#snarfedso the one main casualty of migrating bridgy to FB API v2.6 is that FB's /me/events endpoint consistently returns 500 "unknown error" for a handful of people. haven't figured out why yet. :/ https://brid.gy/admin/sources
#snarfedon the plus side, we're a big step closer to sending reactions!
#Loqi[kevinmarks]: tantek left you a message 32 minutes ago: please capture all the user frustrations you experienced today while trying to demo various indieweb tools. That real-time experience and your immediate reactions / insights are invaluable for future user-centric improvements http://indiewebcamp.com/irc/2016-04-27/line/1461801172830
#LoqiI use this website as my primary hub for online presence and communication and to some extent as my online commonplace book. I try to follow the tenets of the IndieWeb movement by owning all of my own data and publishing on my own site. When I parti...
#aaronpki'm tempted to draw a flow diagram of how p3k interacts with all the related projects. i think it might look a bit insane
#GWGWhat is that quote about genius resembling insanity?
#LoqiIt looks like we don't have a page for "that quote about genius resembling insanity" yet. Would you like to create it? https://indiewebcamp.com/s/10K1
#aaronpki think instagram just changed its syndication UI
#aaronpkall the buttons are in a single column with toggle switches now
[emmak] joined the channel
#[emmak]gwg: i implemented a rate limiter on my webmention endpoint
#miklbso I could set that up and use the micropub plugin on a subdomain that pushes to my repo that then builds the site with Travis and pushes back to my VPS.
#aaronpkGWG: info feel like it's useful to return a different error than 400 to indicate that the request might succeed if the sender tries again later, vs 400 which means that the same request should not be sent again
#[emmak]would 503 "service unavailable" make more sense?
snarfed joined the channel
#aaronpk[emmak] no, because that implies the server did something wrong (5xx)
#aaronpkIt looks like most APIs are using 429 to indicate the client has been rate limited which is why I went with that
#[emmak]but the client may not have done anything wrong either, if its a 3rd party flooding the endpoint
#GWGYes, but it is telling the client it can try again later
#aaronpktechnically it's possible that a bunch of other HTTP codes might be returned since a lot of them are about the HTTP transport protocol itself rather than application logic
#GWGA 429 should be an indication to a sender to try again later.
#sknebel503's can also be retried (RFC even mentions Retry-After header, same as for 429)
#sknebelright now the webmention spec doesn't say anything what to do with errors
#sknebel(HTTP 429 is odd in a way, because it is a client-side error where the client actually should send the exact same request again)
mlncn, tantek and snarfed1 joined the channel
#snarfed1hey kylewm, the new FB bridgy backfeed, was it dupes? or new stuff it hadn't found before?
#kylewmsnarfed: new mentions, haven't seen them before
#GWGThere is a feature implemented in 4.5 that really helps with Webmentions. Prior to that, you had to construct a complex database query to accomplish same. Which meant not taking advantage of caching. So, it basically means more database calls.
#snarfedthis is existing code, right? not new code that doesn't exist yet?
#bearI would suggest using a status code of 429 because while it's technically a client side error, it is used in the wild to represent a request that has been limited - twitter, github and others
#GWGsnarfed: Which? What I'm working on? Or what I'm adding?
#GWGI added the newer code with a version conditional. But I want to use it again elsewhere in the process. This isn't bad if it is cached by WordPress, but it is bad if it isn't.
#snarfedactually bad? how many db queries are we talking here?
#petermolnarwow, this might come useful: "Jam API is a service that allows you to turn any site into a JSON accessible api using CSS selectors" http://www.jamapi.xyz/
hs0ucy, danlyke, Pierre-O, uranther, mlncn, kbs, snarfed, frzn, snarfed1, j12t and friedcell joined the channel
#aaronpkI think we solved that at the same time as allowing you to sign in with the root domain but then your ID has a path. I thought quill had been updated for that but I'll have to check
#voxpellimiklb: I pushed an update that allows you to set a branch-key in the sites.js
#voxpellimiklb: so do this now instead: repo: 'miklb.github.com', branch: 'jekyll'
#kylewmaaronpk: have yall discussed formalizing a key/token parameter for webmention endpoints, so something like bridgy would know it was accessing an endpiont with some sort of authentication?
j12t joined the channel
#kylewmmy intuition is that rediscovering and retrying the webmention endpoint for every failed/rejected mention would be beyond the pale for bridgy
#aaronpkprobably the proper way to handle this is to actually make bridgy send authenticated webmentions
#kylewmor maybe if there was an http code that specifically meant expired
#aaronpksince I have to explicitly sign up for bridgy in order for it to send me webmentions, it seems reasonable that I could give it higher privileges at my site
dogada joined the channel
#aaronpkso if I want to use a CSRF-protected webmention endpoint, bridgy could say that it needs a way to bypass the CSRF protection, and it could then include an HTTP header with a token that I can check for
#kylewmlike, I thnk we should prototype the CSRF behavior by having bridgy rediscover the endpoint every time, but it would be useful if it knew ahead of time if it needed to do that
#snarfedi get CSRF in general, but i don't quite get how it applies to webmention endpoints specifically
#snarfedi'd want to see a clear description of that first
#kylewmmy understanding is it's basically to slow someone down, prevent them from sending a billion webmentions without having to send any GETs themseves
#kylewmcause it takes away their leverage if they have to send you a GET for every GET they "trick" you into sending someone else
#aaronpkit's also less important with current webmentions, but will be more important if anyone starts including things like session cookies or tokens along with the webmention request
#kylewmthen it would *actually* be a CSRF token, right? not just an expiration
#snarfedok. i understand the spam/throttling use case. just wanted to make sure we're talking about that, and not actually CSRF
#snarfedsure, but which problem we're solving matters
#snarfedif it's spam, i'd personally be more reluctant to implement this technique specifically on the client side in bridgy
#snarfedsorry, s/spam/dos throttling/, since that's actually the (straw man) problem. spam filtering is a bit different.
#aaronpkin either case, the spec is actually only specifically recommending a CSRF token, and only *if* you're accepting other authentication along with the source/target parameters, so it's no rush right now
#kylewmI meeeean, we know the DDoS case is real because it's been documented in pingback pretty thoroughly
#aaronpkyou will have already passed this step by the time you're talking about the DDoS issue
#snarfedcoming at it from a different angle, i should reread the spec to see what it says about caching...but there's definitely a need for high volume clients to be able to cache and not rediscover every time
#[emmak]ok, didn't realize that was something i needed to install
#aaronpkusually you'll also get an "intermediate" certificate
#aaronpkand depending on your web server, that gets installed in different ways
#[emmak]i got a chain.pem and fullchain.pem from letsencrypt but didn't know what they're for
#aaronpkuse fullchain.pem and it will probably "just work"
snarfed joined the channel
#aaronpkit's pretty funny that sometimes after i post something on my site, i see the battery icon in the header bar, and am like oh crap i should charge my phone
#snarfedah, and we are finding reactions on photos, we're just not sending you many because we don't navigate across multiple pages of likes/comments/reactions
#snarfedFB evidently puts likes first in reactions, and your posts are popular and have lots :P
#gRegorLoveI knew Huffduffer extracted "elsewhere" links from rel-me, but I didn't realize it kept them up to date. Just noticed it caught my instagram after I added it.
#Loqi[Ben Roberts] Ben Roberts was tagged in Jennifer O'Brien's photo.
j12t, frzn, KartikPrabhu, wolftune, miklb, snarfed and [kevinmarks] joined the channel
#[kevinmarks]MySQL's problem is that they want to map unicode back to fixed bit width characters so they can do case independent indexing, so they keep inventing wider bitwidth representations and breaking things by converting them
#[kevinmarks]If you don't want their dumbass text indexing, blobs are a good idea.