#jeremycherfasHow important, in the grand scheme of things, do you think all of those are?
#ZegnatThose security things you mean? There are definitely reasons to have them, but those reasons are probably more pronounced on websites that offer a service to the visitor.
#ZegnatThey can make the browser help protect against cross site scripting, click-jacking, and other such attacks against the users of your site.
#jeremycherfasRoght. Well, one to add, someday. But not today.
[andrea_arbogast, deeden and eli_oat joined the channel
#sknebel!tell aaronpk jeremy's http://www.fornacalia.com for some reason doesn't show parser output on pin13 (but does on e.g. php.microformats.io)
#sknebeljeremycherfas: ^^^ apparently some kind of DNS issue
#Zegnataaronpk I was getting errors before trying to login to the wiki with indieauth.com and my IndieAuth endpoint. Is there still an issue with relative endpoint URLs?
#Loqi[Zegnat] #172 Relative IndieAuth endpoint URL results in “There was a problem!”
#sknebeljust tried a bunch of global propagation checkers, showing 1-2 locations failing, everything else resolving it fine
#sknebelZegnat: anything odd about the url+params the redirect back to indieauth.com have?
#aaronpki'm guessing it's a bug with trying to verify the link is there
#ZegnatNope, code is there, me is there, and state is there
#ZegnatMight be, aaronpk. I didn’t really have time to go into IndieAuth.com source code to see what it is checking exactly.
#ZegnatJust noticed it when I was moving stuff to the new hosting to get HTTPS going. Thought I could switch to relative URLs because we got all the resolving bugs finished, and then couldn’t login to the wiki.
#sknebelaaronpk: since the ui looks the same on pin13 and php.mf.io now, I guess there is a public repo where I can file a bug for "give an error message if you can't fetch the document"?
Loqi, Ruxton, deeden and schmarty joined the channel
#aaronpkoops, looks like sknebel was on the other side of that netsplit with Loqi and there's a message in the logs that didn't make it over here
#LoqiIt looks like we don't have a page for ".dev" yet. Would you like to create it? (Or just say ".dev is ____", a sentence describing the term)
#ZegnatMozilla includes a different HSTS preload list?
[miklb] joined the channel
#[miklb]aaronpk I was never quite able to figure out how to use that for my local environment. Should probably revisit it
#aaronpkit takes a bit of work if you've never done it before
#ZegnatAnother option might be https://laravel.com/docs/5.5/valet which sebsel pointed me at. It can setup HTTPS for local domains, or be configured to use a different TLD from .dev
#sknebelZegnat: no, HSTS preload list is shared between all browsers, so this will happen everywhere unless the other browser makers decide make a special exception here, which will be troublesome as soon as .dev actually starts to get used