2013-01-05 UTC
# 00:28 tommorris Wikipedia switched over to protocol-relative URLs a while back when they rolled out HTTPS support. # 00:29 tommorris very useful if you have the same resources available on both HTTP and HTTPS. something like a CSS stylesheet: <link href="//en.wikipedia.org/.../whatever.css" rel="stylesheet" /> # 00:30 tommorris will then load using whatever the protocol the HTML document was retrieved with. # 01:00 tantek tommorris, what does protocol relative support mean for the relmeauth / indieauth use case however? # 01:01 tommorris no, more that if you have a link to <a href="//twitter.com/t" rel="me">Twitter</a> on tantek.com, it should be able to handle that # 01:02 tantek Like in what case does a provider's http(s) usage depend on the indieweb site it's linked from? # 01:03 tantek so for Twitter, why not always link to "https://twitter.com/t" # 01:04 tommorris well, some people may just have an aesthetic preference for protocol-relative URLs or just like to not have to type the https: or http: # 01:04 tommorris or there might be a publishing platform that specifically converts things to protocol-relative # 01:04 tantek but isn't that bad? I mean, if you know your provider supports https, isn't it *better* if you're explicit about the https? # 01:04 tantek ok, theoretical publishing platform. when someone shows an example of this perhaps we can fix it (whereever makes sense) # 01:05 tantek peronally I think protocol relative URLs to providers is a *bad idea* and instead you should be explicit about the https when you know they support it. # 01:05 tommorris I think generally, Postel's law should probably apply here. ;-) # 01:06 tantek I don't think so. This is security related and thus the sooner an error helps you find a problem in your set-up, the better. # 01:06 tommorris I'm not sure how cross-domain protocol-relative URIs work. # 01:06 tantek because if it's not cross-domain, then you just use a path-relative URI # 01:07 tommorris well, I know part of the reason we have it at wikipedia is if you login to, say, wikipedia, a cookie is set for letting you login to all the other sister sites # 01:19 tantek but that's different, the TLD is still the same # 01:24 tantek I guess I'm having trouble understanding how that affects the RelMeAuth / IndieAuth flow # 01:24 tommorris it'd be something to check with other URI-based authentication things # 01:25 tommorris it'd probably be sensible to check how OpenID do it and steal that. ;-) # 01:26 tommorris I mean, if I put <link href="//tommorris.myopenid.com" … in the head of a page, what that ends up doing. # 01:27 tantek ok see this is where I'd say that's a *BUG* from a security perspective # 01:27 tantek indicating to the user that they should change it to: # 01:28 tantek You're stating a *counter* use-case (a reason for *requiring* explicit https), not a use-case. # 01:30 tommorris so, according to OpenID2 spec, an OpenID endpoint "MUST be an absolute HTTP or HTTPS URL." # 01:33 tommorris I'd say there is a compelling case for requiring OpenID providers to be HTTPS only. ;-) # 01:34 tommorris should probably practice what he preaches and sort out HTTPS for tommorris.org ;-) # 01:42 tantek tommorris - indieweb HTTPS is certainly a challenge, with all the things you have to get right etc. tantek, danbri, brennannovak, wajiii-afk, danbri__, danbri___, friedcell, barnabywalters, josephboyle, zztr and melvster1 joined the channel
# 22:37 melvster1 hello #indieweb # 22:38 melvster1 i just added secure encrypted chat to my homepage ... anyone interested in testing it out?
tantek why would you want to enter //tommorris.org/ into a form instead of just tommorris.org and then let http://tommorris.org/ upnegotiate to https://tommorris.org/ if it can.
@robodynamo .@t Boo :/ RelMeAuth implementations (http://t.co/Wt1x72vP, https://t.co/VIZJCwUs) don't seem to accept protocol-relative URLs #indieweb
tommorris well, it's more that you'd go to https://en.wikipedia.org/, it'd set a cookie for all the HTTPS wikimedia sites, and then you'd be shot off to http://en.wikinews.org and your HTTPS cookies wouldn't work.
melvster1 hello #indieweb