#scottjenson_We need to find the ways in which federated systems outrun proprietary systems, much like the web did
#aaronpkI think we're at a breaking point for silos though, there have been a lot of negative effects of them in the last couple years and I think people are getting tired
#scottjenson_You're just joining us in the middle of 'will federated sw every beat the evil silos' conversation
#aaronpkscottjenson_: I'd be curious to collect some ideas on "completely new systems"
#abreretonhi guys. can i just say that this conversation was a great introduction into what you guys are doing. very insightful
#aaronpkabrereton: thanks! it's hard to present this all on the wiki in a concise way.
#scottjenson_I've been ranting on a discovery API for smart devices so my mobile browser and 'control' anything nearby (but I don't think that's really interesting to the IW group)
#aaronpkscottjenson_: certainly interesting to me ;)
#scottjenson_I would think that a federated ID system (or the moral equivialent) would unlock all sorts of interesting things (like spam reduction for one) as well as banning passwords forever
#scottjenson_And a centralized storage system allows me to store everything, on all servers on MY storage, not others so I have everythign in one please
#barnabywaltersRE ^: I was thinking about that. silo-specific issues aside, if adding 6 characters to your personal site is “a bitch” there are other issues which need fixing
#Loqi[@CoolBrighton] RT @honorharger: In Brighton for #dConstruct or #ireality? Then come along to IndieWebCamp at @LighthouseArts, with @aral &
#barnabywaltersis there no service which does the simplest possible "put your desired domain, links to social profles and credit card details in these boxes and it is all set up”
#neuro`barnabywalters: do you plan to setup a camera / online something for IWC Brighton? I'm stuck at work all the week-end so I will only be available on IRC / hangout / whatever you use.
#aaronpkcweiske: looks like you added a "/" to your github profile at some point recently?
#aaronpkif github properly redirected github.com/username/ to github.com/username instead of serving your profile from both URLs that wouldn't be a problem
julien51, pfefferle and sandeepshetty joined the channel
#Loqisandeepshetty: tantek left you a message 2 weeks, 4 days ago: - any chance you could license webmention with CC0+OWFa? CC0 is an internationally-aware public domain declaration, and OWFa provides RF patent IP declaration.
#Loqisandeepshetty: tantek left you a message 2 weeks, 4 days ago: spec.indieauth.com does CC0+OWFa (if you're looking for a github hosted example). Markup/phrasing docs here: https://wiki.mozilla.org/Standards/license#Markup
#Loqisandeepshetty: tantek left you a message 2 weeks, 2 days ago: if you're still working on an integrated reader in/on your site for yourself, could you add a comment about it here? http://indiewebcamp.com/reader#Indieweb_perspective
#Loqisandeepshetty: tantek left you a message 2 weeks ago: I've officially added rel=webmention to the HTML5 rel registry and linked to webmention.org as the specification. Would you consider allowing rel=webmention in the spec? I think webmention deserves a keyword rel value like that.
#aaronpkbarnabywalters: yeah that would make a lot of sense
#neuro`barnabywalters: thank you. I have a huge operatio all over the wek-end but most of it will be about waiting for things to happen so I'll be very active
#barnabywaltersaaronpk: how feasible is it? /me has never worked with mediawiki
#aaronpkso the requirements would be to set up indieauth as well as put an h-card on your home page
#aaronpkwell, being a *creator* is an intentional selection
#neuro`barnabywalters: no, moving our application from one platform to another.
#aaronpkalthough we are not intending to exclude non-coders
#neuro`aaronpk: I know that, I just fear it makes #indiewebcamp too software centric because only people using the soft that has implemented webmention rsvp will be able to join
#barnabywaltersthat is the challenge: include non-coders whilst still retaining the creators-only barrier to entry
#neuro`Last night, we were discussing about that and self dogfooding.
#aaronpkalthough technically you don't need to write any software to do webmention rsvps. all you need is the ability to create an HTML post and use curl :D
#barnabywaltersaaronpk: IIRC we’ve both got easy webmention sending UIs on our todo lists, reducing the barrier to “be able to write or copy/paste HTML and press a button”
#aaronpkso the theory about why http->https is not ok is that there's a potential attack vector there where someone could redirect http to something else
#aaronpkbut I suppose that's no less secure than an http link already is
#aaronpkthe primary thing is that if you specify https, it should never allow downgrading to http because you explicitly specified you want to be secure
BjornW joined the channel
#aaronpkso in that way I suppose an http->https link isn't introducing any new danger so it should be allowed
#aaronpkbarnabywalters: re: signups, I don't think it would be easy or fun to make a thing that automatically adds you to the wiki, probably better is to have a separate subsystem for RSVPing, like indienews
#barnabywaltersaaronpk: yeah, the wiki is not going to be the best place to implement fancy webmention hcard crawling niceness
#barnabywaltersaaronpk: yeah, I’ve been thinking about that for a while. I’d potentially be up for setting up Taproot instances for them
#barnabywalterswhich could fairly easily support the multiple-author thing
#aaronpki suppose p3k could support multiple authors fairly easily too... just add a few other domains to my whitelist of who's allowed to access the admin interface
#barnabywaltersanother option would be to make it so that certain people can post notes from their own accounts, which (if they webmention some URL) get tweeted by @indiewebcamp
#neuro`Question: what would be the most useful feature on a Publify like platform: photo albums (we already have image upload), web mentions or lists of links?
#barnabywaltersin this case the the absolute time doesn’t matter, what matters is allowing the user to immediately see whether or not the results they’re seeing reflect the changes they’ve just made
#aaronpkbarnabywalters: building on your idea of posting to your own site and syndicating to the @indiewebcamp account, it could even do a proper re-tweet if it finds the rel-syndication link!
#aaronpkyeah pretty much if I remove the ranking system from indienews and change the home page to a recent-first stream, I would just have to add the twitter syndication bit and we'd have a pretty good setup
#aaronpkthen you could "tweet" as @indiewebcamp by posting a rel-syndication link to something like posts.indiewebcamp.com/post/example.com/notes/xxx
#barnabywalterswhen I try to log in to poetica.com as my domain… nothing happens. no feedback, no console error output, nothing
#tantekand the changes to fix it on their side shouldn't be hard
#aaronpkyeah I can't remember what broke about flickr auth
#aaronpkI know their profile URLs are really weird though
#aaronpkideally I'd like to link to http://flickr.com/aaronpk from my site, but that redirects to my photo stream, not my profile that has my URL in it
#tantekand re: that blog post and Tim Bray's followup. just went to http://findidp.com/ and nothing there. so much for good intentions (and that was two months ago).
#aaronpkheh all my alarms are going off. here I was thinking I'd have trouble getting up this morning, but really I woke up at 4am instead :/
#tantekwoke up for a 7am telcon that got canceled.
#tantekaaronpk - what do you think of special-casing Flickr to check to follow one rel-me on their own domain when looking for a rel-me back to the user's personal domain?
#aaronpkflickr.com/aaronpk doesn't have any rel-me links at all. I'd have to special-case it to swap out "flickr.com/photos/aaronpk" for "flickr.com/people/aaronpk"
#tantekaaronpk - my point is that we can likely get Flickr to add rel=me to lickr.com/aaronpk
#aaronpkI'm hesitant to search all rel-me links because it adds an exponential amount of complexity. but limiting it to flickr URLs would keep it reasonable.
#barnabywaltersI don’t really blame them. MW table syntax is nasty enough to append, let alone navigate and insert
#tantekbarnabywalters - I too wouldn't blame them, except they *are* programmers, and programmers are expected to pick up any odd random syntax quite quickly.
#aaronpkon my personal laptop I would prefer to use github because i'm always logged in to github so it's fast. but on a shared computer I would want to use TOTP or SMS so I don't have to sign in to any providers
#aaronpkgood luck trying to understand all the crypto needed to do it. so instead you find a library like phpmyopenid, and cross your fingers that it does what it's supposed to do
#aaronpksandeepshetty: there are now several ways to auth without silos, including mozilla persona
#sandeepshettywhy not come up with something simpler without having to rely on silos?
#aaronpkalso, check out spec.indieauth.com, I added a bunch of stuff there
#aaronpktechnically now you don't need to rely on silos at all with the stuff documented there
#aaronpkyou can be your own indieauth provider and use whatever auth to your own site that you want. passwords even
#barnabywaltersbetween persona and SMS auth, with silos for speed/fallback, I think indieauth at the moment is an acceptable compromise between complexity and silo-reliance
#barnabywalterssandeepshetty: what did you have in mind? RE simpler+silo free solution
#aaronpkthe updated indieauth spec actually covers that use case now
#sandeepshettyhaven't thought enough about it and don't enough about openid but something simple like publish a link rel for a an auth url that you get redirected to with a token and return on login with the token
#sandeepshettywill get back after I finish reading that..
#aaronpkcheck out the distributed-indieauth page, it's a shorter version
#barnabywaltersbut I haven’t looked very hard or tried implementing it so I may be mistaken
#aaronpkcovers fewer use cases but is what you're describing
#sandeepshettythat (dist-indieauth page) is very close to what I had in mind..
#aaronpkyeah pretty much exactly what you were describing
#sandeepshettybut I think you can remove step 4 and 5 if you send a short-lived token in the redirect
#aaronpkspec.indieauth.com is a rounded out version of that along with describing the actual "log in" step which is glossed over between steps 2-3 in the other page
#barnabywaltersaaronpk: what would it take to implement distributed indieauth discovery on the wiki?
#aaronpkhow do you know the token is valid, or which domain it refers to?
#aaronpkbut you'd still need to verify it against the indieauth server as #5 says
#sandeepshettywhats the attack vector if the sender sends a short lived token (< 60 secs) and gets back a hash based on the token after auth that it uses to verify the payload?
#sandeepshettyso it doesn't need to verify. unless I'm missing some other use of the verification step
#aaronpkput it into more concrete terms, let's use the indiewebcamp wiki as the example of the thing you're signing in to
#aaronpk1) you type "sandeep.io" into the sign-in form on the wiki. 2) the wiki finds the rel=indieauth link on sandeep.io and redirects you to "http://sandeep.io/auth?me=sandeep.io&redirectURI=indiewebcamp.com/signin"
#aaronpk3) you log in on your site however you want (password, cookie, persona, TOTP, whatever) and your site redirects your browser to indiewebcamp.com/signin?me=sandeep.io&token=xxxxx
#aaronpkok now the wiki is getting a request with a token and a "me" parameter, and it has no reason to trust that yet
#aaronpkso it has to go verify that token is valid and find out the domain behind it
cweiske joined the channel
#aaronpkso it makes a request to sandeep.io/auth?token=xxxxx which returns the response {"me":"sandeep.io"}
#aaronpkit knows to use sandeep.io/auth one of two ways. it could a) do the discovery step again or b) use the auth server it had previously stored in a session for example. (a) is more stateless
#sandeepshettythe problem you are trying to solve is how to stop the user from just visitin the redirect url manually
#aaronpkthe nice thing is that either using a session or not is ok. both work, and different implementations will have preferences for each.
#aaronpklarge-scale systems tend to prefer to have things be as stateless as possible
eschnou joined the channel
#sandeepshettyhow did this solve the problem of sites that don't have built in auth (Static sites, git pushes)
#aaronpkalso because the token is opaque to the wiki, you can put whatever you want in the token as long as your site can verify it. again, large-scale systems will prefer to use signed tokens rather than a token database
#aaronpkit helps those sites because the auth server does not have to be the same domain as the user signing in
#aaronpkso I can use indieauth.com as my auth provider for aaronparecki.com
cweiske_ joined the channel
#sandeepshettyah ok and indieauth worries about oauth based silo auth
#sandeepshettyRe LINK method, James Snell's solution is very elegant (one less protocol in the stack by making webmention redundant) except for delegation.... been thinking about a way around that...
bnvk joined the channel
#aaronpkyeah i'm totally meh on LINK. GET/POST are the only http verbs that exist to me :)
ozten joined the channel
#cweiske_on could still 301/302/307 LINK requests, but that means htaccess or server config, which is not everywhere
#sandeepshettyI used to be a regular on rest-discuss so you know I like the semantics and other properties (safe, idempotent) of having different methods that they give :)
#sandeepshettyinteresting thinking about all this got me looking into bi-directional links (xanadu, etc) and how webmention is just a hack to make the webs unidirectional links bidirectional
#sandeepshettyI've seen some awesome advantages.. with uniform urls, methods and status codes.. for example I've implemented revisioning as an orthogonal convern by just intercepting put request and checking for status codes
#Loqisandeepshetty meant to say: I've seen some awesome advantages.. with uniform urls, methods and status codes.. for example I've implemented revisioning as an orthogonal concern by just intercepting put request and checking for status codes
#tantekdid you see brett slatkin's rant about HTTP2.0 being too big?
#barnabywalterstantek: if you’re on a desktop browser, I can recommend getting a browser extension which pretty-prints, unescapes allows collapsing of JSON
#sandeepshettyI'm thinking from the perpective of solving our own problems first
#barnabywaltersfrom that perspective then it’s certainly a portability issue
#tanteksandeepshetty - or moving between hosts is part of one-click-install - an optional import step
#eschnousandeepshetty, yes, we enable to move easily by makign it easy to re-deploy elsewhere, there is a screencast on the site showing a move from ec2 to rackspace.
#tanteksandeepshetty - I disagree - one doesn't necessarily solve the other
#tantekthey're related and overlapping, but not supersetting either way
#eschnousandeepshetty, I mean, moving the same stack (storytlr) from one host to another, not moving from one software to another, which of course ask the question of data portability
#barnabywalterseschnou: overall I’m impressed — install took a little while but worked nicely, account signup was a wall but not too awkward, Storytlr itself is great — very easy to change themes, widgets etc
#barnabywaltersit’s clearly a great way to demo storytlr, but doesn’t handle the most important part — getting a domain name/redirecting an existing one
#eschnoubarnabywalters, thanks, we are working on improving speed by switching the demo platform from AWS to docker.io instances.
#barnabywaltersis that within the scope of what comodit does?
#eschnoubarnabywalters, not sure I understand your question. You could deploy on your own Amazon EC2 account (or elsewhere) with comodit. Then up to you to setup dns of course.
#barnabywalterseschnou: I mean incorporating the domain-getting process into the install process
#eschnoubarnabywalters, well, comodit is a generic infrastructure automation platform, so someone could use it to orchestrate something that also takes care of the domain etc.
#tommorristhinks it is probably a blessing that Justice Scalia has yet to discover the ability to forward emails around only to have the other justices send him Scopes.com and Wikipedia links debunking said emails.
#tantekor perhaps I interpreted "application" differently
#barnabywalterstantek: probably, I heard him say “one application which everyone uses” and the monoculture bell went off
#barnabywalterstalking of indieweb and legal stuff: briansuda and I are working on making some icelandic laws more accessible, starting by publishing them online
#barnabywaltersI realised that indieweb commenting has a lot of useful features for discussing laws
#tantekhadleybeeman - easy, start with what already exists and make them separate sites that they own and control (empower them) - what exists = hover over their names here: http://www.supremecourt.gov/about/members.aspx
#barnabywalterse.g. reply contexts preserving past versions of the text
#barnabywaltersas well as the obvious benefits of hyperlinking
#tantekbarnabywalters - I think I interpreted that "one application" fairly liberally, like "indieweb commenting" being one "application"
#hadleybeemanSorry, tantek: what content did you have in mind for these sites? "...that they own and control (empower them)" implies you want them to do something with them, yes?
#tommorristhe Scalia blog would be fairly unpleasant to read. it'd alternate from entries complaining about women being able to vote and gay people not being arrested, to idolising the Founding Fathers in a creepy way.
#hadleybeemanBlogs... Can you imagine them live-blogging a case? "Defense attorney speaking now. He left his fly open. Hard to concentrate on his argument."
#tantekso as long as we're talking lofty goals like "one-click-install" and instead of referring to dated stereotypes of elder women family members, how about:
#tantekan indieweb solution that even a US supreme court justice could setup and use.
#tantekhadleybeeman, easy. just as owning a house helps you better understand property rights (and why they matter), owning your own site and data helps you better understand virtual property rights (privacy) and why they matter.
#tommorrisI think a compelling place to try and sell indieweb is to journalists
#tantekmaybe they'll even make the 4th amendment connection
#neuro`Replace MP / justice with "your local representative" and I'll be fully with you.
#tantekas people that engage in some virtual behavior (video games), but not email
#hadleybeemanneuro`: fantastic! Let me know if you ever come over to London. :)
#tommorristantek: I saw a bit of discussion of Related Headlines. I'm reaching the point where I know that Twitter and other sites are doing bad shit and I'm ceasing to care.
#tantekhadleybeeman - when you say "add to strategy" I'm hoping you mean , link to in the strategy, rather than add tl;dr prose?
#neuro`tantek: we'll do the localization on the French page then.
#tommorrisApparently, I've become a pragmatist in that I don't care about something unless I can find a solution to it.
#tantekwonders if Twitter/txting has altered reading behaviors, or if Twitter/txting tapped into pre-existing reading behaviors (perhaps reinforcing them) ?
#tommorrisI seem to have managed to have attained a reasonable knowledge of technology without also acquiring an unhealthy addiction to texting and mobile gadgets.
#tantektommorris - I'd say an external citation is needed for "without also acquiring an unhealthy addiction to texting and mobile gadgets" ;)
#tommorrisIt's weird. I'll be at an event with a bunch of non-techy non-geeky people, and I'll be the only person who isn't frantically tweeting/texting/instagramming/whatever.
#tanteksince you say "unhealthy", perhaps a note from your doctor :D
#donpdonpbut mostly im trying to understand how camlistore is different/useful than a nosql server
#tantekdonpdonp - that is an excellent next goal for sure
#brettantek: sorry I meant to go over that at some point, but fiancé just moved in and have been busy once going home.
#tantekwould I be correct in assuming that if you could create notes on your own site, and POSSE to Twitter, that you would do so on your own site instead of posting directly to Twitter?
earplugs joined the channel
#tantekbret - np. was just trying to redirect you from less productive (WS-*) things to more productive :)
#tantekaaronpk - at least the page specific set: Page Discussion Edit History Delete Move Protect Unwatch
#tantekaaronpk - even just to have the same font size/color/alignment of existing page tools links but just below the black header bar
#brettantek: reading through indiemark again. I wonder if this would map better to a real-time-strategy like tech-tree structure rather than linear levels?
#Loqitantek meant to say: whereas "commenting" is actually a user-facing feature that people understand
#tantekwould like to solidify Indiemark levels 0 and 1 before IndieWebCampUK, and preferably most of levels 2 & 3 as well.
smus joined the channel
#bretI'll try to go through before that and actually score out what I have
#tantekexactly - see how you do, and if you don't score on something, see if it make sense that you *should* or if not, note why not
#tantekor if something is too easy/hard note that too
#bretLooking over, one rational for paths would be that I am closer to high level features like reply contexts and reply contents than say, automatic web mention sending
#tantekgrew the home page slightly to link to more events (just in case people can't make it to the next camp, or they want to do something smaller/sooner)
#bretI think its great. Though part of me wants to clarify that the ultimate goal of selfdogfooding isn't a utopia where everyone is a web developer though, or that we are just a developer centric project.
#tantekit's just that currently, if you want to help solve indieweb problems, you need to have your own site and be selfdogfooding on it to understand the problems well enough to help solve them.
#tantekbret - it doesn't fit in, because there's no "consumer-grade" indieweb "solution" yet
#breti think most reasonable people will see that its a means, but the world is full of unreasonable people
#tantekall we can do is steer them to the least harmful silos for now
#bretMaybe its worth a note in the FAQ? http://indiewebcamp.com/Selfdogfood Q: IWC is a crazy utopian cult that thinks the entire world knows html A: No Selfdogfooding is a means to an end...
#tantekbret - how about we use actual question wording from someone?