2016-08-26 UTC
# 00:01 aaronpk snarfed: didn't realize Google had an API! I found a couple other services tho
tantek joined the channel
# 00:24 gRegorLove I have some archives, but they're only for articles. This posting activity thing counts articles, notes, and events.
chrisaldrich1 joined the channel
snarfed joined the channel
leg joined the channel
[number5] joined the channel
# 01:05 Loqi Ok, I'll tell them that when I see them next
snarfed1, thebaer, KevinMarks, pl_, chrisaldrich_, KartikPrabhu and tantek joined the channel
# 02:07 Loqi GWG: tantek left you a message 3 hours, 32 minutes ago: I just checked out the Dalberg space, and took some photos. I can probably answer any further questions you have.
# 02:10 tantek I'm going to need to pick up some sticky notes from a local supply store tomorrow, and we could use a VGA-mini-DVI adapter (but I think Emma will take care of that tomorrow)
wolftune joined the channel
wolftune, tantek, Loqi_, lmorchard23, Ruxton and snarfed joined the channel
# 03:05 miklb I believe he said he a several extra old laptops for streaming, was just working out how to stream multiple rooms
arlen and shiflett joined the channel
# 03:51 AngeloGladding tantek curious why you've chosen to go to the route of a self-signed cert what with letsencrypt and all?
# 03:56 tantek AngeloGladding: it was a stopgap only for my own posting UI - I don't use public https links -
# 03:56 tantek AngeloGladding: curious where did you encounter it?
# 03:57 tantek (I don't use public https links to my own site, yet)
# 03:58 rascul i encountered it at one point because i tend to try https:// whenever i see http://
# 04:00 rascul oh that's because it's still trying to grab it from rascul.io instead of rascul.xyz
# 04:00 AngeloGladding in building my personal social network for /reader and contact (writer) purposes i'm creating a simple UI that accepts a protocol-less URI that tries https first and falls back to http
# 04:01 AngeloGladding my python `requests` library bonks on your unverifiable cert
# 04:01 AngeloGladding but it got me to thinking
# 04:01 AngeloGladding maybe personal self-signed certs are ok
# 04:01 AngeloGladding and certainly easier to implement than letsencrypt
# 04:01 AngeloGladding **i'm about to automate https in my deploy script
# 04:02 rascul just one command with simple options instead of a few weird openssl commands
# 04:03 AngeloGladding i just rush implemented LE a couple days ago and it was frustrating on a non-root shared server
# 04:05 tantek AngeloGladding: if you can figure out a way to store and depend on people's own self-signed certs that would be a major breakthrough
# 04:05 AngeloGladding yeah that's what it got me to thinking
# 04:05 AngeloGladding just another UI hoop really
# 04:06 AngeloGladding unless i'm missing something obvious
# 04:06 rascul it's just me telling you i'm rascul instead of somebody else telling you i'm rascul
# 04:06 tantek AngeloGladding: the only challenge is the setup - the first time you get the self-signed cert, you have no idea if it's real or spoofed
# 04:06 AngeloGladding not too up on TLS but isn't the problem that a MITM could self-sign their own and you wouldn't have any real way of knowing?
# 04:06 AngeloGladding right, so pinning?
# 04:07 tantek AngeloGladding: or you do your own "pinning" in your Python code
# 04:07 tantek where you only allow someone to have *one* self-signed cert *ever* (except for expirations obv)
# 04:08 rascul unless you verify the fingerprint and all by some other means, the first time you ssh to a host you accept what you're offered or you don't
# 04:08 AngeloGladding interesting..
# 04:08 AngeloGladding ssh also has passwords..
# 04:09 tantek if there was a way to do peer to peer sharing of others' self-signed certs, from *non*-self-signed certs, then you could even verify a self-signed cert by way of that same social network!
# 04:09 rascul yes but i'm not referring to user authentication but host authentication
# 04:09 tantek e.g if you and aaronpk's servers happened to see the same self-signed cert from tantek.com, that increases the chances that it's authentic
# 04:09 AngeloGladding a web of trust
# 04:10 rascul i always though https would work better like that
# 04:10 AngeloGladding yeah i've yet to grok vouching
# 04:10 tantek because it gets increasingly difficult to MITM a single server across to every other server that tries to access it
# 04:10 tantek AngeloGladding: in a strictly semantic sense not protocol sense
# 04:11 AngeloGladding rascul give me a second to ponder
# 04:11 AngeloGladding tantek yes i see where you're going with it
# 04:12 rascul it would never happen though on a large scale
# 04:12 rascul the corrupt certificate authority industry would fight it and kill it
# 04:12 tantek it would be difficult / impossible to kill because you could simply implement it as an HTTP extension, open source
# 04:12 rascul then it would require the browsers to implement it
# 04:13 tantek rascul, also the same argument could be made about LetsEncrypt but they've failed to kill that
# 04:13 rascul well let's encrypt isn't really disrupting the industry
# 04:13 tantek if something like that scaled to web servers in general
# 04:14 rascul i could very well be wrong and it might happen
# 04:14 tantek you can bet that browsers would figure out a way to implement it
# 04:14 tantek rascul - you are generalizing from small steps to why large steps would fail, that's the flaw in your reasoning
# 04:14 tantek whereas all we are talking about are the small steps
# 04:14 tantek and how even just getting the small steps working brings its own value without any large steps - that's the point
# 04:15 AngeloGladding sorry Kartik -- realized one post too late
# 04:15 rascul i would really like to see a web of trust or vouch like implementation for https though
# 04:15 tantek yes - and it's late here so I'll say good night on that
# 04:15 AngeloGladding thanks for the input all
# 04:15 tantek feel free to continue in #indieweb-dev as KartikPrabhu suggested
# 04:59 KevinMarks Can we register to remote attend? Is there a different url we can webmention with an RSVP for that?
KevinMarks joined the channel
snarfed, wolftune, KevinMarks_, loicm, comzeradd, chrisaldrich1, ChrisAldrich, nitot, moredhel, gkbrk, KevinMarks, friedcell, cmal and AngeloGladding joined the channel
# 09:02 ChrisAldrich KevinMarks, I don't think there was a separate section to RSVP for remote attendance for the Summit in June, so I suspect there isn't one for NYC2 as the site was copied over.
nitot and tantek joined the channel
# 09:44 cmal it seems by default indieauth.com tries HTTP
# 09:45 cmal when I enter cmal.info it says « sign in as http://cmal.info/ » and then most of the relme fail because they are pointing to my HTTPS site, not HTTP (that's good)
# 09:45 cmal but still, defaulting to (or even allowing) HTTP without TLS for login is…
loicm, catsup and cmal joined the channel
gkbrk, mlncn and gvt joined the channel
pl_, friedcell, tantek, thebaer, chrisaldrich1, AngeloGladding and loicm joined the channel
# 13:38 KevinMarks !tell aaronpk could we have a page to RSVP to for remote attendance?
# 13:38 Loqi Ok, I'll tell them that when I see them next
friedcell joined the channel
snarfed and singpolyma joined the channel
# 13:53 KevinMarks I know, tantek. I was suggesting a page to webmention with an /RSVP so we show up with the others
# 14:03 tantek miklb every day can be an IWC if you want it to be :)
# 14:09 GWG We could also bring back IWC Online
# 14:22 miklb cool. There is a distributed Jekyll conf that is completely online through hangouts and was quite good.
chrisaldrich1, eayoungs1 and tantek joined the channel
# 14:53 tantek !tell KevinMarks speaking of RSVP for *remote* participation, did we ever capture that as a use-case or brainstorm about how one could RSVP yes-remote instead of just yes?
# 14:53 Loqi Ok, I'll tell them that when I see them next
KevinMarks joined the channel
# 14:53 tantek did Loqi get the _ to register with nickserv and get ops?
shiflett joined the channel
# 15:00 Loqi aaronpk: KevinMarks left you a message 1 hour, 21 minutes ago: could we have a page to RSVP to for remote attendance?
Loqi joined the channel
tantek and snarfed joined the channel
# 15:33 KevinMarks Hm yes-remote seems trickier than a remote page as an adjunct to a physically attending page
# 15:33 Loqi KevinMarks: tantek left you a message 40 minutes ago: speaking of RSVP for *remote* participation, did we ever capture that as a use-case or brainstorm about how one could RSVP yes-remote instead of just yes?
neilpdx, gRegorLove, friedcell and wolftune joined the channel
leg and wolftune joined the channel
# 16:41 gRegorLove cmal: https certs aren't needed to verify the rel-me links between your site and your account profiles, that's all indieauth is doing. The authentication step takes place at the profile you selected, like Twitter, which is https.
# 16:45 aaronpk it's true that without the https cert, indieauth.com *might* be MITM'd and the attacker could inject their own link on your home page. but that's a pretty far stretch because it requires MITM'ing the connection between indieauth.com and your server.
snarfed and wolftune joined the channel
wolftune joined the channel
cmal joined the channel
snarfed and begriffs joined the channel
mlncn joined the channel
# 18:18 cmal you're right about it being rather unlikely (it would probably not be the easiest entry point)
wolftune joined the channel
# 18:19 cmal but can we just assume that it's good and common practice to have HTTPS nowadays? I mean I don't see the usecase of someone NOT wanting to do HTTPS on their domain for authentication purposes
# 18:19 cmal (i.e. rel=me links on their homepage)
# 18:19 aaronpk using rel=me links for authentication is intended to be a super easy way to start using your domain for things
# 18:20 aaronpk you don't need to write any code or do any configuration other than setting up a web page
# 18:20 aaronpk so i'm hesitant to start adding restrictions and make people go through more hoops
# 18:20 cmal well I'm asking precisely because HTTPS in 2016 is not supposed to be a hoop anymore
# 18:20 aaronpk https is definitely a lot easier to get set up now, and doesn't have the added cost it used to, but it's still more work than not doing it
# 18:21 aaronpk not "supposed" to be, but it still is, at least for another year or so
# 18:21 aaronpk dreamhost's https checkbox is still technically in beta
# 18:21 aaronpk and they're one of the more proactive hosts supporting letsencrypt
# 18:21 cmal well you've got web servers auto-deploying certs (caddie) and many web hosts providing free certs by default now
# 18:21 bear https for most folks is still more than just a checkbox item when looking for a host
# 18:22 aaronpk until the vast majority of hosts literally don't require the user to do anything in order to support https, i'm going to say no
# 18:22 bear we have to remember that the IndieWeb guidelines and practices have to be designed with non-ops and non-tech folks
# 18:22 bear it's something i've had to learn to temper as an ops person working in this decidely non-ops community :)
shiflett joined the channel
# 18:23 bear cmal - not that folks like us shouldn't stop agitating for better [Info|App]Sec practices :)
# 18:24 bear we should always have on hand indieweb wiki posts and pages that help them take that next step
# 18:24 cmal but I don't know, I feel like HTTPS is now so easy… even for "non-ops" people personal clouds are all starting to implement ACME in the past months
# 18:24 aaronpk is still confused by this use of "personal cloud"
# 18:24 rascul is still confused by the use of "cloud" at all
# 18:24 bear yep, I feel the same - but until the ones that *don't* are the exception... we have to be patient
# 18:25 bear what we can do is start to suggest for new people the services that enable good practices
# 18:25 cmal yeah cloud is a stupid word, and personal cloud, too. maybe we mean admin panel or something?
# 18:25 bear cmal++ for keeping the InfoSec flame burning
# 18:26 cmal swimming pool urgently needs some tape
# 18:26 sknebel the UX issue ("i just put in my domain and it failed because it used http") might be fixable, does indieauth.com handle that redirect to https and have backlinks to https?
# 18:26 aaronpk yes if you have http->https redirects then everything works fine
# 18:27 sknebel oh, cmal.info doesn't redirect to https, that explains it then
wolftune joined the channel
# 18:32 snarfed btw cmal feel free to ask tantek for (some) arguments against https next time you see him
tantek joined the channel
# 18:33 snarfed i don't think he's entirely against, but he can defintiely describe some healthy skepticism
# 18:33 snarfed (tldr: for him, and some others, privacy is less of a priority than longevity and maintainability)
# 18:58 voxpelli is not on https and can not easily deploy to https due to GitHub Pages
# 19:00 voxpelli can probably only do "https" through Cloudflare, but since that would likely use http between Cloudflare and GitHub that is not without criticism and flaws as well
# 19:00 aaronpk you could probably do https through cloudflare and point cloudflare at the https github.io URL for your github pages
# 19:03 voxpelli That https can easily be provided while still relying on unencrypted server to server communications – so key is to teach security more than just enforcing protocols
# 19:04 aaronpk Right. And if you're only worried about https between your computer and the server then that's fine, and that's the more important use of https IMO anyway
# 19:05 voxpelli In context of IndieAuth it's all about server to server communications though
# 19:06 aaronpk you're more likely to be MITM'd on an open coffee shop wifi so it's most important that your computer is always talking to https sites during the login flow
# 19:06 aaronpk with rel-me auth, your server doesn't need to be https because your computer never talks to your server during login
# 19:08 voxpelli aaronpk: I can't remember: Is it possible for IndieAuth client to know how the user authed? To eg make a decision if security was good enough?
# 19:08 aaronpk indieauth.com doesn't tell the consumer which rel-me was used if that's what you mean
[kevinmarks] joined the channel
# 19:08 [kevinmarks] Does that imply that the micropub endpoint should be https though? Otherwise you token is sniffable in a coffee shop
# 19:08 voxpelli Does it tell the protocol of the site used to log in with?
# 19:09 aaronpk [kevinmarks]: if your computer is talking directly to your micropub endpoint then yes
# 19:09 aaronpk but in the case of quill, it's not. your computer talks to quill over https then quill talks to your server
# 19:09 aaronpk voxpelli: it will report the identity as http or https depending on what the user typed in
# 19:09 voxpelli [kevinmarks]: yes, OAuth 2 Bearer tokens always needs to be transmitted over https
# 19:15 [kevinmarks] write.as is a minimal UI blogging tool meant for quick posting with good pseudonymity. It has web, android and iOS clients, free and paid hosting, and supports microformats-2.
# 19:31 miklb voxpelli question: < > are being converted to html entities in micropub posts. aaronpk doesn't think Quill is doing it. What might be doing it in micropub endpoint?
# 19:33 voxpelli miklb: the incredibly epic and totally unnecessary html <-> markdown conversion ;)
# 19:34 voxpelli good news though: it's optional in the formatter, the glue project just needs to expose that configurability
# 19:36 voxpelli miklb: oh, you're sending markdown in your post? all micropub content is either html or plain text :/
# 19:36 voxpelli and plain text needs to be escaped as it would otherwise as you say be interpreted as markdown – so that's a feature, not a bug
# 19:37 miklb micropub is just converting the < > to html entities
# 19:37 voxpelli it's impossible for the micropub endpoint to know that those < > should be left alone and not escaped :/
KartikPrabhu joined the channel
# 19:37 aaronpk voxpelli: i'm not sure that's correct. if the client is sending plain text then nothing should be escaping that until it's displayed as html
# 19:37 voxpelli unless it specifically knows about Kramdown syntax and is specifically told to allow that syntax in plain text notes
# 19:38 aaronpk unless your micropub endpoint is actually storing HTML, at which point it's a storage problem
# 19:38 voxpelli aaronpk: well, in Jekyll it's saved as html or markdown right away so there's no non-html storage
# 19:39 aaronpk wishes that software was called something other than "micropub endpoint" because wow this conversation is hard to follow
# 19:40 miklb I've referred to it as WMG a few times to differentiate
# 19:42 voxpelli aaronpk: the micropub project is extra hard because it's made up of four different projects ;) this formatting doesn't happen in WMG, but rather in the formatter project
# 19:45 voxpelli miklb: I just recently became aware of the fact that there's no autolinking, so currently I don't
# 19:45 voxpelli I think tantek has some js autoformatting code we maybe could borrow?
# 19:46 miklb seems hard to do without passing html in a potential POSSE
# 19:46 miklb I could write a Jekyll plugin, but that wouldn't help gh-page users
# 19:47 tantek voxpelli: yes, auto_link is written in CASSIS and works in both PHP & JS. I use it on my server live on my site, and I think KevinMarks uses it in JS on noterlive.
# 19:51 voxpelli miklb: maybe, we could investigate a few different ways – I'm a bit suprised that GitHub Pages doesn't provide autolinking
# 19:54 miklb iirc when I investigated, the old alternate markdown converter did.
# 19:55 voxpelli miklb: autolinking would be nice as that would make posting the same post to this endpoint and to someone elses endpoint work just the same – which could be important in some cases where eg. the message is autogenerated
snarfed joined the channel
# 19:58 miklb the thing about doing it on the formatter side is would it convert it to HTML and would that effect a POSSE like Twitter where characters count?
[rickc] joined the channel
# 20:14 [rickc] On https: browsers still default to http if no protocol is specified.
# 20:17 [rickc] Apparently there are security concerns even with hsts
# 20:19 rascul [rickc] hsts preload probably takes care of that
# 20:20 GWG Octopub is the name of my Android Github viewer
# 20:22 miklb well, octopub would have been a good name for a micropub/github app ;-)
snarfed joined the channel
anarchivist joined the channel
shiflett and voxpelli joined the channel
begriffs joined the channel
# 20:52 voxpelli tried Markov chains to generate project names. Got "Sadlify" and "Worrytlr". Then tried to feed it with Product Hunt names. Did. Not. Improve.
bashrc joined the channel
# 20:54 voxpelli KevinMarks: pondered whether I could make a IndieWeb project name creator for whenever I needed to name a new project – I think I'll try something else ;)
Jammy_Stuff joined the channel
# 21:01 bear my method is to find verbs to describe what is needed, run that thru some synonym lookups and then thru a english->kanji dictionary
# 21:05 aaronpk i collect a bunch of names ahead of time then pick one from the list when i need one
snarfed joined the channel
mindB and snarfed1 joined the channel
bashrc joined the channel
aaronpk, bashrc, Lana and AngeloGladding joined the channel
friedcell, wolftune, pl_, KartikPrabhu, ben_thatmustbeme and acegiak[m] joined the channel
# 23:28 gRegorLove I think I might get back to working on h2vx.com this weekend, to update it with php-mf2 so it can parse h-event
# 23:30 tantek hey GWG - btw, Emma has confirmed we are good to go for tomorrow morning organizer setup 09:00 at Dalberg
# 23:30 tantek also I have "Hello my name is" and large sticky notes :D
# 23:30 GWG I will be there. I am going to try the Express Bus
# 23:31 Loqi ok, I added "http://microformats.org/wiki/h2vx for more info." to the "See Also" section of /h2vx
# 23:31 Loqi H2VX is a production deployment of the X2V hCard and hCalendar conversion transforms.
It converts hCard contacts and hCalendar events on web pages to .vcf and .ics respectively for use in desktop and other client software applications.
Contents
...
# 23:32 tantek GWG, I am only a few blocks away if you get to the area early
# 23:34 GWG The QM5 is estimated to arrive 34 and Park around 8:30.
tommorris_ joined the channel
# 23:36 GWG But if I get there early will advise.
Pierre-O and voxpelli joined the channel
# 23:38 GWG I have to pack up my equipment tonight. I may need a rolling bag.
Pierre-O and doesntgolf joined the channel