Your idea has been implemented as datapods: https://www.capitalnumbers.com/blog/data-pod-decentralized-d...

It seems dead though...

You can use https://mapcomplete.org/surveillance to delete the cameras from OSM

If you spot missing camera's - Flock or not - you can add them to OSM easily with https://mapcomplete.org/surveillance

Everydoor's UI is also quite nice for this. it even lets you enter in the orientation quite easily

https://every-door.app/

https://github.com/Zverik/every_door

There's also a application called deflock that lets you map them easy

Yes, that's the submission we're commenting on ;)

Haha. I meant an Android application. The website doesn't let you submit. The app makes it easy to submit.

Stupid question, but CORS is designed explicitly to defend against this type of side-surf attack. Adding a strict cors policy should fix this, or am I missing something?

Not here, though. The exact code:

  fetch("https://gyrovague.com/?s="+Math.random().toString(36).substring(2,3+Math.random()*8),{ referrerPolicy:"no-referrer",mode:"no-cors" });

"no-cors" means the request will not be preflighted, but also that JS will be denied access to the body. But the body doesn't matter here — the attack only requires the request be sent.

But more to the point, so long as the request meets the requirements of a "simple request", CORS won't preflight it. GETs qualify as a simple request so long as no non-CORS-safelisted headers are sent; since the sent headers are attacker-controlled, we can just assume that to be the case. In a non-preflighted request, the CORS "yes, let JS do this" are just on the response headers of the actual request itself.

Since GETs are idempotent, the browser assumes it safe to make the request. CORS could/would be used to deny JS access to the response.

Things are this way b/c there are, essentially, a myriad of other ways to make the same request. E.g.,

  <img src="https://gyrovague.com/?s=…">

in the document would, for all intents and purposes, emit the same request, and browsers can't ban such requests, or at least, such a ban would be huge breaking change in browsers.

OpenStreetMap also gathers tree data: https://mapcomplete.org/trees

We're around 31M trees now

OpenStreetMap has ski trails. OsmAnd even has a ski routing engine. Also checkout https://mapcomplete.org/ski

Quick plug for https://pistepal.app/ - that's my own contribution to the space. Features location sharing and nav/directions, and priced lower than the competition yet with perhaps a richer / more focussed feature set. Interested to hear feedback and ideas!

We do take down a lot of old buildings (or renovate them thoroughly) cause the old buildings contain asbestos, are not properly isolated, ...

My forgejo-server ran on a broken fiber for a few weeks - we're talking about speeds in the single kilobits/s. It kept up fairly well!

Pushes and pulls would still kinda work, actions not so much (but that's cause it needed to transfer more then 100MB)

Even better: if the build is reproducable, it guarantees that the source code of the repo is the same as the version that is distributed by FDroid.

Wait, what? Please don't do that, use mangrove.reviews instead please. They use clear CC-BY-SA licenses; MapComplete.org uses it

Bluesky _will_ enshittify sooner or later

Mangrove has almost nothing in its DB, no news for years, and a broken website.

Better go with my own DB.

Or use a network with a well-designed protocol, a hosted service, 30 million users, a social graph, moderation...

Except that it got around 2.9K reviews by now, which is more then you have right now. Furthermore, we shouldn't further fragment the few open source review efforts we have.

Many OSM apps will also be reluctant to adopt a closed source solution that might be closed of any moment. And under what licenses will those reviews be? As MapComplete developer, I can not and will not be adopting a system based on Bluesky

The idea of fragmentation depends on a model of decentralization that still makes the platform inseparable from the data it works with. AT separates concerns so that the priorities of your data host and the priorities of your platform host can conflict without one being able to control the other even if you don't self-host. All the reviews are just an entry in your PDS, so it's all there for any new or existing platform.

Thousands of people have already set up their own PDSes and it's inevitable managed hosts will appear soon. Blacksky just started migrating people over to its own PDS. AT's credible exit is close to reality after about two years while all the promise of ActivityPub and predecessor protocols has yet to materialize after over 15 years.

> Many OSM apps will also be reluctant to adopt a closed source solution that might be closed of any moment.

Bluesky is not closed-source, it's mostly open. It's a hard mastodon-circle myth. Aside from being open-source, it's a protocol.

What I'm doing with Bluesky should be easy to reproduce with Mastodon, opening to 10 M accounts more.

People won't create an account to review. Not even a OSM account. We need to build on what's available, and ATProto is spot-on for this usage.

Also, to my knowledge, Mangroves does not provide photo upload. Panoramax is the way to for outdoor pictures, but not for inside.