KartikPrabhufeeds/reader: question - It seems that the way peopel subscribe to sites is by linking the hompage into their reader which then finds the feeds using rel="alternate". So all the relevant feeds can be linked on the homepage for dscovery. How should this be done using h-feed since each feed will have a separate link. How can we link this right on the homepage?
acegiakKartikPrabhu: Re: your reader question. I'm checking rel="alternate" for rss/atom feeds and if I don't find any I assume that the homepage IS the main h-feed and try and parse it
acegiakreally the rel="alternate" for rss/atom shouldn't point to a feed that isn't a clone of the content on the current page but a lot of people use it to point to an rss/atom feed for updates that aren't presented on the front page
acegiakso if we accept that as standard usage you could rel="alternate" point to another html page that is h-feed marked up even though the semantics are fucked up OR we could use a different semantic keyword like rel="feed"
acegiakKartikPrabhu: my wife's site (which I'm helping her add microformats etc to) is a potential test for this because she's an artist and wants her landing page to be quite specific in appearance
Loqidemis: KartikPrabhu left you a message 5 hours, 6 minutes ago: I see weird boxes (unicode undefined chars?) for the profile links on your homepage. Font not loading?
snarfed, eschnou, bnvk, cweiske and pfenwick joined the channel
tommorrisbarnabywalters, arcatan: I keep getting emails to clifford at tommorris.org - I even got a very apologetic-seeming email from a marketing person apologising for getting my name wrong… sent to ‘clifford’. ;)
tommorrisI use catchall for a reason: so I can give out facebook at tommorris.org to facebook and so on, then know who flogged my email address off to spammers
tommorrisalso, barnabywalters: about the indieweb killing your facebook usage meme? sign me the fuck up. I’ve been doing FB app development too much this week.
tommorrisI may write some FB bridge code for my site to post into FB, mostly because I now know more about the FB API than I ever wanted to know before.
barnabywalterscweiske: I think some other people have also incorporated that step into their build process, so whenver they rebuild their site, new comments are saved into the HTML
voxpellithere should be some discussions regarding that flow to look up on the web, it was the main target before focus shifted to web intents/web actions
barnabywaltersI actually had no idea this existed — I knew apps could register to be custom protocol handlers, but not webpages, and not that discovery and selection UIs had already been built
barnabywalterspresumably either I researched it badly, or by the time I was looking at this stuff it had already been disregarded as a potential solution
voxpellia big problem with protocol handlers right now is that there is no way of detetcing whether there is one or not – so you can degrade gracefully for the ones with no handler registered
voxpellithere seems to be plans to add a isProtocolHandlerRegistered() – but seems like that will only be able to check for whether a specific handler is registered, not if any handler at all is registered
voxpelliI think it will be hard to create a protocol-powered action approach that is secure, because to enable graceful degradation for those without a protocol you need to allow all webpages to check whether a user has registered a protocol – and that’s not okay
voxpellifor a web page to check for an ”indieweb”-protocol without me knowing it to see if I’m an indieweb-participant or not wouldn’t be too good - right?
julien51tantek: no Chrome retired WebIntents suppport (at least publicly because it’s still there last time I checked) because they couldn’t not get the Firefox team to agree on anything with them as to compatibility. Typical NIH syndrome.
voxpellicweiske: looking at it, the iframe with custom protocol that uses postMessage() to send back users preferences actually enables graceful degradation
voxpellione could perhaps use document.referrer + localStorage to maintain a whitelist of pages or something if one doesn’t want to send ones configuration all sites asking
kbsI'm kinda trying to map some of the ideas in indieauth over to validating pgp keys [I guess an indieweb way to functionally achieve what keybase does]
kbsben_thatmustbeme: scenario is - Alice wants to get indieweb user Bob's public key with some degree of confidence from Bob's canonical site. How does Bob link "proof-I'm-Bob" from other sites [eg: prove he's also @bob on twitter, +Robert on g+, etc]
ben_thatmustbemewhen I get done with my site (or at least the basics of it I'll put up my public key on a page with a link thats along the lines you guys were talking about rel="publickey"
kbsI have a sample page over at kbsriram.com that's doing this - some nitty-gritty on the [keybase.io-free] apprach is to handle sites that don't permit embedding a fingerprint (that's sufficient) on a profile page.
ben_thatmustbemeI had been thinking about this as well as i want to be able to generate specific keys to send between sites, and the safest way would be to use pgp and it cuts out a user having to log in at all. I just use the cannonical name to refer to a user, and the tech would do the rest
kbsI think we've independently reached similar conclusions - so on the specifics, here's what I did. Embed a rel=key from my canonical page, pointing to a public key. For each rel=me link that lets me add a fingerprint to a profile page, I do so. Otherwise, I add a rel=pgp-fingerprint link with a post [that can be linked back to an owner] which contains a fingerprint.
kbsRight - absolutely. I think the actual act of pulling in a public key is reasonably in place [h-card, etc] - the act of verifying proofs with other sites isn't there yet.
ben_thatmustbemebut isn't that a bit of overkill, the fact that both sites point to each other with rel=me should be the authentication that either of them can provide the correct key
kbsSo it depends on where the key is linked, if that makes sense.right, that's exactly it :-) It's best that one site [the canonical user site] provide the key, and the supporting sites provide fingerprints.
ben_thatmustbemei guess it guards against either site being hacked and only the pgp key getting changed. but if my site gets hacked, i'm going to change my other sites to break the rel=me relationship
ben_thatmustbemethe fingerprint would have to be on a site that isn't just a generic key store, as the violated cannonical site could just change the link to the key store
kbsThe work [from the perspective of the key-owner] is just about as much as indieauth, and the work [from the perspective of a validator] is less than needed by indieauth
ben_thatmustbememy concern is that because of POSSE just tweeting is giving a false sense of security. I'd want something that my site cannot automatically post to
kbsYou're quite right - any canonical site that just stores passwords for linked silos on the site, would be vulnerable :-) as would indieauth, etc I guess
kbsAs you say, this makes the most sense to add contact info [hcard, etc.] So I expect consumers will effectively store the key locally along with the contact info. TOFU ought to be another line of defense for some of these things maybe?
aaronpkcool, if you update the wiki text I'll go over that this weekend. make sure to phrase it as a user-centric problem rather than just explaining the protocols
gRegor`ben_thatmustbeme: Since the slug is usually based on information that doesn't change and isn't intended to be changed, I'd say store it at post creation time.
kbsgRegor`: ah, actually :) specifically for fingerprint-validation - do you think it's required? I thought a bit about this and I can't find any holes - I thought that was an advantage or something...
snarfedkbs: re your twitter q, they don't do oauth scopes, sadly, but they do have coarse permission buckets for app ids: read only, read/write, and r/w + direct messages
kbsgRegor`: yep, makes sense. Though, even with a single silo verification (and non-TLS from the original domain) - the attacker would need to also MITM the silo connection to be effective
kbsgRegor`: :-) ah, yes indeed. ben_thatmustbeme also pointed this out - convinced me that twitter [especially with most indiewebsites having omni-tokens on their sites] is probably not too hard to get into.
kbsah, sorry to ask a dumb questions - and won't be the last I'm sure - but does the typical publishing system essentially run remotely, rather than somehow proxying data from a locally running setup to a remote site?
ben_thatmustbemeI suppose it could be either, but mostly I've seen everything runs on the server and you just deal with it all there. Prevents any need for client software on your local machine
kylewmkbs: with something like Jekyll (a static site generator), you can do it the other way... generate the html files and stuff on your local machine and just transfer it to a public server somewhere
kylewmthat would definitely be a good approach -- i'm not sure what work has been done with static site generators so far. I believe bret's bret.io is a jekyll site that accepts webmentions, might be interesting to see what he does
kylewmquestion about /databases-antipattern ... my instinct building a flat-file store would be to put everything in JSON blobs organized like year/month/day/note_1 ... but then am i not just building a pale imitation of mongo?
julien51barnabywalters yes, the load the js ONCE from https://subtome.com WHEN the user clicks on the button. If no one clicks on the button, the JS is never loaded and if it’s been loaded ONCE for a visitor it will never be loaded again…
kylewmthanks aaronpk. you made a point the other day about transferring data between development server/production server that definitely resonated with me
ben_thatmustbemeI had not. It seems no matter what I discuss there is a page for it somewhere. I think I need to just sit down and read every wiki page for like a month first
tantek.comedited /OpenID (+176) "/* Shutdowns */ note sourceforge removal of OpenID from UI, but still supporting through old URL param, citation cweiske blogpost" (view diff)
tantekhey KevinMarks - what was the old terminology for full feeds vs. partial feeds that only had a title and link, or title summary link etc? I remember there was a specific term you used while at Technorati
tantekKartikPrabhu: I've never heard that phrase used before, nor is it really accurate - as there's nothing that's "truncated" typically, but rather a choice of only title, or only summary, rather than full content
tantek.comedited /h-feed (+746) "edit summary definition, use term partial rather than truncated, re-order content slightly for intro/use-case, subheads" (view diff)
tantekKartikPrabhu - take a look and see if my edits still make sense with what you were thinking - I tried to keep the intent/meaning of what you wrote and just expand on it: http://indiewebcamp.com/h-feed#Brainstorming
aaronpkquestion: say I have a home page with only headlines (or headlines + summary) *and* a feed.html file with the full text of everything. does that violate DRY or not?
KartikPrabhuIMO all of these design principles are guidelines. You can choose how much to sacrifice one of them for the other. Being very black & white about it seems counterproductive
KartikPrabhuyup. In fact I have a partial atom feed, mainly because I had posts that used custom CSS and scripts that don't render in feed readers anyway. I could have full feeds for normal posts and partial for custom ones, but now I am not inclined to dive into Atom/RSS to do this
tantek.comedited /pgp (+201) "/* Key Lookup Algorithm */ note look for representative h-card first, since that's what microformats.org/wiki/key-examples has found and documented" (view diff)
kylewmKartikPrabhu: :D it is in my databaes as a "reference" but I do not display them differently yet (mostly because nobody would have a reason to reference me on anything)
tantekif you update your article title, or summary, etc. at the top, by sending a webmention to all the replies to your article, you give them a chance to update their reply-contexts accordingly!
kylewmso as the receiver, I can only know that the webmention is from the thing I originally replied to by checking it against my existing reply-contexts right?
KartikPrabhu!tell snarfed: also sending a mention to https://snarfed.org/ returned a 404. Seems like somethign the wordpress plugin does in general. also happened on dariusdunlap's site
tantekKartikPrabhu - interesting thing is - I'm pretty sure we're the first to actually solve this properly, from a user-experience perspective: real time notifications, updates, deletes, reply-contexts etc.