#GWGtantek: what would you suggest I call a page on my brainstorming on the matter of changing communications links on a site based on the owner's context.
#gRegor`This blog will reside at battlestaramandica.amandamaclean.com, btw
crystal_ joined the channel
#gRegor`I agree a common h-card is the ideal and eventually will probably have that.
#gRegor`For now I'm thinking of using /about as that common h-card though, which makes me wonder if there's any reason to mark up the h-card in the sidebar of the individual posts.
#tantekkylewm - another way to ask that is how much of /authorship does php-comments implement?
#gRegor`Another way of framing my thoughts: maybe it's not necessary to mark the sidebar up as an h-card even though the info maps nicely to an h-card?
#kylewmright now I know, mf2util will only process the microformats it's given ... it does not make any additional requests
#gRegor`indiewebify.me does not support rel-author as far as I could tell on Sunday
#gRegor`Might pick your brain about this tomorrow, KartikPrabhu. Might be easier in person than in text.
#kylewm!tell aaronpk am i right in reading php-comments that it assumes the author's h-card is embedded in the h-entry? i.e. 1 & 2 of http://indiewebcamp.com/authorship
#gRegor`Does indiewebify.me need to be updated? It recommends <a rel="author" class="p-author h-card" href="…">Your Name</a> for an author. I thought I saw tantek say earlier it should be either a rel or an h-card, but not both.
#gRegor`Every time I think I *kind* of have mf2 down, some new case confuses me. :)
#gRegor`I don't understand why you add rel=author on a one-line h-card (like on your posts), but not on other h-cards, like this one I've set up in the <aside> element.
#gRegor`Is rel=author in combination with class=h-card saying "Go find the h-card over there"?
#gRegor`Because I was reading it as "this is the h-card"
#tantekgRegor`: rel=author only on the one-line p-author h-card inside the h-entry
#Loqiaaronpk: kylewm left you a message 1 hour, 27 minutes ago: am i right in reading php-comments that it assumes the author's h-card is embedded in the h-entry? i.e. 1 & 2 of http://indiewebcamp.com/authorship
#kylewmaaronpk: that was exactly my issue with it with mf2util
#kylewmit's really nice that it runs quickly and has no dependencies
#aaronpkyep. so implementing the part of /authorship that involves more http requests will probably involve some sort of callback method where you can go do the http request yourself or defer it for later or something
#JonathanNealI’m still trying to understand webmentions. I was told they don’t have to rely on microformats (and I have nothing against them) but I’m trying to understand what fields must be sent in a webmention and how those fields are communicated without microformats.
#JonathanNealaaronpk: a mention is just the request and has nothing to do with whether the source or target exist? Or whether the source has certain content?
#aaronpkJonathanNeal: so you are correct that without microformats, you don't have a lot to go on when rendering a comment
#aaronpkJonathanNeal: yeah, you may receive a webmention request from an invalid URL for example
#KartikPrabhuhandling incoming webmentions is what I have heard used
dybskiy joined the channel
#JonathanNealSo for all colloquial purposes, the handling is known as a (web)mention, and the formalized protocol for “processing” or “handling” is part of the (web)mention spec?
#gRegor`or the source URL can return 410, if the content was removed. :)
jsilvestre joined the channel
#KartikPrabhuJonathanNeal: the notification is called a "webmention" (similar to a pingback) and has a spec as to what parameters it needs. The handling is not really formalised I think.
#kylewmKartikPrabhu: when we've talked about author verification before, the obvious thing was to accept mentions that come from only {the author's domain OR bridgy}
#JonathanNealDo webmention replies support replies to replies?
#KartikPrabhukylewm: how do you know the author's domain?
#KartikPrabhuJonathanNeal: they could. depending on how you parse the "source" page for microformats
#kylewmlike, u-url of the post is the same domain as the source of the webmention
#KartikPrabhukylewm: that would mess up bridgy wouldn't it?
#snarfedpetermolnar: you're right, i've seen that sometimes elsewhere too. sometimes it's because they don't have https://github.com/acegiak/Semantic-Linkbacks installed, but it looks like that site does have it...?
#GWGCommon practice is to use content-(format) for the different formats. I think I could switch to just having template parts for the differing headers and footers and a single content file to stitch them together.
#kylewmdoes it go through email? SMS -> email -> post?
#pfefferleGWG I am not sure if it simplyfies the code… because you have even more files in the end… if we assume that every file has a different header AND footer…
#tommorriskylewm: nope, it goes SMS -> HTTP POST webhook -> post.
#GWGNot really. Because in the absence of a specific file it falls back to generic.
#GWGAnd most post formats except standard use the untitled style.
#tommorriskylewm: Twilio can be set up to send you HTTP POST containing a blob of XML containing the content of an SMS. You can reply in the response body of the XML
#tommorriskylewm: when I text my blog post number, I get a response back containing the URL of the post.
#pfefferleGWG that depends on the taste of the designer/coder
#tommorrisEspecially if you can find someone who works for Twilio - they’ll often be able to give you $25 worth of credit if you are hacking on something
#rascultwilio keeps emailing me they want to support me!
#tommorrisso, the grand plan which I haven’t had time to do is to do Dodgeball style checkins via Twilio.
#pfefferleGWG sure, I am curious how it will perform...
#brettantek re: the reader subscription list stuff from yesterday. I understand your idea much better now and am totally onboard with the idea of using h-cards instead of the old style import/export patterns
#tommorrisI actually had reason to use Twilio recently - I went to France and had no roaming on my iPhone. I wanted to post something to my site, so I could actually post it from my £10 Nokia 1000 phone while roaming in France.
#bretan outline model is not necessary here. tagging/category is much more flexible
#tantekany other backup Portland hosts for tonight? Bret?
waltz joined the channel
#bretim a bit burnt out to host another tonight with os bridge all last week, indiewebcamp during the weekend and then code for portland org meetings this week
#tantek" it is far from the “And once they see the power of my code, the people will rise up” bullcrap that typically dominates this set of conversations. " - love it!
#gRegor`Scoble on Facebook, "Filtered feed. Truth is this is a mixed bag. For me it's a HUGE deal because I have put thousands of hours into tuning my feed . . . " https://plus.google.com/+Scobleizer/posts/ZSJzgnvKaWy
#tantek"Every presentation I saw focused *heavily* on user experience, whether it was on IndieBox, or Known, or IndieAuth." - well done IndieWebCamp Portland!
#gRegor`Imagine if he'd spent, say, 1/10th of that time on his own site.
#gRegor`Someday when Facebook screws him over, he'll have lost thousands of hours.
#tantekgRegor`: perhaps start a "Apologists" section on /Facebook and cite that Scoble commentary?
#tantek(and the irony of it being posted on Google+)
#aaronpkand then is easy to demonstrate when someone here does something with better UX on their own site
#gRegor`I was just surprised by the face he's put thousands of hours into it.
#peatI'm raising the flag to mention that I'm digging into the Teahouse theme today. Fixing links, a few styles, merging in some work that was done a couple of days ago (skinny, aaronpk, myself).
#donpdonpgRegor`: i was trying to figure that out too. i assume he meant hours of adding and muting the people that contribute to what he wants to read about.
#gRegor`peat: I was going to suggest setting the <p> margin to be top and bottom instead of just bottom. Spaces it out better from some other text with no margins, like the "See [[Main Article]]" links.
#peatThis includes the original logo assets (AI files) and such. :)
#gRegor`peat: Is there already a wiki page with all the different wiki components to test against? Like all headings, paragraphs, <code>, <pre>, etc?
#peatgRegor`: No, not yet. A lot of the stuff I'm stumbling over has to do with wiki controls (eg: tabbed navigation) and fun with microformat markup and nesting.
#peatgRegor`: It's all been pretty easy to fix, though.
#peataaronpk: I don't have a test environment set up on my laptop, so .. uhh. yeah. those are all changes from the other day, so I think they should work. Haha.
#tantekHow do I see it? I'm refreshing indiewebcamp.com and don't see it!
#peattantek: Check out the "Teahouse" theme in Appearances, in your perferences.
#kylewmtantek: when you were talking about having a reading on your own site (our own sites), are you thinking my main view when I log into my site would be a stream of my friends, a la social media?
#kylewmI might be in the minority of thinking their UI improvements have generally been good
mdik joined the channel
#tantekkylewm, some good, others, nothing but distractions designed to increase traffic, visits, clicks etc. all that usual free-service-keep-you-looking-at-ads crap.
cweiske joined the channel
#gRegor`kylewm: I just miss some of the simplicity. Multiple clicks to get from my stream to someone's profile now
#gRegor`another click to see "Tweets and Replies" instead of just whatever selection Twitter chooses on their profile
#gRegor`the old-old ability to choose whether to see others' conversations even if you only followed one half of it.
#gRegor`In the early days, half of how I found new interesting people to follow was catching half a conversation and checking out who the other person was.
#gRegor`It used to be a feature you could select to see only conversations where you followed both parties, or "all" at-replies.
#aaronpkif you specify exactly one authorization_endpoint and no other providers (github, sms, email, pgp, etc) then yes that probably makes sense
#aaronpkhowever, what happens if you change your authorization endpoint?
#aaronpkif indieauth.com has to make an http request every time to your site, it ends up feeling slow and you get annoyed
#aaronpkthat's why I made it cache the list of providers and require clicking "re-scan" in order to find any changes from your site
#cweiskewhen logging in via openid, I don't even get a login prompt since my openid server stores the login cookie for a week
#cweiskewith indieauth.com I would have to select my provider
#aaronpkI would be more inclined to do something like that
#aaronpkwhere indieauth.com would store a cookie and skip even validating with any provider
#aaronpkbut it would have to be based on the combination of client_id, redirect_uri and scope, so that if a new app wants to authorize you it would prompt you still
brianloveswords joined the channel
#aaronpkalso keep in mind that this is an optimization being done at the indieauth client level, so every indieauth client may behave slightly differently for you
#aaronpke.g. https://quill.p3k.io doesn't use indieauth.com, it implements an indieauth client directly so it behaves quite differently
#aaronpkso while these are good suggestions, the end result is that will solidify indieauth.com as the best implementation of an indieauth client, causing more people to use it, making it look more and more like a silo
michielbdejong joined the channel
#cweiskeyou can provide a clean indieauth protocol specification to help preventing that
#aaronpkyes, but it's still a ton of work to build one
#aaronpkthe feedback i'm hearing from GPG people is they all assume i'm doing something with key servers and checking the contents of the key and such... it's really much simpler than that and I hope that's ok
#rasculwhy would you check the contents of the key?
#rasculsure, but it wouldn't work for signature verification
#michielbdejongrascul: if i get control of your webserver, then i can publish a new public key which i generated, and to which i (not you) have the private key
#rasculmichielbdejong oh now i see what you're saying
#michielbdejonggRegor`: oh, that would be weird. don't know about that, though.
#aaronpk"This is why PGP keyservers are networked for synchrony. If one has it, they all have it. Publishing one's fingerprint far and wide (say, in the .signature appended to one's e-mails) makes it more difficult to substitute a public key with a fake."
#gRegor`michielbdejong: e.g. http://pgp.mit.edu/, though looks like https is available there too
#aaronpkif someone has access to your web server, they can sign in as you. whether that's by swapping out your public key, changing the link to a github profile or email address, etc
#aaronpkGPG has a mechanism to protect this, a way to distribute keys all over so that you have more places to verify them
#aaronpkso me implementing more of the GPG stuff has little benefit for indieauth.com because there is still the potential to attack via other methods
#gRegor`I think so. With the important caveat that if your key is available over http, they don't have to compromise your server to impersonate you, just MITM your site. I'd be concerned about someone new to indieweb / crypto putting a GPG key on their non-secure site.
#rasculaaronpk well it's still another mechanism that doesn't rely on a third party service
#kylewmgRegor`: that's true of all the indieauth methods right?
#cweiskewhich is diametral to indiewebcamp that wants the homepage for everything
#aaronpkwhat would make sense is adding stuff like "it looks like you're tryign to use a new provider, we'll need an extra check before you can continue"
#rasculyes spdy, hsts, fs, sni and all that good stuff
#aaronpkor "last time you signed in as github.com/aaronpk, you'll need to re-verify your domain in order to change to signing in as github.com/attacker"
#cweiskeit gets more complicated with every thought
#aaronpkanyway I think I'm sufficiently convinced that there's no need for me to bother with gpg keyservers
#aaronpkand at the point where I am worried about preventing the attack where someone takes over the website, I will continue to think about it further
#gRegor`yeah, I think it adds a lot of complexity for not much value
#aaronpkfor now, it is a known quantity that gaining access to the web server will allow the attacker to impersonate the site owner
#aaronpkof course signing in is not the only attack someone could do. they could update past posts and re-send webmentions to change the contents on the target sites, fake new posts, etc etc
#tantekaaronpk - exactly. as soon as someone has control of someone's server i.e. through their web host control panel etc. that's a much worse compromise than indieauth
#bearin the realm of GPG web of trust - you *must* not trust a public key (hashed or otherwise) unless you trust the people who have signed the key and you verify that by pulling down from a key server the full key
krendil and paulcp joined the channel
#JonathanNealWould someone help me understand why indiewebcamp might require I re-authenticate after a relatively short period of inactivity? Am I perceiving things incorrectly? Or is there a great rhyme or reason to this?
#aaronpkit's cause i can't find the mediawiki setting for it
#aaronpkif you go to your user preferences there's a "keep me signed in" checkbox and you'll never have to sign in again
#KartikPrabhuaaronpk: oh! so you either log in everytime or stay logged in forever!
#KartikPrabhusays this with no idea of how hard it might be
#aaronpkwonders if he should also attempt to upgrade the microformats wiki at the same time
#JonathanNealWould there be a secure way to login without authenticating off site? Like, could my site contain its own session token that tells you I am indeed who I say I am?
#aaronpkJonathanNeal: that's basically the gpg auth
#gRegor`ben_thatmustbeme was working on upgrading the mediawiki version, I believe?
#cweiskeJonathanNeal, my indieauth-openid auth provider does this
#JonathanNealThat seems promising then. I would much prefer to put my own site’s login behind lock and key, and let every other site be password free without even selecting an additional authentication method.
#cweiskeJonathanNeal, I also like to have the auth on my side and don't like selecting auth methods
#cweiskewhich is why I wrote my own indieauth implementation :)
#kylewmcweiske: when you log into the wiki it will still send you to indieauth.com and give you the option to authenticate with your own authorization_endpoint provider?
#tantekcweiske++ for writing his own indieauth implementation
#Loqiaaronpk: tantek left you a message 32 seconds ago: yes on upgrading microformats wiki at the same time. Will also have some plugin compatibility testing to do.
#cweiskeseems I found a way to send webmention spam without getting caught as duplicates :)
#tantekcweiske, if you're up for doing spam testing, please start gently. 1-3 maybe rather than 1-10k. And preferably with someone who has explicitly opted in as a spam-test-target. :)
#shepazuJonathanNeal, if there isn't, I could make one in about 5-10 minutes
#tantekhaha "SVG" as hot-keyword for summoning shepazu ;)
#tantekshepazu - is there a service for making "comicbook" versions of avatars (i.e. upload JPG/PNG) in SVG?
#shepazutantek, don't know of one, but I'd love it
#shepazutantek, it's actually not trivial to convert a PNG to an efficient SVG
#shepazuthere are apps, but it's not terrible smooty
paulcp joined the channel
#tantekshepazu I figured of all people you would know. Plus it would be fun way to promote SVG adoption (since people like cartoony-avatars of themselves)
#tantekwhat if you also put a mini inline facepile of the avatars of those who had left marginalia on that paragraph, immediately after/inline with the comment icon.?
#tantekso just by scrolling, you could see the faces of those who added marginalia on each paragraph - no need to show/hide or anything
#tantekthat way if someone in particular that you like to read said something, you would know to open it up
#tantekor say, if *a lot* of people left marginalia on a paticular paragraph
#Loqitantek meant to say: or say, if *a lot* of people left marginalia on a particular paragraph
#KartikPrabhutantek: the problem is the "lot" of people. This is not scalable in any sense. I don't want 50 faces after a paragraph interrupting the reading flow
#KartikPrabhudoes not expect 50 margin comments anyway
#tantekKartikPrabhu: so you cap it at 6 (like Twitter) or some other number
#tantekKartikPrabhu: anyway - just some thoughts - I find that UIs with faces like that are much friendlier, more humanizing, and the little splash of color at the end of a paragraph would help break up the b&w
#KartikPrabhutantek: of course. It just happens that that idea might not go with my design tastes. But I would like to see more diff. ways of doing it :)
#tantekKartikPrabhu: because it still feels too hypothetical / handwavy. If I was implementing it myself (even planning to soon) then I might capture it on the wiki.
#KartikPrabhuanother reason I am reluctant at the moment, is that the facepile is very site-specific (who know where the avatar is.) I want to have some generally usable thing first
#tantekKartikPrabhu: I'd probably just use an inline style= attribute to size/align the image
#shepazuJonathanNeal, can you ack that you got it?
#tantekbret - did you pick a bar for an informal PDX HWC tonight?
#tantekor dietrich? any chance of hosting @MozPDX?
#KartikPrabhutantek: I am not sure if my HTML cleaner gets rid of inline styles! Will be a really good test case.... looking forward to it. Along with fixing some webmention verification issues
#tantekso you can get the mexican food delivered to you at the bar, and then use the bar's bathrooms so you don't have to walk through the other club.
#brettantek the way portland works is that everyone leaves downtown at 5 XD. aaronpk and I met up and ford food and drink the other weekend and had a few people show up
chrissaad, paulcp, willnorris_, gRegor` and KartikPrabhu joined the channel
#willnorris!tell tantek, could you release your NewBase60 implementation in Cassis under a “traditional” permissive license (Apache, MIT, BSD, etc). I’m getting a lot of pushback over the BY-SA license from Google lawyers in trying to release my Go port.
#Loqitantek: willnorris left you a message 50 minutes ago: you release your NewBase60 implementation in Cassis under a “traditional” permissive license (Apache, MIT, BSD, etc). I’m getting a lot of pushback over the BY-SA license from Google lawyers in trying to release my Go port.