#LoqiGWG: tantek left you a message 3 hours, 32 minutes ago: I just checked out the Dalberg space, and took some photos. I can probably answer any further questions you have.
#tantekI'm going to need to pick up some sticky notes from a local supply store tomorrow, and we could use a VGA-mini-DVI adapter (but I think Emma will take care of that tomorrow)
#rasculoh that's because it's still trying to grab it from rascul.io instead of rascul.xyz
#AngeloGladdingin building my personal social network for /reader and contact (writer) purposes i'm creating a simple UI that accepts a protocol-less URI that tries https first and falls back to http
#tantekif there was a way to do peer to peer sharing of others' self-signed certs, from *non*-self-signed certs, then you could even verify a self-signed cert by way of that same social network!
#rasculyes but i'm not referring to user authentication but host authentication
snarfed, wolftune, KevinMarks_, loicm, comzeradd, chrisaldrich1, ChrisAldrich, nitot, moredhel, gkbrk, KevinMarks, friedcell, cmal and AngeloGladding joined the channel
#ChrisAldrichKevinMarks, I don't think there was a separate section to RSVP for remote attendance for the Summit in June, so I suspect there isn't one for NYC2 as the site was copied over.
#cmalwhen I enter cmal.info it says « sign in as http://cmal.info/ » and then most of the relme fail because they are pointing to my HTTPS site, not HTTP (that's good)
#cmalbut still, defaulting to (or even allowing) HTTP without TLS for login is…
#LoqiJoin us for the very first IndieWebCamp Online. IndiewebCamp Online is a one-day IndieWebCamp conducted entirely online without a physical venue https://indieweb.org/IWC_Online
#miklbcool. There is a distributed Jekyll conf that is completely online through hangouts and was quite good.
chrisaldrich1, eayoungs1 and tantek joined the channel
#tantek!tell KevinMarks speaking of RSVP for *remote* participation, did we ever capture that as a use-case or brainstorm about how one could RSVP yes-remote instead of just yes?
#KevinMarksHm yes-remote seems trickier than a remote page as an adjunct to a physically attending page
#LoqiKevinMarks: tantek left you a message 40 minutes ago: speaking of RSVP for *remote* participation, did we ever capture that as a use-case or brainstorm about how one could RSVP yes-remote instead of just yes?
neilpdx, gRegorLove, friedcell and wolftune joined the channel
#gRegorLovecmal: https certs aren't needed to verify the rel-me links between your site and your account profiles, that's all indieauth is doing. The authentication step takes place at the profile you selected, like Twitter, which is https.
#aaronpkit's true that without the https cert, indieauth.com *might* be MITM'd and the attacker could inject their own link on your home page. but that's a pretty far stretch because it requires MITM'ing the connection between indieauth.com and your server.
#aaronpksee above for thoughts on your indieauth comment
#cmalyou're right about it being rather unlikely (it would probably not be the easiest entry point)
wolftune joined the channel
#cmalbut can we just assume that it's good and common practice to have HTTPS nowadays? I mean I don't see the usecase of someone NOT wanting to do HTTPS on their domain for authentication purposes
#bearcmal - not that folks like us shouldn't stop agitating for better [Info|App]Sec practices :)
#bearwe should always have on hand indieweb wiki posts and pages that help them take that next step
#cmalbut I don't know, I feel like HTTPS is now so easy… even for "non-ops" people personal clouds are all starting to implement ACME in the past months
#aaronpkis still confused by this use of "personal cloud"
#rasculis still confused by the use of "cloud" at all
#bearyep, I feel the same - but until the ones that *don't* are the exception... we have to be patient
#sknebelthe UX issue ("i just put in my domain and it failed because it used http") might be fixable, does indieauth.com handle that redirect to https and have backlinks to https?
#aaronpkyes if you have http->https redirects then everything works fine
#sknebeloh, cmal.info doesn't redirect to https, that explains it then
#voxpellican probably only do "https" through Cloudflare, but since that would likely use http between Cloudflare and GitHub that is not without criticism and flaws as well
#aaronpkyou could probably do https through cloudflare and point cloudflare at the https github.io URL for your github pages
#voxpelliAlso shows that https URL:s are not necessarily safe
#voxpelliThat https can easily be provided while still relying on unencrypted server to server communications – so key is to teach security more than just enforcing protocols
#aaronpkRight. And if you're only worried about https between your computer and the server then that's fine, and that's the more important use of https IMO anyway
#voxpelliIn context of IndieAuth it's all about server to server communications though
#aaronpkyou're more likely to be MITM'd on an open coffee shop wifi so it's most important that your computer is always talking to https sites during the login flow
#aaronpkwith rel-me auth, your server doesn't need to be https because your computer never talks to your server during login
#voxpelliaaronpk: I can't remember: Is it possible for IndieAuth client to know how the user authed? To eg make a decision if security was good enough?
#aaronpkindieauth.com doesn't tell the consumer which rel-me was used if that's what you mean
[kevinmarks] joined the channel
#[kevinmarks]Does that imply that the micropub endpoint should be https though? Otherwise you token is sniffable in a coffee shop
#voxpelliDoes it tell the protocol of the site used to log in with?
#aaronpk[kevinmarks]: if your computer is talking directly to your micropub endpoint then yes
#aaronpkbut in the case of quill, it's not. your computer talks to quill over https then quill talks to your server
#aaronpkvoxpelli: it will report the identity as http or https depending on what the user typed in
#voxpelli[kevinmarks]: yes, OAuth 2 Bearer tokens always needs to be transmitted over https
#[kevinmarks]write.as is a minimal UI blogging tool meant for quick posting with good pseudonymity. It has web, android and iOS clients, free and paid hosting, and supports microformats-2.
#miklbvoxpelli question: < > are being converted to html entities in micropub posts. aaronpk doesn't think Quill is doing it. What might be doing it in micropub endpoint?
#voxpellimiklb: the incredibly epic and totally unnecessary html <-> markdown conversion ;)
#voxpelligood news though: it's optional in the formatter, the glue project just needs to expose that configurability
#miklbok. I was going to use the built in kramdown <http://example.com/> to markdown conversion for notes w/links
#voxpellimiklb: oh, you're sending markdown in your post? all micropub content is either html or plain text :/
#voxpelliand plain text needs to be escaped as it would otherwise as you say be interpreted as markdown – so that's a feature, not a bug
#miklbnot markdown, but specifically `<http://example.com/>` then when Jekyll builds the page, it converts that to a markdown link
#miklbmicropub is just converting the < > to html entities
#voxpelliit's impossible for the micropub endpoint to know that those < > should be left alone and not escaped :/
#voxpelliaaronpk: the micropub project is extra hard because it's made up of four different projects ;) this formatting doesn't happen in WMG, but rather in the formatter project
#voxpellimiklb: I just recently became aware of the fact that there's no autolinking, so currently I don't
#voxpellimiklb: perhaps something the formatter should do?
#voxpelliI think tantek has some js autoformatting code we maybe could borrow?
#miklbseems hard to do without passing html in a potential POSSE
#miklbI could write a Jekyll plugin, but that wouldn't help gh-page users
#tantekvoxpelli: yes, auto_link is written in CASSIS and works in both PHP & JS. I use it on my server live on my site, and I think KevinMarks uses it in JS on noterlive.
#miklbso possibly an exception for the <http://example.com/> format? Kramdown will autolink that in Jekyll
#voxpellimiklb: maybe, we could investigate a few different ways – I'm a bit suprised that GitHub Pages doesn't provide autolinking
#miklbiirc when I investigated, the old alternate markdown converter did.
#voxpellimiklb: autolinking would be nice as that would make posting the same post to this endpoint and to someone elses endpoint work just the same – which could be important in some cases where eg. the message is autogenerated
snarfed joined the channel
#miklbthe thing about doing it on the formatter side is would it convert it to HTML and would that effect a POSSE like Twitter where characters count?
#LoqiJust generated this week's newsletter! You still have a few minutes to make changes, and I'll re-generate it 10 minutes before it gets sent out at 2pm Pacific time. https://indieweb.org/this-week/2016-08-26.html
#LoqiGitPub is a micropub endpoint that creates static content inside a git repository for later consumption by a ssg or flat file backed cms https://indieweb.org/GitPub
#voxpellitried Markov chains to generate project names. Got "Sadlify" and "Worrytlr". Then tried to feed it with Product Hunt names. Did. Not. Improve.
#voxpelliKevinMarks: pondered whether I could make a IndieWeb project name creator for whenever I needed to name a new project – I think I'll try something else ;)
#Loqiok, I added "http://microformats.org/wiki/h2vx for more info." to the "See Also" section of /h2vx
#LoqiH2VX is a production deployment of the X2V hCard and hCalendar conversion transforms.
It converts hCard contacts and hCalendar events on web pages to .vcf and .ics respectively for use in desktop and other client software applications.
Contents
...
#tantekGWG, I am only a few blocks away if you get to the area early