tilgovi, kbs, KevinMarks2 and Phae joined the channel
#kbssnarfed: as I'm updating the checkmention to handle rel links better - would it be ok to run one more test on your polytics page? [this one adds a rel=me link in the content, and tries to spoof identity in a few ways.]
#GWGsnarfed: Do you have any idea on how, if the webmention hook uses the source, destination, and response, to figure out the post_id? Or do I have to go through every single post to compare the permalink?
#GWGI've never been particularly good at prioritizing.
#GWGI have this idea for a Bridgy plugin that does this and offers post meta boxes that allow you to select which sites to publish to and then adds the link in. That would be simple enough to work.
#GWGNot sure what other features would be desirable.
onewheelskyward, kbs and brianloveswords joined the channel
#kylewm!tell kbs love the new checkmention test, but I can’t quite parse this sentence: “Please also check the links don’t have a rel="me" attribute on them, or someone could indieauth as you.” isn’t the solution to not accept mentions from third-party sites (except whitelisted sites like bridgy)?
#kbskylewm: ah, that does sound confusing. All I meant to say is that when embedding the content, that <a href=""> link should not also contain a rel="me" attribute
#Loqikbs: kylewm left you a message 1 minute ago: love the new checkmention test, but I can’t quite parse this sentence: “Please also check the links don’t have a rel="me" attribute on them, or someone could indieauth as you.” isn’t the solution to not accept mentions from third-party sites (except whitelisted sites like bridgy)?
#kylewmohhh, aonther layer removed from the exploit i was worried about
#kbskylewm: right - I think the host-based whitelisting for bridgy would be 'good enough' (likely also need to ensure it's only using https, and whatever library is also verifying the certificate etc...)
#kylewmout of utter ignorance, is it totally trivial to spoof a site without https?
#kylewmI guess you'd just need to misdirect someone's dns
#kbswell, I think the main hurdle (my 0.02 anyway) is spoofing DNS
#kbs(at least in the java world, the other issue tends to be clients that don't actually validate an ssl connection. For some strange reason, many jvms are set up to not actually validate the cert after doing all the hard work of talking tls)
#kbsYou could also just use a pinned certificate on appspot.com which ought to do the trick just in case the certificate authority list used by your library isn't as kosher as it ought to be.
#kbsand as usual, there's a nice balance between how attractive your site is to spammers, and how much effort one is willing to spend on this :)
#aaronpkalso MITMing your server is another attack vecgtor, but probably not very likely
#snarfedalso, if you own the network to that degree, there are probably much simpler and more practical attacks
#snarfedit's an interesting question though. i don't know enough about wildcard ssl certs to say
#kbsI guess what I'm thinking, is that authentication now falls on dns, not ssl
#snarfedi know google login itself is immune, since google account cookies are compartmentalized by product/domain, so checkmention-bad couldn't use checkmention's cookies
#kbsnice, hope Portland gets the fast access :) Unrelated, but I dropped into one of the starbucks offering "google internet" out in the east-bay, and boy it was not too shabby.
#kyankBut looking at the markup of http://tantek.com, I don’t see his name tagged inside an h-card.
#kyankI see <h1 class="p-name p-author">Tantek Çelik</h1>, but that’s in an h-feed, not in the h-card.
#barnabywalterskyank: yep, that’s because if there’s no explicit “name” property given, microformats parsers will take the text content of the element and use it as the name
#barnabywalterswhich has two benefits: all microformats are guaranteed to have a name property (even if it is a little messy);
#@MfeckaI merely signed up to Twitter so that I can use it for the abomination known as `Web sign-in' aka `IndieAuth'. Next, Github (same reason). (twitter.com/_/status/463674583879782400)
#aaronpki'm using curl to do the file upload, so it gets set automatically somehow
#kbsah, nice - thanks kylewm and ben_thatmustbeme . I was starting to tinker with creating signed tokens - so in principle one could validate them directly with public keys from the associated site. eg: I submit a signed token with "iss"="https://kbsriram.com" and an endpoint can validate it from a suitable pubkey rel tag on kbsriram.com
#kbs(This potentially reduces the dependence on other sites to validate identity)
#ben_thatmustbemejust a cursory reading of some archives. seems that curl itself supports setting mime type, but php_curl does not
#kylewmaaronpk: so you download the file to a temporary location from IG, and then upload it via micropub, right? could the temporary filename just have an extension added to it?
#aaronpkI wonder if that's how php curl figured out the mime type
#kylewmyes, otherwise you would see lots of pictures of my coffee
#ben_thatmustbemeso as a token endpoint all i have to do is pass those 5 post values on to the auth endpoint and it will return me the me and scope in the body?
#kylewmkbs: I'm not quite understanding how pub key/private key comes into play? unless the micropub client wants to verify that the token actually came from the person it thinks it came from
#aaronpkthe idea with signed tokens is that they can be verified without an API request
#kbskylewm: rough thought is actually around ACL-based access to portions of your site. Ie, you want to allow some set of people access to a part of your site
#kbskylewm: you can lookup the issuer of the token, go back to their site, and validate the token - which allows for identity validation without needing to (say) get into g+ etc
#aaronpkkbs: careful to not conflate the idea of signed tokens with the idea of access control in general
#kbshm - wouldn't access control fundamentally depend on identity validation, which presumably signatures offer?
#aaronpkyes but there's more than one way to skin the cat
#kbsthat's why I was wondering about whether signature checking (implemented by the cat skinners who choose to do it that way) would allow for identity validation as well
#kylewmso you would essentially do login by saying "hey prove to me you are who you say you are by signing something", then verify the signed thing against their site's rel=pgp-key ?
#kbskylewm: right - [which is the same function that JWT also does at the moment]
#kylewmmmm, but kylewm.com signs the JWT with its private key, the user's key doesn't come into play at all. that's where i'm confused
#kbsso the use-case [to start with] is that you have a portion of your site that I could access
#kbsI start by creating a signed JWT (signed with my private key of course) and pass that to a GET request on that protected section of your site
#kbs(ie - your site gets that token only at that point). The creation of the initial signed JWT token by me would be done on my own site, or thorouh a local app
#aaronpkI guess I'm unclear what advantage that gives over how it's currently implemented by others using IndieAuth + session cookies
#kbsnot much - other than it possibly allows logins to occur without needing g+ and other sites
#aaronpkok so not relying on silos can also be solved by your site becoming its own OAuth provider
#aaronpkwhich is what rel=authorization_endpoint does (whether it points to indieauth.com or your own site, same thing)
tantek joined the channel
#kbshm. *thinking* I'm probably missing some connecting dots :)
#aaronpkmaybe I should make another reference authorization endpoint that's super simple and just uses password auth
#ben_thatmustbemeso minor question, i'm guessing the idea of the scope bit is basically saying that by authorizing this application to post (which G+ sees as authorizing indieweb to post to G+) i'm saying that I'm authorizing this app to post on my site?
#aaronpkas a demonstration of an auth server that doesn't require silos
#aaronpkben_thatmustbeme: the idea with scope is that your micropub endpoint can verify that the token generated is authorized to post to your site
#aaronpkwhich lets you generate tokens that can do other things
#ben_thatmustbemei guess for my code it really doesn't matter, i am really only concerned with the ME bit,
#aaronpklike maybe you want to try out barnaby's note interface, but yuo don't want to let his app post syndications for you. your micropub endpoint could require that in order to syndicate automatically, the token must include the "syndication" scope
#voxpelliaaronpk: these rel-authorization_endpoint and such – for relmeauth – should all of the linked rel-me profiles be checked for such rels as well=
#tantekkbs, you find signing stuff with PKI works smoothly for you?
#kbstantek: very much so - I have a couple of apps that my family and friends use
#kbsit's not PKI - but it's private-key based crypto underneath
#kylewmkbs: you'll have to show tantek that android app at HWC some time, it is slick
#tantekkbs - ok, good to know, I'll keep listening and try to understand better.
#@MfeckaI merely signed up to Twitter so that I can use it for the abomination known as `Web sign-in' aka `IndieAuth'. Next, Github (same reason). (twitter.com/_/status/463674583879782400)
#kbssure thing - think the main reason it works is that it's a mobile app, and the word crypto doesn't show up anywhere - it's a fairly simple 'share this photo/status' with so-and-so. That's about all it does
#kbstantek: pretty much, in use. Mostly photos, occasional video.
npdoty joined the channel
#kbsContent gets stored on each other's dropbox/gdrive accounts encrypted
#kbsand is pulled down to the local device and decrypted there.
#kbsfrom the user's point of view, it's a very basic share-this with that-person(s) sort of thing.
#voxpellitantek: RelMeAuth – is it specifically meant to be used with OAuth or with any standard auth mechanism one can find on rel-me-consolidated profiles?
#tantekit's meant to ephemerally delegate auth to whoever the publisher wants to (via rel=me), which is typically OAuth
#voxpelliso it would make sense if this new non-silo auth that has been brainstormed in eg. auth-brainstorming would be used there as well I presume?
#voxpelliI need relmeauth if I want to keep my consolidated profile DRY
#tantekthose two have nothing to do with each other
#tantekrel=me can be used to consolidate your profile yes
#tantekrelmeauth is only for using 3rd parties to ephemerally authenticate yourself as your domain.
#voxpelliI'm thinking that if I have three blogs with micropub on all of them, consolidated with rel-me, then I should just have to specify auth-details on one of them
#voxpelliand that's why I'm wondering about these things as well because that crawling could be extended to also fetch info about new auth mechanisms like these
#voxpellito get subpage-support into an indieauth like tool
#kylewmis IndieAuth simply a RelMeAuth implementation or is the relationship more complicated?
#voxpellikylewm: it started as a RelMeAuth implementation, now it does some more things I think
Sebastien-L joined the channel
#kbsseems to have trodden some well-trodden path with lindy and relspider :)
#tantekI've got a test version deployed here http://tantek.com/relmeauth/ , and ever since Twitter's 1.1 and website/t.co changes it's been a bit broken :(
#voxpellitantek: my idea is that relspider can work as a web service which tools like that one can fetch more complicated identity graphs from instead of or in addition to their own lookups
#Loqismagali: tantek left you a message 11 minutes ago: now that you've joined a second time, you should definitely add yourself to http://indiewebcamp.com/IRC_People
#aaronpkhaving just discovered that I lost a bunch of photos (not because of a lack of backups, just literally lost) I am coming to the conclusion that the only way to make things persist is to spread copies out all over the place
#KevinMarksdoesn't have word though, just photoshop and swedish hypercard
#tantekbretttt: I don't understand it enough to say why it is cool or not
#bnvktantek: so my plan was to be in Berlin in June- perhaps jancborchardt will be around and perhaps we could do a mini-IWC on the same day as East / West... thoughts?
#tantekKevinMarks, example of an actual "unhosted" site? a pile of code and conference foo is not that interesting
#bretttttantek: I went to one of their meetups. They are looking at ways to build apps so that the app code lives on a server, and you data lives in your browser. It works, but is totally novel so not many people work on it
#tantekwhy would I trust app code on some random server?
#aaronpkusing other people's apps to post content to your own site
#kylewmi started out wanting to write an unhosted micropub client, but cross-origin restrictions got in the way
#bnvkI've seen an unhosted todo list app that ran on my iPhone and used localStorage... there was an option to sync to remote servers or apps as well IIRC
#brettttkylewm: thats what I ran into a bit of. browser security is confuuusing
#jancborchardtbnvk: actually – I wanted to register an .is domain – I remember I got to the point of getting an account somewhere but never went through with it. You don’t need to be citizen of Iceland, do you?
#ben_thatmustbemei don't know why people think its such a good idea to move off of searchable names to non-searchable names. the only way i used to be able to find chef stuff was by searching for opscode.
#gRegor`barnabywalters: yeah, I asked about UA because I found a random mailing list thread with the same problem at command line. They set a curlrc with User-Agent: curl and it worked
#barnabywaltersmaybe they got angry that if you test a .wordpress.com URL with indiewebify it says it’s a silo and promotes controlling your own domain :)
#gRegor`Wordpress.com is blocking curl based on UA?
#KartikPrabhuBut after pushing code to mf2py I am sure HTML is mighty fine
#KartikPrabhuhere is my argument "If I can write code to parse microformats after only about 6 months of learnin python, HTML parsing can't be that hard"