#KartikPrabhufeeds/reader: question - It seems that the way peopel subscribe to sites is by linking the hompage into their reader which then finds the feeds using rel="alternate". So all the relevant feeds can be linked on the homepage for dscovery. How should this be done using h-feed since each feed will have a separate link. How can we link this right on the homepage?
snarfed joined the channel
#tantekKartikPrabhu - not sure - we'll have to ask people building indie readers
#KartikPrabhuisn't barnabywalters building a reader?
#KartikPrabhualso i don't understand what that thread has to do with indieweb. indieweb = bubble?
#kylewmyeah Dash's mention of indieweb seems apropos of nothing
ttepasse, sparverius, scor, fmarier, KevinMarks and snarfed joined the channel
#acegiakKartikPrabhu: Re: your reader question. I'm checking rel="alternate" for rss/atom feeds and if I don't find any I assume that the homepage IS the main h-feed and try and parse it
#KartikPrabhuacegiak: i figured that is how current ones work with rss/atom. But how would somethign based completely on h-feed work? or should work?
#acegiakso we're saying what if the h-feed isn't on the main page?
#acegiakreally the rel="alternate" for rss/atom shouldn't point to a feed that isn't a clone of the content on the current page but a lot of people use it to point to an rss/atom feed for updates that aren't presented on the front page
#KartikPrabhuyes like many people publish multiple ones like notes and articles
#acegiakso if we accept that as standard usage you could rel="alternate" point to another html page that is h-feed marked up even though the semantics are fucked up OR we could use a different semantic keyword like rel="feed"
#acegiakKartikPrabhu: my wife's site (which I'm helping her add microformats etc to) is a potential test for this because she's an artist and wants her landing page to be quite specific in appearance
#KartikPrabhuvery cool... I currently show only the first 5 articles on mine too...
#Loqidemis: KartikPrabhu left you a message 5 hours, 6 minutes ago: I see weird boxes (unicode undefined chars?) for the profile links on your homepage. Font not loading?
snarfed, eschnou, bnvk, cweiske and pfenwick joined the channel
#tommorrisbarnabywalters, arcatan: I keep getting emails to clifford at tommorris.org - I even got a very apologetic-seeming email from a marketing person apologising for getting my name wrong… sent to ‘clifford’. ;)
#cweiskeI disabled the catchall on cweiske.de years ago
#barnabywaltersor a prank — someone signed you up for spam under that email address
#tommorrisI use catchall for a reason: so I can give out facebook at tommorris.org to facebook and so on, then know who flogged my email address off to spammers
#arcatana coworker of mine has a common name and apparently his namesake is the ceo of a mid-sized company
#tommorrisalso, barnabywalters: about the indieweb killing your facebook usage meme? sign me the fuck up. I’ve been doing FB app development too much this week.
#barnabywalterstommorris: ow, nasty. I still use it as a reader, and chat for people who can’t be easily contacted otherwise
#barnabywaltersis their API still as slow and nasty as I remember?
#arcatani should figure out how to do all this indieweb stuff like posseing and webmentioning with my site that is static html generated by hakyll
voxpelli joined the channel
#tommorrisbarnabywalters: slow, nasty, inconsistent, poorly-documented and painful to use
#barnabywaltersarcatan: bret and voxpelli have been doing some great work getting static HTML sites to do things like that
#tommorrisEspecially because they now encourage you to use their JS API exclusively.
#cweiskearcatan, I use a standalone tool for my static site
#cweiskeyou can delegate webmention receiving easily
#cweiskeand load the received comments via javascript
#tommorrisI may write some FB bridge code for my site to post into FB, mostly because I now know more about the FB API than I ever wanted to know before.
#barnabywalterscweiske: I think some other people have also incorporated that step into their build process, so whenver they rebuild their site, new comments are saved into the HTML
#barnabywalterscweiske: it’s a good idea! it solves the discovery problem
#barnabywaltersit could even be incorporated into the webaction extension
#voxpellithere should be some discussions regarding that flow to look up on the web, it was the main target before focus shifted to web intents/web actions
#barnabywaltersI actually had no idea this existed — I knew apps could register to be custom protocol handlers, but not webpages, and not that discovery and selection UIs had already been built
#barnabywalterspresumably either I researched it badly, or by the time I was looking at this stuff it had already been disregarded as a potential solution
#voxpellia big problem with protocol handlers right now is that there is no way of detetcing whether there is one or not – so you can degrade gracefully for the ones with no handler registered
#voxpellithere seems to be plans to add a isProtocolHandlerRegistered() – but seems like that will only be able to check for whether a specific handler is registered, not if any handler at all is registered
#cweiskebut at least isprotocolhandlerregistered() should be implemented
#voxpelliI think it will be hard to create a protocol-powered action approach that is secure, because to enable graceful degradation for those without a protocol you need to allow all webpages to check whether a user has registered a protocol – and that’s not okay
#voxpellifor a web page to check for an ”indieweb”-protocol without me knowing it to see if I’m an indieweb-participant or not wouldn’t be too good - right?
#tantekwhether or not you have a protocolhandler registered at all should be ok
#tantekbarnabywalters, cweiske, please comment in the bug with the use-cases you have in mind
#julien51barnabywalters JS is hosted in your browser! It’s AppCache, so loaded once, and then never again
#julien51tantek: no Chrome retired WebIntents suppport (at least publicly because it’s still there last time I checked) because they couldn’t not get the Firefox team to agree on anything with them as to compatibility. Typical NIH syndrome.
#julien51Now, FF has argued they did not want WebIntent because they did not like the UX… but that was not Chrome’s decision.
#voxpellicweiske: looking at it, the iframe with custom protocol that uses postMessage() to send back users preferences actually enables graceful degradation
#voxpellione could perhaps use document.referrer + localStorage to maintain a whitelist of pages or something if one doesn’t want to send ones configuration all sites asking
#voxpelliusing a confirm() to ask whether to send settings or not
connextrum, alistair and CheckDavid joined the channel
#kbsben_thatmustbeme: yea :) Would love to hear what you're thinking about here
#kbsI'm kinda trying to map some of the ideas in indieauth over to validating pgp keys [I guess an indieweb way to functionally achieve what keybase does]
_6a68 joined the channel
#kbsben_thatmustbeme: scenario is - Alice wants to get indieweb user Bob's public key with some degree of confidence from Bob's canonical site. How does Bob link "proof-I'm-Bob" from other sites [eg: prove he's also @bob on twitter, +Robert on g+, etc]
#ben_thatmustbemewell I would think Bob has a rel=me link to his site and he could just have the public key posted on his site
#kbsyep - that's exactly the idea :-) just formalizing this notion.
#ben_thatmustbemewhen I get done with my site (or at least the basics of it I'll put up my public key on a page with a link thats along the lines you guys were talking about rel="publickey"
#ben_thatmustbemealternatively, i don't know if any keybases have web-pages you can directly access to get the public key
#ben_thatmustbemeif they do I would say a rel=me to your key on the keybase's website
snarfed joined the channel
#kbsI have a sample page over at kbsriram.com that's doing this - some nitty-gritty on the [keybase.io-free] apprach is to handle sites that don't permit embedding a fingerprint (that's sufficient) on a profile page.
#ben_thatmustbemeI had been thinking about this as well as i want to be able to generate specific keys to send between sites, and the safest way would be to use pgp and it cuts out a user having to log in at all. I just use the cannonical name to refer to a user, and the tech would do the rest
#kbsI think we've independently reached similar conclusions - so on the specifics, here's what I did. Embed a rel=key from my canonical page, pointing to a public key. For each rel=me link that lets me add a fingerprint to a profile page, I do so. Otherwise, I add a rel=pgp-fingerprint link with a post [that can be linked back to an owner] which contains a fingerprint.
#ben_thatmustbemeactually, would be very cool to put it in the h-card, I'm interested in getting some contacts list auto-pulled from h-cards
#ben_thatmustbemeto be able to auto-fetch their pgp could be very useful
#kbsRight - absolutely. I think the actual act of pulling in a public key is reasonably in place [h-card, etc] - the act of verifying proofs with other sites isn't there yet.
#ben_thatmustbemeahh, i see what your concern is more now. basically you want to use multiple sites to verify that the key you are getting is correct
#ben_thatmustbemeso if site A has the same key as site B, we can be sure it is correct
#ben_thatmustbemebut isn't that a bit of overkill, the fact that both sites point to each other with rel=me should be the authentication that either of them can provide the correct key
#kbsSo it depends on where the key is linked, if that makes sense.right, that's exactly it :-) It's best that one site [the canonical user site] provide the key, and the supporting sites provide fingerprints.
#ben_thatmustbemei guess it guards against either site being hacked and only the pgp key getting changed. but if my site gets hacked, i'm going to change my other sites to break the rel=me relationship
#ben_thatmustbemei'm just concerned its getting too complex for most use cases
#ben_thatmustbemethe fingerprint would have to be on a site that isn't just a generic key store, as the violated cannonical site could just change the link to the key store
#ben_thatmustbemeit would have to be on another secure site, which for the trust to exist would likely mean a silo of some sort
#kbsThe work [from the perspective of the key-owner] is just about as much as indieauth, and the work [from the perspective of a validator] is less than needed by indieauth
#kbsLink to a key from canonical site, and either tweet a fingerprint or update profile on major silo
#kbsFrom a validator - simply follow the rel=me links, check for fingerprint
#kbsor follow rel=pgp-fingerprint links and check for fingerprint
#ben_thatmustbememy concern is that because of POSSE just tweeting is giving a false sense of security. I'd want something that my site cannot automatically post to
#ben_thatmustbemeputting it in profiles makes sense, tweets become just as compromised the second your site becomes compromised
#kbsYou're quite right - any canonical site that just stores passwords for linked silos on the site, would be vulnerable :-) as would indieauth, etc I guess
#kbsSo the second thought/observation here is to also include the TOFU idea from ssl [trust-on-first-use] - flag when a new key is posted
#kbsAs you say, this makes the most sense to add contact info [hcard, etc.] So I expect consumers will effectively store the key locally along with the contact info. TOFU ought to be another line of defense for some of these things maybe?
LauraJ and Sebastien-L joined the channel
#kbs(and yea, it does seem like twitter has just one token-type - and an update_profile api :-)
demis joined the channel
#ben_thatmustbemekbs, i think the most secure way would be to have one silo that is used for auth but does not have profile update api
#kbsI think g+ fits that bill, at least at the moment
#kbsI also think github fits it [but more because of the immutable commit - can link to a specific version of a gist, etc.]
#ben_thatmustbemetrue, so long as the link is somewhere immutable too
#ben_thatmustbemeanyone have any thoughts on storing the slug in DB at time of creation vs creating it on the fly?
#aaronpkcool, if you update the wiki text I'll go over that this weekend. make sure to phrase it as a user-centric problem rather than just explaining the protocols
#kbsyep :) appreciate the advice - (that's what tantek suggested as well) - so iterating on the writeup
snarfed joined the channel
#gRegor`ben_thatmustbeme: Since the slug is usually based on information that doesn't change and isn't intended to be changed, I'd say store it at post creation time.
#gRegor`And if you do change it, be sure to set up a 301 redirect.
#gRegor`kbs, ben_thatmustbeme: Cool PGP conversation. I hope TLS on your domain is implied in all this. :)
paulcp joined the channel
#kbsgRegor`: ah, actually :) specifically for fingerprint-validation - do you think it's required? I thought a bit about this and I can't find any holes - I thought that was an advantage or something...
LauraJ joined the channel
#kbsbut quite possibly I've missed something - won't be the first time :)
#gRegor`If you're serving your PGP key on your domain without TLS, I wouldn't trust it, personally.
#gRegor`Well, I suppose if your fingerprint is on multiple other sites (twitter profile, etc) then yeah, I'd trust it.
#kbs*nod* - yea - that's just it -- the typical domain is non-TLS
#kbsand I figure this would actually enable leveraging additional safeguards that would otherwise not be possible
#gRegor`Without TLS, I feel like I would want to verify the fingerprint on two other sites. With TLS, I would accept just one other site.
#kbsI hear you :) and you're more distrustful than indieauth, I guess ;)
#snarfedkbs: re your twitter q, they don't do oauth scopes, sadly, but they do have coarse permission buckets for app ids: read only, read/write, and r/w + direct messages
#gRegor`It's just the MITM attack vector if the key isn't over TLS that concerns me.
#kbssnarfed: ah, okay - thanks for the clarification. Oh well.
#kbsgRegor`: yep, makes sense. Though, even with a single silo verification (and non-TLS from the original domain) - the attacker would need to also MITM the silo connection to be effective
#gRegor`I was thinking of gaining access to the Twitter, not MITM it. But you're right
snarfed joined the channel
#gRegor`Hopefully anyone putting their fingerprint on Twitter also has 2FA on. :)
tantek joined the channel
#kbsgRegor`: :-) ah, yes indeed. ben_thatmustbeme also pointed this out - convinced me that twitter [especially with most indiewebsites having omni-tokens on their sites] is probably not too hard to get into.
#kbsah, sorry to ask a dumb questions - and won't be the last I'm sure - but does the typical publishing system essentially run remotely, rather than somehow proxying data from a locally running setup to a remote site?
#ben_thatmustbemeI suppose it could be either, but mostly I've seen everything runs on the server and you just deal with it all there. Prevents any need for client software on your local machine
#kbsben_thatmustbeme: yep - thanks for the clarification :) (and - congrats on round#1 of getting the moving pieces fitted!)
#ben_thatmustbemeand not to worry, asking dumb questions is how you learn. I ask plenty
#kbsI think it was my early misread of POSSE -- I took "own site" to be something I could run on my computer, rather than "owning a domain" :)
#kylewmkbs: with something like Jekyll (a static site generator), you can do it the other way... generate the html files and stuff on your local machine and just transfer it to a public server somewhere
#kbskylewm: aah - okay. Thanks for that pointer as well. Does it periodically also ah, check for webmentions and so on via a cron job or something
#kbsso it can merge them back into the files it generates?
LauraJ joined the channel
#kylewmthat would definitely be a good approach -- i'm not sure what work has been done with static site generators so far. I believe bret's bret.io is a jekyll site that accepts webmentions, might be interesting to see what he does
#kylewmquestion about /databases-antipattern ... my instinct building a flat-file store would be to put everything in JSON blobs organized like year/month/day/note_1 ... but then am i not just building a pale imitation of mongo?
#julien51barnabywalters yes, the load the js ONCE from https://subtome.com WHEN the user clicks on the button. If no one clicks on the button, the JS is never loaded and if it’s been loaded ONCE for a visitor it will never be loaded again…
#aaronpkkylewm: sorta yeah, but even then it's better than (especially) mongo
#kylewmhehe, I have no experience with mongo. I just mean, I want to heed the warning about databases without just rebuilding something worse :)
#kylewmbut if the main point is to have things in stable, easy-to-backup files, then I tihnk I'm good
#aaronpk(e.g. not a binary sqlite format that requires a specific version of sqlite to parse)
#kylewmthanks aaronpk. you made a point the other day about transferring data between development server/production server that definitely resonated with me
#kbstantek: yep - info read and digested by what's left of my few brain cells :)
ttepasse joined the channel
#ben_thatmustbemeI had not. It seems no matter what I discuss there is a page for it somewhere. I think I need to just sit down and read every wiki page for like a month first
#tantek.comedited /OpenID (+176) "/* Shutdowns */ note sourceforge removal of OpenID from UI, but still supporting through old URL param, citation cweiske blogpost" (view diff)
#tantekhey KevinMarks - what was the old terminology for full feeds vs. partial feeds that only had a title and link, or title summary link etc? I remember there was a specific term you used while at Technorati
#tantekI'm going with "partial feeds" until / unless someone provides a better / more canonical term
#KartikPrabhutantek: I used truncated feeds but that doesn't seems so nice :)
#tantekKartikPrabhu: I've never heard that phrase used before, nor is it really accurate - as there's nothing that's "truncated" typically, but rather a choice of only title, or only summary, rather than full content
#KartikPrabhuagreed. That was just something that came up in my head while writing.
#tantektotally fine. much better to get something written first, then clean up terminology etc. later
#tantek.comedited /h-feed (+746) "edit summary definition, use term partial rather than truncated, re-order content slightly for intro/use-case, subheads" (view diff)
#tantekKartikPrabhu - take a look and see if my edits still make sense with what you were thinking - I tried to keep the intent/meaning of what you wrote and just expand on it: http://indiewebcamp.com/h-feed#Brainstorming
#cweiskeI didn't get why you think I compared apples with oranges last night
#tantekbecause you're not comparing the same content
#cweiskeso to get the same content, the h-feed consists of 11 files
#tantekit's the having a separate file/URL that's the violation
#cweiskeso the DRY h-feed is 2.3 times larger than the atom feed
#tantekcweiske - that's your choice, nothing to do with the format
#tanteknope a DRY h-feed would just be full content on your home page
#tantekbut you chose not to have full content - which is fine, that's your design choice
#tantekso you could havea feed.xml file and a feed.html file and compare them
#tantekthat would actually compare the efficiency of the formats
#tantekby comparing one feed file to a partial feed + permalink pages, you are comparing one apple to many oranges
#aaronpkquestion: say I have a home page with only headlines (or headlines + summary) *and* a feed.html file with the full text of everything. does that violate DRY or not?
#tantekyou could do the converse and have worse results too: a full h-feed feed.html, and a partial feed.xml that linked to permalinks
#cweiskebut following the "spirit" or "reason" for h-feed forces me get rid of a full-content feed, or forces me to abandon my design choices
#tantekaaronpk - well it violates what's been duplicated
#tanteki.e. saying, well my code is a little crappy is no excuse for making your code even crappier.
#KartikPrabhuIMO all of these design principles are guidelines. You can choose how much to sacrifice one of them for the other. Being very black & white about it seems counterproductive
#KartikPrabhuyup. In fact I have a partial atom feed, mainly because I had posts that used custom CSS and scripts that don't render in feed readers anyway. I could have full feeds for normal posts and partial for custom ones, but now I am not inclined to dive into Atom/RSS to do this
#tantekKartikPrabhu: right. there is too little benefit to you to bother with Atom/RSS to do this
#tantek.comedited /pgp (+201) "/* Key Lookup Algorithm */ note look for representative h-card first, since that's what microformats.org/wiki/key-examples has found and documented" (view diff)
#kylewmKartikPrabhu: :D it is in my databaes as a "reference" but I do not display them differently yet (mostly because nobody would have a reason to reference me on anything)
#KartikPrabhutantek: but I shouldn't have sent a mention to kylewm's reply in the first place right?
#tantekand at least *one* answer to that use-case question is:
#tantekif you update your article title, or summary, etc. at the top, by sending a webmention to all the replies to your article, you give them a chance to update their reply-contexts accordingly!
#tantekthat was perhaps the worst part of the RSS/Atom wars - it distracted so many smart people away from actual important things
#kylewmso as the receiver, I can only know that the webmention is from the thing I originally replied to by checking it against my existing reply-contexts right?
#tantekand the sadder part is that some of those folks are *still* spending time fighting that war instead of working on user-facing features
#KartikPrabhu!tell snarfed: also sending a mention to https://snarfed.org/ returned a 404. Seems like somethign the wordpress plugin does in general. also happened on dariusdunlap's site
#KartikPrabhuthis is such a complicated puzzle. this federated comments thing... very interesting
#tantekKartikPrabhu - interesting thing is - I'm pretty sure we're the first to actually solve this properly, from a user-experience perspective: real time notifications, updates, deletes, reply-contexts etc.
ttepasse, pfenwick, designdream and _6a68 joined the channel
#bretbeen playing around with feedbin lately. really happy with it. makes following lots of small websites a joy... for now
#bretevery feed reader I have used ends up becoming a major maintanance chore after a while and the noise floor tends to gorw over time
#KartikPrabhubret: would be great to document those frustrations, niceties as people build indie readers
#bretI still have not found a filtering or training system for a reader that I like, and I think it stems from treating all posts and feeds as the same
#bretKartikPrabhu: ill try to get these down right now