2016-07-29 UTC
# 00:16 gRegorLove Where's the image of indieweb participant faces, used for the FB events? # 00:46 tantek It's in my blog post from 2014-review for sure # 00:50 tantek aaronpk - not all. and they're a good longevity decay test # 00:50 tantek perhaps we can determine a halflife of profile images, given a large enough samplesize like that KevinMarks joined the channel
# 00:53 gRegorLove Should we link to current avatars from their sites, or just what's on the guest lists? # 00:55 tantek we should only update their profile images to repair them if broken mblaney joined the channel
KevinMarks, tantek, cweiske and loicm joined the channel
# 07:40 pfefferle cweiske sorry for the delay, but I finally added your hub to the pubsubhubbub wiki KevinMarks joined the channel
# 07:48 pfefferle cweiske thanks, removed... The whole wiki needs an update, because it was simply imported from the old google code wiki... # 08:19 voxpelli I think one could add Medium to that list considering that they own Superfeedr now ;) # 08:19 voxpelli hah, Cliqset is also very much dead, too bad on the first SWAT0 compliant service :'( # 08:27 pfefferle voxpelli oh, the list is that old... I also removed cliqset... # 08:30 voxpelli even Friendfeed is still there :D nice retro feeling on that list :) a different 2.0:ish era KevinMarks_, KevinMarks and loicm_ joined the channel
tantek joined the channel
loicm_ joined the channel
# 12:59 GWG I hope you are feeling better now # 13:00 GWG I am trying to simplify a post and POSSE workflow # 13:01 pfefferle GWG will probably hold a presentation about IndieWordPress at the WordCamp Frankfurt (Germany) # 13:03 GWG Then I can't understand the presentation if it is recorded, but will cheer you on with moral support # 13:03 pfefferle I am not that comfortable holding a 30 minutes presentation in english # 13:04 GWG I am hoping to improve the state of Indieweb things for WordPress even more...not sure what would have the most impact # 13:05 pfefferle GWG perhaps we can have a chat the other day, so that I will be able to make correct advertisement for your plugins ;) # 13:06 GWG Pfefferle, I am thinking of the entire set of plugins, including yours. What moves everyone forward as well as me. # 13:07 pfefferle GWG I meant for the presentation... because I am using only very few IndieWeb plugins atm. # 13:08 GWG Well, if you have a time, I will try to be available. # 13:08 pfefferle GWG I have a three week holliday, so I will find some time ;) # 13:09 GWG Post Kinds is probably the most involved. # 13:11 GWG I keep Trying to make it easier to use. # 13:16 cweiske maybe provide patches to the standard wordpress themes to add mf2? (sorry, don't know the current state there) # 13:16 GWG I have some PRs ib that direction # 13:17 GWG pfefferle, if you do look at Post Kinds and Syndication Links, any thoughts you have are always appreciated. singpolyma, KevinMarks, rMdes and loicm_ joined the channel
tantek and cweiske joined the channel
# 16:54 bear I don't see any mention of state in my token endpoint handlers # 17:01 aaronpk i think that would be better said "in the authorization request" gRegorLove, KevinMarks_ and singpolyma joined the channel
# 18:58 aaronpk the token endpoint might be unrelated to the authorization endpoint and not have prior knowledge # 18:59 aaronpk this is the case for tokens.indieauth.com, it's a completely stateless server and can be used by any authorization endpoint # 18:59 cweiske but in "Access Token Request" I am to supply parameters from the first request # 19:00 aaronpk some of them are optional yes (although highly recommended such as "state") # 19:00 aaronpk the other reason for returning it there is multi-user sites like Known return the user's profile URL who actually logged in, when the URL they may have typed at the beginning was just the root domain # 19:09 cweiske but why should the token endpoint be able to change the user's me URL? # 19:10 aaronpk hm yeah, in this example thhe token endpoint actually got the url from the authorization endpoint # 19:14 cweiske then I still don't understand the section " that the app does not yet know which user the authorization is for" # 19:14 cweiske because this should all be clear after authorization # 19:15 aaronpk huh, i might have to walk through this from scratch myself # 19:15 cweiske (i'm trying to implement a token endpoint myself, so I'm hanging at every word) # 19:20 aaronpk okay yeah the request to get the token is the first time the client knows the final "me" URL # 19:21 cweiske but why is the URL allowed to change between authorization and token fetching? # 19:21 aaronpk in order to support multi-user sites, or aliasing equivalent URLs such as "http://aaronparecki.com" and "https://aaronparecki.com/" # 19:22 aaronpk that second one is common, where the user enters "http://aaronparecki.com" or even just "aaronparecki.com" but the auth server returns the full https URL # 19:23 aaronpk right but at the time of the redirect, that code (and any other parameter in the redirect) can't be trusted by the client yet # 19:24 aaronpk and in this flow, the client never verifies anything against the auth server, since it just exchanges the code for an access token at the token endpoint # 19:25 aaronpk yeah i guess that isn't needed there. the client can't trust it at that point anyway. # 19:25 aaronpk if the client is using the "state" parameter (or even just using its own sessions) then it knows the "me" that would be there anyway # 19:28 aaronpk in that case, the client still has to verify the auth code (at the auth server) so it wouldn't be needed there either as long as the client is using "state" # 19:29 cweiske ok, so we can remove "me" from the "Redirect to web application" section in the authorization endpoint # 19:30 aaronpk that actually has the added benefit of requiring the client to use "state" which it should really be doing anyway # 19:31 aaronpk the only reason i made "state" optional in IndieAuth is because it's optional in OAuth 2.0, but maybe it should just be required in IndieAuth # 19:32 aaronpk oh yeah that reminds me of the other thing i was supposed to review about "state" # 19:33 aaronpk I think it's not required to send the state in either the token request or the auth code verification request # 19:33 aaronpk since it's really a mechanism for protecting the client against CSRF (and the client can use it as a session key if it's not using a cookie for that) # 19:47 cweiske that whole paragaph should be switched with the next # 20:15 cweiske what about issued_at and nonce? what if I don't have them? # 20:16 cweiske or is this a leftover from the "Self-Encoded Tokens" example? # 20:17 aaronpk i think that's a leftover from self encoded tokens # 20:17 aaronpk the micropub endpoint needs to know 1) whether the token is valid (the token endpoint should error out if it's not), and 2) the "me" URL, and client_id and scope # 20:18 aaronpk those are the values that my micropub endpoint actually uses when deciding how to process the micropub request # 20:19 aaronpk e.g. the micropub endpoint can reject the request if the scope isn't valid, and i have some rules that say "this app can only create posts in this category" so that uses the client_id, # 20:31 aaronpk the client_id URL is where the client can look up the "registered" redirect URIs plus fetch application info like name and app icon to use in the auth screen # 20:33 aaronpk i think the redirect URI stuff is only mentioned in brainstorming right now, but the app info is used by indieauth.com and my p3k apps # 20:33 cweiske my auth endpoint does not do redirect verification # 20:33 cweiske and since it doesn't support code auth requests, it does not need to display anything from the client's url # 20:34 aaronpk the screen where you approve or deny the request is where you'd show the application info # 20:35 aaronpk so the act of you authenticating is effectively approving the request? # 20:35 cweiske which delegates this task to the openid server behind # 20:35 cweiske but that's ok for now because that's only logging in mindB joined the channel
# 20:36 aaronpk it does mean i could trick you into logging in to an app you weren't intending to # 20:36 aaronpk but that doesn't leave a lot of room for an attack anyway # 20:37 cweiske except some voting portal uses indieauth and automatically makes me vote when I click the login button # 20:38 aaronpk if i were building an app like that though i'd want to add a step to make sure you confirm # 20:40 cweiske my openid endpoint also only asks me the first time, then I usually use the "automatically continue" checkbox # 20:41 cweiske my indieauth endpoint is even more comfortable by never asking # 20:41 aaronpk yeah, mine asks me the first time then automatically continues afterwards mindB joined the channel
# 20:51 cweiske aaronpk, you said quill has a html editor. I only see a text area. no pretty buttons? # 20:51 aaronpk it's kinda hard to find, i think there's a link in the footer # 20:51 aaronpk also if you click the quill logo there's an ugly menu there tantek joined the channel
# 20:57 aaronpk oh i think p3k internally stores it as an mf2 property called p3k-slug # 21:00 cweiske I thought about adjusting quill so that I can pass the "me", do not get asked if I really want to login now and pre-fill reply-to # 21:03 cweiske can't really explain now without revealing my master plan :) # 21:06 cweiske by providing a micropub endpoint that doesn't care about authentication # 21:06 cweiske and since I didn't want to make comment text field myself I thought I could use quill # 21:08 aaronpk i think that would be a reasonable request for Quill, to basically handle login redirects better # 21:09 cweiske so blogs could have a "add comment" button, which links to my comment hosting silo, preconfigured with the reply-to-url # 21:09 aaronpk you want to provide an "in-reply-to" URL along with the login request so that after they log in with Quill it takes them to the screen with the reply URL already populated # 21:09 cweiske and the silo would then redirect to quill, passing the "me" url, so that quill automatically redirects to login # 21:10 cweiske the login happens automatically since the auth endpoint would not require any input # 21:10 cweiske then it'd redirect back to quill, which then shows the form # 21:11 cweiske I thought about buying comments.xxx, but that's 8$ per month - too much for a fun project # 21:18 cweiske aaronpk, I was amused that you use savant in quill # 21:18 tantek I think there would be an amazing humor quality to anon comments from comments.wtf # 21:18 tantek cweiske++ for pursuing quite an interesting assumption-questioning project # 21:18 Loqi cweiske has 50 karma (1 in this channel) # 21:19 aaronpk oh yeah, savant is quite old now and looks mostly unmaintained # 21:19 tantek .xxx is a top level domain that costs about $8 per month to register. # 21:22 tantek .wtf is a top level domain that costs about 40€/year to register. # 21:24 tantek awww we had a new person from godaddy show up to HWC SF and she's even arranged to host HWC SF meetups for the next two months! # 21:24 aaronpk i've never heard of a real person who works at godaddy! # 21:24 tantek and she was hired post godaddy revolt because, as she put it, she was one of the "godaddy haters" # 21:25 Loqi godaddy has 0 karma (0 in this channel) # 21:25 aaronpk have they gotten better about not trying to upsell you on useless crap? # 21:25 aaronpk i guess it has been almost 10 years since i last registered a domain with them # 21:25 tantek KevinMarks_: perhaps you can ask your HWC SF co-organizer at next month's meetup? ^^^ # 21:26 tantek aaronpk, my interactions with godaddy people (like 3-4 now?) in the past few years have all been positive, and quite humble # 21:26 aaronpk i just remember trying to find that "skip" link on about 5 different screens when trying to register a domain # 21:26 aaronpk tantek: that's good, hopefully they can make some progress there then # 21:28 tantek looks very unlinked, (except the post I bookmarked author's home page) # 21:29 aaronpk yep i just forgot to add a link when there is no name # 21:29 tantek it just looks like bookmark posts weren't quite handled # 21:29 aaronpk it's not really a difference of whether it was a bookmark post # 21:30 tantek I find that hard to believe, because a bookmark post has two layers of information to choose from # 21:30 aaronpk it uses the name for the large text which is hyperlinked to the post # 21:30 tantek and indienews deliberately knows to look *inside* the bookmark in the h-entry # 21:30 aaronpk all the bookmark posts that i've submitted have a name (on my site) which is the name of the bookmarked post # 21:30 tantek rather than just looking for u-url and p-name of the top level h-entry # 21:31 aaronpk your p-name was the same as p-content so it disregarded it as a name # 21:31 tantek my point is that bookmarks are special treated by indienews, thus they should be by /this-week as well! # 21:32 aaronpk yes i'm saying it is a bug where the permalink is not included when there is no name # 21:32 tantek that is, the "name" of a bookmark post should be taken from the thing being bookmarked and similarly its URL, and then optionally show "bookmarked by" or something for the outer h-entry author info etc. # 21:32 aaronpk where "no name" means "name == content" because that's the heuristic it has to use # 21:33 tantek I'm saying that's inconsistent with the heuristic that indienews already uses # 21:33 tantek where it uses the name of the thing being bookmarked, not the bookmark post # 21:33 aaronpk the thing being bookmarked doesn't always have a parsable name # 21:33 aaronpk so it uses the name that is on the site that bookmarks it # 21:35 tantek so it needs an explicit h-cite on the u-bookmark-of? # 21:37 aaronpk the newsletter uses only the mf2 found on news.indieweb.org fyi # 21:40 cweiske that's the 3rd button I have to press to finally see the reply form # 21:41 aaronpk yeah quill is definitely meant to be used as a micropub tutorial :) # 21:41 cweiske that's what I meant when I said I think quill isn't made for my task # 21:41 aaronpk it intentionally steps you through each step the first time you use it # 21:41 tantek aaronpk interesting, then I should add h-cite to my next u-bookmark-of and see if that helps # 21:41 aaronpk tantek: that would do it! otherwise it's using the p-name of your bookmark post # 21:42 aaronpk hm i need to use an autolinker on the content too # 21:42 aaronpk i just fixed the newsletter to make the timestamp there a permalink to the bookmark post # 21:49 tantek and when you use it, it will auto-link "@megnut" also # 21:53 aaronpk cweiske: i'd be open to adding a parameter to quill that bypasses the debugging stuff # 21:55 Loqi [Malcolm Blaney] dobrado SWAT0 #indieweb # 21:56 tantek we need to help him make an IWC happen near him! get another 3 person / implementation SWAT0 demo happening # 21:58 tantek The long list of "Changed Wiki Pages" is making me wonder if there would be some way of giving each of them unique-ish icons to indicate what kind of page they were # 21:59 tantek ok so for example, every "event" page could have an 📆 # 22:00 tantek (how we determine that icon is a different question, postpone that for now, just thinking about presentation / semantics first) # 22:00 aaronpk once each thing on that list has an icon then i think it would make sense to group them by those icons # 22:00 tantek wow that's another approach that may be even better # 22:01 tantek since sorting by global activity doesn't necessarily add as much as activity per type # 22:01 tantek hopes for Loqi search/replace and is disappointed # 22:01 aaronpk (newloqi doesn't have the same access to IRC logs as oldloqi, so that's disabled for now) # 22:03 tantek another kind of page (are these Mediawiki categories?) # 22:04 tantek would be project pages, pages about specific projects, e.g. ikiwiki, WordPress, Getting Started on WordPress, WordPress/*, p3k # 22:05 tantek so they might have icons in addition to whatever grouping # 22:06 tantek then we have building block pages (which I'm torn about, because OTOH, user features like "album", OTOH, plumbing building blocks like protocols and formats like "Webmention") # 22:07 tantek maybe we have "technology" building blocks (a nicer name for plumbing), and "feature" building blocks? (just thinking out loud here) # 22:08 tantek looks for how he clustered pages in his "in review" blog post # 22:10 tantek a-ha, I split "technologies" into two lists: "technologies" and "types of content" # 22:10 Loqi [Tantek Çelik] #IndieWebCamp 2014 Year in Review — This Is A Movement # 22:11 tantek then "services" (e.g. Bridgy), and "resources" (sounds like a generic name for concepts being documented) # 22:12 cweiske and it's based on the readme PR I sent this morning # 22:14 aaronpk so this actually brings up the issue with registering redirect URIs KevinMarks joined the channel
# 22:15 aaronpk the "correct" way to do it is to not have the redirect URI change, and instead use the session or state parameter to encode stuff like that # 22:20 tantek these kinds/categories are more brainstorming than a specific issue so I'm going to use a subsection not a gh issue # 22:46 tantek I forget who it was who previously (like years ago?) advocated using MediaWiki Categoris # 22:46 aaronpk i use categories on a couple things, i think only indieauth and p3k pages # 22:46 tantek I remember being vaguely against it, but now having come upon this use-case, I wanted to at least present / document the evidence possibly for it # 22:47 tantek it feels like the kind of thing that MediaWiki Categories were meant for # 22:47 tantek I've also been wanting a way to distinguish building blocks, in order to prioritize feature-centric thinking (e.g. what IndieMark does) # 22:48 aaronpk without having to maintain a separate list of things with that category # 22:48 tantek rather than plumbing/protocol centric building blocks (webmention, microformats, h-* etc.) # 22:48 gRegorLove I don't know if I advocated them, but when I first came into IWC I was used to them from Wikipedia so thought it odd we weren't using them much. Havne't seen a whole lot of use for them for IWC yet, though you can do some cool things with listing links to pages in a category. # 22:48 gRegorLove I vaguely recall trying to do something in the last six months with them, but it required newer MW # 22:48 aaronpk i use them on my recipe wiki to tag recipes based on a few categories # 22:48 tantek gRegorLove: I think we didn't use them because we didn't have well defined uses for them # 22:49 tantek without a well defined use, any system of categorization just becomes a hypothetical ontological exercise # 22:49 gRegorLove Oh, I think it was about implementations of things like Webmention. # 22:49 tantek I think for sessions / IWCs done in a particular year # 22:50 tantek if there is no incentivizing use-case, then categories are not maintained, and then those "neat listing links to pages in a category" pages become horribly inaccurate / misleading representations of what's on the wiki # 22:50 gRegorLove Listing the user pages from that category on /Webmention, and individual implementation details could go on the user pages. # 22:51 aaronpk if you have a page X that lists things, that page requires maintenance # 22:51 tantek "things tagged x" and "all the things x" are very different meanings though # 22:51 aaronpk using categories saves you a maintenance step because updating the list requires a change in only one place instead of two # 22:51 tantek and the problem is the Category pages tend to present as the latter # 22:52 tantek aaronpk, that's not been the case in practice # 22:53 tantek e.g. lists of indieweb implementations of stuff = one edit on the appropriate "indieweb examples" section # 22:53 tantek sometimes with *one* edit you can add *multiple things / people* ! # 22:53 tantek whereas if you depend on Category: then you MUST do one edit per thing / person # 22:53 aaronpk if I add a new p3k project, then I have to create the page for it and also add it to /p3k. with categories, i can just add the category to the project page itself and /Category:p3k is updated automatically # 22:54 aaronpk things like indieweb examples are different though, because there's additional information *about* that thing that's effectively added to the tag # 22:54 tantek right, that's the one kind of edit that tht helps with # 22:58 gRegorLove Thinking out loud: if we got in the practice of adding sub-pages under our User page for implementations, then the category and additional information would be in one page. KevinMarks joined the channel
# 22:59 gRegorLove Not as obvious as going to the page and editing #IndieWeb_Examples though # 23:01 aaronpk i do know that it's super hard to track down all the places my site is referenced in "indieweb examples" sections though # 23:02 aaronpk so because i did a big rewrite, a bunch of the "indieweb examples" sections for me need to be updated, but it's hard to find all of them # 23:03 gRegorLove Yeah, or like when Kyle switched to Known and back. Lot of outdated references there :) # 23:06 tantek on the flipside, anytime you make something require a side-effect, it makes editing the page more difficult # 23:06 tantek I see a page, I see a place on a page to add myself, I click edit, I want to just add myself directly there # 23:07 tantek whereas the "go find the magic OTHER page to edit to make stuff happen" is a barrier to more people # 23:07 tantek it's why I generally don't like such side-effect solutions like "automatic category lists" # 23:08 tantek I think that problem is MUCH worse than the occasional aaronpk rewrites p3k, or kylewm switches to Known and back to Red Wind # 23:08 aaronpk kinda the same reason people always have trouble figuring out how to upload images to the wiki # 23:08 tantek definitely in that same category of problem ;) # 23:19 tantek is there a name for when people just bounce from one silo to another? # 23:20 aaronpk Flickstagram was an application that allowed you to silo-hop from Instagram to Flickr # 23:22 tantek 2010-09-30 Six Apart shutting down Vox on September 30, 2010 (going read-only on 2010-09-15), irony: Six Apart encouraged Pownce users to switch to Vox # 23:22 tantek Pownce.com shutting down, switch to Vox.com. Vox.com shutting down, switch to ... ? KevinMarks_ and KevinMarks joined the channel
KevinMarks joined the channel
jkphl.is created /events/2016-08-17-homebrew-website-club (+2791) "Created page with "<div class="h-event vevent"> <img style="width:100%;height:18em;object-fit:cover;object-position:50% 50%" class="u-featured" src="http://assets.veganstraightedge.com/articles/201..."" (view diff)
gRegorLove Where's the image of indieweb participant faces, used for the FB events?
tantek the one on /2014-review is "live" with hot links of images
gregorlove.com edited /events/2016-08-10-homebrew-website-club (+67) "/* Bellingham, WA */ FB event" (view diff)
cweiske pfefferle, maybe look over the link on https://github.com/pubsubhubbub/PubSubHubbub/wiki/Companies-Using-PubSubHubbub - at least favit and lazyfeed are dead
Loqi It looks like we don't have a page for "initial request" yet. Would you like to create it?
cweiske.de edited /token-endpoint (-6) "/* Creating a token endpoint */ change wording, add links" (view diff)
aaronpk if the token endpooint gets them, it has to return them. the optional ones in the authorization request are noted here: https://indieweb.org/authorization-endpoint#Request
www.boffosocko.com edited /SubToMe (+263) "added example with possible UX/UI implications" (view diff)
aaronparecki.com edited /token-endpoint (+0) "/* Verifying an Access Token */ s/above/below" (view diff)
KevinMarks Like the tag dump from Christopher's site?