have a recommendation for how OP can change things so you’re satisfied with your privacy?
deleted by creator
Dude, I literally develop stuff all the time and have dozens of open source projects. Why the hell do you think I have the need for collecting your credentials? Use a fake account for all I care, the code is open source and you can read it.
JWT token is not stored on the server
JWT token are stored in a job that gets scheduled to run later
Where’s the job stored?
In a scheduling system. Probably bad wording on my part, sorry. I meant that it’s not stored anywhere for just logging in, though it’s stored as part of every scheduling job in the scheduling system.
- You log in using your account, the site checks whether it’s a valid account using api and if it is, it creates a JWT token that’s used to authenticate you against Lemmy. At this point your password is already forgotten and the site has no way of getting it.
What’s the usecase?
I think it would be useful to automate the posts for discussions following from the broadcast of a TV show, or a sports game.
I used it for example to post this very post at a time when people from US are most likely to engage (though I’m not sure if the Lemmy demographics is predominantly US, but my gut feeling is it is).
That’s great, thank you for this!
No problem, glad I could be of service!
As a side comment, I see that the very aggressive comments from earlier have been removed, thank you mods for your work!
Interesting.
I suppose the only thing is that you wouldn’t be able to upload an image to the instance as part of a post - you’d have to upload it somewhere else first, to then be able to refer to it.
For the detractors, register a throwaway account at some random instance, and use that if you want to test it out.
If you’re able to properly pore through the source to check it’s not stealing anything, then you’re capable of scheduling your own posts. The Lemmy API is very simple, it’s not rocket science.I suppose the only thing is that you wouldn’t be able to upload an image to the instance as part of a post
It would be possible but it would add more complexity, more costs etc. I’ll probably tackle the problem when I have time, but now I’m glad that I have a version that I can use working.
If you’re able to properly pore through the source to check
I even pointed out some interesting parts regarding this in the README.
I think this is a cool idea. Like others, I would love a self-hosted and open source version to make sure there isn’t any funny business.
It is open source! https://github.com/RikudouSage/LemmySchedule
Self-hosting is possible, though I don’t have a direct support for that right now, you would have to figure it out yourself (it’s not hard if you know how to work with the Symfony framework).
Awesome! I’m just starting my workday now, but I could take a look to see if I could put it in a docker container if you would like. I would have to do it after work, which means I probably won’t make significant progress until the weekend.
That would actually be great! Feel free to contact me if you need some pointers.
kind of a pet peeve of mine: you should make the `` of the page something that can be found in bookmarks and history. Right now it is “Log in”.
It’s minor but in 3 months when I vaguely recall having seen this somewhere and want to use it, I will never find it.
Good idea, done!
Nice idea!
I get an error when logging in (lemm.ee):
The server returned a “500 Internal Server Error”.
I’ll make an account there tomorrow and try it out.
What about posting images?
On the todo list, not very urgent, though. Currently you can upload the image somewhere that allows direct link grabbing and put the direct link into the URL field. I use imgur for that.
Nice. Thanks :)
deleted by creator
Fediverse has made me click on so many weird links that could possibly be phishing links. I give Lemmy instance links to other people and they say it might be a scam phishing link as well and I kind of get their point.
Don’t worry about them, it’s open source: https://github.com/RikudouSage/LemmySchedule
deleted by creator
deleted by creator
What’s a “local version of this”?
As a side note, have you considered actually being nice to people?
This level of negativity is insane. Sorry you have to go through that.
Not my first rodeo with releasing software, there are always people like that.
deleted by creator
I totally get your demands and they’re fine with me! What I don’t particularly enjoy is being told to “GTFO”.
deleted by creator
Just stop, please. You told me to GTFO and I don’t like it. Learn to communicate, please. Yes, I’m super, super defensive when someone tells me to fuck off.
