#indiewebcamp 2014-11-29

2014-11-29 UTC
gr0k joined the channel
#
wolftune
hi everyone! note: Snowdrift.coop fund-drive is now live https://snowdrift.tilt.com
#
wolftune
oh and since we're on IRC I should mention that our channel is #snowdrift
tantek_____ joined the channel
#
tantek_____
good evening #indiewebcamp
#
Loqi
tantek_____: thedod left you a message 4 hours, 45 minutes ago: in my example I assume all authors are using indiewebcamp sites. a solution that requires silos is a flawed one IMHO
#
tantek_____
!tell thedod are you now posting all notes/tweets/replies from your own site dubiousdod.org/indie and never directly to Twitter ? if so, add yourself to /ownyourdata#IndieWeb_Examples !
#
Loqi
Ok, I'll tell them that when I see them next
parzzix joined the channel
#
tantek.com
edited /IRC_People () "(-3329) Part of the point of this page is to have individuals *THEMSELVES* edit this page and add their URL *and* their icon. Undo revision 15765 by [[Special:Contributions/Fiatjaf.alhur.es|Fiatjaf.alhur.es]] ([[User talk:Fiatjaf.alhur.es|talk]])"
(view diff)
cmhobbs joined the channel
#
tantek.com
edited /IRC_People (+311) "emphasize please only add yourself, encourage others to add themselves instead of doing it for them"
(view diff)
cmhobbs, parzzix_ and amblin joined the channel
#
tantek.com
edited /Falcon (+140) "/* one-off person-area-tag reply to photo */ add a couple of area tag / image map references to feed into docs"
(view diff)
mdik_ and cmhobbs joined the channel
#
tantek.com
edited /antipatterns (+340) "increase findability of single-page-antipattern notes, add a couple of citations"
(view diff)
chrissaad, irdan, gr0k, colintedford, cmhobbs and snarfed joined the channel
#
snarfed
!tell parzzix sorry bridgy's seemed inconsistent for you! do you know if you're missing things entirely? (see https://www.brid.gy/about#missing ) or if they just seem delayed? it slows down a bit if it hasn't sent you a webmention for a while, down to once a day at the slowest, but speeds back up when it sends another, so it could be that.
#
Loqi
Ok, I'll tell them that when I see them next
snarfed and KevinMarks_ joined the channel
#
colintedford.com
edited /short-domains (+254) "/* Domains */ .us"
(view diff)
dariusdunlap_ and dariusdunlap joined the channel
#
colintedford.com
edited /User:Colintedford.com (+73) "/* For now */ mark done items re: comics nav"
(view diff)
reidab, Kopfstein and dariusdunlap_ joined the channel
#
owen1
is https://unhosted.org/ related to this channel? is it someone that is part of indiewebcamp?
#
colintedford
I'm pretty sure one or two of the Unhosted folks drop by occasionally.
#
colintedford
Looks like there've been a couple of talks on the topic at past IndieWebCamps, there'a wiki page about it. http://indiewebcamp.com/Special:Search?search=unhosted&fulltext=Search
#
colintedford
Hm, guess the page is just a stub.
#
owen1
colintedford: thanks. it seems like a very similar idea
#
colintedford
Yeah, I don't understand the unhosted stuff in detail but it seems quite intriguing & certainly related.
#
owen1
hi is basicaly say - host your stuff (;
#
owen1
own it, set up your domain, server, db whatever
KartikPrabhu joined the channel
#
colintedford
Yeah, I got the general idea :)
#
colintedford
I've read through a bunch of the posts at unhosted.org but the technical parts are mostly beyond me as a layperson.
#
owen1
i love the fact that you can almost copy paste his code
#
owen1
oh yeah. it's for developers. i think it's mostly node.js stuff, from the quick look i took
snarfed joined the channel
#
colintedford
Yeah. I look forward to seeing that stuff eventually become more accessible, though; sounded pretty exciting.
#
owen1
colintedford: interesting. i guess what's missing is instructions for non devs.
sammachin1, awolf, a__, sh4l, cmhobbs, brianloveswords, eschnou and KevinMarks__ joined the channel
#
KevinMarks__
!tell snarfed does a summary have to be a p-summary and not an e-summary? What if a not purely textual summary makes more sense? Could an image be a summary?
#
Loqi
Ok, I'll tell them that when I see them next
#
KartikPrabhu
KevinMarks__ do you mean featured image there? that would be u-featured
#
KevinMarks__
No, I'm thinking about summary in the broadest sense, that encompasses twitter cards and Facebook previews too
#
KevinMarks__
Summaries should be html
#
KevinMarks__
In the broadest sense - I can imagine a mathml summary
Deledrius, michielbdejong, j12t, loic_m, KevinMarks__, LauraJ, swartwulf, eschnou, KartikPrabhu, friedcell and squeakytoy joined the channel
eschnou and brianloveswords joined the channel
#
@hugoroyd
RT @FSFEfrance: Mardi 16 décembre, introduction aux technologies IndieWeb et au logiciel Known avec @benwerd chez @MozillaParis http://t.co…
(twitter.com/_/status/538675207872196608)
LauraJ, j12t, danlyke, eschnou, brianloveswords, dariusdunlap_, catsup, michielbdejong, chrissaad, cmhobbs, gr0k, friedcell and petermolnar joined the channel
snarfed joined the channel
#
snarfed
KevinMarks_: re p-summary, you're right, i was thinking narrowly based on the mf wiki and existing code (including bridgy)
#
Loqi
snarfed: KevinMarks__ left you a message 9 hours, 6 minutes ago: does a summary have to be a p-summary and not an e-summary? What if a not purely textual summary makes more sense? Could an image be a summary?
#
snarfed
i'd generally defer broader mf2 questions to you and others :P
tributarian, gr0k, snarfed, rootforce and wolftune joined the channel
mlncn joined the channel
#
www.kryogenix.org
edited /Webmention (+681) "Add Stuart Langridge to implementations list"
(view diff)
#
bret
woo hoo!
#
bret
Stuart Langridge, inventor of pingback, is hopping on the webmention bandwagon :D http://www.kryogenix.org/days/2014/11/29/enabling-webmentions/
#
Loqi
aaronpk: tantek left you a message on 11/26 at 3:54pm: could you create a stub FB POSSE event copy of
#
Loqi
aaronpk: tantek left you a message on 11/26 at 3:54pm: could you create a stub FB POSSE event copy of https://aaronparecki.com/events/2014/12/03/1/homebrew-website-club and rel-syndication link to it from your original? If you make me a co-organizer of it I can take care of adding details/fields etc. Thanks! -t
#
@aaronpk
@sil Congrats! This is exciting to see! #indieweb (http://aaron.pk/r4ZP1)
(twitter.com/_/status/538755296324096001)
loic_m and j12t joined the channel
LauraJ, friedcell and rootforce joined the channel
catsup, tributarian, gmack, gr0k, irdan, friedcell, nagaway and j12t joined the channel
#
bret
neat, jekyll is getting incremental regeneration
#
bret
should help with some of its scaling issues
gr0k and snarfed joined the channel
#
@sil
@aaronpk does https://aaronparecki.com/replies/2014/11/29/1/indieweb link to the root of my site rather than the post in question because I've done something wrong?
(twitter.com/_/status/538778017649414144)
Pea1 joined the channel
wolftune joined the channel
caseorganic joined the channel
#
@sil
What about hashcash for webmention spam (not Vouch)? Pass time_t & nonce, where sha256(target+time+nonce).startswith("000000") /cc @aaronpk
(twitter.com/_/status/538789224166993920)
aquarius joined the channel
#
aquarius
I'm sure someone must have already thought of this, but my google-fu is weak today. Wouldn't a hashcash approach be useful against webmention spam? So you POST source=http://source/article&target=http://target/whatever&time=1417292519&nonce=5684712, where sha256(http://target/whatever+1417292519) starts with "000000" and time is less than, say, five minutes ago? So it takes 5 seconds to generate the nonce, which
#
aquarius
makes large-scale spamming infeasible?
#
aquarius
Ahh, it's mentioned in the context of preventing a ddos, but not to stop spam generally, which I think it might at least help to attenuate?
chrissaad joined the channel
#
snarfed
aquarius: as usual with most problems like this, adoption is one of the biggest challenges at the beginning
#
snarfed
especially with something like hashcash spam prevention which needs both sides to implement it to be useful
#
bret
im not exactly sure, but vouch was the first spam prevention tactic because its more useful against the kind of spam first expected?
#
aquarius
snarfed, certainly, yeah. But there are not *that* many implementations of webmentions, yet, I believe.
#
snarfed
a fair amount, at least code wise if not instance wise. even the existing vouch design is only implemented in a few
#
aquarius
I personally worry very seriously about how I'd find a link that will vouch for me and is trusted by the target. Without the whole everyone-has-a-foaf-profile thing taking off, which it hasn't :)
#
snarfed
more importantly though, we don't really see native webmention spam yet, so the motivation is a bit weak
gr0k joined the channel
#
bret
the only WM spam so far has been pingback to WM gateway spam, and silo spam via bridgy
#
aquarius
oh, totally; part of the reason I suggested a hashcash thing is it's about three lines of code in everyone's send-webmentions function and another three in the endpoint and two extra parameters in the POST, rather than requiring a big social network :)
#
snarfed
sorry though, i should have said up front: hashcash definitely makes sense! if i have objections, they're not design or technical
#
aquarius
and if it's baked in at the beginning then it's easier than trying to get it adopted later :)
#
bret
i think hash cash would be cool to implement. plus it won't break form WMs..
#
aquarius
indeed not
#
bret
since you can hash cash with JS
#
bret
right?
#
snarfed
aquarius: what's your web site?
#
aquarius
kryogenix.org
#
snarfed
ah! cool, didn't realize that was you
#
bret
having functions isn't that hard, but we definitely want to be carful with crypto stuff as it has a tendency to make things hard/scary for new implementors (i.e. salmon)
#
bret
hasing*
#
snarfed
selfishly, i also shudder a bit at the cost it'd impose on proxies like bridgy
#
aquarius
bret, hashcash function: take a known string (above I propose time + target url), and then compute a nonce such that sha256(known string + nonce) begins with "000000" -- one sets the number of zeroes to control the difficulty of the hashing function.
#
snarfed
(but that's an externality, don't mind me)
#
aquarius
ah. Now, a prove-you-have-done-work idea such as hashcash will totally sod up proxies. Heh. :)
#
bret
snarfed: maybe a WM could take a vouch and/or cash
#
snarfed
people already whitelist bridgy, i'd probably just propose that
#
snarfed
yeah, basically
#
aquarius
vouch is clearly better than hashcash
KartikPrabhu joined the channel
#
aquarius
bridgy is popular enough that it can probably vouch for itself ;)
#
bret
you can't really vouch automatically with a form
#
bret
without external logic afaict
#
aquarius
yeah. I honestly can't think of a way that a script can vouch; it'll require manual intervention, which I am wildly against :)
cmhobbs joined the channel
#
aquarius
mainly because if I have to (a) find a vouch for each external link I put in a post or (b) just not put the external link in, I'll do (b), so it just disincentivises people to do the right thing :)
#
bret
i think barnaby was thinking about adding hash cash stuff to WM processing a while back
#
aquarius
also, it basically bakes "this is a clique" into the rules. It's like the web version of Mean Girls.
#
bret
aquarius: start stub subsection here http://indiewebcamp.com/webmention#Brainstorming
#
aquarius
but this is just how I feel about it :)
#
snarfed
aquarius++ on the clique point
#
Loqi
aquarius has 1 karma
#
bret
yeah i don't want mean girls/boys
#
bret
the best way to see it is to implement it... its going to break the WM curl workflow, but you can add it as a form with a JS hashing lib
#
michielbdejong
don't forget that the web is itself a clique. only pages that have inbound links are on the web, really
#
aquarius
definition of a clique: a thing that you are not in and which you will find it hard or impossible to join. The web is the first bit but not the second. :)
#
michielbdejong
i think it's useful to think about how a spammer would react to Vouch
#
michielbdejong
right, that's true.
#
michielbdejong
it should be effortless for a human to send their first webmention
#
bret
aquarius: i don't have much time this week, but could help put some html+js patterns into a git repo for creating a WM + hashcash form submissions
#
michielbdejong
if you have to get mentioned before starting to mention yourself, that's not so nice
#
aquarius
I can probably do something like that, yeah
#
bret
i can help to, but I need to finish this school quarter first ;)
#
aquarius
question: if someone has curl, which command line hashing thing can I pretty much also assume that they've got? python? openssl? (perl? wince)
#
aquarius
I'm an Ubuntu bloke, so I don't know what I can pretty much guarantee is there
#
bret
ermm
#
bret
there are a few webmention cli tools now for python and node
#
aquarius
oh, sure, and I'd be happy to add code to them
#
aquarius
I was thinking about the curl one-liner use case
#
bret
oh like piping it
#
bret
i dunno
#
aquarius
which it ought to also be possible to do with a hashcash thing
#
michielbdejong
"Hashcash was invented by Adam, back in 1997" :) http://hashcash.org/
#
aquarius
ya, this is hashcash-ish, what I'm proposing, not necessarily exactly hashcash :)
#
bret
aquarius michielbdejong, re the vouch network, in theory we could bootstrap vouches off existing silo graphs. no one has done it yet though
#
bret
IE linking to your twitter, your contacts there act as vouches
#
aquarius
does "echo foo | openssl dgst -sha256" work out of the box on a mac?
#
bret
i have dev tools buuuut
#
bret
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
#
aquarius
good :)
#
bret
which is.. not home-brew. but maybe xcode
#
bret
its not symlinked, which means its probably there by default, but don't quote me on that
#
michielbdejong
we could build a web page for it as well
#
bret
tbh, sending web mentions with curl one liners gets sorta complicated
#
bret
even without hash cash
#
michielbdejong
the default should be your CMS takes care of it, i think
#
bret
totally agree
chrissaad joined the channel
#
bret
ok i gtg for a bit
#
KartikPrabhu
reading back...
#
KartikPrabhu
vouch can be sent automatically
#
bret
from a html form?
#
KartikPrabhu
why not it is a parameter in a request
#
bret
requires finding a vouch link
#
bret
which could be easy or hard, depending on who you are talking to
#
KartikPrabhu
yeah, but it can be done
#
KartikPrabhu
also your reader software/CMS could find a vouch link for you
#
aquarius
KartikPrabhu, the form can't find one itself, I think is the point. You'd need two text boxes: one saying "what's your source?" and one saying "which URL vouches for it?"
#
aquarius
agreed that once you *have* a vouching URL, sending it is the easy bit :)
#
KartikPrabhu
no the form could find a vouch link for you
SRCR joined the channel
#
bret
CMS backed vouches seems the most reasonable interface
#
bret
for vouch sending
#
KartikPrabhu
I mean is 2 boxes a problem?
#
bret
its not the box, its vouch discovery
#
aquarius
ya. My objection to Vouch is that it's hard to find a voucher.
#
KartikPrabhu
yeah. the sender has to do some work to send a mention, that is the point
#
aquarius
It's not *automateable* work, though.
#
KartikPrabhu
aquarius: it is automateable
#
michielbdejong
i also think receiving a mention and displaying it are two different things. you could whitelist people, and put everyone else into a moderation queue
#
KartikPrabhu
vouch was made to avoid etensive moderation
#
aquarius
Srsly, if I want to drop a link into a post which says "thanks to this person", and I have to go and work out which of our friends we have in common and which one already links to me and already links to them, then I'm really just not gonna add the link, and so no credit or attention is given.
#
KartikPrabhu
aquarius: no.
#
michielbdejong
aquarius: good point
#
KartikPrabhu
you have to sent that person a webmention notification
#
KartikPrabhu
you can link to him all you want
#
michielbdejong
yeah, but it's nice to show up in the comments under the post
#
KartikPrabhu
aquarius: really!
#
aquarius
right, but the point of webmentions is to make the conversation automatically two-way
#
michielbdejong
the person would still receive the mention, and have the option to approve it for displaying
#
aquarius
so I become aware when the discussion is continuing elsewhere.
#
KartikPrabhu
sure. and automated systems are prone to spam. this is a way to avoid it if you want. Vouch is not a compulsory part of webmention
#
michielbdejong
aquarius: that problem is solved if you don't display comments
#
aquarius
michielbdejong, it's solved for *me*. It's not solved for others who want to join the conversation, right?
#
KartikPrabhu
what is "solved"?
#
aquarius
I read a post on your site; it'd be cool to see if that discussion you started carried on elsewhere.
#
aquarius
if you don't display comments then I can't do that.
#
michielbdejong
so how about, everybody publishes a list of people they follow.
#
michielbdejong
that would fix everything
#
aquarius
a blogroll, indeed.
#
aquarius
how would it fix stuff?
#
KartikPrabhu
michielbdejong: that has been suggested as a mechanism for vouch discovery
#
aquarius
in particular, how does a new person join the conversation?
#
michielbdejong
that is what's hard, yes
#
aquarius
that's why I don't like vouch.
#
michielbdejong
you need to be followed by at least one person
#
michielbdejong
that's what creates the threshold
#
KartikPrabhu
aquarius: do you siggest then that I should accept all in coming mentions?
#
aquarius
I understand that there are certainly some people who are only interested in hearing conversation and discussion from people they are already friends with, and that's fine -- but I think institutionalising that concept as the way it *has* to work to prevent misuse is short-sighted. :)
#
michielbdejong
KartikPrabhu: right now, that is still safe, yes. but it won't be next year, anymore, when spam starts
#
KartikPrabhu
aquarius: vouch is not instituionalised. it has been formalised as an option. you don't have to receive or send vouches
#
aquarius
KartikPrabhu, yep, and do post-moderation, in conjunction with something that makes it hard for spammers to affect you without specifically targeting you (hence the proof-of-work idea above).
#
KartikPrabhu
aquarius: the proof-of-work can also be vouch
#
KartikPrabhu
no one is saying you have to reject vouchless metions.
#
michielbdejong
aquarius: yes, i have to admit you're right :) it's just a captcha problem, really. the question is not 'do you have friends', but rather 'are you human'
#
KartikPrabhu
if a mention has no vouch then by all means add it to your moderation queue
#
KartikPrabhu
michielbdejong: no. the question is also about harrassment and trolling
#
aquarius
sure! I'd certainly go along with what snarfed (or bret) said above, that if you're vouched for, you don't need a further proof-of-work
#
michielbdejong
yes, so provide both mechanisms? either have friends or do work?
#
aquarius
but I think there ought to be a more friendly choice than the one between "manual pre-moderation", "get spam", or "be in the clique". :)
#
michielbdejong
KartikPrabhu: i don't see how we can fix trolling, that seems much harder. i thought we were trying to fix spam, first
#
KartikPrabhu
michielbdejong: aquarius: none of these are compulsory. if you want to have moderation, captcha, vouch you are free to pick one or all of them
#
KartikPrabhu
it is your site. do what you like
#
aquarius
KartikPrabhu, but there's no way to know what methods you accept
#
michielbdejong
aquarius: would you be willing to resolve a captcha to say "thank you for this post"?
#
KartikPrabhu
that is also my choice. I might publish my methods or not
#
aquarius
and hitting the endpoint twice for each wm (once to get a list and once to send a wm) seems fairly inefficient to me
irdan joined the channel
#
KartikPrabhu
aquarius: not each wm. vouch only happens the first time
#
aquarius
KartikPrabhu, it only happens the first time for a given website. However, I don't repeatedly link to the same website, 'cos the web is pretty big :)
chrissaad joined the channel
#
KartikPrabhu
and even with vouch you don't send 2 pings. if you are sending a mention to some site for the first time then just include a potential vouch the first ime
#
aquarius
michielbdejong, from the point of view of being prepared to do it, sure. From a *practical* point of view, it's harder, because my site is statically generated... so outgoing WMs are resolved at build time, which is me running "make rsync_output" in a terminal and there's nowhere to show a captcha :)
#
michielbdejong
aquarius: ok, that's a good point
#
aquarius
michielbdejong, if that were just a peculiarity of my setup then I think that's reasonable, of course, but I think this approach is common-ish -- there's not necessarily a convenient web UI around to show a captcha in. (It makes native clients a bit harder, etc.)
#
KartikPrabhu
a statius site could build vouch paramenters along with mention links
#
aquarius
KartikPrabhu, the problem from my point of view (maybe I'm misunderstanding) is that I have no way at all to know who out there might (a) vouch for me and (b) be trusted by you
#
KartikPrabhu
aquarius: what if someone comes along and objects to proof-of-work as being to cliquie-y?
#
KartikPrabhu
aquarius: yes. <shrug>
#
aquarius
KartikPrabhu, the clique problem is that it's hard to get into the clique and that's not something that you personally can fix.
#
KartikPrabhu
yeah proof-of-work is too hard
#
michielbdejong
i guess my only objection to hashcash is environmental, it wastes electricity
#
aquarius
I personally don't like approaches where I'm locked out and there isn't anything I can do about it; it's a popularity contest. The school playground writ large. :)
#
KartikPrabhu
aquarius: so don't use them.
#
aquarius
michielbdejong, it does. Not all that much, but I agree with you. I am, however, prepared to bet that I can hash a thing faster than you can find someone who will vouch for you and whom I trust, which also uses electricity ;)
#
michielbdejong
aquarius: otoh, you are talking about whether someone else will display what you write. that's not automatic. it requires a bit of playground politics.
#
KartikPrabhu
aquarius: you can use proff-of-work if you'd like. I can use vouch if I want
SRCR joined the channel
#
KartikPrabhu
also even if I accept your webemntion. there is no guarantee that i'll show it
#
michielbdejong
maybe relates to KartikPrabhu's troller point - maybe it's not just about whether your human
#
KartikPrabhu
I mean you accpet human moderation (the most clique-y and playground politics mechanism) but you don't like vouch!
#
aquarius
KartikPrabhu, totally! That's what I was trying to explain above, but I may have done it wrongly. If you prefer to only display an engagement in conversation with people you already trust, that's cool. What I'm trying to avoid is Vouch being basically the only game in town other than horrific spam. :)
#
michielbdejong
KartikPrabhu: when i say 'accept' i mean 'display'. I will receive all mentions in my inbox, which I can read privately
#
KartikPrabhu
aquarius: I don't implement vouch. not needed it yet
#
KartikPrabhu
michielbdejong: yes. I can recieve your webmention with proof of work, with vouch and choose not the display it.
#
aquarius
michielbdejong, your point about playground politics is well taken. I suppose I think of WM as being about making links bi-directional
#
KartikPrabhu
webmention is a notification. not a contract
#
KartikPrabhu
aquarius: it is. if the receiver displays your post
#
michielbdejong
another option would be to display different mentions in different sizes, the spam ones behind a 'more ...' link
chrissaad joined the channel
#
KartikPrabhu
michielbdejong: how do you decide which is spam?
#
michielbdejong
KartikPrabhu: i'm undecided between social graph and proof-of-work. maybe a combination
#
aquarius
yeah -- the idea of applying degrees of trust to incoming mentions seems perfectly doable for someone who wanted to go that far (plain mention: trust level 1, hashcashed: trust level 2, vouched: trust level 3, etc)
#
KartikPrabhu
if you have decided something is spam, then why show it
#
KartikPrabhu
increasing the noise in your posts's discussion?
#
michielbdejong
KartikPrabhu: just the principle of supporting two-way links
SRCR joined the channel
#
KartikPrabhu
michielbdejong: really!? you want to link to spam posts out there?
#
michielbdejong
if i actively decided something is definitely spam then, i would delete it of course
#
michielbdejong
but i want to leave the default open
#
KartikPrabhu
also the proof-of-work concept needs a lot of techincal know-how, and won't be great for a beginner anyway. It is almost as clique-y. with the clique now being people who uinderstand this
#
michielbdejong
KartikPrabhu: true that. except if you use a CMS like Known
#
KartikPrabhu
michielbdejong: then what is the point of having automated alogrithms if you will manually moderate everything anyway
#
michielbdejong
i think it's time indieweb grows beyond homebrew
#
KartikPrabhu
michielbdejong: then I can use my CMS and proof-of-work to send spam to people
#
michielbdejong
KartikPrabhu: yes, but it will cost you $$$
#
KartikPrabhu
wait so sending proof-of-work costs money?
#
michielbdejong
KartikPrabhu: yes
#
KartikPrabhu
ok. I'm out
#
michielbdejong
it's CPU time
#
aquarius
I agree with that know-how point, certainly. I'm not *sure* that there's a big gap between "people who understand a curl command line" and "people who understand how to call a sha256 function", but there is potentially a gap there. (I am assuming that "people who don't understand the curl command line" will be using some sort of library or existing CMS which handles it for them.
#
KartikPrabhu
aquarius: sending a webmention does not require you to know curl
#
KartikPrabhu
you can do it through a form
#
aquarius
KartikPrabhu, not actual money. CPU time, which is of minimal impact to you sending a webmention, but is a much bigger problem if you want to send a million webmentions.
#
michielbdejong
aquarius: I'm not here to free people who can already use curl. Programmers are born free. We need to build the open web for all the other Earthlings
#
KartikPrabhu
aquarius: yes. I'm out still. CPU time specially on hosted shared servers is not cheap anyway
#
KartikPrabhu
so much for being beginnner friendly
SRCR joined the channel
#
michielbdejong
exposes his background as a fedsocweb dreamer
#
aquarius
KartikPrabhu, yep -- that form will submit to a webmention endpoint which will then show the user JSON. If you are knowledgeable enough to submit the form with JS, then I would suggest that you're also knowledgeable enough to include a simple JS library.
#
michielbdejong
KartikPrabhu: it's true that although it's money, probably a cost of like 0,01 USD per mention is enough to deter spammers
#
aquarius
michielbdejong, if one's using a system which does WMs for you, having the system author (who does understand this stuff) add a couple of lines of code to the library is in my thoughts not a problem.
#
aquarius
KartikPrabhu, think of it as a time constraint: if it takes you five seconds to send a WM, then it doesn't affect you much, but it means that a spammer can only send 12 a minute, not 12,000 a minute :)
#
michielbdejong
aquarius: i agree. i'm interested in the CMS case. End users uses Known. Known takes care of everything.
#
michielbdejong
still, spending CPU power is not ideal
#
aquarius
there is some tuning to be done in terms of "make it easy enough that it doesn't significantly affect real people" and "make it hard enough that you can't do it a million times".
#
aquarius
not sure there will ever be One True Answer here, of course. :)
#
michielbdejong
and there's the uncertainty if the receiver will even require the proof-of-work. you may be doing the work for nothing, if they were going to accept it anyway.
#
michielbdejong
ok, i have an idea
#
michielbdejong
proof-you-are-human.com
#
aquarius
this is true, but I think I'd suggest that asking them *if* they'll accept it is more impacting than doing the work :)
#
michielbdejong
you do the proof of work, and it can be your vouch
#
aquarius
sneaky.
#
michielbdejong
CMS systems whitelist proof-you-are-human.com by default
#
aquarius
so we just do vouch as before but build a site which autovouches
#
michielbdejong
so we built hashcash into Vouch
#
aquarius
that way it's all built on vouch
#
aquarius
eeeeeeenteresting
#
michielbdejong
no more playground politics barrier
#
aquarius
it feels -- this is not as much of a criticism as it sounds -- it feels a bit like a hack. Like the sort of thing you'd do if we'd built vouch two years ago and it was the standard rather than something done at the beginning before there are standards. :)
#
aquarius
but I'm not sure that's necessarily a *problem*
#
aquarius
and it's quite a neat hack -- it hacks the concept rather than the code :)
#
michielbdejong
yes, see your point
#
michielbdejong
but it keeps complexity inside one URL
#
michielbdejong
someone else might propose a captcha-based or whatever-based enter-the-playground site
#
aquarius
mmmm, I like it
#
aquarius
so if you think "man, finding vouchers is hard", then you set up "do-this-$thing.com" and if everyone agrees that your $thing is difficult enough, they'll whitelist you.
#
aquarius
schneaky.
#
michielbdejong
and if it turns out that spammers start showing up on do-X.com then it will get downvoted again
KartikPrabhu joined the channel
#
www.kryogenix.org
edited /Webmention (+382) "/* proof-of-work addition to webmention to help avoid spam */"
(view diff)
#
KartikPrabhu
aquarius: I am not submitting a form through JS. It is just an HTML form
#
aquarius
KartikPrabhu, that is of course fine. My concern with doing that is that a WM endpoint returns JSON, as per spec. So if you submit an HTML form in the browser to a WM endpoint, your end user gets a screen of meaningless technical gibberish.
#
KartikPrabhu
no. my webemntion end point just return plain text
#
KartikPrabhu
Another point is right now I have a "send me a link to your reply" under my posts. I can easily add a vouch parameter to it, but I can't do that with proof-of-work. example of such a form: https://kartikprabhu.com/notes/helvetica-mcdonalds-erikspierkermann
#
KartikPrabhu
using this, people who don't have automated webmention sending can also send me a webmention (and adding vouch to this is not hard)
#
aquarius
Adding a proof of work to that form is a few lines of JavaScript. I understand that you might not want to do that, though, which is fine.
#
KartikPrabhu
wait you want the readers browser to run hash-computing javascript!?
#
aquarius
for a couple of seconds, yep; but as I say, not everyone wants that, of course.
#
KartikPrabhu
also, if I accpet vouch and someone does not send me one, I can return a nice response saying "I don't know you. Could you also send me a link that links to your site that you think I might trust?" How do I do that for proof-of-work ? people know what "find a link is" but not "do this hash thing on your CPU..."
#
aaronpk
i think it's important to note that vouch doesn't require the vouch URL support webmention or any sort of additional markup
#
aaronpk
it's literally just "find someone who linked to me"
#
michielbdejong
KartikPrabhu: that response will not be displayed to the end-user, necessarily
#
KartikPrabhu
michielbdejong: then it is not user friendly. you didnt tell me why this thing failed
#
aquarius
aaronpk, certainly; what worries me is that I don't know how to easily find someone who links to me and is trusted by you.
#
KartikPrabhu
aquarius: if you are on the /irc-people list then you have one right there...
#
aquarius
KartikPrabhu, "I don't know you, so I need to establish that you're not a robot. Could you fill in this captcha, or press this button and wait five seconds, while I verify you are prepared to do work?"
#
michielbdejong
KartikPrabhu: define failed - the webmention was sent successfully, the receiver chose not to display it very prominently
#
aaronpk
ben_thatmustbeme had some code that would help find a URL I think
#
KartikPrabhu
aquarius: I don't like the "running a script on the users browser part" who know what your script is doing
#
KartikPrabhu
michielbdejong: my comment is not being displayed you should tell me why
#
aaronpk
(aquarius: just wanted to get that reply on the twitters, I know we're talking about it here)
#
aquarius
aaronpk, equivalent problem: find someone who will tell you my mobile number. We're both reasonably visible, reasonably well-connected web people; we know a bunch of the same friends. If you wanted my mobile number, you could find it through a chain of friends. But you know of no efficient way of doing so -- you basically have to ask people we might both know at random
#
aquarius
aaronpk, ha! I just wrote that :)
#
aquarius
oh, right good :)
#
aaronpk
yeah that's a good analogy
#
aaronpk
here's the current brainstorming on how you'd find a vouch URL http://indiewebcamp.com/Vouch#How_can_a_sender_find_a_vouch_link
#
aquarius
Yeah. It basically assumes that there is a vouch URL out there to be found -- that is, that A and B would happily trust one another but they just haven't got round to it yet
#
aquarius
which means that it, in my opinion, blocks new people from entering a conversation.
#
KartikPrabhu
aquarius: have you encountered such a situation?
#
aquarius
(not new to the conversation: new to the social group)
#
KartikPrabhu
sounds like pre-mature optimisation
#
michielbdejong
so that's where proof-you-are-human.com comes ing
#
aquarius
KartikPrabhu, yep. I get @mentioned on twitter by people I do not know and have never heard of, but who follow me, *all the time*. And mostly their conversation is valuable to me.
#
KartikPrabhu
ok then follow twitter model and accpet all mentions
#
aquarius
michielbdejong, yep. I like that idea. :)
#
michielbdejong
KartikPrabhu: accept != retweet
#
KartikPrabhu
<sigh> sounds like a indieweb silo to me <shrugs?>
#
KartikPrabhu
michielbdejong: I didn't say retweet
#
KartikPrabhu
do you moderate twitter replies? twitter @-mentions, twitter favs?
#
michielbdejong
but webmention is about displaying comments. that's why the spam problem is even real
#
KartikPrabhu
webmention is about notifying the other person
#
aaronpk
i'm wondering if Vouch would still work in that case. Because it's not like you have to link to people first before you accept their webmentions
#
aquarius
Twitter put some effort into removing spammers so that I don't have to do it manually. Nobody is doing that for my site other than me, and in a world where we don't have big central organisations who can get a sense of everything that's going on and detect spam through big data, I think it's important to make it a bit harder to spam.
#
aaronpk
aquarius: so up until a couple days ago, you never heard of me and never linked to me. But I can go look at your Twitter page and scan a few tweets down and find someone you've talked to recently that has also talked with me.
#
michielbdejong
aaronpk: by 'accept' you mean 'display as a comment', right?
#
KartikPrabhu
michielbdejong: also on twitter any reply to your post is automatically displayed below yours
#
aaronpk
michielbdejong: displaying as a comment is secondary to accepting
#
KartikPrabhu
aquarius: but nothing stops spam replies from showing up in your tweet replies?
#
KartikPrabhu
you don't moderate them, have proof-of-work
#
aaronpk
aquarius: so I look a few tweets down and I find that you recently linked to @jancborchardt
#
aquarius
aaronpk, I do not ask this as an accusation, and it's not meant to sound snide, but: do you *like* doing manual moderation of stuff? I mean, having to go find friends of friends in order to link to someone, and having to check friends of friends to see if they should be allowed to link to me... it just seems like a terribly onerous amount of manual work to me?
#
aaronpk
I think "hey I'm pretty sure we had a conversation online in the past" and find a post from him
#
@jancborchardt
@aallan @aaronpk yeah, and for those cases you need to decide on the good default: relative dates in stream, absolute on detail page.
(twitter.com/_/status/239914510243201026)
#
michielbdejong
KartikPrabhu: I hereby dare you to write graffitti on https://twitter.com/michielbdejong
#
aaronpk
aquarius: I'm also similarly not intending to sound snide :) just trying to walk through this
#
KartikPrabhu
michielbdejong: i mean. you can block me. but that is after the fact
#
aaronpk
the point is that actually digging up the links should be a pretty automated process given our tools
#
KartikPrabhu
unless you have blocked me already
#
michielbdejong
aaronpk: spammers will likely not be friends of jancborchardt :)
#
aaronpk
for example I found that tweets from jancborchardt by searching google for "aaronpk site:twitter.com/jancborchardt"
#
aquarius
aaronpk, I totally agree that the above approach is doable -- when you first tweeted at me I thought, who's this? and viewed your twitter profile, and saw you talk to people I talk to. Which is great
#
michielbdejong
KartikPrabhu: no, i'm pretty sure you're not a spammer :)
#
KartikPrabhu
right. so i don't get the point
#
aaronpk
i could imagine any number of search engines, either services or built into my own indieweb tools, that could find these links
#
aquarius
aaronpk, but we've both got about 3,000 followers. Are they all honestly friends of friends?
#
michielbdejong
aaronpk: i think you just invented social spamming :)
#
aaronpk
so the point is that with a very small amount of human effort of recognizing someone (or some website) we might have in common, the tools can do the rest
#
aaronpk
also keep in mind that Vouch is not attempting to prevent trolling, just automated spam
#
aquarius
eyeballing my mentions, I'd say somewhere between a quarter and a third of people who @mention me are people I do not know and am more than one degree away from, and yet I want to see their conversation
#
michielbdejong
aaronpk: yes, that's important to keep in mind
friedcell joined the channel
#
aaronpk
aquarius: I wonder if we could analyze that somehow
#
michielbdejong
aquarius: and display it as comments, probably
#
michielbdejong
not just receive
#
aquarius
michielbdejong, absolutely
#
michielbdejong
so do we want to build proof-you-are-human.com as a playground-politics breaker for Vouch? is the domain free?
#
aquarius
example: yesterday I bitched that "1em" does not mean "the width of an m character". Two people explained that it's the *height* of an "m" character. I know neither; they both follow me; one retweeted a friend of mine recently, one didn't but talks about similar *stuff* to me... so I as a person can relatively easily tell they're OK. But that's happening after their information is published.
#
aquarius
michielbdejong, might wanna mention webmentions in the domain
#
aquarius
also, I'm about to go for a drink, because it's been a long day :)
#
aquarius
but I have at least some of tomorrow free...
#
michielbdejong
KartikPrabhu: https://twitter.com/michielbdejong doesn't display anything out of the ordinary?
#
aaronpk
oh hey there's a suggestion of hashcash for vouches
#
aaronpk
where did that come from?
#
aaronpk
oh that was aquarius! nice!
#
michielbdejong
aquarius: nice to meet you! honoured to talk to the inventor of pingback
#
KartikPrabhu
michielbdejong: my homepage also does not display any webementions!
#
KartikPrabhu
but my post page does
#
KartikPrabhu
same on twitter
#
aquarius
aaronpk, well -- I suggested hashcash. michielbdejong came up with the idea of a site where you hashcash to it and then it vouches for you (this is the proposed proof-you-are-human.com), which I think is pretty clever. I just wrote it on the wiki :)
#
aaronpk
oh here's the hashcash note I was trying to find on the wiki http://indiewebcamp.com/DDOS#Hashcash
#
aquarius
michielbdejong, ha! I wouldn't necessarily be honoured by that invention. It was a good idea at the time, and the underlying idea is still right, but webmention is a better implementation now that we have a clearer picture of how to actually use HTTP properly :)
#
michielbdejong
it's good that you're still here, though
#
aaronpk
there's also a bunch of other ideas here http://indiewebcamp.com/spam
#
michielbdejong
there are few of us
#
aquarius
the web is the most powerful tool for knowledge and fun that's ever existed. I'm not going anywhere any time soon :)
#
aquarius
aaronpk, ya, I had a look at those, indeed
#
Loqi
aquarius has 2 karma
#
aaronpk
well it's certainly an interesting problem
#
aquarius
I like the idea of Vouch, I just worry that it's (a) the FOAF/Semantic Web stuff in new clothes, and it didn't work the first time around, and (b) intentionally *designed* to make it difficult for new entrants to join the conversation. But I think michielbdejong's hash-for-vouches scheme is a neat hack :)
#
aquarius
which might cover all bases
#
michielbdejong
"It behooves us, the indieweb, to be pre-emptively thinking" :) http://indiewebcamp.com/spam
#
aaronpk
hash-for-vouches is a neat hack indeed
#
aaronpk
also remember that in Vouch it's not required that the vouch URLs be from individual *people*
#
KartikPrabhu
I am worried that "has-for-vouches" will make it more difficult for non-programmers to join the conversation
#
KartikPrabhu
s/has/hash
#
Loqi
KartikPrabhu meant to say: I am worried that "hash-for-vouches" will make it more difficult for non-programmers to join the conversation
#
aaronpk
they could jhust as well be business' web pages, or aggregators like hackernews or something
#
aaronpk
so I think that makes it a little less "clique-ish" than a pure FOAF model
#
aquarius
KartikPrabhu, that's a reasonable point -- I think that most will not even be aware that the hash is happening, but I agree -- and so those people can use normal Vouch, right?
#
michielbdejong
yeah, a CMS silo could be a voucher
#
aquarius
KartikPrabhu, that is: if you can't find someone to vouch for you, you have the option of using a service that will vouch for you instead.
#
KartikPrabhu
aquarius: then why can't programmers use normal Vouch?
#
aaronpk
so who's gonna be the first to implement hashcash verification on their own webmention endpoint?
#
KartikPrabhu
< not me> I don't know what this hash thing is anyway
#
aaronpk
cause the real test is whether it's faster for people to understand+add hashcash verification vs vouch verification
#
michielbdejong
aaronpk: you wouldn't need to as soon as hashcash-to-vouch.com exists
#
aquarius
KartikPrabhu, because finding someone who knows me and that you trust is potentially infinitely hard -- I can never know whether there isn't anyone or if I just haven't found them yet.
#
aquarius
aaronpk, I'd need my own endpoint for that :)
#
aaronpk
aquarius: I think you described exactly why Vouch prevents all automated spam :)
#
KartikPrabhu
hmm well people can implement what ever they want so...
#
aaronpk
"potentially infinitely hard"
#
aquarius
but more importantly, hash for vouches.com means you don't *need* hashcash verification on endpoints.
#
aquarius
everyone just does vouch
#
aquarius
and hashforvouch.com vouches for youy.
#
aaronpk
give it a shot!
#
michielbdejong
yeah, worth a try!
#
aquarius
aaronpk, I agree it does, but I think it's like avoiding hearing dissenting opinions by only talking to close friends :P
#
michielbdejong
i guess we have about one year before spammers start targetting webmention
#
aaronpk
certainly software like Known, and the Wordpress webmention plugin makes it a much bigger target now
#
michielbdejong
aaronpk: yep
#
aquarius
michielbdejong, so, how would it work? quck spec, before I go to the pub. I POST target=wherever&time=1234567&nonce=8760930 to hashforvouch.com/endpoint and it returns {vouch_url: "https://hashforvouch.com/abaskbfkfbcq"}, and I then use that vouch_url in my Vouch request to the iriginal site as normal?
SRCR joined the channel
#
michielbdejong
aquarius: well, ideally the CPU time would be client-side
#
aquarius
michielbdejong, it is client side
#
aquarius
calculating the nonce is the hard bit
#
aquarius
verifying the nonce is trivial
#
aaronpk
aquarius: well phrased: "hearing". Because there's nothing stopping people with dissenting opinions from posting stuff on their own site anyway. It's just the webmention and comment display part that would be stopped by the un-vouched webmention.
#
aaronpk
aquarius: anyway nice chatting. hope to see you around these parts in the future as we figure this stuff out! and when you get a chance, would love to see you add yourself to http://indiewebcamp.com/irc-people !
#
michielbdejong
aquarius: oh, and actually, one vouch would suffice for however many posts you want to write, or just one?
#
aaronpk
if just one, isn't that essentially the same thing as using the /irc-people page?
#
aaronpk
"register yourself here and then this URL can be used as a vouch URL"
#
aquarius
only if people are already part of the webmentions clique :)
#
aquarius
because the instant people start registering just *so* they can send webmentions, then it's (a) a SPOF and (b) a massive spammer target
#
aaronpk
isn't that what would happen with hashforvouch?
#
aaronpk
that only works for people who are part of the "hashforvouch clique"
#
aaronpk
cause before I'd accept that vouch URL, I would have to have known about it first
#
aquarius
aaronpk, no, because anyone can hit hashforvouch and hashforvouch requires that you prove yourself to have done some work.
#
aquarius
Yeah -- part of the long-term goal here is that if it becomes reasonably widely trusted, it gets whitelisted by default,.
#
aaronpk
that sounds like a SPOF then
#
aaronpk
and a massive spammer target
#
aquarius
it can't be a massive spammer target
#
aquarius
because in order to massively spam you have to do massive amounts of work
#
aquarius
I agree it's a spof
#
aquarius
which is why I suggested every endpoint implementing hashcash :)
#
aaronpk
well since right now I'm soft-failing un-vouched webmentions, maybe I could *also* implement hashcash verification and soft-fail for it too
#
aaronpk
then see which one people start using more
icco and j12t joined the channel
#
aquarius
michielbdejong, well, https://github.com/stuartlangridge/hash-for-vouch is the very basics of it, I just haven't got time to faff with databases right now :)
#
michielbdejong
aquarius: cool! will have a look in the EU morning
#
arcatan
Meh. I guess I should host my photos indie-style.
#
arcatan
Licensing-wise Flickr is of course within their rights to do so, but I don't like to have a buy button on my social media profile that does not send money to me.
gr0k, KevinMarks__ and chrissaad joined the channel
#
KartikPrabhu
!tell kylewm just confirming that the rel-bookmark change was field tested before I merge the changes
#
Loqi
Ok, I'll tell them that when I see them next
caseorganic and tantek joined the channel
#
tantek
good afternoon #indiewebcamp!
#
tantek
and welcome aquarius! glad to see you here :)
#
tantek
is still catching up on logs
#
tantek
hey aquarius add yourself to indiewebcamp.com/irc-people so you show up with a nice icon and link the logs indiewebcamp.com/irc/today
#
tantek
needs to write up an FAQ about the clique/playground-politics issue, which is actually moot because we are seeding the vouch network at this very moment with all our unchecked webmentions :)
#
tantek
I see aaronpk has already cited /spam
#
tantek
hashcash to bootstrap a vouch link might be interesting, but in general I am opposed to protocols that waste energy / electricity / fuels (ethical reasons).
#
tantek
It's a pretty obvious place where protocol design actually has a real world impact with physical/ethical consequences.