#tantekbrb. restarting to clear out VM. darn leaky browsers and other apps. :/
KevinMarks and tantek joined the channel
#tantekKevinMarks what's your ETA at 21A? I may stop by depending on how late at work etc.
#pauloppenheimaaronpk: catching up with backlog, i think most people feel burned by REST after using it, basically variations on: Oh this is cool -> i guess i can sandwich these weird cases in with these verbs -> dammit I need self-defined verbs and error codes, this is causing bugs and downtime -> <sound of pitchforks and torches>
#pauloppenheimtantek: it's a whole world of its own, i still haven't spent enough time digging into it, but anyone who's been in mobile for a while should know a bit about it
#kbshave you been playing with something already? I saw aaronpk and sandeep's quick demo on /pgp - that's about all I know on what's already been done
#pauloppenheimkbs: i don't have a working piece of software, if that is what you are asking
#kbsor ideas too - think this is very much in the thinking stage for me at least
#pauloppenheimdue to crypto being crypto, i'd love to have as little of my own code as possible;
#pauloppenheimi've been talking about several different ways to do private messaging with several people, at which point i decided to take more of the "code or gtfo" mantra and only talk about what works today
#pauloppenheimkbs: your quick demo is probably the most impressive thing going, but it's also not web
#kbsI think the auth bit is probably quite reasonable to layer on top of the indieauth rel=me mechanism - all it takes really is to add a fingerprint to either a "silo"'s profile site or lnk to a tweet/post etc
#pauloppenheimkbs: ahh, i think the private messaging page has more
#kbsyea. I have a feeling that having a browser-based client is probably somewhat orthogonal [to my conception at least :)] of indieweb
#kbsso my feeling here is that this is acls implemented by the server, and I'd love to see an even more resiliant structure [ie, end-to-end] if at all possible
#kbsI was thinking that aaronpk and sandeep's idea might basically be the thing to build upon - but I had a couple of gotchas surrounding it
#pauloppenheimkbs: a general extension of sign-in - in addition to suddenly seeing more data (such as my phone number) you also see the existing data change - my non-marked email for instance, and so the webmention link could be different as well
#KartikPrabhupauloppenheim: I seems that a little waiting and the months filter in Django 1.6 started working?! some sort of python cache ing happening?
#kbsah - so you indieauth a user, then proceed from there
#pauloppenheimKartikPrabhu: i can't recall the specifics, but is it an apache mpm_prefork issue? workers holding bad state with too long of a lifecycle?
#pauloppenheimkbs: yeah, basically going back to the iceberg model
#KartikPrabhuit happened on local server and now on my apache, don't recall specifics of server
#KartikPrabhuapologises for interupting conversation flow!
#pauloppenheimkbs: "oh, this is what the world actually looks like" (yes, to *you*, my mom sees something different from that too)
#pauloppenheimKartikPrabhu: well, i recall you tried the query and it actually showed data manually, and then there was confusion about the state of database connections
#kbsso as far as actual code goes, it so happens that I have some appengine thing going on for an unrelated project [basically it behaves as a store-and-forward system for transient, signed messages] and probably might not be too hard to repurpose it as a store-and-forward webmention thing
#kbshas a static site, and works entirely via cron jobs and random scripts
#KartikPrabhupauloppenheim: yes then I gave up and wait and after a few days of doing other unrelated things it worked!
#pauloppenheimKartikPrabhu: unfortunately i have seen many web apps not behave well with mod_wsgi and apache worker pools, whether fork or thread
#pauloppenheimkbs: yeah, my site is also primarily static, not very interested in busying up a computer for every request that comes in over the network willy-nllly
basal joined the channel
#kbspauloppenheim: great - hopefully whatever either of us build will work for the other :)
#pauloppenheimkbs: sounds reasonable to use that codebase if you think it works
#kbsI've slowly been putting together a locally running server that does the auth validation bits bits [ie, given a url - find keys, rel=me links to various silos, and validates fingerprints on silos.]
#kbspauloppenheim: something like that yea. So it's basically a locally running java web server with a browser that's essentially a UI to it. I feed it a URL (say, http://waterpigs.co.uk/ - it goes there, figures out the h-card etc, find's theres a key, then chases rel=me links for fingerprints
#kbstrying to be a crude contact manager app really - although right now all it's doing is validating rel=me links, and potentially also keys and fingerprints
#kbseg: barnaby has chosen to syndicate his fingerprint (marked as rel='pgp-fingerprint') to twitter
#kbsI follow that link, and check taht it actually belongs to @barnabywalters - and that this profile is also a rel=me link.
#snarfedfb does 500 my api calls surprisingly often
#kylewmi can just ask you what i was trying to find out -- does bridgy send back the ID of the published post? i'm guessing that would require it to be synchronous
#kylewmstill trying to figure out how i want to do syndication ... can never seem to get automatic formatting/posting quite right
#kylewmi sort of like the stopgap solution that i think willnorris said he uses where there are just silo-provided "share this on ..." links in his posting ui. but then i don't think there is a way to know the id of the created post
#KevinMarksboost (C++ libraries) db48 (Berkeley DB 4.8) qt4-mac (Open Source QT 4.8.4, includes qmake) openssl (ssl dev libraries) git (to move source back and forth to the repository) miniupnpc (UPNP dev libraries, optional–honestly I say skip this crap)
#aaronpkpretty much the rule of thumb is avoid lock-in
#aaronpkso as long as you can switch to another client if you suddenly disagree with the chrome client, that's fine
#aaronpknobody is saying you can't use closed-source or proprietary software or software created by megacorps
#bupkesI'm very much a non-coder, non-technical person but like the idea of indieweb so am tinkering with my site. Have webmentions etc up and running through a bunch of WP plugins and stuff
#ben_thatmustbemeaaronpk, was there any consensus on format for webhook notifications or is it just was is in the brainstorming section of /webmention?
#KartikPrabhuI thought iPython was an interative shell thing... not a storage format
#ben_thatmustbemeI'll try to write up the spec as I have understood it. and maybe we can actually get it all written out to make sure we are on the same page. That conversation got quite long and intertwined with other things
#bupkestrying to find a way to push 'status' format WP posts out to twitter/app.net etc. Annoyingly it doesn't seem as simple as finding an RSS feed. Thankfully I have a WP pro chap looking into it...
#bupkesI'd use a category but that'd mess up my main rss feed.
cjuehring, Jeena and KartikPrabhu joined the channel
#ben_thatmustbemeI'm trying to keep it as unified as possible with the callback/queue messages reflecting what would be returned if there were no queue and it returned immediately
#ben_thatmustbemeIt did get me thinking though, Unless we have some sort of trusted central service, there is no real way to validate that a key is correct
#kbsto some extent, yea. I think as in all such things, there's really a sliding scale
#kbsone could trust a group of services (a.k.a. indieauth) or one could directly verify keys (a.k.a. PGP verification) I think
#ben_thatmustbemewell, indieauth only says that you are talking to the owner of a site, and that person also owns this other account
Kopfstein joined the channel
#kbsright - and implicitly, indieauth trusts that atleast one of these two sites is telling the truth
#ben_thatmustbemeto prevent a hacked site from being abused, basically you have to have a separate site that required an alternate security method. You basically require that both sites agree on a key
#ben_thatmustbemein indie auth, one site not-telling the truth means the link to the other could be false
#ben_thatmustbemeso you need something that is a single central service so that you know the link to the alternate site isn't a lie
#ben_thatmustbemekbs, IF they know you through your G+ account, they key on G+ is what they can use to verify (assuming you posted in there). However, for the general case, as soon as the script kiddie is on your site, they could change all your keys and most importantly, the link to your G+ account, to point to their own
#gRegor`kbs: Has this person verified your PGP key signature out of band?
#bupkeshooray i think i have posse-fied my site. in a way, at least.
#ben_thatmustbemenow if someone only knows you through your site, they are incorrectly getting the posts as valid from you
#kbsgRegor`: haven't come to pgp plumbing yet, just trying to set up the conditions and the threats
#kbsben_thatmustbeme: re the change-link scenario. So someone is likely to "know" me from my g+ (also twitter, etc) accounts. If they don't know me other than my web-site, then yes - there's no way to 'authenticate' it unless they know me in another way
#gRegor`The most secure scenario is that you've signed your h-note with a PGP key and the reader has verified your key out of band. Or via a secure channel that is linked from your site, but not able to be updated via your site. Like ben_thatmustbeme said, if they can compromise your site, all bets are off.
#ben_thatmustbemethe way this is handled through SSL (validates that you are actually talking to whoever registered the key) is to go to a central repository of public keys and find the one for your site. The assumption is that the SSL registrar is not hacked. SSL keys for the SSL registrar are usually distributed from manufacturers so you know your connection to them is validated
#kbsIt's the same middle ground as indieauth. That is, if someone "knows" me from my twitter, g+ etc profiles, there is in fact a way to validate things
#kbsso the specific threat model is: Indie is compromised, but not g+, twitter and other profiles
#kbsYes - so I'd just like to automate that cleanly - that's the middle ground :)
#ben_thatmustbemeit does make validation through known connections possible, but those connections have to be made first, if they get them from your site, again, it could be compromised links
#kbsben_thatmustbeme: hm, not following you fully there. Let's say someone points to +xxyyzz with a new fingerprint -- wouldn't I know that +xxyyzz is not actually +kbsriram?
#KartikPrabhubupkes: did you implement automatic POSSEing?
#gRegor`The automation wouldn't know, kbs. It would just follow the rel=me/rel=fingerprint (or whatever)
#ben_thatmustbemeif I know that +kbsriram is you, then yes, i can validate that way... assuming i trust that G+ isn't compromised too
#kbsyes, :) the assumption is indeed that the user sees the associated profiles before use
#bupkeskartik: I used this feed : http://bupk.es/feed/?post_format=status to post my 'status' posts to my app.net account, and from there on to my twitter. not pretty, but it worked. i think.
#ben_thatmustbemethen yes, I would agree that would work. but also assuming your private key isn't stored on your site
#gRegor`I'm not sure I follow. Just a visual inspection to confirm it's +kbsriram?
#ben_thatmustbemegRegor`: we are assuming that we know the profile beforehand
#bupkeskartik: best i could do with zero coding skills :)
#KartikPrabhubupkes: you should write about the details of doing that/setting it up so others can see and try it too
#kbsgRegor`: yes, pretty much. It doesn't prevent phishing (someone creates +kb$riram I guess) but like most things - it's a simple enough step that seems worth the automated effort
#ben_thatmustbemeso if I were to personally know kbs, and thus trust that his g+ account is kbsriram
#bupkesoh ok will do. embarrassingly simple but might help someone i guess
#bupkeskartik: well using app.net is not obligatory, i just used what i had at hand :)
#gRegor`If we already know them / trust their profile, shouldn't that be cached? "kbsriram's fingerprint is XYZ" and match that against the signed h-note?
#kbsyep - taht's a good idea.So the thought I have is more on the lines of a contact manager that I'd use to contact someone. I enter a URL (say, http://gregorlove.com
#gRegor`I guess I'm wondering about the "first time" experience, when you don't really know kbsriram from anyone else.
#kbsIt crawls the rel=me links, and any keys it finds
#kbsit then shows the vcard, + all associated sites, + any validated keys
#ben_thatmustbemegRegor`: thats what I was saying, with this model, if you only know him from URL... thats all you have, there is no validity
#ben_thatmustbemeyou are really doing the same as indieauth, validating that the set accounts are all the same person, not that they are a specific person IRL
#gRegor`I guess I still don't understand the use-case.
#kbsso let's say I happen to know tantek as @tantek
#ben_thatmustbemekbs, the better question is, doesn't this make all the keys unnecessary?
#ben_thatmustbemethe links between the sites will suffice to validate they are all the same person
#gRegor`If you want to ensure that I wrote on gregorlove.com, and you're checking a key signature on the note against the fingerprint posted on my twitter...
#gRegor`Then an attacker can compromise my site, change the note signature, link to @gregorl0ve (zero instead of "o"), list the corresponding signature on twitter, and your system still validates it.
#kbsben_thatmustbeme: no, actually not :) because the script-kiddie can change the content, but not the key - and, therefore, now I can sign my pages to mark that abuse
#kbsgRegor`: yes - it doesn't prevent phishing attacks indeed
#kbshowever, if you use the tofu model, you might be able to mitigate phishing by watching for changes
#kbsgRegor`: I think the 'automation' is merely in displaying the set of profiles - the user still decides whether to trust that key or not [and they can always use the traditional pgp model if they so choose]
#gRegor`Adding the key / fingerprint check doesn't seem to add any value I can see. Still a single point of failure - my domain
yaf joined the channel
#kbshm - do you feel so? Because it doesn't prevent phishing attacks?
#gRegor`Because in either situation, it relies on information that is on the domain.
#gRegor`They key / external site fingerprint check doesn't mitigate if my domain is compromised.
#ben_thatmustbemejust don't know about the waiting for moderation thing
#kbsgRegor`: hm - could you elaborate more on why? [assuming that there isn't a phishing attack involved]
#kbsso the assumption is - you know one or more of my other profiles on twitter/g+/github etc
#kbsbut my primary domain is potentially untrustworthy
#gRegor`kbs: What you're trying to do is let anyone be able to verify that the note on your domain was actually written by you, not another party, correct?
#kbsgRegor`: I'm coming to that, but right now, I just want to be able to verify that a pgp key on my domain, specifically, belongs to me
#gRegor`But this could easily be relied on too heavily and people start using it to trust everyone's keys
#gRegor`Especially if people get in the habit of going through 20 profiles of people they know, clicking "Accept key." Eventually they're like "yeah yeah... *click*"
#gRegor`Presuming there's 20 people in the world using PGP... ;) I kid, I kid
#peakwinterplease excuse my momentary evangelization, but my project is looking for a "co-founder" and I wanted to make sure it gets spread around in case anyone is interested by the idea
#bupkesoh gosh sorry it looks like my tweets have spammed the channel
tilgovi, snarfed, paulcp_ and tantek joined the channel
#Loqitantek: ben_thatmustbeme left you a message 16 minutes ago: I don't know where to put in pending human moderation really, but this is what I have worked up thus far https://github.com/dissolve/webmention
#tantek!tell bupkes Welcome! And nice domain name :)
#GWGStill trying to get some of the indieweb standards set up. As a Wordpress person, wondering if anyone had any good examples of someone who has set up a site using it that they would recommend for inspiration.
#KevinMarksaha. I thought that name rang a faint bell from the past
#tantekbear - thanks! looks just like a few references to the Personal Comms blog post(s) as I thought
#GWGtantek: I will see if any of them pops up tonight. I'm trying to figure out the right combination of theme hacking and plugins. But I'll look at their sites.
#kbsa dumb question - are rel attributes expected to relate to the entire document [rather than being scoped to a section?] eg: a rel=author would refer to the author of the page
#KartikPrabhuyeah... it is useful to just lurk around here and tinker with your site
#GWGI do lurk. But I also enjoy pleasant discourse when I can
#snarfedGWG: there are two main reasons to do ssl on your own site: 1) security for your own login and admin activities, 2) privacy for your users/readers
#snarfed…but KartikPrabhu is definitely right. first things first…ie the things you personally care about most
#gRegor`I was thinking it would be nice to have a network of trust. E.g. if Y has verified and trusts Z, and I trust Y, then it could allow me to automatically trust Z.
#gRegor`And perhaps specify how "strong" that verification was. E.g. if I verified your PGP signature over the phone or in person, that's really strong.
#kbsgRegor`: gotcha - so baking the web-of-trust model into the 'web', literally I guess :)
#gRegor`Hehe, same here GWG. Probably for a lot of us
#snarfedre sync, do you mean posse? lots of good options there, and it sounds like you're already reading http://indiewebcamp.com/WordPress . i'd recommend jetpack publicize, mailchimp social, or nextscripts snap
#gRegor`Going to work on a template to easily navigate past HWC in the footer, too.
#kbsare some of you already 'extracting' vcard-equivalent data from plus.google.com pages? any sample code you have handy - starting to poke at what attributes it has
#kbsbut maybe someone has done the dirty work already :)
#KartikPrabhugRegor`: since we are at a diff. time we should put that on the wiki too... 1830 is it?
#benward@kbs: We have our own set of meta-tags for Cards, but we parse og: as well for the common things like `description`, `title`, `photo` and so on.