#ben_thatmustbemesknebel, huh? no, i don't want access to my github, i'm creating a micropub client, but it can't fetch the homepage and thus endpoints.
#sknebelben_thatmustbeme: oh, sorry, misunderstood... was quickly scrolling through the logs
#mblaneyso the only way to use less resources is to send the relevant links in the headers, so the people who lose out are those who can't send headers.
#mblaneyGWG I don't see how HEAD vs GET stops the amplification attack, attackers will send GET requests anyway.
#GWGmblaney: It stops your endpoint being used in one.
#mblaney"may be" gentler means also may not be, so just trying to understand the rationale.
#GWGmblaney: As far as I understand it is...however, I admit that I don't have the data behind me
#mblaneyI understand that a HEAD is better if that's all that is required, but we have a protocol that allows the links to be found in the content, and that part of the protocol is obviously used by many implementations.
#bearI am sorry I brought up the whole conversation to be honest
#bearHEAD is better for one specific reason - it doesn't pull the whole body content and if you are only *verifying* that the site is proper then HEAD is faster
#mblaneyso GWG, in the case of your amplification attack, if you are forced to verify against a url where the links are in the body, you send two networks request for every attackers one!
#beara HEAD followed by a GET is normal and a lot of older systems used to do that anyways
#bearand saying that 2 requests is bad means that if you follow the logic that know one will ever want to use JS or any other dynamic site
#bearbut it's obvious that I am now considered so old school by all of these web devs that I will just stop trying to ever correct anything
#KartikPrabhubear: using JS to fill content does not show up in GET either
#bearbut it sure does increase the number of round trips
#mblaneybear I appreciate your knowledge on the subject, I'm really just trying to understand the logic and readily admit that I don't know what's best here.
#bearmblaney - my rant above is not directed at you , apologies
#bearall I wanted to do was point out that for the use case of static sites and for the use case where building a dynamic page can be resource intensive, doing a HEAD request can completely remove the need for any further processing for a few cases
#bearsure, for 95% of the cases you will make another request, but those folks who don't like that can just do the GET
#bearfirst step is to verify that a received webmention is a valid source, so the way I learned HTTP was that to verify a url as valid you do a HEAD request
#gRegorLoveAnother advantage of HEAD is you can check the content-type, so you're not tricked into load a large video or something as part of an attack
#mblaneyplus it sounds like it won't be a matter of personal preference soon, as if you fail a test for not doing the HEAD first, then that's a strong statement about how it should work.
#gRegorLoveThough I don't think? the spec says anything about content-type currently
#bearand then if you get back anything in the 2** range you are ok, 4** or 5** you can dump and run
[kevinmarks] joined the channel
#[kevinmarks]This is for endpoint discovery on the target, or for checking the source for links?
#GWGgRegorLove: I suggested we add the content type check.
#tantekgRegorLove: it does a little HTML vs JSON vs plain text
#beardid the author of that post forget that browsers exist for the users and not for "the popular 10000 websites" ?
#tantekthanks Superfeedr for tracking all my WikiMo edits :P
#tantekkevinmarks, bear, there's something to that article, I do think there is a lot of bloat in web platform features overall that could be trimmed back
#tantekand the increase in security surface is a real problem
[kevinmarks] joined the channel
#[kevinmarks]I should read the original paper, the reg is not exactly judicious
rhiaro, snarfed, dogada, frzn and micajah joined the channel
#micajahhi. i want to cross post between fb twitter and other social media and my ghost blog, but its not original writing i want to make a links/newsletter like a firehose thing on a topic. so im not concerned about owning content is there any info on which is best first place to post ie from fb or twitter or out of my ghost blog? thanks
#tantek!tell cweiske what is digikam? (gps correlator?) It looks like we don't have a page for "digikam" yet. Would you like to create it? https://indiewebcamp.com/s/10MJ
#tantekplus then the error messages can be personalized a bit
#tantekby reading their representative h-card from their home page
#tantekand they can be encouraged to take the next steps to get more working
#tanteke.g. "Hey Tantek, thanks for signing in! Currently mobilepub only works with sites that support micropub, and we don't seem to be able to find your micropub endpoint. Unsure what that is or want to learn how to add it to your site? Check out: https://indiewebcamp.com/micropub"
#tantekkylewm maybe. a heads-up may be nice for those that don't want to bother signin-in if they can't do anything more. OTOH a "would you like to try signing in anyway?" prompt may be a nice encouragement too
#kylewmThink of all the bug reports you'd get! "It let me sign in but then it wouldn't do anything"
#kylewmAssuming people click buttons without reading all the text :)
#sknebelis there any scenario where you'd want login and *then* present the endpoints? E.g. different logins get to use different endpoints?
#tantekreally? I think a brief kind message up front would avoid such bug reports
#sknebel(is there a mechanism to discover endpoints with the authentication?)
#tanteksknebel: I don't know how different micropub endpoints would work
#kylewmIs this like the idea that you might give different clients different endpoints?
#sknebeljust noticed that discovery would be an issue as well, since fetching the main page again with auth to potentially get the right endpoint isn't standardized as well (?)
#tantekspeaking of which, community review please?
#tantekfreshly written, in a presumed community voice, would appreciate some verification/validation that this easily resonates with folks here (and any issues if it doesn't!) https://indiewebcamp.com/wikifying#FAQ
#tantekalso welcome: improvements in spelling/grammar/tone
#sknebeltantek: there is documentation for many Silos/other services on the wiki, e.g. where you try to find patterns/interesting features, that might be worth a line and some explaination in the "should go on the wiki" section? (as in, what is important/useful on such pages, maybe link a good example)
#tantekyes I should make that exception more clear
#tantek!tell chrisaldrich re: "my issue is usually remembering the huge list of microformats to include", would love to chat about that to better understand it some time, hopefully to help make it easier. Context: http://indiewebcamp.com/irc/2016-05-20/line/1463806033428
#tanteksknebel: more re: " reason why "this week in indieweb" gets sent out on Friday and not on the weekend", Fridays tend to be slower (in terms of getting things done) so it makes sense to use that time to capture / reflect / broadcast what's been done the rest of the week.
#tantekalso, it's a good encouragement for folks (especially in Europe!) to take the (rest of the) evening off :)
#tantek.comedited /js;dr (+935) "another article, link to / excerpt from HN, Reddit threads" (view diff)
#tantekgreat fallback text for when Disqus JS embed is not loaded: "Apologies, but part of running a static blog is that the comments are served by Disqus's JavaScript slurry. If it's any consolation, you're probably not missing much. :)"
#tantek.comedited /Facebook (+938) "/* Reinforcing shallow dopamine responses */ Pacifies isolates people with comfort bubbles" (view diff)
#tantek.comedited /Facebook (+74) "/* Pacifies isolates people with comfort bubbles */ also add medium POSSE copy" (view diff)
#tantek!tell chrisaldrich re: "Eventually the wiki will have too much in it for the common person to browse it and be able to get value for the types of choices they'd like to make.", it can be improved, e.g. like Wikipedia.
#tantekprobably better for a Cyberpunk meetup. which I'd be happy to go to myself ;)
#[kylewm]I really like the idea of having a microformats cheat sheet available, and also agree that putting it on people’s nametags that they have to wear might be a turnoff to aesthetes
#aaronpkmy plan with the h-card stickers was not to put them on the front of the badge
#aaronpkthe idea was you'd get a stack of them and you'd give them out to people, and they'd put them in their "face book"
#aaronpkwhich is a bunch of inserts that go inside the badge
#tantekI understand, that *is* what I was talking about
#aaronpkalso that mockup doesn't actually accomplish what i want with it
#tantekcreating a "weird" token that's expected to be used in a social exchange context
#tanteksets off all kinds of non-coder empathy alaarms
#tantekwhen we should be doing the opposite, focusing on adding to the experience of IndieWeb Summit that is *more* encouraging of non-coders
#aaronpki just can't figure out how to make it look right. the idea is that it looks like a mostly normal business/contact card, but also shows the underlying html kind of like how you'd see a semi finished drawing still with the wireframe/sketch in it
benborges joined the channel
#tantekah that's a decent "vision" - which I'd say requires a *very good* designer to make it work
#tanteksomeone who draws things like architecture diagrams
#tantekwhich look "pretty" to a broad set of people
#tantek.comedited /2016/Planning (+169) "/* Cheat Sheets */ can help write, also any other building blocks for a better IndieMark" (view diff)
#tantekaaronpk: can you add your printing / time constraints to that?
#tantekI'm wondering if shaners and I iterated like on Thursday night would cheat sheets be something we could review/approve at Leaders Summit and print just in time
#tantekneeds to see if he can dig up an actual printed microformats fold-up cheat sheet booklet from back in the day
#aaronpkespecially if we do rounded corners to match the nametags
#aaronpkwonders if he can get precut 4x6" paper to print on
#tantekaaronpk: or if it makes it easier, for microformats we made fold-up booklets from normal 8x11 paper that progressively revealed the most immediately/commonly/intro useful stuff first
#ben_thatmustbemesigh.... if you dont' LIST your use of indieauth, most assume indieauth. so really the only requirement is to list the micropub endpoint
#ben_thatmustbemeaaronpk: found the issue... i fat fingered the if test
#aaronpkquill will *only* redirect to your designated auth endpoint, will never fall back to indieauth.com, because there is nothing it can do if it won't be able to get an access token
#aaronpkweird. it said "IndieAuth failed, redirecting back to the main application" but there was an auth code in the URL and when it redirected me i am signed in
#ben_thatmustbemeaaronpk: if you get that, it failed when checkint the auth
#tantekwhoa I just figured out (I think) why FB sometimes shows [Going][Maybe][Can't Go] and sometimes shows [Interested][Going][Ignore] as webactions on Event invitations!
#aaronpk"interested" is there to be able to let others know of your potential interest in the event, but doesn't make sense on a private event since a private event doesn't need the "boost" of promoting it to a larger network
#ben_thatmustbemeKevinMarks, the SW should only be caching the items i list, the main page is one of them, but it has all the templates in it via handlebars
#aaronpkand I am more likely going to need the "ignore" button for public events since it's a lot easier for me to be "invited" to those because of the way facebook encourages sharing events. If I receive an explicit invite to a private event, it's more likely that the host wants an actual yes/no response vs a silent ignore
#tantek.comedited /event (+143) "/* How to provide an RSVP UI */ list all the buttons and say some subset of depending" (view diff)
#ben_thatmustbemeKevinMarks: you are welcome to tear it apart. the code isn't very much
#KevinMarksit says ServiceWorker registration failed: ReferenceError: success is not defined(…)
#tantek^^^ lessons to learn for Webmention / Vouch?
#tantekben_thatmustbeme: they were asking for your preferred email for such invitations, assuming you'd have more than since you have your own domain :P
#tantekspam bots don't care if you don't *currently* support HTML, you may very well in the future, or make the mistake and forget to escape a text field even once
#snarfedaaronpk: oh man are you porting oyg to it?
#aaronpklooks like currently 101 people using ownyourgram
#snarfedaaronpk: btw re your business card design idea, i wonder if making the content black (name, domain, etc) and the markup light gray could work
#KevinMarksthey can still be marginalia, but the length limit went so now they can be a bit odd, and they are shown at the bottom too, and as standalone
#snarfedemphasizes the content and de-emphasizes intimidating technical parts, but they're still there and discoverable
#aaronpk16 this week (at least 16 that the realtime api picked up this week)
#tantekif anyone with an IndieWebCamp tshirt in person can vouch for the color quality (I guess we'll have to ask shaners about if it worked per his intent) I may want to setting something up to do microformats tshirts too (since there's been a demand for reprinting)
#ben_thatmustbemenow this is getting super odd... i'm trying to hit the auth endpoint for known, (after getting a code back, trying to verify it) and i get