2015-04-16 UTC
dariusdunlap joined the channel
torrorist, scor, j12t and KoopaKiy joined the channel
KevinMarks__, KartikPrabhu, aranasaurus and j12t joined the channel
yakker, snarfed and tantek joined the channel
# 04:28 aaronpk i'm not convinced that a reader interface that is actually part of your own website is actually a useful thing
# 04:29 aaronpk as long as the reader stores things on your own website (posts likes to your site, etc) then I think that's fine
# 04:31 acegiak aaronpk: I agree. there's nothing inherently advantageous to hosting your own reader if you can use another to post to your own site
# 04:33 aaronpk the distinction between hosting your own reader and using a hosted reader is tangential, since in both cases the reader is not part of your own site
# 04:34 aaronpk being able to host your own reader is important, but should not be required or even necessarily encouraged. as long as readers behave well by posting things to your site, and as long as there are multiple options for hosted readers to use, then using a hosted reader shouldn't be an issue
# 04:37 acegiak yeah. I think one of the reasons I like the idea of whisperfollow is that I like the idea of being able to deploy a wordpress indieweb solution complete with personal reader
# 04:38 acegiak but the problem is that whisperfollow is actually awful code because all I've done is focus on the UX
# 04:40 aaronpk integrated readers are great, and wordpress is definitely pushing that model, but I don't think that is necessarily a requirement or goal everyone needs to strive for
# 04:42 acegiak no, but when I want to pitch someone on indieweb I talk a lot owning your own stuff and not being beholden to the shitty design or facebook or tumblr
# 04:43 aaronpk right, so allowing new players to come along and create beautiful interfaces to read and post content should be encouraged, and I should be able to use those interfaces with my existing website, not needing to replace the code that runs on aaronparecki.com
# 04:43 acegiak so it makes sense to demo a reader built into my site rather than woodwind or any of the others which are almost definitely better softeware than whisperfollow but feel disconnected from the experience I'm talking aout
# 04:44 acegiak and I can use those other readers and they work pretty well with my site
tantek, torrorist, KevinMarks_, loic_m, KartikPrabhu, eschnou and snarfed joined the channel
# 06:00 snarfed acegiak++ for acknowledging that we don't necessarily have to host our own readers
j12t, KevinMarks__, elima_, cweiske and tilgovi joined the channel
# 06:21 cweiske there is a second google PuSH server; pubsubhubbub-qa.appspot.com - the normal one is pubsubhubbub.appspot.com
# 06:21 cweiske and a google search for this domain leads 0 results
lukebrooker joined the channel
Erkan_Yilmaz joined the channel
# 06:31 cweiske if he accepts that I'm developing that one and that it can break anytime
lukebrooker joined the channel
# 06:35 cweiske although I'm using it myself and thus are interested in its stable functioning
eschnou and csarven joined the channel
# 07:06 cweiske I wonder why google's hub and feedly only subscribe for a day, and not longer
# 07:08 cweiske kylewm, woodwind also only subscribes for a day. why?
friedcell and frzn joined the channel
nloadholtes, KevinMarks_, KevinMarks__, thehighfiveghost, alexhartley and fkooman joined the channel
# 08:36 fkooman indiecert.net is back online, the host got compromised through the management console of the VM platform, w00ps :) using reissued TLS cert now and all should be in perfect working order again :)
j12t and Sebastien-L joined the channel
# 08:58 cweiske fkooman, what do you say to the feature request about allowing certificates that are issued by the same issuer that the website is?
# 08:58 fkooman cweiske, i commented on the github issue
# 09:00 fkooman cweiske, yeah, maybe i am misunderstanding it... can you explain?
thehighfiveghost joined the channel
# 09:02 fkooman cweiske, it sounds that it is still vulnerable to MITM
# 09:02 fkooman the traffic between indiecert and your website
# 09:03 fkooman i think the only part of TLS with client certificate you can trust is 'proof of secret key'
# 09:04 fkooman i could generate a CA + client cert and put the CA on your MITMed homepage
# 09:04 fkooman what binds your client cert to the CA?
# 09:04 fkooman yeah but I can make a CA and sign your public key
# 09:05 fkooman no, but because you can't verify the fingerprint on your homepage in a trusted way...
# 09:05 fkooman i could run a https proxy with a cert signed with my ca in between indiecert and your homepage
# 09:06 cweiske I assume that the user got his client cert on a not MITMd way
# 09:06 fkooman and put the fingerprint of your public key signed with my ca on your mitmed homepage
# 09:06 cweiske so the user's certificate can be trusted, and the user's certificate is signed by his own CA
# 09:07 fkooman maybe you are right
# 09:08 cweiske if the connection between indiecert and the user's homepage is MITM'd, the comparison of the CA of both the client cert and the website's cert would fail
# 09:09 fkooman but then another attack: what stops me from claiming other websites as my identity?
# 09:10 fkooman i have this setup and also sign cweiske.de with my CA...
# 09:10 fkooman and MITM the traffic between indiecert.net and cweiske.de
# 09:10 fkooman *suppose i have this setup
adactio joined the channel
# 09:13 cweiske the result would be that indiecert.net would certify to the application you want to sign into that you are cweiske.de
# 09:13 fkooman exactly, which is a problem if i am not cweiske :)
# 09:14 cweiske and this works if you MITM the connection between indiecert and cweiske.de
# 09:14 fkooman which is the whole reason to implement https to make that impossible
# 09:17 fkooman i think the only way to fix this is to implement an additional white list of CAs and link them to domains, so { "cweiske-ca.crt": [ "cweiske.de", "www.cweiske.de" ], 'bengo-ca.crt": [ "bengo.is"]}
# 09:17 fkooman but then there needs to be a channel for me to make sure the ca file you send me is actually you :)
# 09:18 cweiske you simply store the used CA the first time that cweiske.de tries to log in
# 09:19 fkooman yeah, but then there is no need for a CA at all
# 09:19 fkooman just use self signed certs
# 09:19 fkooman i mean, indiecert.net could even display the fingerprint of your server's tls cert
# 09:20 fkooman so you can check if :)
Pierre-O joined the channel
# 09:25 fkooman but i am not sure it is worth it to build that :) with letsencrypt coming soon and stuff :) what do you think?
nloadholtes joined the channel
# 09:25 fkooman i am actually not that optimistic about it, it will not be easy to deploy on most hosters...only if you run your own VM
# 09:26 cweiske I bet most hosters will implement it sooner or later
# 09:26 fkooman but for stuff like indiehosters it is perfect :)
# 09:26 fkooman there should be no button... :)
stream7 joined the channel
Pierre-O joined the channel
# 09:29 fkooman cweiske, also have to deal with revocation... complex shit :)
winghouchan joined the channel
# 09:31 fkooman you can remove it from ~/.ssh/known_hosts
# 09:31 fkooman so you have to also build the ability to remove the 'pins' from indiecert.net
# 09:31 fkooman and that has to be bound to a user again...but how do you login
# 09:31 cweiske or at least warn the user that it changed, with a confirmation button
# 09:31 fkooman actually it still wouldn't work
# 09:32 fkooman how do you bind it to a user without knowing for sure who he is
# 09:32 fkooman so you need to maintain users with both the domain, and with just the cert as identity
# 09:33 fkooman but then still you can mitm the thing :(
# 09:33 fkooman i think there is no reasonable way to build this without substantial work and a million ways to shoot yourself in the foot
# 09:34 fkooman it will be an exercise on "how to rebuild the PKI"
# 09:35 fkooman maybe, but i doubt they will include a domain name in the SAN :-)
# 09:35 fkooman they could do that for webid stuff, but webid also doesn't use a CA :)
j12t joined the channel
# 09:43 cweiske I don't advertise/endorse the ssl connection anyway since nearly no browser trusts CAcert
# 09:43 fkooman that is not a good excuse :)
modem, Sebastien-L, elima_, Deledrius and j12t joined the channel
scor, sammachin, j12t and modem joined the channel
# 11:17 cweiske did someone try to built and alternative to twitter that simply syndicates all user's notes/blog posts? with push support, so one does not have to rely on twitter to get notified about new posts with interesting hash tags?
# 11:17 Loqi cweiske meant to say: did someone try to build and aldernative to twitter that simply syndicates all user's notes/blog posts? with push support, so one does not have to rely on twitter to get notified about new posts with interesting hash tags?
alexhart_ joined the channel
friedcell joined the channel
Acidnerd, j12t, torrorist, fkooman, frzn, wolftune and fourtonfish joined the channel
elima_, snarfed, marclaporte, squeakytoy, alexhartley, chalettu, tantek, j12t, frzn, adactio_ and KevinMarks_ joined the channel
# 15:10 aaronpk lol I had forgotten I registered pubsubhubbub.club
# 15:16 cweiske didn't you want to build some kind of planet software for push-enabled sites?
# 15:16 cweiske which is nearly like what I asked for this morning
# 15:16 cweiske did someone try to built and alternative to twitter that simply syndicates all user's notes/blog posts? with push support, so one does not have to rely on twitter to get notified about new posts with interesting hash tags?
# 15:18 aaronpk if pubsubhubbub.club subscribes to people's hubs, and then publishes out feeds of its own for hashtags, you could subscribe to something like pubsubhubbub.club/indieweb to find community content with that hashtag
scor joined the channel
# 15:27 aaronpk that'll be great cause then I can finally get realtime #indieweb non-twitter content into this channel
gRegor`, fourtonfish, KevinMarks__ and j12t joined the channel
# 15:56 aaronpk oh I just realized I need to be more proactive about re-subscribing to feeds in monocle
j12t, tilgovi, benwerd, benwerd_, snarfed, KevinMarks_ and cweiske joined the channel
KevinMarks_ joined the channel
# 16:49 cweiske phubb is fast enough if you look at the xmpp window
# 16:49 aaronpk i should get realtime updates in monocle so you can try there
interactivist joined the channel
# 16:57 aaronpk twitter didn't used to put the photos above the text in tweets did they?
# 16:57 aaronpk oh funny it's only above the text in the stream view, not on individual tweets
csarven joined the channel
# 17:13 aaronpk oh hey kylewm deleted a post and monocle successfully emptied the post but didn't remove the entry fro mthe list
# 17:28 kylewm Aaronpk: if it's the post I'm thinking of, it was blank to begin with
# 17:29 aaronpk kind of like how buildings don't have a 13th floor
# 17:29 kylewm cweiske: what do you mean it only subscribes for a day? Woodwind shouldn't be giving a expiration date at all
# 17:30 aaronpk isn't the subscription lifetime determined by the hub?
# 17:30 kylewm Yeah, subscribers can request a lifetime but it's up to the hub
# 17:34 KevinMarks does the hub tell you when you need to resubscribe, or does it just go quiet?
# 17:35 KevinMarks "we're going to abolish polling, except, you know, for when you need to poll us to resubscribe"
KevinMarks__ joined the channel
# 17:41 cweiske but my logs show that your subscriptions have a lifetime of 86400 seconds
# 17:42 cweiske since you don't give a value, the default one is used.
j12t joined the channel
# 17:42 aaronpk i'm missing something... kylewm is using superfeedr for his hub, so shouldn't you be seeing that expiration date?
KevinMarks_ and todrobbins joined the channel
# 17:54 KevinMarks may make sense to have it be less than an exact day so you don't have a gap in subscription
# 17:54 aaronpk presumably PuSH consumers should pro-actively renew their subscription
# 17:54 aaronpk there's no harm in subscribing again before the original subscription expires
KevinMarks__ joined the channel
# 18:11 gRegor` What is hashtag?
benwerd and KevinMarks_ joined the channel
# 18:17 cweiske aaronpk, I'm talking about reader.kylewm.com. I subscribed it to push-tester.cweiske.de
# 18:18 cweiske KevinMarks, actually you should register with a lease time a bit more than a day
# 18:18 cweiske so you can use a cron job to update your subscription every day
_1_nick2 joined the channel
benwerd joined the channel
friedcell, benwerd, KartikPrabhu, benwerd_ and frzn joined the channel
frzn joined the channel
davidmead joined the channel
# 19:41 cweiske I wish tt-rss would push updates to the browser. push integration does work nicely
# 19:49 cweiske kylewm, what do you use to push data to the browser? eventsource, websockets, ??
# 19:49 aaronpk I tried some eventsource stuff with php but kept running into weird memory issues
# 19:50 kylewm i think it's nice that websockets manages sending heartbeats and stuff for you, i don't think SSEs do that
# 19:51 kylewm now that i'm thinking about it, i might not have finished writing the sse way
# 19:51 aaronpk i was very hopeful about eventsource because it's such a simple protocol
# 19:52 aaronpk i'll have to try it again some time, or maybe try it in Node
frzn joined the channel
# 19:57 kylewm Python3's asyncio stuff handled websockets very nicely
# 19:59 cweiske ha. just found a php websockets server tutorial from 2011, which was written by a friend of mine from university days...
# 20:02 cweiske I just don't know if I can handle multiple client connections with a single php process
# 20:04 aaronpk this is why I just wrote a tiny node websockets server and send data to it from php
# 20:04 kylewm it does feel like swatting a fly with a sledgehammer
# 20:04 cweiske i'll rather check if I really have to go away from php
# 20:05 kylewm aaronpk: i don't mean it's not a good solution, i think it is good, it's just a bummer
benwerd joined the channel
# 20:11 aaronpk it looks like it is entirely possible to do in php
# 20:12 cweiske question is if I have to start a php process for every client connection
eschnou joined the channel
# 20:14 cweiske it's german but the example code shows that it handles multiple clients
tantek joined the channel
# 20:15 cweiske yep. no abstraction or anything. just what you need
# 20:15 cweiske in phubb I only use file_get_contents for fetching and POSTing data :)
# 20:15 aaronpk maybe for eventsource that'd be true, but any time you deal with sockets in PHP you should really use a library.. thatstuff gets edge-casey fast
# 20:16 cweiske that reminds me that I wanted to finish my imap server in php
# 20:17 cweiske my goal was to use the mantis bug tracker as backend for the imap server
# 20:17 cweiske so I can categorize issues by dropping them into a different imap folder with my email client
j12t, benwerd, gRegor` and benwerd_ joined the channel
# 20:33 bret fun to open monocle or woodwind in that
# 20:35 aaronpk now I reaaaly need to get realtime updates for monocle
# 20:37 bret are they the same as the ones in safari?
# 20:38 aaronpk cweiske: no, using google's push notification service
# 20:38 bret e.g. notifications without a webpage open
# 20:38 bret i know firefox also has something similar in the works especially for ffos
# 20:39 ben_thatmustbeme as soon as I have time to sit down and figure that out, i'd love for that to work too
# 20:42 voxpelli Firefox and Chrome will be using the same browser API:s for the push notifications
KartikPrabhu joined the channel
# 20:48 voxpelli aaronpk: I btw use EventSource for realtime updates of my WebMention embeds
# 20:49 voxpelli aaronpk: nope, Node.js backend, but fairly decoupled using Postgres pubsub
# 20:49 bret so aaronpk are you going to use my name suggestion?
# 20:51 aaronpk well i already have pubsubhubbub.club, but pubsubhub club is good too
# 20:57 bret didn't nginx modules play as a key inspiration to nodes design?
lukebrooker joined the channel
# 20:59 voxpelli Maybe, feels like PHP need some sort of outside hub like Node or that to handle long running connections like EventSource
modem joined the channel
# 21:01 KevinMarks so so these notifications do anything on mobile, or is this a desktop thing?
# 21:15 zachdono- GWG: afternoon!
# 21:18 GWG I may not get out of work till 6:30.
Kyle-K joined the channel
torrorist joined the channel
# 21:29 zachdonovan Any New York Area Lurkers hangin' out in here? let me know if you want to come to the inaugural(?) NYC HWC!
benwerd and benwerd_ joined the channel
# 21:43 gRegor` NYC HWC is a nice rhyme
benwerd and friedcell joined the channel
# 21:46 ben_thatmustbeme Tried to get notifications tested on my site before I had to leave for the train. Just couldn't get it in that quick. Will have to finish up later
# 22:02 gRegor` Glad to help get it off the ground, since Chicago's on hiatus :)
dariusdunlap joined the channel
# 22:08 aaronpk now that iOS push notifications can run code, it seems like Chrome could actually implement their push API on iOS
# 22:10 aaronpk okay from what I understand, that nginx module is managing the pubsub stuff itself, so doesn't require PHP be running long-running processes
scor joined the channel
# 22:18 gRegorLove Hai guys. Over a year later, I solved the difficult backtick problem. I am smrt.
# 22:30 gRegorLove Heh, I think that tell from snarfed above is actually 1 year, 3 weeks, 5 days ago. Loqi probably doesn't do years?
KevinMarks__, frzn, KevinMarks_ and lukebrooker joined the channel
# 22:44 tantek dariusdunlap: another way of restating that is, should your rel="me" hyperlink also have class="u-url" and be inside your h-card?
tilgovi joined the channel
# 22:45 tantek and the answer is yes it should, because it will enhance your h-card, and make it into a representative h-card, but it is not necessary for rel=me to work with indieauth.
# 22:48 tantek agreed - and because it is on your blog, you're likely using that URL as your p-author h-card URL
# 22:48 tantek thus making sure it has a good representative h-card is a good idea
# 23:09 GWG One of possible good things about being stuck in bed for a bit is I can do Indieweb stuff.
KartikPrabhu joined the channel
KevinMarks_ joined the channel
KevinMarks__ and KevinMarks_ joined the channel
# 23:27 tantek.com edited /rel-me (+1344) "update dfn, add Why, How sections, FAQ / Should my rel me be inside my hCard per IRC chat with dariusdunlap, fix example to use example.com subdomain" (
view diff )
nloadholtes and torrorist joined the channel