KartikPrabhutantek: one naive I idea I had was, when A sends a webmention to B, A could include a "secret_code" in the POST request, which B can use while using GET to verify the mention by A, then A allows access only if the secret_code matches .... ?
tanteki.e. if I set secret_code to same as target, then I can webmention EVERYONE and simply include a temporary link to secret_code in EVERY response to a query with a secret_code
tantekreceiver does a GET with the secret_code in it, and sender includes in the reply a custom HTML page that includes a link to secret_code which happens to be the same as target. then receiver goes oh there's my target, verified.
KartikPrabhutantek: aaah i see, if the sender changes the HTML based on secret code... yes, it is a spam waiting to happen... i did not think of that :)
KartikPrabhudid not follow that discussion but for me "context" is posts that this post is in response to, and "response" is the responses to this post
KartikPrabhuben_thatmust_1: not to worry, you guys can decide the "best" terminology for the wiki and I can keep using what makes sense to me on my site #indieweb ;)
ben_thatmust__tantek, reading back on this vouch stuff now... haven't gotten all the way through it, but wouldn't it only take one person who has auto accepting webmentions to be able to spam everyone in their friends network
ben_thatmust__or rather, once one spam link gets it, it could spread to all that site's friends, and then that sites, friends. and once that is accomplished you basically have the task of trying to fight a virus
ben_thatmust__i think an XFN 'friend list' would be useful, then you know its not some errant link or a "look at this site, its funny but also has spam" link
ben_thatmust__well yes, but i mean, its annoying if i want to send a message to someone or worse multiple people, I have to look up their url constantly
ben_thatmust__/indieweb-messaging has you polling twice for every request. I really wish there were some way to say in the webmention 'this is a priv message, i'll need an auth key'
ben_thatmust__alternatively i could just always include the auth keys when polling from a site I have a key for, but then i don't know what ones are private or public
ben_thatmust__certainly, just need something standard for that. I know a number of people don't like to do things in the http headers as they cannot do that on static sites, but it could be done in meta tags or in microformats perhaps
KartikPrabhujust like I don't go back and see if my comment passed moderation or not, it is unlikely that i'll go back, look for a suitable vouch and resend a webmention
tantekit's dynamic because every day people you've linked to in the past, themselves link to new folks all the time - thus dynamic. even if you're not doing anything yourself.
tantekit won't stop people you sort of know from spamming you - the response to that is to give them a hard time socially. that is, if you have a social tie with them already, them spamming you is straining that social tie
LoqiWhisperFollow is a WordPress based social reader create by acegiak that currently supports H-Entry, RSS, Atom and PubSubHubbub http://indiewebcamp.com/Whisperfollow
voxpelli!tell tantek,barnabywalters,kylewm My quick stab at a web component using X-Tags can be found here: https://github.com/voxpelli/indie-action-component Not sure if X-Tags is the right way to go, Polymer might be preferable. (Or perhaps a non-Web Component polyfill)
Loqivoxpelli: barnabywalters left you a message 8 hours, 25 minutes ago: did you publish your indie-action webcomponent code anywhere? I’d love to add it to shrewdness for people who don’t have micropub enabled!
Loqivoxpelli: tantek left you a message 8 hours, 12 minutes ago: could you provide the URL where you have (had?) <indie-action> markup plus web componenets support e.g. with reply and pay actions?
voxpelli!tell kylewm Regarding how to fallback if no indie configuration is present, I believe one would have to use a timeout on the request, but perhaps there are better ways.
Loqibarnabywalters: voxpelli left you a message 6 hours, 4 minutes ago: My quick stab at a web component using X-Tags can be found here: https://github.com/voxpelli/indie-action-component Not sure if X-Tags is the right way to go, Polymer might be preferable. (Or perhaps a non-Web Component polyfill)
tantekben_thatmustbe: in general you should NOT put rel=nofollow on your links - that's the point - you're linking to something you think has relevance and that someone you're likely ok with commenting on your posts
Loqitantek: voxpelli left you a message 6 hours, 10 minutes ago: My quick stab at a web component using X-Tags can be found here: https://github.com/voxpelli/indie-action-component Not sure if X-Tags is the right way to go, Polymer might be preferable. (Or perhaps a non-Web Component polyfill)
tantekben_thatmustbeme: what vouch adds is the implicit "ok to comment" on people that your links themselves link to, which is a reasonable approximation. It's unlikely that those you link to themselves link to spam.
barnabywaltersacegiak: strange. It’s worth fixing regardless, as that conditional will always fall back to $page as it is :) Other than that I can’t see what might be wrong
barnabywaltersacegiak: btw, mf-cleaner also has some functions for more robustly getting microformats properties, e.g. rather than assuming e-content with $mf[‘properties’][‘content’][0][‘html’], M\getHtml($mf, ‘content’, [optional fallback]) will look first for [‘html’], falling back to html-escaping the value if it’s a plaintext property
ben_thatmustbemetantek_ tantek___ that all makes sense to me, i'd make sure to note that the vouch could also be a link from within your own site as well. if I linked to an article, i may not record that, but i'd still want to accept mentions from them. Also note that this really only works as a generated white list, its just a first level to spam filtering
barnabywaltersacegiak: I think netbeans does interactive PHP debugging quite well, but my favourite is jetbrains PHPStorm, which you can get a free copy of if you’re working on open source software
cuibonobobarnabywalters: i don't, but i'm specifically interested in how to get lower-income people on the indie web so it seems like a good entry-level option
barnabywaltersI’m also cautiously interested in whether the various free domain name registrars could be used to make it easier for people to get on the indieweb
barnabywaltersif they have an API for registering domain names, hosted services like known could offer free signups with your own domain name, completely config-free
barnabywaltersas far as I can tell, if you don’t pay you can register them for up to 12 months, and then renew for free two weeks before the end of the renewal period
barnabywaltersif nothing else, it would be a wonderfully compelling demo, to actually have a working “sign up for a personal website” service with a single field
cuibonobook. i'm researching the dot TK company in particular. seems like the government of Tokelau gave them exclusive registration rights for their country, and any proceeds will go toward development projects on the Islands of Tokelau
petermolnarI have a long-shot idea: what if there really was a tld domain, with as much free entries as many DNS servers you're willing to host to serve the tld zone?
cuibonoboother revenue streams for dot TK include a $75 a month subscription service for brand protection to make sure trademarked stuff isn't squatted on
barnabywalterscuibonobo: .tk also charge huge amounts of money for very short domains (e.g. if tantek wanted t.tk he’d have to shell out thousands of $$$)
cuibonobobarnabywalters: and i got a 502 error the first time i clicked the confirmation link. hardly the kind of infrastructure i'd like to make an app depend on, but it's free!
ben_thatmustbemecuibonobo, eventually I want to make my own auth endpoint, which will warn you if you don't have an auth endpoint specified. OR if you are getting there and it isn't your proper endpoint.
LoqiWelcome to news about the IndieWeb where recent notable articles about the IndieWeb are cited and linked to keep you up to date http://indiewebcamp.com/new
Loqikylewm: voxpelli left you a message 9 hours, 29 minutes ago: My quick stab at a web component using X-Tags can be found here: https://github.com/voxpelli/indie-action-component Not sure if X-Tags is the right way to go, Polymer might be preferable. (Or perhaps a non-Web Component polyfill)
Loqikylewm: voxpelli left you a message 4 hours, 51 minutes ago: Regarding how to fallback if no indie configuration is present, I believe one would have to use a timeout on the request, but perhaps there are better ways.
Loqiaaronpk_: tantek left you a message on 9/30 at 1:40pm: all of tantek_ and tantek___ and tantek_otp are leftover connections from ?beta Join - server might need rebooting to let go of those connections.
davidmeadi think this is now the pain point of #indieweb - wrestling your content from silos and import it in a meaningful way to your blog. retaining the meta info & dates
davidmeadaaronpk: cool thing about yr ownyourgram & #indieauth was I just changed my homepage URL in Twitter bio to http://davidmead.withknown.com/, and it worked like a dream :-)
aaronpk_man google analytics is confusing the crap out of me, it's all different than it was 5 years ago. I think I might just turn it off on my site cause I don't even know what to look for anymore
aaronpk_methinks we're gonna see a lot of questions about "how do I ____ after I change my domain name" thanks to known providing subdomains by default
barnabywalterstantek: indeed, which demands some sort of identity check e.g. requiring a unique email address, and then (for example) limiting people to one free domain per email
Loqitantek meant to say: I'd like to see a way to bootstrap (in the general sense) to owning a new domain *without* previously owning an email or phone number.
tantekthe more people we have writing code to natively read/write HTML for the web for their apps, the more holes we poke in the theories that you always "need" XML/JSON/RDFa/databases/YAML/etc. for "storage" for all apps.
squeakytoy, chrissaad, catsup, a_ and emmak joined the channel
jancborchardthmm – tantek is erinjo around in this channel at all? Just wanted to let here know that our »Open Source Design« devroom for the FOSDEM conference in Brussels was accepted – and it would be cool to have her there: https://twitter.com/jancborchardt/status/517350150574837760
jancborchardttantek: thanks! Are you at FOSDEM at all? Or are there any other IndieWebCamp folks you think should attend especially the OS Design devroom? I’m already in touch with Brennan
jenmontes.comedited /personal-domain (+604) "/* Free Domain Registrars */ Added note about how ToS for free domain registrars could be dangerous" (view diff)
tantek! tell KevinMarks perhaps next time you have a timely tweet re: Ello, perhaps suggest that they add IndieWeb support per http://indiewebcamp.com/friendly
tantek!tell KevinMarks perhaps next time you have a timely tweet re: Ello, perhaps suggest that they add IndieWeb support per http://indiewebcamp.com/friendly
cuibonoboaaronpk_: i'm trying to understand the `vouch` extension. are you saying that you can vouch for someone if you have their site on a list where the link *does not* have rel=nofollow?
LoqiKevinMarks_: tantek left you a message 11 minutes ago: perhaps next time you have a timely tweet re: Ello, perhaps suggest that they add IndieWeb support per http://indiewebcamp.com/friendly
tantekI suggest that any hyperlinks in any statements from anyone in the logs who is *not* in /irc-people have rel=nofollow place upon them, so people can't use the logs for vouching
danlykeHeck, in moments of weakness I've linked to sites like sfgate.com and Huffington Post, it's quite possible that advertisers on those sites will spam me with WebMentions.
tantekif you get a well known brand trying to spam you, you can a) block them (black list), b) embarrass them by posting about it with a rel=nofollow link
ben_thatmustbemetantek, for that matter, the same is true of google though. Just because I link to google, does not mean i trust it as a vouch. google.com/+spam is under google's domain, but I am not about to trust anything from there
TysonBrooksKevinMarks: what were question were you answering from me? I just seen I had mIRC still opened and had a notification from you saying: "they do at http://stream.withknown.com/"
ben_thatmustbememy biggest concern with using any link i don't put rel=nofollow on is puts the burden on me to worry about who i link, rather than the other way around which was what this was for. maybe i am being overly cautious, but I see this as a shortcut through any extra spam filtering, so I want to make sure what is getting through is as clean as possible
tantekif you ever get a spam link via a vouch, go see who vouched for it, and then give them a hard time, up to and including replacing all your links to them with rel=nofollow
aaronpk_wouldn't it make more sense from a publisher perspective to have to explicitly mark up the links that *should* be used for vouching instead? (e.g. add markup to the links from people who *are* on irc-people)
tantekwhat's much more likely is that it's an old blog post, with a link to an expired/squatted domain, and your friend you linked to will be happy to be made aware of the link to fix!
danlyketantek, I'm not sure what bad actors we're going to be fighting, I'm just saying that blog authors are going to have to be selective about which external sites they allow to be vouch sites.
cuibonobotantek: indeed! i was only looking through the vouch extension to see if it somehow put less burden on the receiver's end, but sadly that isn't the case.
danlyketantek, the amount of malware attempts delivered through ads in sites I read (and potentially link to) is high, so I assume there'll be lots of overlap. But most of those ads are currently served via Ajax inclusion, not in the raw HTML.
ben_thatmustbemeokay, a spammer sets up a user account, twitter.com/spammer with rel=me back to their site. they send me webmention with vouch = twitter.com/spammer, I link to twitter.com/dissolve33 with rel=me
ben_thatmustbemethank you cuibonobo, perfect example. if i link to ello right now without a rel=nofollow, (i forgot) now anyone with an ello account can spam me
ben_thatmustbemetantek. its also non-trivial for you to verify that you linked to a site, not without storing every link you ever made that doesn't have a rel=me
cweiskeThe server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.
cuibonobotantek: mostly links to twitter profiles for authors. i found an article with a link to the cdc. i don't think they add nofollow to anything though.
ben_thatmustbemetantek, i would be fine with you implementing any non-relnofollow links, but I think it would be best to prefer an XFN list of some sort. as I won't implment it for all links
tantekBTW - ben_thatmustbeme only minor complaint about your /vouch write-up so far, you mixed up (swapped) A and B from my description in IRC which could be confusing
ben_thatmustbemetantek, exactly what i'm saying, but if someone grabs the wrong link because the only place i test for B->C is my XFN list, then they are SOL
aaronpk_so basically when someone joins, Loqi would do an "ACC" on their nick to find if they are registered with nickserv. If so, would then check the irc-people list and if they are present, would +v them.
tantekaaronpk - would it make sense to also only link / avatar people in the logs if their nick is registered? is there some way to capture in the logs "this person had +v when they spoke" ?
gRegor`sparverius: Yeah, there's a fair range of opinions on databases in the community. I'm fairly pro, but definitely see some good points on /database-antipattern
tantekit wasn't til at least (maybe?) a year later that people thought it was "cool" to have a shorter name. for me it was pure utility - initially you could tweet longer if your username was shorter. tweet length used to be 156 - length-of-username.
KartikPrabhunot really. he has criticised ello for exactly what he thinks is wrong with them, and he is providing an alternative to correct those wrongs
KartikPrabhui'm more interested in how the experience is rather than technical details. like if I post privately where is the post stored. If I post publically is it viewable on a URL. If so whose URL? Or is all of this stuck inside Heartbeat, in which case so much for freedom
bretim totally behind his vision, the problem is that its never been done, and its going to be a) super duper hard to and cost a ton of money and work to get anything remotely close to what is being called for in a short ammount of time and b) no proof of prior related work so I am afraid its all talk
cuibonobore heartbeat: i dunno. the maidsafe guys have been working on data decentralization for years and years to ensure that even if your computer is off, your public stuff will remain public somehow. color me skeptical
cuibonoboKartikPrabhu: they're in the middle of wrapping up their first test network. test net 2 is scheduled for this week, and i think 'the real thing' will probably deploy at the end of the year
GWGI know this keeps coming up, but if I don't hang around on silos, how do I know what to reply to on my own site if I want to engage with less independent people? Except I don't want to hang around on silos really
aaronpk_GWG: not sure what you mean? do you mean how do you find content from non-indieweb sites without actually having an account on a bunch of silos?
GWGaaronpk_: I still would like to get some more detailed feedback on the Wordpress stuff I've been doing. I keep missing that guy who comes in and was asking about it, davidmear, I think it was.
techlifewebGWG: sounds like you are a developer so anything where something existed that wasn't working so you decided you could do it better. Or you saw a need and filled it.
LoqiBitbucket is a source code silo and alternative to github as it offers free git (and mercurial) repository hosting for public and private projects for individuals http://indiewebcamp.com/Bitbucket