-
Notifications
You must be signed in to change notification settings - Fork 39
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
embed more social media platforms besides twitter + telegram #16
Comments
I would like to work on this in the coming days. @msramalho can you assign me the issue? |
I'd also like to help out! |
Awesome, should we split up the work? I could take care of insta? |
Thanks for the interest in this one! @fspoettel go for insta. As for the youtube one, I'd say first to declare here can go ahead (just so there's not duplication of work), but @fspoettel feel free to give @ohcnivek a couple of days in case he wants to give it a go since he's a potential new contributor here (👋) and this is a good first issue. |
sounds like a plan, thanks! |
it's my first time here! will try my best & follow up here if I need help 😄 |
I reviewed above instagram plugin and there is a major problem: it calls an In order to call this endpoint, we need:
I'm really confused how they plan to review the implementation before giving us a token to actually make it work. Also not sure how we can supply them with a review link as our app does not support deep-linking. Embedding individual instagram posts via the embed button in Instagram is not a problem as it calls the oauth endpoint for the user when creating the embed, so no access token is required. It might be possible to "hardcode" this embed code and thereby circumvent calling the graph api in the first place. This could be brittle depending on how often this API changes. |
@msramalho does bellingcat have a facebook graph application with required scopes already by any chance? |
I'd prefer to avoid using the graph API with credentials, and going for the 2nd option, even though from what I understand visitors not logged to instagram will not see the post (?) |
Yes, I agree - it's nuts that Facebook hides this behind a very restricted api scope.
If Facebook allows us to construct an embed string manually w/o first calling the oembed API, then everyone should be able to see these embeds. The main ❓ is whether or not Facebook requires a call to the |
Just tested it and it appears they don't - we should be able to embed any public post in this fashion. I'll go forward with the 2nd option. |
Thanks for looking into it, happy it works as we wanted. |
Also interested in assisting if there are any more embeds that need to be done. |
Following up on the discussion in PR #39 I am indeed concern if some of these embeddings need to bring in scripts from 3rd parties and especially those with tracking capabilities. I would like to encourage some more discussion on that here, but the simplest way that already always users access to all links is a simple button that redirects to the original post. |
From a GDPR (and privacy) perspective, an iframe is as bad as a script embed. there is no real difference, both can track and both require consent and a privacy policy. |
Personally, I think these embeds add a lot of value to the map as less context switching is required to assess events. It would be great to have a toggle "Show Embeds" in the source panel that converts "plain" links to real embeds so that 3rd party content (iframes and scripts) is only loaded on user request. As mentioned in the Insta PR, their embed is a styled placeholder link until the script loads (=could be put behind consent) so this might be one way to go UX-wise. |
I also agree that the previews add a lot of value to the map and that if they are not shown by default users might have a worse experience (knowing the toggle exists + using it is not straightforward), but I am not a fan of injecting scripts outside iframes. As for privacy/gdpr concerns, I'm curious whether we could have some additional message on the intro panel that would cover that or if it actually requires something like an "accept" button. |
Alright, I'll close the PR then - I don't think there's a way to embed instagram in an iframe. It would be great to document expectations like this so people don't waste their time. |
As for GDPR:
The use of the injected Google TagManager script w/o consent is a direct violation of GDPR as well. |
Hi @fspoettel thanks for being so thorough, we will take these into account and try to fix it soon. |
Although Twitter and Telegram represent the vast majority of sources we have for the events, there are a few other platforms for which we would like to add embed support, namely:
current embeds are used here
The text was updated successfully, but these errors were encountered: