#dev 2017-10-16

2017-10-16 UTC
snarfed, [miklb], KartikPrabhu, EmreSokullu, eli_oat, [eddie], renem and mblaney joined the channel
#
mblaney
snarfed nice work on fed.brid.gy! I've given it a go and looks like I get compressed data back when I try and discover the webmention endpoint?
#
mblaney
I could handle the encoding, but just wondering if it's intentional as I've never hit that issue during endpoint discovery before. (And I'm not sending any accept-encoding headers)
eli_oat, EmreSokullu, cweiske and tantek joined the channel
#
sknebel
so HWC Berlin didn't end up in the newsletter because someone put "open end" as the end time and (surprise) the parsing script didn't manage to make a useful timestamp out of that. I'll fix the newsletter script to handle that more gracefully, but any suggestions how to publish something like that? "open end" as text, and have let'S say midnight in a machine-only mf2 attribute? /cc aaronpk
#
tantek
parsing script should be more robust and just ignore bad input instead of failing
#
tantek
that's like, the default for anything that parses text
tantek, jeremycherfas and eli_oat joined the channel
#
aaronpk
I suspect it tried to convert that to a timestamp, which probably parsed to 1970, which then excluded it from the newsletter cause it’s in the past
jeremych_ joined the channel
#
tantek
end time after start time should be thrown out as invalid
#
tantek
er, s/after/before
#
cweiske
for a conference about reverse-chronological lifeforms that would be ok
#
sknebel
yes, that's the issue pretty much. not having a end-property is covered, but not having one that can't be parsed to a timestamp. will fix for the newsletter, question remains if there is something we can do markup wise to make consuming apps do something better than "ignore property due to weird content"
#
cweiske
throw a fatal error
#
tantek
better to ignore and continue processing, as we've learned from XML fragility lessons
#
tantek
and if we come up with "something better" later we can consider that
#
tantek
just silently breaking is definitely wrong
#
cweiske
but you are recommending silently doing different things that the author intended
#
ben_thatmustbeme
its a good processing model to follow though, it future proofs it. Specs often say specifically you must ignore anything you don't understand, that way any future additions don't cause breakage
John__, snarfed and tantek joined the channel
#
snarfed
!tell mblaney sorry for the trouble! yeah, if you don't send Accept-Encoding, that actually means you're ok with any encoding, including gzip. https://tools.ietf.org/html/rfc7231#section-5.3.4
#
Loqi
Ok, I'll tell them that when I see them next
#
snarfed
!tell mblaney looks like you have to send something like Accept-Encoding: identity to disable it...but that doesn't work here either. (i don't control this serving path; google does.) i'll see what i can do.
#
Loqi
Ok, I'll tell them that when I see them next
[manton] joined the channel
#
GWG
aaronpk: OYS doesn't seem to be sending checkins past the first one. I had to manually go in and do it. Any troubleshooting advice?
#
aaronpk
GWG: you're on the once-a-day polling interval in case the foursquare web hook fails, have you waited at least that long to see if it catches up?
#
GWG
I'm new.
#
GWG
I waited 5 hours
#
aaronpk
normally the foursquare web hook runs and you should get it in realtime, but occasionally they just don't run
#
aaronpk
and shoot, the OYS queue got locked up again
#
GWG
Sorry
#
GWG
Hope it wasn't me
#
GWG
snarfed: I'm finding annoyances. Expect some PRs
#
aaronpk
i don't know what's going on with it
#
snarfed
GWG: micropub? sure
#
aaronpk
it shouldn't be possible to have it just lock up like this
#
GWG
snarfed: I opened an issue. More time handling bugs
#
snarfed
GWG: i'll trade you if you try out https://fed.brid.gy/ :P
#
Loqi
Ryan Barrett
#
GWG
snarfed: What would I federate with?
#
GWG
I don't have an account with any of those. Which would you suggest I add?
#
GWG
I will to help
#
snarfed
mastodon!
#
aaronpk
you don't need a mastodon account to use it! that's the point :)
#
aaronpk
i think OYS wasn't properly timing out when sending webmentions, and that caused it to stall out
#
aaronpk
added a timeout to test that, so we'll see how it holds up
#
GWG
I will try it
[eddie] joined the channel
#
[eddie]
aaronpk: Is there an easy way to get a token from indieauth.com? Compass wants a token, so my thought was to just build a quick app that let's you login via IndieAuth and it will present a token, but if there is an easier way then I'll do that
#
aaronpk
not sure what you mean
#
aaronpk
compass generates its own tokens for read/write access to the databases
#
[eddie]
sorry for micropub ?
#
aaronpk
oh for exporting from compass via micropub?
#
aaronpk
heh i was lazy and didn't build a proper indieauth client into it. that's the real fix.
#
aaronpk
"easy way to get a token from indieauth.com" isn't the right question. the token comes from the token endpoint which is entirely up to your website to decide how to do.
#
aaronpk
hah i forgot about that
#
[eddie]
sknebel: Do we know who runs that server? ?
#
aaronpk
it's sebsel. the code is all client-side tho.
#
sknebel
sebsel
#
[eddie]
Ahh gotcha. Thanks ? I guess I might sit down and see if I can put together an IndieAuth client into compass since I've done that for a couple projects now and if that works I can send a PR. If I run into issues I can use gimme a token as a backup if I'm not able to get it done before I head out somewhere
#
aaronpk
cool. Compass already has the indieauth client library in it so should be pretty straightforward.
cweiske joined the channel
#
[eddie]
Oh yeah, it does! Sweet.
#
[eddie]
aaronpk: Quick brainstorm to make sure I'm thinking down the right path. We would want to determine the micropub endpoint from the identity URL (same as any micropub app), but we also don't want to require you to post to the same identity you logged in with. (Example: Someone might log in with a static site identity but might want to post to their Known micropub endpoint). Which means you're starting the IndieAuth part from the very beginning. W
#
[eddie]
URL? A "Micropub Endpoint" is obviously the Micropub endpoint itself, but we would want them to point to the homepage of whatever micropub server we want them to point to. From there, we would have them enter that URL, click "Login" and we would do the standard micropub app workflow to authenticate, get a token and discover the micropub_endpoint for that identity
snarfed joined the channel
#
aaronpk
oops that got cut off
#
aaronpk
"Which means you're starting the IndieAuth part from the very beginning. W"
#
[eddie]
oh darn! lol
#
[eddie]
What do we call that URL? A "Micropub Endpoint" is obviously the Micropub endpoint itself, but we would want them to point to the homepage of whatever micropub server we want them to point to. From there, we would have them enter that URL, click "Login" and we would do the standard micropub app workflow to authenticate, get a token and discover the micropub_endpoint for that identity
#
aaronpk
"web sign-in" or "IndieAuth URL" i think
#
aaronpk
and yeah taht's what I was imagining. basically start the IndieAuth flow from the beginning from that settings screen
#
aaronpk
another use case is you might have several Compass databases and want them to post to different places
#
[eddie]
Exactly
#
aaronpk
and since Compass DBs can be shared between users it doesn't make sense to tie it to who logged in
#
[eddie]
Okay, that makes sense, because we have the "Realtime Micropub Export" header, that provides the context for the "web sign-in". That sounds good. I was initially concerned web sign-in wouldn't make it obvious that they were doing their micropub, but the context on the page provides that for us.
#
[eddie]
Cool. Here we go ?
snarfed, KartikPrabhu and tantek joined the channel
#
tantek
didn't see bear post this so I will: Looks like WPA2 wifi is fundamentally (at the spec level!) crackable and any compliant implemenations are thus vuln https://www.krackattacks.com e.g. your home wifi access point
#
snarfed
not quite at the spec level. from https://www.krackattacks.com/ : "implementations can be patched in a backwards-compatible manner"
#
snarfed
...but still, yes, bad break, and patches aren't even out yet for many client devices.
#
tantek
"The weaknesses are in the Wi-Fi standard itself"
#
tantek
that sounds pretty spec-level
#
snarfed
sure, maybe i misinterpreted your statement
#
snarfed
also sounds like routers are less vulnerable than client devices, fortunately. "Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients."
#
tantek
yeah still reading
#
snarfed
btw tantek i need your software-breaking gift! pls try out http://fed.brid.gy/ when you get a chance :P
#
tantek
oh boy
#
bear
tantek - I was going to post when I got some links about how to mitigate it, the issue for the WPA2 hack is that it's clientside
#
bear
Ubuntu has just released an update to wpa-supplicnt (the client tool for wifi)
#
aaronpk
the other thing about that is if you're talking to https sites you're still fine because of the https transport is still encrypted
#
aaronpk
it basically turns encrypted wifi connections into public wifi connections, same as you'd be connecting via a coffeeshop unencrypted wifi
#
bear
yes - HSTS and HTTPSEverywhere for all
#
snarfed
module the sslstrip vulnerability, at least
KartikPrabhu and snarfed joined the channel
#
GWG
That is comforting
#
loqi.me
created /PDO (+105) "prompted by tantek and dfn added by ben_thatmustbeme"
(view diff)
snarfed, KartikPrabhu, [keithjgrant], John__, cweiske and [eddie] joined the channel
#
aaronparecki.com
edited /p3k (+1582) "/* Itching */"
(view diff)
EmreSoku_ and KartikPrabhu joined the channel
#
loqi.me
created /excerpt (+132) "prompted by snarfed and dfn added by snarfed"
(view diff)
EmreSok__, EmreSo___, EmreSoku_ and [kevinmarks] joined the channel
#
aaronparecki.com
edited /User:Aaronparecki.com (+1156) "/* working on */ indieweb community todo"
(view diff)
snarfed joined the channel
#
GWG
snarfed: Incoming
#
snarfed
thanks! i have github notifications on :P
#
snarfed
GWG: can you guess my first request?
#
GWG
snarfed: Documentation?
#
GWG
hopes
#
snarfed
GWG: unit test pls :P
#
GWG
I really get stalled on them
#
GWG
But I get your point.
#
snarfed
good to learn!
#
GWG
Well, I broke your tests, so I must have made a mistake somewhere
#
snarfed
are you set up to run them locally? that's the best first step
#
GWG
It keeps resetting. I have a script that fixes it.
#
GWG
I'll fiddle with it
#
GWG
And try to write some test data
#
GWG
This issue is going to annoy me for the whole trip unless I fix it
[miklb] joined the channel
#
[miklb]
fork & fix then work on tests and PR when you return
snarfed joined the channel
#
GWG
[miklb]: Instead of writing new unit tests, I fixed snarfed's existing ones
#
snarfed
er, made them pass again with your changes :P
#
GWG
I also just installed the fix manually on my site, so I will test in production.
#
GWG
snarfed: I will concede the point, but I'm not sure if most Micropub clients pass a timezone offset as opposed to Z.
#
snarfed
GWG: we do want new tests too though. the existing test timestamps without timezones were valuable. we want to test with them *and* with timezones
#
GWG
I'll see what I can do. I have to go to bed now though. Early morning
#
snarfed
thanks! gl!
#
aaronpk
OYG includes the proper timezone offset if there is a location included with the photo
#
GWG
But I think the primary test should be with the timezone, because I think most clients would pass it.
mblaney joined the channel
#
GWG
aaronpk: What if there is no location, what would it pass?
#
snarfed
not sure what a "primary" test is. the more tests, testing more code paths, the better.
#
GWG
aaronpk: What would it pass with no location?
#
GWG
I will add a second test.
#
aaronpk
tho i suppose it would make more sense to use the same timezone as previously was sent
#
GWG
Does anyone's website report a default timezone?
#
GWG
Or Micropub server?
#
aaronpk
what do you mean "report"?
#
aaronpk
my server will set the timezone to my current location if no timezone offset is provided in the micropub request
#
GWG
Then the WordPress assumption should be to set to site default.
#
[miklb]
I just meant that if it was a matter of using the client/enjoying your trip vs struggling with tests, use a fork with with a hotfix and address tests later. but sounds like you have a plan.
#
GWG
I deployed the fix to my site, but I intend to get a PR that pleases snarfed as well.
#
snarfed
i should add that to the readme
#
snarfed
[Contributing: Your PR will be merged IF AND ONLY IF I AM PLEASED.]
#
Loqi
yea!
#
GWG
snarfed, I consider it a personal challenge to work well with others
#
GWG
snarfed, if I keep using Micropub tools this week, my intention is to get many things fixed. I had originally thought that would be in my plugins only.
#
snarfed
great!
#
GWG
snarfed, follow my site and you can see how things improve.