Skip to content
Diazoma

Security and privacy

Where the wall runs

Section titled “Where the wall runs”

The wall runs in the visitor’s browser. It reads your pages or your feed from there. Diazoma does not crawl the web, does not host third-party content and does not keep a copy of anyone’s pictures. The demo is a static site with no server code.

Saying no: policy: deny

Section titled “Saying no: policy: deny”
{ "version": 1, "policy": "deny", "feeds": [{ "id": "x", "url": "/x" }] }

With policy: "deny" in /.well-known/wall.json, programs must not build a wall for your origin. WellKnownAdapter makes page() reject with policy-denied, and the embed script stops. With recipes-only, only the recipe you publish yourself in recipe may be used.

A recipe never applies outside its match patterns, and the adapter refuses to run for a URL outside them.

What a program does with your data

Section titled “What a program does with your data”

A program that reads a feed, a manifest or annotations must treat them as untrusted input.

  • link, image, image_focus, image_full and video are http(s) URLs or relative references. An item whose link or image has another scheme (javascript:, data:, file:) is dropped. Another scheme in an optional media URL removes that field.
  • An action with auth: "session" must point at the origin of the manifest (or, for annotations, of the page). A program does not send the visitor’s cookies anywhere else.
  • A deeplink action is http(s) only.
  • A panorama in a view that is not an absolute http(s) URL is dropped.

Sessions and CSRF

Section titled “Sessions and CSRF”

Session actions send the visitor’s cookies only to your own origin, carry X-Requested-With, and do not follow redirects. If you use cookie sessions, declare auth.csrf in the manifest. See Actions and login.

Recipes contain no code

Section titled “Recipes contain no code”

A recipe is data. It has no code and no regular expression on HTML. A regular expression runs only on a string that was already extracted, through re and group. See Recipes.

Privacy of the visitor

Section titled “Privacy of the visitor”

The wall stores comfort settings, the queue and the resume position in the visitor’s localStorage, under keys that start with diazoma: and the site key. It sends nothing to Diazoma. Telemetry is off unless the site that embeds the wall passes a telemetry option, and then it goes to the endpoint that site chose. See Wall API.