Pea1, shiflett, tantek, caseorganic, cmhobbs and verdi_ joined the channel
#aaronpkjust realized something... "___ is invited" shouldn't really be an h-entry with the person who is invited as the author, since that's not who created the post
#GWGAlong with Support for Verifying Client AP and a proposal about Comment author must have a previously approved comment...which is a WordPress setting, but essentially, whitelist.
#snarfedGWG: tantek: re expiring wm endpoints, fwiw they make endpoint discovery less cacheable, which is sad for high volume senders
#snarfedit's been discussed before, but i don't see it captured on /webmention. maybe somewhere else
#snarfedaaronpk: bret: the difficulty with any service like that is load. downloading from yt uses a lot of bandwidth, transcoding uses lots of cpu, etc
#snarfedwhich has killed many of these services when they get popular
#aaronpkthe ruby parser made it easy cause it has a bunch of built-in methods for accessing things like the first h-entry on a page, or the first author in an h-entry
Garbee, verdi_, KartikPrabhu, j12t, mlncn, npdoty and eschnou joined the channel
#marcthiele.comcreated /2015/Germany (+4222) "Created page with "= <span class="p-name summary">IndieWebCamp 2015</span> = The first IndieWebCamp in Düsseldorf, but just one of many [[IndieWebCamps]]! <div class="p-description description">..."" (view diff)
#ben_thatmustand sadly I don't see questo being viable. Its taking all the burden of receiving and all the burden of sending, if it gets spammed heavily it will end up pretty expensive
#gRegor`I'm about to try it. Curious to see what it sends for the author info
wolftune joined the channel
#snarfedi like that we've been thinking about spam so much recently…but i wonder if it's too much
#snarfedgiven that we've seen *zero* actual native wm spam so far
#gRegor`I'm interested in thinking/working on it, but it's not a top item for me
#aaronpkit's not necessarily that pingback itself is a spam target, it's the fact that all wordpress blogs have the same xmlrpc.php endpoint, so you can just pick domains and send pings to that URL regardless of whether it actually exists
#gRegor`I saw chatter about wanting to get wm into core WordPress recently, though I think that would be a looong road
#snarfedaaronpk: eh yeah. it's a point, but i don't know how much it actually matters. if every site had a unique one, you'd introduce a discovery step, which costs a bit, but it's probably not prohibitive
#aaronpkthe theory is if you run a wordpress site and rename the xmlrpc endpoint, you'd reduce most of your spam
#snarfedesp for botnet spam where costs are externalities
#snarfedyeah but that's a narrow view. works for individuals, not for the ecosystem
#aaronpkanyone with a wordpress site want to test that?
#aaronpkno that totally works for the ecosystem! that's the whole point of the expiring webmention endpoint, which could work just as well with pingback
#gRegor`aaronpk: indieauth.com is showing a broken TLS icon for me in Chrome "verified by PositiveSSL CA 2 but does not have public audit records"
#snarfedi'm not convinced. see my discovery/cost msgs just now P:
#snarfedregardless, both of those are well known and fixed, so there's no big difference
#fiatjafwell, about questo.email, I'm assuming emails are already a platform with a lot of spam-filtering technology. and that mailgun automatically filters inbound email for me, but I can actually do some kind of filtering by address, the webmention receiver also can also block/allow webmentions by individual email addresses, if he wants it, I'm assuming.
#snarfed(ie you can also use a unique endpoint for the comment form)
#snarfedfiatjaf++ for piggybacking on existing spam filtering solutions
#aaronpksnarfed: something weird is happening with bridgy and my site. the bridgy likes have both http and https URLs for my site, but I'm not sure where they are coming from
#aaronpkso i'mg etting two webmentions for each like
#gRegor`evil sockpuppets that don't know how to set a from: address or a throwaway email? :)
#gRegor`It's not ordinary comment form, but it's analogous as I'm thinking about it. I have the commenter's email in either situation, which is enough "accountability" for me
#tantekgRegor` don't be silly. every incremental barrier reduces misbehavior like that. you know that.
#tantekdon't be absolutist about it "that don't know how"
#gRegor`I don't actually know that in this case. I guess I don't understand.
#tantekit makes it clear that others will keep them accountable too
#gRegor`Should local comment forms also display commenter's email addresses?
#tantekhas anyone implemented "Report Abuse" buttons on comments on their site? E.g. so *others* can click and report bad comments to you? (maybe only for users logged into your site with indieauth)
#tanteke.g. on Instagram, anyone (logged in obv) can report a comment as abuse (red square button with white outline stop sign inside with white exclamation point inside)
#gRegor`Now a report abuse tool makes sense for accountability and I'm behind that.
#LoqiA person tag (AKA people tag) is a special kind of tag that refers to a specific person by URL rather than just a word or phrase, and is done as an explicit tag by the user, beyond just mentioning a person via hyperlink / h-card http://indiewebcamp.com/person-tag
#aaronpki'm thinking a little JS widget you could drop in to your page (with regular link fallback of course) which would handle showing the UI for reporting abuse, and collect the reports.
agaric joined the channel
#aaronpkthen you could log in and review reports, or the service could send an HTTP request if a comment is reported more than your threshold or something
#tantekgRegor' that sounds more conceptual than feature
#tantekI specifically asked about "report abuse" because that's a *feature* in many (most?) social network silos
#tantekdocumenting a real world feature like that is more factual and doesn't need to wade into long handwringing conceptual discussions
#tantek(of course I was being too detail oriented ;) )
KartikPrabhu joined the channel
#pwccGWG: cool, noob to the irc channel but been lurking in the logs for a while. Isn't a filter to change the comment form URL but could be hacked with the WP comment_form_top action.
#pwccfound a comment/support request re: using nonces too - is concern re caching. This, too, applies to expriging end points in the web mention plugin..
#aaronpki just hacked up a wordpress install to change the comment endpoint
#aaronpkthe spam bots already found the new endpoint!
#snarfedis saddened by the rediscovery, not by tommorris's muttering :P
#tommorrisI spent this evening getting frustrated by both WordPress and Squarespace.
#tommorrisI really wish there was a sane and acceptable normal-person-friendly and reasonably customisable website-as-a-service offering for artists, designers and other image-based creatives. :)
#tantektommorris: I thought that was squarespace. Interested in hearing about specific frustrations.
#tommorrisWordpress.com really doesn't fit that well for artists.
#tommorrisSquarespace is marginally better but it is too Ajaxy for my liking - hash URLs for content ffs.
#tommorristhe Gallery page types on Squarespace are very limited and not very customisable.
#tantekah - architectrual problems rather than UI problems
#pwccrediscovery allows for use of nonces. I can see implementers ignoring this and cahcning though. By which I mean I would :)
#tommorrisso if your art fits within what Squarespace works for, awesome. If not... sucks to be you.
#tommorrisSquarespace is a better fit and because it sucks less than anything else I've tried, it's my current recommendation to non-technical folk but it is expensive and a long way from my dream of a great experience.
#pwccGWG, to answer your question - peterwilson.cc
#tantekaaronpk, gRegor` re: Instagram as an example of "Report Abuse" - I kind of went a little nuts and documented nearly their entire report abuse feature across users/photos/comments: http://indiewebcamp.com/report_abuse#Instagram
#snarfed!tell KartikPrabhu yup, sounds right. that's a pretty unusual structure. not sure how to handle it, but kylewm and i could definitely listen or accept a PR!
#KartikPrabhusnarfed: maybe only use the u-syndication links that are the properties of the first-h-entry
#LoqiKartikPrabhu: snarfed left you a message 1 minute ago: yup, sounds right. that's a pretty unusual structure. not sure how to handle it, but kylewm and i could definitely listen or accept a PR!
#tantektommorris: that manifest is a joke because it itself is not an single-page-site / app :P
#aaronpkso ReportAbuse club would provide all the UI and interaction, but would result in sending report pings to your website where you'd do whatever you want with the info.
#snarfedmore importantly though, we're now discussing missing gmail features. i'll happily concede those, but they don't affect the larger point that SPI may be appropriate for private webapps
#KartikPrabhuso like webmention.io for abuse reports?
#tanteksnarfed - oh neat - ok. then we're just debating how good the /URL_design is - which is s different debate
#aaronpkand it could also provide a simple UI for reviewing reports it's collected, in case you don't want it to ping your website
#snarfedright. *ideally*, ajax vs page loads don't affect UX. but *in the real world*, ajax is often faster and feels more seamless. hence my point.
#tanteksnarfed - when a SPI starts updating history and URL location with specific "permalinks" for states - it becomes more like progressive enhancement than actual SPI.
#KevinMarksThe advantage akismet has is that it gets all the spam reports from WordPress
#tantekKevinMarks: meh. Akismet is a giant fail for me.
#aaronpkif I build a "report abuse" feature for my site, I will build it as a separate component like that, and anyone can use it if they want :)
#tantekstill see lots of stuff I have to moderate, and when I try to post a reasoned comment with citations, I get rejected
#KartikPrabhuif you can replicate everything that normal pages do by writing this long list of codes to do it... @snarfed
#aaronpkthe idea is not for this service to own the abuse reports, just to be a proxy service and provide the UI for it
#tantekI think centralized report abuse is problematic because of *both* the burden it puts on that centralized party, and the power it grants them
#pwccGWG: good to meet you, thatnls for been so welcoming.
#snarfedKartikPrabhu: see my ideal vs real world msg. :P in general, *in practice*, good ajax webapps often feel faster and more responsive, which is important for web*apps*, as opposed to just pages
#tantekaaronpk - anyway, seems easier to build it first as a baked in feature before making a "proxy"
#tantekI've also thought about how an "untagging" could be a type of webmention too
#tanteke.g. if you want to untag yourself from a post that tags you
#snarfedfor truly complex apps - e.g. gmail, feed readers, maybe fb/twitter - i'd contend that average programmers using common tools will deliver a somewhat faster-feeling UX with ajax than with page loads
#tantekespecially a post that tags you via a 3rd party person-tag!
#GWGIf we all keep our abuse reports retrievable from a URL that can be discovered on our site...
#tantekGWG - so far there is no prior work for report abuse permalinks
#tanteke.g. no sign of them in FB all activities feed
#KartikPrabhukylewm: snarfed: could you point me to the code that bridgy uses to find u-syndication links? I am not familiar with bridgy code organisation
#GWGtantek: I'm theorizing. Not an itch for me right now
#KartikPrabhusnarfed: thanks. will see what can be done for that error i pointed out
#tantekGWG, cool. doing distributed "abuse report" posts that are verifiable could be quite useful. of course you'd have to use rel-nofollow to link to the items of abuse, which is yucky too.
#tantekas someone that reports abuse, I'd prefer *not* to provide any more discoverability to the abusive items
#snarfedKartikPrabhu: thanks! might be worth discussing w/kylewm first, and/or making a minimal example test case. it's such an unusual structure that i'd be a bit worried about it affecting other behavior
#KevinMarksHm. Pointing out abuse in-channel is a report worth a permalink
#KartikPrabhusnarfed: yes. it has an h-entry in a h-entry
#kylewmKartikPrabhu: rel-syndication is scoped to the page
#GWGtantek: While I might not be ready to build it, I like brainstorming. But, I'm pondering how someone wanting to gather abuse reports would trust the source.