#bearkbs - so i'm thinking that since the /xss left a mention that it failed?
#KartikPrabhugRegor`: might also want to add a "required" attribute so the modern browsers can save a request incase there is no source ;)
#kbsbear: so in theory, one of the mentions should succeed, and the other (if not correctly stripped) leaves behind javascript that displays alerts and so forth
#KartikPrabhugRegor`: yes it does, but only after a request has been sent to your server. If you set "required" on the input, the browser will do it for you :)
#snarfedkbs: sounds like you could attack bear by putting xss etc inside h-card data?
#gRegor`I'm thinking of changing the subheadings. Adding "Respond" before the webmention form and changing "Add Comment" underneath to "Or Add a Comment"
#kylewmbenwerd: posse-post-discovery didn’t find it :( I think there is only one piece missing (famous last words)… it looks for the permalink to a post with h-entry -> u-url, and it doesn’t look like yours have u-url
#benwerdwould you agree that it should go on the anchor tag here?
#benwerd<h2 class="p-name"><a href="http://werd.io/2014/looking-forward-to-iiw">Looking forward to #IIW</a></h2>
#kylewmI would probably put it on the link at the bottom of the post (the one with the time)
#KartikPrabhuok I wrote a response to Joschi Khupal's article. It is online and accepting webmentions but will be public on 2014-05-02. Feel free to openly add any sort of responses through webmentions to it. Link: http://kartikprabhu.com/article/concurrence-cooperation Also try, using fragmentions to reply to specific phrases, I'll play around with implementing that correctly too.
#KartikPrabhuFYI: it is a bit incomplete but I'll fix that soon
#aaronpkKevinMarks: should I set up a copy of indieauth.com at indie.oauth.net? lol
#KartikPrabhuaaronpk: I usually pull out the introduction/conclusion of a section if it has some sort of standout point I'd like to make
#bretPersonally i think the wake up call to people talking about how we need open versions of silos or federated this or thats on a silio is worth while. What is the simplest thing you can do that others have already shown possible!?
#bretjust a bummer when people confuse that for something else
#aaronpknow that I'm actually trying to implement a token endpoint
#aaronpkthe main problem is the token endpoint gets a request with arbitrary "me" values, so has to first go find the authorization endpoint for the person
#aaronpkthen, for the JWT case, it has to go fetch the public key from the authorization endpoint. or for non-crypto version, makes a POST request to the auth endpoint to verify the code
#aaronpkeither way there's an HTTPS request involved
bnvk and wraithgar joined the channel
#aaronpkso I don't really see the benefit of the crypto version
#GWGbarnabywalters: There are 3 options I see. Strip the h-card on the home page only, and keep it on the single page
#GWGStrip the h-card entirely as there is a big one in the sidebar
#GWGkeep the multiple h-cards but mark it up differently
#barnabywaltersGWG: you should always have an h-card on the homepage
#barnabywaltersthe way I would do it on your site would either to mimic what I do (h-feed with author h-card and child h-entries) or what aaronpk does (flat page with h-entries and h-card on)
#GWGWell, that will be something I fiddle with tonight.
#kbsaaronpk: user (say) signs into indieauth.com, which then provides a TOTP key for each scope of interest. (eg:) totp-key1-write, ... user installs these keys on their mobile device
#kbsnow, a third-party app/website comes along and wants to publish a comment on behalf of user
#kbsnow the mobile-app requests the code for a totp-key1-write from the user, submits it to indieauth.com, and gets back a signed token confirming it has the ability to write to the user's site
#kbssigned token == bearer token, used/verified with each call to the user-site as usual
#snarfedbtw kbs, i'm going to (periodically) clean up the test mentions on the polytics post. holler if you need any, i can always restore them
#kbssnarfed: :) thanks much - appreciate that you let me test with your page, but don't need them permanently. I'll also give you a heads up before testing again -- should be done for the moment.
gRegor`, tilgovi, KevinMarks and v0_ joined the channel
#kylewmI just tried checkmention ... had a false sense of security cause I thought I was using python bleach everywhere
#kylewmbut apparently I was not using it in the most important place!
#kbsoh, cool - glad it's helping! I don't use python, so not familiar with the quirks of commonly used libraries. If you notice corners where things could be tested more, please do let me know
snarfed joined the channel
#kbsI need to add a rel=me test link, somehow forgot to add that in the last change. (snarfed also uses nofollow everywhere when embedding links, which also seems like a good idea...)
#cweiskeyou're breaking the internet with nofollow
#kylewmI'm not sure, in the indieweb, it makes sense to me that they would get a small bump from being on my low-traffic site, but should not get a big bump for me commenting on a higher traffic blog
#KartikPrabhuit definitely is more aggressive than how others here have responded.
#kbsKartikPrabhu: okay :) the 0.02 that struck me, is that Joschi seemed (to me) to be saying that his notion of indieweb includes people who don't actually build things
#kbsso there's a chance that both of you might be right in different ways.
#JeenaI am thinking of adding pictures or images or something like that to my blog/ and notes/
#Jeenabut I can't quite decide on how to call it, pics/ images/ imgs/ pictures/ pix/ look all funky
#aaronpkJeena: I also couldn't decide on any of that, or how I even want to host my photos, so I punted for now in favor of an instagram-like stream of photos in my notes
#Jeenahm yeah, I'm more in favour of a flickr photostream with only pictures
snarfed joined the channel
#JeenaPerhaps I just should call it pictures/ and just change it if I really feel that it was the wrong name
#kbsdoesn't flickr call it /photos ? [muddying the waters as usual :)]
#snarfedkylewm: looking at your PR now. re the test failure, if you run alltests.py with —debug, it should show you more details, including a real stack trace
#Loqitantek: snarfed left you a message 2 hours, 7 minutes ago: in case you didn't see, fb announced that thing i mentioned a while back: http://applinks.org/
#KartikPrabhuJeena: it seems that the h-as-* is not a microformats pattern
#tantekKartikPrabhu: your post looks great. honest, from the heart, and positively encouraging.
#tantekwell, h-as-* does create a microformat object (since it is an h-* classname), it's just not part of any proposed format for doing anything. more of an experiment.
#tanteksnarfed, quickly skimming applinks.org, looks like some interesting design/engineering behind it. Still a bit confused about the "app to app linking" use case. When would I want that? (as a user)
#tantekActually I should get to bed - don't answer that. :) We can chat more tomorrow. Er, your tomorrow. It's already 2014-05-01 here.
#aaronpkoh this is just so that you can be in the spotify app, click a link, and it launches the songkick app to buy tickets. not really about creating posts or anbything.
#KevinMarksI see applinks as a way to further marginalise the browser
#KevinMarksAnd to make sure that sites decide which apps are approved by them
#KevinMarksCan I make applinks that say to use Firefox mobile for my site? Not an embedded web view?
#aaronpki still don't quite understand applinks, I'm going to need to try this out with something real before I get it
#KevinMarksSo, I'm in sf and have a free afternoon. Where should I tempt east coast journalists here to cover f8 to come and sit in the sun with drinks and talk indie web? Near townsend and 7th helps, but lush is key
#KevinMarksIf twitter were smart they'd be ferrying them to their roof garden from the conf
#KevinMarksApplinks are the twitter card for apps, generalised so other apps can do it
#aaronpkso I guess app links are a way to say "this web page is also available at this native app URL"
#aaronpkand facebook provides an API to answer that question, but you can also just read the applinks tags yourself too
kbs joined the channel
#brainTrainI've always been a zeitgeist fan, but that's probably a bit out of the way if you're in SOMA
#kbsbenwerd: out of curiosity - has anyone [but me now I guess :)] ever expressed a desire to post 'transient' comments? Ie, things that stick around for a few days but bar anyone archiving them, just disappears
#aaronpkwhat is this Prefer-Html-Meta-Tags header that applinks references? the only result for it on google is the applinks docs
#kylewmbenwerd: it looks like you got a webmention from barnaby’s notes stream? that’s … odd
#gRegor`!tell benwerd I'm a fan of flat comments and having a "local" comments option since the majority of people are not webmention capable yet. I actually just implemented interleaving of comments and webmentions: http://gregorlove.com/2014/02/1180/
#kylewmno, not much anymore … it’s cool to be nerdy and obsessive now
#gRegor`Related: I showed off my new manual webmention form to a friend last night. He said "Look. Quit doing things and making me feel bad for just sitting here playing Minecraft."
kbs joined the channel
#gRegor`So I told him I would probably play after I grabbed some food followed by " . . . and BUILD WEBMENTIONS IN MINECRAFT! jk"
#kbssomething I don't yet grasp [on android specifically] is what applinks adds, that isn't already being done by the apps?
#kbsit works the other way admittedly - the apps register for urls, and the caller simply asks the system to resolve any given url
#kbsnow it seems that applinks wants to move that [relatively nice] system-provided-user-mediated resolution mechanism into the calling app, which doesn't immediately seem like a better approach
#kbssnarfed: does applinks (on android specifically) turn the decision on what app to resolve a given URL on its head? Ie, normally the caller registers for URLs, and the user mediates which app is used. With applinks, the caller/library directly decides
#snarfedkbs: i don't actually know it in depth, so i'd have to go read the docs with you for detail q's
#snarfedi agree w/you that the original ideas of both android intents and app-independent url schemes are great, and ideally make applinks unnecessary
#kbsjust curious - what do you find the best benefit from using applinks? (I assumed you were working on it to some extent, apologies if that isn't the case!)
#snarfeddefinitely haven't worked on it. at a high level, it seems useful for 1) translating single-app web links (e.g. a quip doc) to an intent/url that opens it in the native app, for all ios apps and android ones that don't correctly/fully register intent filters
#snarfed2) reliably generating a specific app's url/intent across breaking changes by the app itself
#snarfed(since the applinks db should be kept up to date)
#snarfedit seems like applinks is useful for when you already know you want a specific app
#kbsthe navigation flow docs for android certainly puts the choice right in the caller, as far as I can tell
#kbsrather than in (the android-centric view) of having the user mediate it.
caseorganic joined the channel
#snarfedit doesn't disable generic cases. generic android intents are still powerful and useful independent of applinks
#aaronpkbut won't applinks stop the android intents from working?
benwerd joined the channel
#aaronpkcause applinks will translate the web URL to an app URL, then ask the OS to open the app URL instead of the web URL
#Loqibenwerd: gRegor` left you a message 1 hour, 9 minutes ago: I'm a fan of flat comments and having a "local" comments option since the majority of people are not webmention capable yet. I actually just implemented interleaving of comments and webmentions: http://gregorlove.com/2014/02/1180/
#KevinMarksFor when the site wants only one app. Yes. It works for quip where your site is a stub. It's anti web
#kbsalso prefers me (the user) to decide which app -- browser or otherwise -- to handle any given url
#KevinMarksSo, can I declare to Facebook to open my site in chrome on iOS with this, instead of a web view?
#aaronpklet's use twitter as an example. you're in the Quip app, and click a link to a tweet. Quip uses the facebook SDK which translates the link to twitter.com/xxx to a twitter app link like twitter://xxx, then hands it off to the OS which launches the twitter app.
#snarfedKevinMarks: i don't know enough about the specifics to answer detailed questions, sadly
#aaronpkso instead of apps providing the OS with web links, they now provide the OS an app link, breaking the ability for other apps to handle the twitter.com/xxx link
#snarfedaaronpk: right, i see. for content where you reasonably have multiple clients, this isn't the right thing to use
#snarfed…or maybe it is, if applinks can return multiple apps for a given url. not sure.
#aaronpkbut... if twitter one day decides to include the applinks tags, then all apps using the facebook SDK will suddently change
#KevinMarksThey do let you express multiple apps. But the website declares them. It gets a veto
#snarfedsure. all true., i definitely grant those poinst. there are tons of things that don't have multiple clients though. this is a huge improvement on the status quo for those cases.
#snarfedif it turns out to tie the multiple-client drawback with the single-client benefit, that's a tradeoff to consider
#snarfedi don't know much about the current state on ios. afaik it doesn't let multiple apps register for the same url schemes, right?
#snarfedie you can only do generic intents on ios right now if you specifically look for each candidate app separately…?
#aaronpkno, an app can register for a custom URL scheme, but behavior is unspecified if multiple apps register the same
#kbsis still quite perplexed on the android end :)
j12t joined the channel
#jonnybarnesbenwerd: kylewm's posts have also ran amuck in your comment section
#kbseg: if the quip android app registers for a suitable filter - doesn't it automatically work like all similar apps? What benefit do I get by using the applinks navigation mechanism from (say) my messaging app that gets a link to a quip doc?
#kbsalso (to KevinMarks point) it lets the user decide which app to use, which seems nice to me
#kbsI see your point about access-protected URLs on the web, with no browser-client UI to open them. [I'm not quite as opposed to non-browser clients as KevinMarks :)] but I do also feel it takes the choice away from the user. Maybe this is fundamentally an ios-vs-android thing as well
#snarfedagreed. it definitely does help interop by hurting user choice a bit, and helps ios more than android
#snarfedit does help user choice in a different way, though
#snarfeda *very* indirect way: most apps don't register to handle their http links at all, on either platform. app links will theoretically let me make "glue" apps like open-in-app handle way more apps
#snarfedwhich will let users choose to open way more links in native apps, if they want, instead of in their browser
#GWGRight now, I use Bridgy for backfeed, but not for publishing.
#GWGIf I disabled the plugin I use and switched, what are the pros and cons, do you think?
#kbsthanks snarfed! think I'm slightly less perplexed after hearing how quip finds it handy, and possibly other situations. I was initially only able to appreciate what KevinMarks and aaronpk were saying, good to get another perspective on it :)
#snarfedGWG: mostly that you can publish things that aren't just posts
#gRegor`snarfed: Is it by design that bridgy comments shows the author URL as the site linked in the profile, but bridgy favorites shows the twitter profile URL?
#kbsdo you also predict a day when facebook will charge for the "preferred-launched-app" to handle some particularly desirable endpoint? :)
#KevinMarks_or sell it to a movie for the ultimate in "takeover marketing"
wraithgar and pauloppenheim joined the channel
#gRegor`I'm a python novice, so that probably won't happen, snarfed. :) No biggie, though. the u-uid might help, actually. Is that from the twitter API or something bridgy generates?
#kbs:) it's a clever idea. Be curious how it evolves - clearly there's a huge incentive for everyone to add these tags so they can show up directly from links from the facebook app.
#snarfedgRegor`: bridgy generates it. in retrospect, should be the actual url intsead of a tag uri, but meh
#KevinMarks_remember when half the web went down because the facebook login iframe redirected the container to an error page?
#kbssurfs with noscript and ghostery, and probably half the web is already invisible!
#gRegor`Can you point me in the repo where the uid is generated?
#gRegor`I see they're both "tag:twitter.com,2013:LucyStag" for the comment and like. Wondering if I can reliably extract the twitter name. wasn't sure about that 2013 in there though
#gRegor`Or I suppose if they always match, I could group them together that way (on a single post)