2014-04-02 UTC
KevinMarks and kbs joined the channel
# 00:05 tantek tilgovi - annoying that "public-*" isn't already implied
# 00:05 tantek and that "private-*" whatever could be the exception
# 00:07 tantek and thanks aaronpk and barnabywalters for hosting the spoofed content
# 00:07 kbs no worries - good discussion too :) appreciate the insights
# 00:07 tantek it's useful to have a real world example to point to
# 00:08 tantek brb. restarting to clear out VM. darn leaky browsers and other apps. :/
KevinMarks and tantek joined the channel
# 00:11 tantek KevinMarks what's your ETA at 21A? I may stop by depending on how late at work etc.
# 00:16 pauloppenheim aaronpk: catching up with backlog, i think most people feel burned by REST after using it, basically variations on: Oh this is cool -> i guess i can sandwich these weird cases in with these verbs -> dammit I need self-defined verbs and error codes, this is causing bugs and downtime -> <sound of pitchforks and torches>
# 00:38 KevinMarks If we have three webmention hosting services, can we converge the APIs?
# 00:40 pauloppenheim is webmention a misnomer now? webnotify? webping? webheysomeonesaidsomethingaboutyou?
# 00:42 KevinMarks "someone said something about you" is a longwinded way of saying mention
KartikPrabhu joined the channel
# 00:48 pauloppenheim i mean, it's an amazingly simple little idea, that small kernel can be used for so many asynchronous things
# 00:51 tantek pauloppenheim: webmention is fine, because it refers to the lowest common semantic denominator
# 00:52 tantek re: provably secure microkernel - interesting - open source?
# 00:53 pauloppenheim tantek: it's a whole world of its own, i still haven't spent enough time digging into it, but anyone who's been in mobile for a while should know a bit about it
# 00:54 tantek so no, it's not a "final turtle", by any means
# 00:55 tantek because from a security perspective, exploits can be introduced at any of those layers, and *have* been
# 00:55 tantek basically, since we can't trust USB charging cables and USB sticks, we're basically toast.
# 00:56 pauloppenheim tantek: there're certainly more details to it, but the tools exist if you have the right practices
# 00:56 tantek um, I'm not sure the tools exist for fab verification except to very rich entities
# 00:57 tantek we're not actually going to "solve" this until we can "compile" the hardware ourselves from open hardware specs on our home replicators
# 00:57 tantek and even then - the replicators themselves have to be self-inspectable
# 00:58 tantek to make sure they're not compiling in any exploits
# 00:58 pauloppenheim i hate to hand wave, but i'm already beating a dead horse by posting that source
# 00:58 tantek pauloppenheim: I used to believe that. not any more. not since the USB cable/stick exploits.
# 00:58 tantek at this point we have to assume that well-off attackers have access to those vectors
# 00:59 pauloppenheim tantek: there are several replies to the classic "trusting trust" paper these days
# 00:59 tantek so we're basically stuck. until we can rebuild things inspectably from scratch.
# 01:00 tantek don't worry - don't have time to read them anyway
# 01:00 tantek and they're likely just the usual probabilistic stuff
# 01:03 KevinMarks you can write Compiler B yourself for a computer you built yourself from vacuum tubes that you made yourself.
# 01:04 KevinMarks Weird, Firefox doesn't show up in the running apps ux on android
# 01:04 tantek KevinMarks - I'm hoping for matter compiler access to transistors at least as a starting point :)
basal joined the channel
# 01:08 KevinMarks This reminds me of QuickTime - we had a special compiler for release builds that took ages but was measurably better at optimising
# 01:09 tantek KevinMarks - I seem to remember that for PPC in general
# 01:11 tantek and I think we used MetroWerks as the "fast" compiler that produce not as optimal code
# 01:12 KevinMarks QT was built on all kinds of weird systems. Breaking the build on solaris or Windows nt was an issue
# 01:14 KevinMarks I'm reflecting on this after the annoying experience with qt (the other one) earlier
# 01:14 pauloppenheim KevinMarks: i saw that indiecreddit uses qt - should it build cross-platform?
# 01:15 KevinMarks Yes, it should, but I had trouble getting a usable binary on Mac OS
# 01:17 KevinMarks I think there is a parameter that wants a long enough blockchain first
# 01:19 KevinMarks Seeing as I started at 9pm and finished at 8am I was getting a bit fuzzy at that point
kbs joined the channel
# 01:27 KevinMarks The point of this exercise for me is to understand this stuff more, as well as lulz
kbs joined the channel
# 01:41 kbs pauloppenheim (and bnvk if you're awake) good time to talk about pgp :)?
# 01:43 kbs have you been playing with something already? I saw aaronpk and sandeep's quick demo on /pgp - that's about all I know on what's already been done
# 01:44 pauloppenheim kbs: i don't have a working piece of software, if that is what you are asking
# 01:44 kbs or ideas too - think this is very much in the thinking stage for me at least
# 01:44 pauloppenheim due to crypto being crypto, i'd love to have as little of my own code as possible;
# 01:45 pauloppenheim i've been talking about several different ways to do private messaging with several people, at which point i decided to take more of the "code or gtfo" mantra and only talk about what works today
# 01:47 pauloppenheim kbs: your quick demo is probably the most impressive thing going, but it's also not web
# 01:47 kbs yep. makes sense. I sort divvied thingh up into auth, sign and encrypt
# 01:47 kbs I think the auth bit is probably quite reasonable to layer on top of the indieauth rel=me mechanism - all it takes really is to add a fingerprint to either a "silo"'s profile site or lnk to a tweet/post etc
# 01:47 kbs yea. I have a feeling that having a browser-based client is probably somewhat orthogonal [to my conception at least :)] of indieweb
# 01:49 kbs ah yes - I have looked at this page
# 01:49 kbs so my feeling here is that this is acls implemented by the server, and I'd love to see an even more resiliant structure [ie, end-to-end] if at all possible
# 01:50 kbs I was thinking that aaronpk and sandeep's idea might basically be the thing to build upon - but I had a couple of gotchas surrounding it
# 01:50 kbs one thing I note about webmentions as it stands, is that it's susecptible to an amplification atatck
# 01:50 pauloppenheim kbs: yeah, as i mentioned at the meetup, i think using both together is a good idea
# 01:51 kbs ah - that's an interesting thought indeed
# 01:51 pauloppenheim kbs: yup, but depending on what you implement, that might not be a problem
# 01:52 kbs so I'm not sure how to avoid amplification without some extra params to the web-mention
# 01:53 kbs but the sender of the webmention is not, which is where I see the issues coming from...
# 01:53 pauloppenheim i mean, it could lead to you pummeling a known place, if there's no domain rate limiting
# 01:54 pauloppenheim you could flood two co-conspirators out from each other, but that could be detected and worked around with new params, as you said
# 01:55 kbs yep! If I am forced to add a signature - that would do it, that's what I was thinking of as well
# 01:55 pauloppenheim kbs: if there's a problem domain, ie, mallory is tryiing to keep you and I from messaging
# 01:56 pauloppenheim kbs: then i can talk with you and we can do sig exchange, if we have keys
# 01:56 kbs yea [or the less secure but probably more usable method of the rel=me fingerprints]
# 01:56 pauloppenheim kbs: there's also some even more fun ideas i have, like having different webmention endpoints for logged in users
tantek joined the channel
# 01:58 pauloppenheim kbs: a general extension of sign-in - in addition to suddenly seeing more data (such as my phone number) you also see the existing data change - my non-marked email for instance, and so the webmention link could be different as well
# 01:59 KartikPrabhu pauloppenheim: I seems that a little waiting and the months filter in Django 1.6 started working?! some sort of python cache ing happening?
# 01:59 kbs ah - so you indieauth a user, then proceed from there
# 02:00 pauloppenheim KartikPrabhu: i can't recall the specifics, but is it an apache mpm_prefork issue? workers holding bad state with too long of a lifecycle?
# 02:01 KartikPrabhu it happened on local server and now on my apache, don't recall specifics of server
# 02:01 pauloppenheim kbs: "oh, this is what the world actually looks like" (yes, to *you*, my mom sees something different from that too)
tantek and lukebrooker joined the channel
# 02:03 pauloppenheim KartikPrabhu: well, i recall you tried the query and it actually showed data manually, and then there was confusion about the state of database connections
# 02:03 kbs so as far as actual code goes, it so happens that I have some appengine thing going on for an unrelated project [basically it behaves as a store-and-forward system for transient, signed messages] and probably might not be too hard to repurpose it as a store-and-forward webmention thing
# 02:03 kbs has a static site, and works entirely via cron jobs and random scripts
# 02:03 KartikPrabhu pauloppenheim: yes then I gave up and wait and after a few days of doing other unrelated things it worked!
# 02:04 pauloppenheim KartikPrabhu: unfortunately i have seen many web apps not behave well with mod_wsgi and apache worker pools, whether fork or thread
# 02:05 pauloppenheim kbs: yeah, my site is also primarily static, not very interested in busying up a computer for every request that comes in over the network willy-nllly
basal joined the channel
# 02:06 kbs pauloppenheim: great - hopefully whatever either of us build will work for the other :)
# 02:07 kbs I've slowly been putting together a locally running server that does the auth validation bits bits [ie, given a url - find keys, rel=me links to various silos, and validates fingerprints on silos.]
# 02:11 kbs pauloppenheim: something like that yea. So it's basically a locally running java web server with a browser that's essentially a UI to it. I feed it a URL (say, http://waterpigs.co.uk/ - it goes there, figures out the h-card etc, find's theres a key, then chases rel=me links for fingerprints
# 02:11 kbs trying to be a crude contact manager app really - although right now all it's doing is validating rel=me links, and potentially also keys and fingerprints
# 02:11 kbs eg: barnaby has chosen to syndicate his fingerprint (marked as rel='pgp-fingerprint') to twitter
# 02:11 kbs I follow that link, and check taht it actually belongs to @barnabywalters - and that this profile is also a rel=me link.
# 02:14 pauloppenheim in some ways i'm not super worried about trying to see if a key is authentic online
kbs joined the channel
kbs` joined the channel
# 02:20 kbs` I'll catch up from the web logs - think this connection from my phone is getting more and more flaky :)
snarfed and KevinMarks joined the channel
tantek joined the channel
# 03:33 KartikPrabhu tantek: do you include your permashortlinks in your posts for others to use? or is it just for personal POSSEing
# 03:34 KartikPrabhu eh, the question is more along the lines of "should I" or "why not"...
# 03:36 tantek KartikPrabhu: I used to have permashortlinks in my posts for copy/paste
# 03:37 tantek but eventually I decided it was not a significant enough of a use-case to keep them in the UI of the site
# 03:38 GWG How should a post sent from a personal site to a Siloed site be formatted is a question that occurs to me based on that statement.
# 03:41 KartikPrabhu snarfed: does bridgy send mentions to everything that you have POSSEd when you first enable it?
# 03:41 tantek KartikPrabhu: I do include the permashortcitation in all my posts so that it is googlable
# 03:41 GWG I'm still new around here. May ask some questions.
# 03:41 tantek i.e. if you *search* for the permashortcitation at the end of my POSSEd tweets / fb posts, you will find the *original* post via google
# 03:42 KartikPrabhu snarfed: I want to get some sample backfeeds to play with so I can have better webmention receiving test cases
# 03:42 tantek in that way, I use the permashortcitation kind of lik a per-post watermark
# 03:43 tantek so that even if/when spammers copy my posts, they end up copying my watermark too
# 03:44 tantek KartikPrabhu: yeah I don't know anyone else who is publishing them currently, though I've seen folks experiment with them
# 03:45 KartikPrabhu aah ok wth... my parsing is so messed up that I can mess it up more with pre-mature bridgy mentions :)
# 03:48 GWG tantek: Am I a regular though? Going to go read that Twitter page though
# 03:49 tantek GWG - hopefully! if you're already looking at questions of how to POSSE your content
# 03:51 GWG Understood. It just said regular. I will add in a bit.
# 03:55 GWG tantek: You are one of the people organizing the IndieWebCampNYC, I see?
# 03:58 GWG I already had registered GWG on IRC.
# 04:00 GWG I think I need a User page to link to first.
# 04:00 GWG I'm sure there is a template somewhere here...
# 04:01 GWG KartikPrabhu: How long have you been involved here?
# 04:03 GWG Not sure I like my username, being as it is my domain name.
josephboyle joined the channel
pauloppenheim joined the channel
# 04:10 Loqi Ok, I'll tell them that when I see them next
paulcp joined the channel
GWG joined the channel
# 04:37 GWG Did I miss anything? My bouncer went down.
# 04:43 GWG This is what happens when you pay only $19 a year for your server
# 04:43 GWG Hmm...so you didn't see me answering your question
# 04:47 GWG KartikPrabhu: I had asked you where the usernames list is. I was curious to see who had a username longer than mine
# 04:51 snarfed they're just mf2. you're welcome to look at one if you want, you can fetch the source URL that it sends
caseorganic joined the channel
KevinMarks joined the channel
tantek joined the channel
# 05:31 snarfed hey kylewm! not sure. first place i'd look is the log, linked from your user page
eschnou joined the channel
# 05:34 kylewm oh? i couldn't tell if it was coming from them or me
# 05:34 snarfed i wonder if it's the newlines. i can take a todo to strip them
# 05:35 snarfed yeah, looking at the log, the 500 comes from urllib2.urlopen of an fb api call
# 05:36 kylewm oh or at least... i don't intend for it to have newlines, but it looks like it still does
# 05:36 snarfed that's just a random guess, not at all sure it's the cause
# 05:37 kylewm thanks! no hurry of course, i am just messing around
# 05:38 snarfed deploying that change now. i give it maybe 1 in 3 that it works
# 05:41 kylewm love opaque error messages, although i guess 500 means "something bad happened and we dont' even know what it was"
# 05:43 snarfed yeah. there may be a response body. sad that i'm not surfacing it
# 05:45 kylewm i can just ask you what i was trying to find out -- does bridgy send back the ID of the published post? i'm guessing that would require it to be synchronous
# 05:47 snarfed the response is json with id and url params, and sometimes more
# 05:48 snarfed not much more for fb, but for twitter you get a full tweet api entity
# 05:50 kylewm still trying to figure out how i want to do syndication ... can never seem to get automatic formatting/posting quite right
# 05:51 kylewm i sort of like the stopgap solution that i think willnorris said he uses where there are just silo-provided "share this on ..." links in his posting ui. but then i don't think there is a way to know the id of the created post
# 05:56 aaronpk kylewm: i think he said that some silos return the ID in the js callback and others don't. not sure if he documented it anywhere.
cweiske and snarfed joined the channel
# 06:12 snarfed kylewm: agreed. i've been using bridgy publish for lots of likes/favorites/RTs, but actual posts are still manual
npdoty, basal, snarfed and LauraJ joined the channel
Jihaisse joined the channel
caseorganic and voxpelli joined the channel
# 07:00 Loqi voxpelli: KevinMarks left you a message on 4/1 at 9:27am: only one url per github account?
# 07:02 voxpelli !tell KevinMarks One can add as many url:s/domains per account as one want
# 07:03 Loqi Ok, I'll tell them that when I see them next
# 07:04 Loqi KevinMarks: voxpelli left you a message 1 minute ago: One can add as many url:s/domains per account as one want
tobiastom, carlo_au, eschnou, krendil, friedcell, LauraJ, Sebastien-L, jsilvestre, tilgovi, caseorganic, vf5761, KevinMarks_, josephboyle, glennjones, basal, pfenwick, bnvk, pasevin, scor, melvster and peck_lx joined the channel
CheckDavid, LauraJ, ttepasse and peck_lx joined the channel
# 14:00 ben_thatmustbeme this is the first time i wasn't able to catch up fully on the logs on my train ride in
peck_lx and snarfed joined the channel
# 14:09 KevinMarks Heh. I'm on a train now and seen to have nothing since last night
# 14:10 KevinMarks I changed the reward model of Indiecreddit.com and now I have coins
# 14:11 bnvk KevinMarks: are you really making an Indie crypto currency?
KevinMarks_ joined the channel
# 14:23 ben_thatmustbeme okay, read up on enough of yesterday's discussion. I'll admit i ended up just skipping bits
KevinMarks joined the channel
# 14:28 Loqi ben_thatmustbeme meant to say: makes me sad
# 14:29 KevinMarks_ also, getting the mac one to work is still a work in progress, as it requires external libs installed with brew or macports at the moment
# 14:30 ben_thatmustbeme once you get that all set i can build it on my funtoo machine. Should be just a matter of writing an ebuild file
# 14:31 ben_thatmustbeme at least i beat 2048 Numberwang, so I can stop playing that.... Thanks a bunch for that one.
jedahan, gRegor`, LauraJ, KevinMarks and josephboyle joined the channel
# 14:55 KevinMarks !tell tantek I got the 7am train. is there breakfast at the w3c thing?
# 14:55 Loqi Ok, I'll tell him that when I see him next
KevinMarks2 joined the channel
# 15:00 KevinMarks2 And into the tunnel. I suspect that you won't see the machine I still have running at home. I need to get port forwarding set up.
gRegor`, caseorganic, fungoat and snarfed joined the channel
# 15:16 ben_thatmustbeme ack, package slots causing error on one machine and my other machine is having issues doing qmake
iangreenleaf and tantek joined the channel
# 15:46 Loqi tantek: KevinMarks left you a message 50 minutes ago: I got the 7am train. is there breakfast at the w3c thing?
KevinMarks and KevinMarks2 joined the channel
# 15:52 GWG I still can't get Twitter right. Darn you 140 characters.
# 15:54 Loqi hober: tantek left you a message on 4/1 at 4:37pm: any of you going to the W3C Workshop on Annotations tomorrow?
# 15:55 hober i think that's the event that this is collocated with
npdoty joined the channel
tilgovi joined the channel
peck_lx joined the channel
paulcp, squeakytoy and tantek joined the channel
# 16:24 tantek also for those that want to lurk, there is a scribe taking notes/minutes here: irc://irc.w3.org/annotation
bnvk joined the channel
# 16:38 aaronpk KevinMarks: is there a list of the dependencies I need to install to run indiecreddit-qt?
# 16:39 KevinMarks boost (C++ libraries) db48 (Berkeley DB 4.8) qt4-mac (Open Source QT 4.8.4, includes qmake) openssl (ssl dev libraries) git (to move source back and forth to the repository) miniupnpc (UPNP dev libraries, optional–honestly I say skip this crap)
# 16:41 KevinMarks I suspect I need to put a client on a VPS with a public IP to connect the chain
bupkes joined the channel
# 16:43 bupkes Hi Kevin, I'm Matt :)
# 16:43 Loqi ben_thatmustbeme meant to say: hey there
# 16:43 bupkes This is my first ever IRC chat. I'm amazed how easy it was to join
# 16:45 bupkes Though I'm using a Google Chrome client which doesn't seem to jive with #indieweb too well...
benprew and kbs joined the channel
# 16:59 aaronpk so as long as you can switch to another client if you suddenly disagree with the chrome client, that's fine
# 17:00 aaronpk nobody is saying you can't use closed-source or proprietary software or software created by megacorps
# 17:00 bupkes I'm very much a non-coder, non-technical person but like the idea of indieweb so am tinkering with my site. Have webmentions etc up and running through a bunch of WP plugins and stuff
# 17:01 bupkes damn have to go as my mum just arrived and needs a cup of tea :) Well thanks for teh welcome and I will return to pick your brains hopefully
# 17:05 kbs do you know how many verified rel=me sites you have, KevinMarks? :)
# 17:06 kbs I count 24 in all - hope you're POSSE'ing to the max :)
benwerd joined the channel
# 17:07 Loqi benwerd: tantek left you a message on 4/1 at 4:37pm: any of you going to the W3C Workshop on Annotations tomorrow?
bnvk joined the channel
jsilvestre_ joined the channel
paulcp joined the channel
catsup joined the channel
jjuran joined the channel
# 17:39 KartikPrabhu seems like a lot of Dat's time will be spent on trying to convert between xls and other formats...
JasonO joined the channel
# 17:42 tantek ben_thatmustbeme: yes - it makes the protocol consistent between sync and async versions
# 17:42 tantek thus hopefully simplifying both webmention sending and receiving code
# 17:43 KevinMarks there is not a good format for representing spreadsheets with formulae in
josephboyle joined the channel
# 17:43 KartikPrabhu KevinMarks: is there a good reason or just that no one have made one?
# 17:43 ben_thatmustbeme so then we would be expanding what we are returning for sync version to include 201 and not do the new header proposed?
# 17:45 KartikPrabhu any data structure in Mathematica depends on that propreitary processing backend
# 17:45 tantek ben_thatmustbeme: no I think we realized that 201 is inaccurate there as we are not creating the webmention endpoint itself
# 17:45 tantek are there remnants of 201? I thought we removed it all
# 17:45 KevinMarks .xlsx and .ops are the complex ones, SYLK and .dif the retro ones
# 17:46 tantek ben_thatmustbeme: yes, just found it and fixed. thanks.
# 17:47 KartikPrabhu I thought iPython was an interative shell thing... not a storage format
# 17:47 ben_thatmustbeme I'll try to write up the spec as I have understood it. and maybe we can actually get it all written out to make sure we are on the same page. That conversation got quite long and intertwined with other things
# 17:50 KartikPrabhu true. but it still does not solve "store computations in tables" problem does it?
tobiastom joined the channel
bupkes joined the channel
# 18:06 bupkes oh that was my tweet then. dodn't realise it would show up here
# 18:18 bupkes trying to find a way to push 'status' format WP posts out to twitter/app.net etc. Annoyingly it doesn't seem as simple as finding an RSS feed. Thankfully I have a WP pro chap looking into it...
# 18:19 bupkes I'd use a category but that'd mess up my main rss feed.
cjuehring, Jeena and KartikPrabhu joined the channel
pauloppenheim joined the channel
# 18:35 ben_thatmustbeme I'm trying to keep it as unified as possible with the callback/queue messages reflecting what would be returned if there were no queue and it returned immediately
npdoty and basal joined the channel
eschnou and kbs joined the channel
tantek joined the channel
# 18:59 kbs heh. There must be some equivalent of godwin's law for such conversations - the moment turtles are mentioned :)
# 19:01 ben_thatmustbeme It did get me thinking though, Unless we have some sort of trusted central service, there is no real way to validate that a key is correct
# 19:03 kbs to some extent, yea. I think as in all such things, there's really a sliding scale
# 19:04 kbs one could trust a group of services (a.k.a. indieauth) or one could directly verify keys (a.k.a. PGP verification) I think
# 19:04 ben_thatmustbeme well, indieauth only says that you are talking to the owner of a site, and that person also owns this other account
Kopfstein joined the channel
# 19:05 kbs right - and implicitly, indieauth trusts that atleast one of these two sites is telling the truth
# 19:06 ben_thatmustbeme to prevent a hacked site from being abused, basically you have to have a separate site that required an alternate security method. You basically require that both sites agree on a key
# 19:06 ben_thatmustbeme in indie auth, one site not-telling the truth means the link to the other could be false
# 19:07 ben_thatmustbeme so you need something that is a single central service so that you know the link to the alternate site isn't a lie
# 19:07 kbs let me take a specific example, so it's easier for me to follow along [forgive my diminishing brain cells :)]
# 19:08 gRegor` We talking about sharing/verifying PGP keys?
ShaneHudson joined the channel
# 19:08 kbs let's say that I have a site Indie, that's running some vulnerable server plugin, so some script kiddie can randomly change stuff on my site
# 19:08 kbs let's also say [for the sake of argument if that's ok] that I also have a g+ account, and that the script kiddie finds it harder to hack into that
# 19:09 kbs so the question is - let's say someone finds a h-note sitting on my site - how do they know that I really wrote it
# 19:09 kbs doesn't contain something fishy [assuming they trust "me"] that is
# 19:09 gRegor` Nice work, ShaneHudson
# 19:11 ben_thatmustbeme kbs, IF they know you through your G+ account, they key on G+ is what they can use to verify (assuming you posted in there). However, for the general case, as soon as the script kiddie is on your site, they could change all your keys and most importantly, the link to your G+ account, to point to their own
# 19:11 gRegor` kbs: Has this person verified your PGP key signature out of band?
# 19:11 bupkes hooray i think i have posse-fied my site. in a way, at least.
# 19:12 ben_thatmustbeme now if someone only knows you through your site, they are incorrectly getting the posts as valid from you
# 19:12 kbs gRegor`: haven't come to pgp plumbing yet, just trying to set up the conditions and the threats
# 19:13 kbs ben_thatmustbeme: re the change-link scenario. So someone is likely to "know" me from my g+ (also twitter, etc) accounts. If they don't know me other than my web-site, then yes - there's no way to 'authenticate' it unless they know me in another way
# 19:13 gRegor` The most secure scenario is that you've signed your h-note with a PGP key and the reader has verified your key out of band. Or via a secure channel that is linked from your site, but not able to be updated via your site. Like ben_thatmustbeme said, if they can compromise your site, all bets are off.
# 19:14 ben_thatmustbeme the way this is handled through SSL (validates that you are actually talking to whoever registered the key) is to go to a central repository of public keys and find the one for your site. The assumption is that the SSL registrar is not hacked. SSL keys for the SSL registrar are usually distributed from manufacturers so you know your connection to them is validated
# 19:14 kbs I actually think there's a middle ground here
# 19:14 kbs It's the same middle ground as indieauth. That is, if someone "knows" me from my twitter, g+ etc profiles, there is in fact a way to validate things
# 19:15 kbs so the specific threat model is: Indie is compromised, but not g+, twitter and other profiles
KartikPrabhu joined the channel
# 19:15 kbs By placing a pgp key on Indie, and fingerprinst on g+, twitter, etc - an automated way to validate that is already feasible
tantek joined the channel
# 19:16 gRegor` And people actively do that currently
# 19:16 kbs Yes - so I'd just like to automate that cleanly - that's the middle ground :)
# 19:16 ben_thatmustbeme it does make validation through known connections possible, but those connections have to be made first, if they get them from your site, again, it could be compromised links
# 19:17 kbs ben_thatmustbeme: hm, not following you fully there. Let's say someone points to +xxyyzz with a new fingerprint -- wouldn't I know that +xxyyzz is not actually +kbsriram?
# 19:18 gRegor` The automation wouldn't know, kbs. It would just follow the rel=me/rel=fingerprint (or whatever)
# 19:18 ben_thatmustbeme if I know that +kbsriram is you, then yes, i can validate that way... assuming i trust that G+ isn't compromised too
# 19:19 kbs yes, :) the assumption is indeed that the user sees the associated profiles before use
# 19:19 ben_thatmustbeme then yes, I would agree that would work. but also assuming your private key isn't stored on your site
# 19:19 gRegor` I'm not sure I follow. Just a visual inspection to confirm it's +kbsriram?
# 19:20 gRegor` What if the attacker makes a similar looking profile?
# 19:20 bupkes kartik: best i could do with zero coding skills :)
# 19:20 KartikPrabhu bupkes: you should write about the details of doing that/setting it up so others can see and try it too
# 19:21 kbs gRegor`: yes, pretty much. It doesn't prevent phishing (someone creates +kb$riram I guess) but like most things - it's a simple enough step that seems worth the automated effort
# 19:21 bupkes oh ok will do. embarrassingly simple but might help someone i guess
# 19:22 KartikPrabhu bupkes: yeah such things might not be simple for others (I actually have no idea what app.net does :P )
# 19:23 bupkes kartik: well using app.net is not obligatory, i just used what i had at hand :)
# 19:23 gRegor` If we already know them / trust their profile, shouldn't that be cached? "kbsriram's fingerprint is XYZ" and match that against the signed h-note?
# 19:23 kbs yep - taht's a good idea.So the thought I have is more on the lines of a contact manager that I'd use to contact someone. I enter a URL (say, http://gregorlove.com
# 19:23 gRegor` I guess I'm wondering about the "first time" experience, when you don't really know kbsriram from anyone else.
# 19:24 kbs It crawls the rel=me links, and any keys it finds
# 19:24 kbs it then shows the vcard, + all associated sites, + any validated keys
# 19:24 ben_thatmustbeme gRegor`: thats what I was saying, with this model, if you only know him from URL... thats all you have, there is no validity
# 19:24 kbs if all you know is just my site, then it does nothing
# 19:25 kbs er, only if you don't know my other profiles :)
# 19:25 kbs because you wouldn't think it's "me"
# 19:26 gRegor` I don't see how that's true.
# 19:26 ben_thatmustbeme you are really doing the same as indieauth, validating that the set accounts are all the same person, not that they are a specific person IRL
# 19:27 kbs I think it's a reasonable middle ground
# 19:27 kbs and can be automated also quite simply
# 19:27 kbs of course - I expect the paranoid would call me up and ask me to read out my pgp words, but that's always feasible :)
# 19:27 gRegor` I guess I still don't understand the use-case.
# 19:28 kbs so let's say I happen to know tantek as @tantek
# 19:28 gRegor` If you want to ensure that I wrote on gregorlove.com, and you're checking a key signature on the note against the fingerprint posted on my twitter...
# 19:29 gRegor` Then an attacker can compromise my site, change the note signature, link to @gregorl0ve (zero instead of "o"), list the corresponding signature on twitter, and your system still validates it.
# 19:29 kbs ben_thatmustbeme: no, actually not :) because the script-kiddie can change the content, but not the key - and, therefore, now I can sign my pages to mark that abuse
# 19:29 kbs gRegor`: yes - it doesn't prevent phishing attacks indeed
# 19:30 kbs however, if you use the tofu model, you might be able to mitigate phishing by watching for changes
# 19:31 kbs gRegor`: I think the 'automation' is merely in displaying the set of profiles - the user still decides whether to trust that key or not [and they can always use the traditional pgp model if they so choose]
# 19:31 gRegor` Adding the key / fingerprint check doesn't seem to add any value I can see. Still a single point of failure - my domain
yaf joined the channel
# 19:32 kbs hm - do you feel so? Because it doesn't prevent phishing attacks?
# 19:34 gRegor` Because in either situation, it relies on information that is on the domain.
# 19:34 gRegor` They key / external site fingerprint check doesn't mitigate if my domain is compromised.
# 19:36 kbs gRegor`: hm - could you elaborate more on why? [assuming that there isn't a phishing attack involved]
# 19:36 kbs so the assumption is - you know one or more of my other profiles on twitter/g+/github etc
# 19:36 kbs but my primary domain is potentially untrustworthy
# 19:37 gRegor` kbs: What you're trying to do is let anyone be able to verify that the note on your domain was actually written by you, not another party, correct?
# 19:37 kbs gRegor`: I'm coming to that, but right now, I just want to be able to verify that a pgp key on my domain, specifically, belongs to me
# 19:38 kbs once I have that - I can simply sign pages (or sections of pages) to prove the rest
# 19:38 gRegor` You cannot *reliably* do that unless someone can verify your PGP fingerprint out-of-band.
# 19:38 kbs gRegor`: yes, understood - the goal is simply to do better than what's otherwise possible
# 19:39 ben_thatmustbeme yeah, gRegor`, thats the idea of putting your fingerprint on G+, IFF someone knows you through your G+ then that is the verification
# 19:39 kbs so specifically, if I know your g+ and github profiles, *and* I assume that those have not been compromised
# 19:39 gRegor` *and* the fingerprint appears on both g+ and github, sure.
# 19:40 kbs just - automate the linkages and checks and show the 'confirming' sites in the UI
# 19:40 gRegor` The thing I worry about is:
# 19:40 gRegor` Yes, it's great if I know kbs' profile.
# 19:41 gRegor` But this could easily be relied on too heavily and people start using it to trust everyone's keys
# 19:41 gRegor` Especially if people get in the habit of going through 20 profiles of people they know, clicking "Accept key." Eventually they're like "yeah yeah... *click*"
# 19:42 gRegor` Presuming there's 20 people in the world using PGP... ;) I kid, I kid
# 19:43 kbs that's why I think I'm really looking for a better middle ground
# 19:43 gRegor` Interesting conversation. I'm very interested in using PGP more (but have barely begun).
# 19:43 gRegor` I have to get going for now. Look forward to talking more.
# 19:43 kbs thanks for the thoughts gRegor` - love to hear more about what you're thinking here
# 19:44 gRegor` ben_thatmustbeme: I'll have to take a look at the webmention stuff later
peakwinter joined the channel
# 19:45 peakwinter hallo indiewebcamp!
# 19:46 peakwinter please excuse my momentary evangelization, but my project is looking for a "co-founder" and I wanted to make sure it gets spread around in case anyone is interested by the idea
# 19:47 peakwinter feel free to check it out and shoot me an email if you're interested. cheers!!
# 19:48 kbs ben_thatmustbeme: thanks the feedback - good points as always :)
# 19:52 kbs and this works pretty much mostly for static content - I'm not sure signing things on the server is a good idea, as you say :)
# 19:56 kbs tantek helped me come up with 'selfie' - syndicate everywhere from local files I edit
# 19:57 Loqi Ok, I'll tell him that when I see him next
# 19:58 Loqi Ok, I'll tell them that when I see them next
KevinMarks joined the channel
# 20:05 bupkes oh gosh sorry it looks like my tweets have spammed the channel
tilgovi, snarfed, paulcp_ and tantek joined the channel
# 20:15 tantek !tell bupkes Welcome! And nice domain name :)
# 20:15 Loqi Ok, I'll tell them that when I see them next
# 20:21 KevinMarks that's not spamming, spamming is when I live tweet an actual indiewebcamp
# 20:23 benwerd for one, really deeply appreciates KevinMarks's notetaking, particularly on days like today when he can't attend in person
bnvk and friedcell joined the channel
# 20:27 tantek three degrees of separation reference? or four?
# 20:27 tantek ben_thatmustbeme: what are they saying - is there an IRC channel?
# 20:28 tantek ben_thatmustbeme: is there an archive you can point to?
# 20:29 ben_thatmustbeme yeah, he just mentioned briefly, Kevin mentioned your posts last week and the week before
KartikPrabhu joined the channel
# 20:31 ben_thatmustbeme he wants the "OK House: start a call with Kevin Marks" and have it replace his TV with a video call
# 20:32 benwerd seems totally reasonable to me? particularly if everything (tv, calls, etc) is in a browser
# 20:33 ben_thatmustbeme my apple only friend loved it when I showed her she could stream her home plex server to my TV
# 20:33 benwerd agnostic: use the microphone / camera servers in the web platform, and pick which screen. then just change which "tab" has focus
# 20:34 tantek ben_thatmustbeme: hmm - I don't seem to be able to get into the irc://irc.twit.tv/#twitlive channel
# 20:34 KevinMarks the only thing is that chromecast doesn't route to the external speakers, only the TV ones
# 20:34 ben_thatmustbeme what drives me crazy is our router doesn't seem to bridge 2.4 and 5 g correctly, so if i'm on 5g it doesn't see the chromecast
# 20:39 KevinMarks to get surround I have optical from the cable box, and the DVD player makes it work for netflix/amazon
# 20:39 Loqi KevinMarks meant to say: to get surround I have optical from the cable box, and the Blu-ray player makes it work for netflix/amazon
# 20:40 ben_thatmustbeme There always ends up something missing, You need like a surround system that has HDMI in and out
snarfed joined the channel
scor and krendil joined the channel
jsilvestre joined the channel
# 21:37 bear tantek - there is no archive of twit's irc but I am the admin so have access to the logs if you are looking for something specific
paulcp and pfenwick joined the channel
# 21:56 tantek bear - mentions of say, indieweb indiewebcamp microformats tantek :)
# 21:57 bear let me run a grep and get some log snippets
# 22:01 bear which, knowing the folks who are in their chat, does not surprise me
# 22:01 tantek really? not even to URLs to my personal comms posts? Kevin had said he discussed them / referenced them during last week's ep (or week before?)
LauraJ joined the channel
# 22:01 tantek so is the chat not really a reflection of the show then?
# 22:10 bear @tantek - ok, 3 references on two days - i've grep'd out the whole hour - how do you want it? 2263 lines
KevinMarks2 joined the channel
# 22:15 GWG Still trying to get some of the indieweb standards set up. As a Wordpress person, wondering if anyone had any good examples of someone who has set up a site using it that they would recommend for inspiration.
ttepasse joined the channel
# 22:22 tantek bear - thanks! looks just like a few references to the Personal Comms blog post(s) as I thought
# 22:22 GWG tantek: I will see if any of them pops up tonight. I'm trying to figure out the right combination of theme hacking and plugins. But I'll look at their sites.
# 22:22 tantek GWG - hanni also has quite a bit of WordPress experience :)
# 22:23 GWG tantek: Thank you. WIll find their sites in the directory and look at the source/design for inspiration
# 22:25 GWG I'm customizing the appearance of my site. So I might look at a bunch of Indieweb type sites
# 22:28 CheckDavid Showe an indie site now!
lukebrooker joined the channel
# 22:30 GWG Why do I need HTTPS on my own server? Most content sites don't need it...
# 22:31 GWG Assuming Loqi is a bot, I probably won't get an answer.
snarfed joined the channel
ttepasse and kbs joined the channel
# 22:37 gRegor` And secure all the things. Make it harder for the creeps in the NSA and GCHQ
# 22:37 kbs a dumb question - are rel attributes expected to relate to the entire document [rather than being scoped to a section?] eg: a rel=author would refer to the author of the page
# 22:38 GWG KartikPrabhu: But, what is the scenario for wanting HTTPS on a site? It seems like, if you are't doing commerce...
# 22:38 KartikPrabhu GWG: it is just to make your connection secure... depends on how secure you want it
# 22:40 GWG KartikPrabhu: I'm looking at higher priorities right now
# 22:40 GWG Even I don't want to visit my site right now
# 22:41 GWG I'm learning a lot though, which I suppose is helpful.
# 22:41 GWG I'd nver toched some of his stuff
# 22:41 KartikPrabhu yeah... it is useful to just lurk around here and tinker with your site
# 22:42 GWG I do lurk. But I also enjoy pleasant discourse when I can
# 22:42 snarfed GWG: there are two main reasons to do ssl on your own site: 1) security for your own login and admin activities, 2) privacy for your users/readers
catsup joined the channel
# 22:43 gRegor` Haha, sorta jinx.
# 22:43 gRegor` Eric's post links to Tim Bray's. :)
# 22:47 GWG The thing is...my site shares an IP with other sites.
# 22:50 KartikPrabhu GWG: I recommend getting your site in order for posting and POSSEing before diving into SSL.
# 22:56 GWG I like to bookmark things to read at lunch though
# 22:56 GWG I can't POSSE and eat at the same time
pasevin joined the channel
# 22:59 gRegor` kbs: I was thinking about keys and verification some more, and maybe expanded the scope, heh...
# 23:00 snarfed …but KartikPrabhu is definitely right. first things first…ie the things you personally care about most
# 23:00 gRegor` I was thinking it would be nice to have a network of trust. E.g. if Y has verified and trusts Z, and I trust Y, then it could allow me to automatically trust Z.
# 23:01 gRegor` And perhaps specify how "strong" that verification was. E.g. if I verified your PGP signature over the phone or in person, that's really strong.
# 23:01 kbs gRegor`: gotcha - so baking the web-of-trust model into the 'web', literally I guess :)
# 23:02 gRegor` Doesn't really change the core challenge. Just adds on to it. :)
# 23:02 gRegor` indieweb of indietrust. Haha
pauloppenheim joined the channel
# 23:03 kbs fwiw, the PGP crowd has had a hard time maknig the WoT model work in practice
# 23:03 kbs but it sure would be interesting to see whether something might work better over the web + some tools.
# 23:03 GWG snarfed: I know. But I thought the certificate I'd need would require money.
# 23:03 GWG snarfed: Trying to get Wordpress to do some of the sync stuff I want it to
# 23:04 GWG I've been an indieweb person apparently for years. I just discovered my personal philosophy had a movement.
# 23:04 gRegor` Hehe, same here GWG. Probably for a lot of us
# 23:06 snarfed GWG: aha. afaik brid.gy is the only substantial backfeed implementation right now
# 23:07 snarfed if you're thinking about plugins to support it, pfefferle's indieweb bundle plugin alone should do it
# 23:09 gRegor` Do we wait until closer to the HWC meeting to add them? I was going to add a stub for the 4/9 meeting.
# 23:09 gRegor` Homepage still has the 3/26 meeting
# 23:09 gRegor` ^ tantek aaronpk
# 23:10 gRegor` Also, KartikPrabhu and I need to decide where to meet :)
# 23:11 tantek gRegor`: go ahead and make the page for the 2014-04-09 HWC meeting!
# 23:11 gRegor` I was definitely planning on 6:30 central - so not in sync with west coast.
# 23:11 GWG gRegor`: I'm waiting to get my site up to snuff
# 23:11 gRegor` tantek: same locations for SF and PDX as last time?
# 23:11 tantek gRegor - pretty sure I can get MozSF so leave that in
# 23:11 GWG snarfed: Nextscript's SNAP does import @replies and Facebook comments.
# 23:11 tantek and anything you're not sure about, use HTML comments to comment it out
# 23:12 GWG snarfed: But not likes. And for some reason, my friends are lazy
# 23:12 KartikPrabhu gRegor`: the intelligentsia downtown on Jackson closes at 6pm so that is out
# 23:13 gRegor` KartikPrabhu: I was looking at Randolph
# 23:13 KartikPrabhu gRegor`: walking back home. will be back in a bit. we can decide time/place.
jedahan joined the channel
# 23:21 gRegor` Going to work on a template to easily navigate past HWC in the footer, too.
# 23:22 kbs are some of you already 'extracting' vcard-equivalent data from plus.google.com pages? any sample code you have handy - starting to poke at what attributes it has
# 23:22 kbs but maybe someone has done the dirty work already :)
# 23:23 kbs oh! I guess it's using the itemprop idea
jedahan_ joined the channel
# 23:26 tantek kbs - I think originally KevinMarks added nice simple microformats to their pages
# 23:27 tantek then someone went through and changed it to RDFa
# 23:27 tantek then someone went through and changed it to microdata
# 23:27 kbs :-) ah yes, the joys of a big company
# 23:28 tantek well, especially when no one is measurably consuming what they're doing
# 23:28 tantek they have little incentive NOT to keep changing things around
lukebrooker_ joined the channel
KartikPrabhu joined the channel
# 23:34 gRegor` wb KartikPrabhu
jedahan joined the channel
# 23:39 gRegor` Cool. I'll put it on the wiki
jedahan joined the channel
# 23:46 kbs just realizes twitter apparently has its own cool little markup
# 23:47 kbs this is entertaining :) all the spec authors must have the patience of Job
# 23:49 KartikPrabhu gRegor`: since we are at a diff. time we should put that on the wiki too... 1830 is it?
# 23:49 benward @kbs: We have our own set of meta-tags for Cards, but we parse og: as well for the common things like `description`, `title`, `photo` and so on.
# 23:49 kbs benward: ah, gotcha - thanks for the tip.
# 23:50 kbs [context is that I'm doing this foolhardy attempt at doing the parsing locally, so I guess I need to figure out all the different markup formats
# 23:50 kbs or atleast the interesting subset.]
# 23:50 gRegor` Was just thinking that.
# 23:51 gRegor` Separate h-events might be a good idea in the future. Good problem to have. :)
# 23:56 kbs snarfed: that's what I'm doing at the moment
# 23:56 kbs but I have a feeling I might need to go down the api path for more reliable results
# 23:56 gRegor` Wish it was easier to work with MediaWiki templates, not requiring special modules or plugins.
# 23:56 KartikPrabhu nice! :) I was surprised since I had more activity on my page than on twitter...
# 23:57 kbs snarfed: thanks for the tip - agreed
# 23:58 kbs [scrape indieweb and use apis for silos, I guess, essentially]