iiinova — where your digital self keeps evolving

Thibault @thibmeu.com · 28/11/2025

all French. Might be worth some hackathon time over back and forth on bsky. If the code is public, happy to check some time this weekend.

300

Thibault @thibmeu.com · 05/06/2025

From where I'm standing, it looks close enough

Cliff, sea, sun, in the south of France. Vertical photo

020

Thibault @thibmeu.com · 15/05/2025

Compatibility with existing web The good thing: it works today. We provide examples with a Chrome extension, a Caddy plugin, and a Cloudflare Workers. With a few lines of JS, your bot/website is ready to go. All is on GitHub github.com/cloudflarere...

$import { signatureHeaders } from "web-bot-auth" const request = new URL(details.url); const created = new Date(); const expired = new Date(created.getTime() + 300_000) // Perform request signature const headers = signatureHeaders( request, new Ed25519Signer(jwk), { created, expires } );$

120

Thibault @thibmeu.com · 15/05/2025

How does it work One proposed solution relies on HTTP Message Signatures (RFC 9421). Bots sign the host of the request they are making, add a validity window, and send the signature with the request. See the demo http-message-signatures-example.research.cloudflare.com.

$GET /path/to/resource Signature: abc== Signature-Input: sig=(@authority signature-agent); \ created=1700000000; \ expires=1700011111; \ keyid=ba3e64==; \ tag=web-bot-auth Signature-Agent: signer.example.com$

110

Thibault @thibmeu.com · 26/04/2025

There is the "technical should be hidden" team, and there is @porkbun.com suggesting you go implement TOTP RFC 6238. Love it

Build Your Own - RFC 6238
Taken from porkbun account page when setting up TOTP

010

Thibault @thibmeu.com · 21/03/2025

Not sure if the above gif renders with bluesky. The same as a video, still generated by VHS. Part of why it's awesome.

000

Thibault @thibmeu.com · 21/03/2025

Sneak peak at the demo, validating WhatsApp Key Transparency using Plexi github.com/cloudflare/p...

Gif demonstrating usage of Plexi
It says

Hello RWC!
Let's make a demo

It installs plexi
List all auditted logs
Audit the latest epoch from WhatsApp

100

Thibault @thibmeu.com · 16/01/2025

From what I see in my day to day experience, I'd say mostly big players. Datadome publishes this quadrant. At the same time, captcha providers don't place captcha on website. Website owner do. This vaan be for anyone using a VPN to anyone making a payment. How they are used would be interesting.

110

Thibault @thibmeu.com · 22/12/2024

That works well indeed. Thanks!

020