#dev 2018-04-25

2018-04-25 UTC
tantek_, [tantek], [jgmac1106], KartikPrabhu, [kevinmarks], AngeloGladding, [matthilt], eli_oat, renem, [snarfed], [miklb], [mrkrndvs], [eddie], cweiske, snarfed, bhh, leg1, [pfefferle], loicm, snarfed1 and swentel joined the channel
#
Zegnat
Hmm. Wondering how to send a notification to someone posting to GitHub from their website (e.g. tantek) that I have mentioned them in a reply I wrote on GitHub.
#
cweiske
that isn't your task
#
cweiske
they probably backfeed the github comments as replies to their own posts
#
cweiske
at least that's what I think should happen
#
Zegnat
Maybe, but I would expect them to only backfeed that if they created the original issue.
#
Zegnat
As GitHub doesn’t have a concept of replies-to-replies
#
cweiske
hm, right
#
Zegnat
sends a webmention to tantek’s endpoint, knowing it will fail
#
cweiske
with 10 comments, the backfeeder would have to send webmentions for new replies to all 10 previous comments
#
Zegnat
Huh. Webmention.io seemed to not mind me doing this: https://webmention.io/tantek.com/webmention/Vom9xCvFXB1DeO61QeQH
#
cweiske
eeks. who chose that grey text on grey background?
#
Zegnat
I block CSS, so I never knew :P
#
cweiske
oh. you're the first person I encounter who does this
#
Zegnat
That in-reply-to seems wrong though. My comment is not in reply to tantek’s user page
#
swentel
cweiske, you mentioned you didn't have google iirc, which android flavor are you using then ?
#
cweiske
lineageos with microg
#
Zegnat
I block everything in uMatrix. images, css, javascript. To save on data-usage. Though the saving from CSS is basically 0, it does sometimes stop multiple third-party CDNs from loading
#
cweiske
but not the pure lineageos
#
cweiske
the microg variant
#
swentel
cweiske, aha, yeah, that's on my list to checkout, does it/you use f-droid for packages then also?
#
swentel
cweiske, ok, I'll start deploying indigenous to that as well
#
cweiske
the normal lineageos misses a feature that allows deep microg integration (package spoofing)
#
cweiske
s/package spoofing/signature spoofing/
#
swentel
ok, going to check that out
#
swentel
also doing the excercise of ungoogling myself
#
Zegnat
That does look like an interesting Android to run. Been seeing LineageOS pop-up a lot lately.
#
Zegnat
I still just do not want to hassle of flashing my phone :/
#
Zegnat
Oh. Not available for my phone anyway. So no need to worry.
#
Zegnat
!tell aaronpk why does wm.io think my GitHub comment was in-reply-to tantek’s GitHub profile? https://webmention.io/tantek.com/webmention/Vom9xCvFXB1DeO61QeQH
#
Loqi
Ok, I'll tell them that when I see them next
gRegorLove joined the channel
#
cweiske
I chose my phone because there was cyanogenmod/lineageos for it
#
Zegnat
Maybe for my next phone, I’ll take that into consideration :)
#
Loqi
[Peter Molnar] How to install microG an odexed stock android ROM
#
petermolnar
but I'm having weird issues with it, namely with location precision and even more weirdly with gms connectivity, however, I'm not convinced that last has anything to do with it
#
cweiske
I think that I don't have GMS at all
#
cweiske
at least telegram acts as if
loicm joined the channel
#
petermolnar
not gms... gsm...
#
cweiske
I can't send SMS (have to SIM cards). No idea if that works on the stock android
#
cweiske
but no gsm problems
#
petermolnar
I'm going to revert to stock android if the problem persist; having a phone without people being able to phone me is not ideal
#
Zegnat
Ha. That would be my ideal phone. “You tried calling me? Sorry, I only communicate in text.”
#
[kevinmarks]
Location uses WiFi and cellphone towers as well as GPS - if it can't see those it may be less accurate.
#
petermolnar
microg has the unifiednlp location backend, where I have a pre-compiled gms cell tower database downloaded, but it's weird
#
cweiske
I also use the local gsm tower backend
#
cweiske
location is usually within 10km
#
[kevinmarks]
10km is pretty coarse
#
cweiske
it's there immediately without network connection
#
cweiske
so that's ok
#
cweiske
for more detailled loc, GPS used
#
cweiske
cell tower triangulation would be ideal, but I don't know if that's implemented or if that's possible to implement
[deeden], tomasparks, kapowaz, jeremycherfas, [jgmac1106], syamkumar, [kevinmarks], eli_oat, [kimberlyhirsh], Ruxton, AngeloGladding, treora, jacky, oodani and klez joined the channel
#
ascraeus.org
edited /Instagram (+272) "/* Exporting your data */"
(view diff)
[jgmac1106] and iasai_ joined the channel
#
@thorkon
Mit der großartigen Hilfen von Gregor Morrill (@GregorLove), der ein ProcessWire-Modul zu Webmentions schrieb und betreut, unterstützt meiner Seite nun Webmentions zu verpassen.: https://www.thorsten-konigorski.de/journal/25-04-2018/
(twitter.com/_/status/989128540795887616)
#
@thorkon
Mit der großartigen Hilfe von Gregor Morrill (@GregorLove), der ein ProcessWire-Modul zu Webmentions schrieb und betreut, unterstützt meine Seite nun Webmentions. https://www.thorsten-konigorski.de/journal/25-04-2018/
(twitter.com/_/status/989129869253599232)
barpthewire joined the channel
[snarfed] joined the channel
#
[snarfed]
@Zegnat bridgy github actually does backfeed replies to your replies (technically replies "after" your replies, yes) as well as replies to your issues. eg https://publog.stuifzandapp.com/posts/589
#
Loqi
[Peter Stuifzand] It is possible to create extra activities for "like", however I noticed that not all apps supports this. I think Twitter will only shows different apps, and not the specific actions.
#
[snarfed]
not sure why that one also got backfed itself, but that's a separate question
[matthilt] joined the channel
#
Zegnat
do you also get mention backfeeds? E.g. because I mentioned `@tantek`, do you send a mention to his homepage?
#
Zegnat
(ignorant question from a non-user)
#
[snarfed]
no, not mentions
snarfed joined the channel
#
Zegnat
Gotcha!
leg, [jgmac1106], radedwork and [tantek] joined the channel
#
@ramsey
@shiflett Atom is supposed to follow RFC 4287 and should use a proper namespace. RSS has no formal spec.
(twitter.com/_/status/988904481738944512)
#
[tantek]
(And I thought RSS had a frozen spec hosted at Harvard)
kaushalmodi joined the channel
#
kaushalmodi
!tell cweiske Is there a way to extract comments specific to just my domain from commentpara.de?
#
Loqi
Ok, I'll tell them that when I see them next
#
petermolnar
I can't believe rss vs atom is still a thing
#
kaushalmodi
petermolnar: So I support both; users can pick whichever they like :P
#
petermolnar
kaushalmodi: you should publish rss 0.9, rss1, rss2, atom, json, rss3, activitystreams, mf2feed (did I leave anything out?), so you'd make truly everyone happy...
#
Loqi
aaronpk: Zegnat left you a message 6 hours, 32 minutes ago: why does wm.io think my GitHub comment was in-reply-to tantek’s GitHub profile? https://webmention.io/tantek.com/webmention/Vom9xCvFXB1DeO61QeQH
#
aaronpk
Zegnat: webmention.io gets a few things like that wrong right now
#
aaronpk
it needs a bit of an overhaul
#
Zegnat
Gotcha
#
aaronpk
i've been holding off since it works reasonably well most of the time
#
Zegnat
petermolnar, you left out YAMLFeed
#
petermolnar
on purpose :P
[eddie] joined the channel
#
aaronpk
thinking i might either combine it or integrate it with aperture so that there's a way to actually read your webmentions that it receives
iasai_ joined the channel
#
kaushalmodi
petermolnar: Hah! Good one :) You forgot jf2feed (which I support too :P)
#
petermolnar
what is jf2feed?
#
Loqi
It looks like we don't have a page for "jf2feed" yet. Would you like to create it? (Or just say "jf2feed is ____", a sentence describing the term)
#
kaushalmodi
Looks like there are separate stubs for https://indieweb.org/jf2 and https://indieweb.org/JF2_Feed
kaushalmodi, wagle, j12t, ben_thatmustbeme, strugee, [matthilt], [eddie], iasai_, AngeloGladding, Ruxton, treora, leg, eli_oat[m], [tantek], loicm, dougbeal, jeremycherfas and mifga joined the channel
#
ascraeus.org
edited /Instagram (+159) "/* Exporting your data */"
(view diff)
tantek, myfreeweb, snarfed, loicm, plindner, eli_oat[m], grantcodes, zoglesby, schmarty, mindB and peterlawson[m] joined the channel
#
Zegnat
dgold, did you do the Instagram download? Are those “comments, likes” you mention on the wiki comments and likes you have left on other photos, or also comments and likes others left on your photos? Big distinction, possibly worth elaborating.
#
dgold
Zegnat: I don't know how to answer that - I never liked or commented on anyone elses' posts, so the file is empty
maingo joined the channel
#
dgold
oh, wait, other people did like mine, so I guess that means that its _your_ comments/likes
#
Zegnat
That’s too bad, though perhaps expected as those comments/likes aren’t “yours”
#
dgold
{"media_comments": [], "live_comments": []}
[kevinmarks] joined the channel
#
aaronpk
whoa, this really is a complete dump
#
aaronpk
all direct photos sent, plus all stories
#
aaronpk
uh, the likes.json file leaves something to be desired
#
aaronpk
it's just a list of timestamps and usernames
#
aaronpk
comments.json is similar. looks like it is the timestamp of the photo i'm commenting on, my comment, and the username of the person whose photo i'm commenting on
#
aaronpk
no photo ID or permalink or anything tho
#
snarfed
wow yeah that's pretty useless
#
sknebel
so you'd have to "somehow" get all their photos and match the timestamps?
#
snarfed
that way lie dragons
#
aaronpk
i guess the argument is that their photo isn't your data so it isn't included in the dump?
#
aaronpk
seems odd to not even include a photo ID tho
jimpick and [matthilt] joined the channel
#
sknebel
yeah. not including the photo fine, only a crappy reference isn't nice
#
snarfed
aaronpk: and to confirm, just your likes/comments, right? other people's on your photos aren't anywhere in there?
#
aaronpk
correct, I don't see any indication of comments or likes on my photos, not even a count
#
aaronpk
oh well
#
aaronpk
there is enough data to make an app that would parse those files and send a bunch of micropub requests to your site to import all your history tho
#
aaronpk
for your photos/videos anyway. not your comments
#
aaronpk
someone please make a desktop app that does that :)
#
aaronpk
should be doable with electron or whatever
singpolyma, KartikPrabhu, tantek, sebsel, tomasparks and cweiske joined the channel
#
Loqi
cweiske: kaushalmodi left you a message 3 hours, 59 minutes ago: Is there a way to extract comments specific to just my domain from commentpara.de?
#
aaronpk
That's an interesting question
#
cweiske
no, you can't currently
#
aaronpk
A similar question would be could you get a list of all comments on aaronparecki.com made to your posts
#
aaronpk
I used to have that actually
#
cweiske
but webmention.io has that info already (comments on commentpara.de to scripter.co)
#
cweiske
because commentpara.de sent webmentions out
#
aaronpk
Yeah that's the direction the info normally flows
#
aaronpk
you choose where to receive your webmentions and then you can get them from there
sebsel_, pstuifzand, [kimberlyhirsh] and kaushalmodi joined the channel
#
kaushalmodi
So even if commentpara.de is down, webmention.io will return the full webmention contents?
#
cweiske
wiki++ for the useful tumblr export link
#
Loqi
wiki has 1 karma in this channel (3 overall)
renem joined the channel
#
singpolyma
Question: mf2 json vs jf2 -- I'm a bit confused why both of these almost-identical formats are around?
#
singpolyma
heh. I realise this is not a new question. happy to read wiki pages or past discussions :) reading over jf2 spec now
#
Zegnat
jf2 tries to normalise certain behaviour for easier consumption. “mf2 json” isn’t really a format, just a name for the canonical serialisation of mf2 parser output.
#
Zegnat
At least that is how I would describe the two.
#
KartikPrabhu
what is jf2?
#
singpolyma
"normalise" as in, remove all the array wrappers mostly? and also chop off "h-" looks like
#
Loqi
jf2 is a working prototype of a simpler JSON serialization of microformats2 intended to be easier to consume than the standard Microformats JSON representation https://indieweb.org/jf2
#
Zegnat
It also defines a stricter vocabulary than mf2, I think?
#
Zegnat
I am not super up-to-date on jf2.
#
Zegnat
What is microformats2 JSON?
#
Loqi
It looks like we don't have a page for "microformats2 JSON" yet. Would you like to create it? (Or just say "microformats2 JSON is ____", a sentence describing the term)
#
Zegnat
microformats2 JSON is the canonical output format of the microformats2 parsing algorithm. As such it can be used to compare parsers and create test suites. It is also used as the official serialisation format of microformats objects, and relied upon by specifications such as Micropub. http://microformats.org/wiki/microformats2-json
#
loqi.me
created /microformats2_JSON (+361) "prompted by Zegnat and dfn added by Zegnat"
(view diff)
#
kaja.sknebel.net
edited /microformats2_JSON (+1) "linkify ('x is y. <url>.' pattern)"
(view diff)
#
Loqi
zegnat has 56 karma in this channel (200 overall)
#
Zegnat
Now I remember part of why I hadn’t finished the one-php-file token endpoint companion to selfauth: I didn’t want to write the code that does the auth endpoint discovery.
#
singpolyma
snarfed: in bridgy you have a p-numeric-id property -- I assume that's just a thing you made up? Should it be p-x-numeric-id? (I don't care that much, just trying to understand)
#
snarfed
singpolyma: nah it's the underlying silo's numeric user id for a user
#
snarfed
and sure, it could be x-numeric-id
#
Zegnat
FWIW, I am against -x-, I dropped it for pronouns (https://wiki.zegnat.net/microformats/pronoun) base on https://tools.ietf.org/html/rfc6648
#
Zegnat
s/base/based/
#
Zegnat
If you really must mark properties for very specific uses, better to use a vendor prefix like -bridgy-.
#
scripter.co
edited /jf2 (+788) "Add jf2 feed and post examples"
(view diff)
KartikPrabhu joined the channel
#
Zegnat
snarfed++ for always being on the ball
#
Loqi
snarfed has 59 karma in this channel (381 overall)
#
singpolyma
So, I feel the ergonomics of jf2, but I think micropub using mf2json makes it enough of a real thing to tip me that way for now. I mean, my experiment will probably go no where and then why did I do all this thinking anyway? ;)
#
singpolyma
snarfed: Interesting... can bridgy only generate /post/twitter/* pages for people who have auth'd? Even if the tweet is public?
#
snarfed
singpolyma: you can put any tweet id at the end of the url
#
snarfed
but yes it needs an authed user's username in the url to know which token to use
#
snarfed
or try https://granary.io/ if you want a generic service for reading silo data in mf2 (or other formats)
#
singpolyma
would just any token work most of the time?
#
singpolyma
yeah, I know, probably I should use granary :P
#
snarfed
either!
#
snarfed
what's your use case?
#
singpolyma
I'm working on building a thing that can do twitter/mastodon-style "show the whole conversation" for distributed conversations across silos/fediverse/indieweb
#
singpolyma
my plan is to start by using it as the webmention receiver for my site (so just conversations my site is in) but then extend from there
#
singpolyma
so, it'll be a weird degenerate webmention where I ignore `&target=` entirely and just parse the source looking for in-reply-to, etc, myself
#
aaronpk
Zegnat: if you're writing a token endpoint for selfauth you don't need to do endpoint discovery
#
Zegnat
Not integrated in selfauth in any way, should work with anything, is the idea
#
singpolyma
probably most times I see a parent post that is a silo it'll be someone who uses bridgy anyway, but I'd like to get the whole chain even if they POSSE manually
#
Zegnat
Just, like selfauth, a one PHP file thing
#
singpolyma
but very often the silo stuff will come from bridgy, especially initally
#
Zegnat
Think I got the whole curl thing running smoothly now, now for parsing link headers. Getting tired though so regex foo is running out
#
snarfed
Zegnat: and you did full conneg right? :P
#
aaronpk
Ah hm. tokens.indieauth.com isn't one file but it's pretty small. Still I'm not sure how may more of that kind of thing needs to exist. Ultimately thetoken endpoint and auth endpoint should be closely linked
#
Zegnat
I still feel like the link between e.g. the micropub endpoint and the token endpoint is more tight than to the auth endpoint.
#
Zegnat
I did snarfed. I also wrote a pretty need little function to get the q parameters off of conneg ;)
#
aaronpk
In any case you don't need to do endpoint discovery if you just provide a config option for it
#
Zegnat
But link headers and their variable amount of parameters, and possibility to have multiple rels defined, the regex just isn’t flowing tonight, hehe
#
aaronpk
the reason mine does discovery is because I host it as a service that doesn't require registration
#
aaronpk
Also I wrote all those regexes for you with tests already :-P
#
Zegnat
I probably should have looked around, aaronpk, hehe
#
Zegnat
I actually think I wrote a (partial?) regex for the javascript mp helper too. :facepalm:
#
aaronpk
But yeah just leave out discovery for this if you're making something you expect people to install and set up
#
Zegnat
Mostly doing this because I want to preempt the first issue being “how do I run this for multiple domains” ... as we got on selfauth now
#
Zegnat
Almost there now, link headers are working. Seems I missed a * on a \s
#
aaronpk
Multiple entries in the config?
#
aaronpk
The flip side to this question is how do you avoid people using your instance of this endpoint
#
Zegnat
That is going to be a whitelist of endpoints.
#
aaronpk
Right so just define the auth endpoints in that whitelist
#
Zegnat
So if a client sends a $me (which may even be pre-redirects etc, hard to whitelist, maybe?), I discover the endpoint. If the endpoint for $me is on the whitelist for the token endpoint, I go and check the code.
#
Zegnat
Is the idea.
#
Zegnat
If the code comes back A-OK, issue a token.
tantek joined the channel
#
www.svenknebel.de
edited /Pinterest (+409) "/* Criticism */ copyright issues section"
(view diff)
#
Zegnat
I am pretty sure that regex is still borked, but that’s tomorrow-Martijn’s problem: https://gist.github.com/Zegnat/18da1dce95838b4503f35ea960ffb461
#
Zegnat
Only need to implement resolving relative URLs and I think it works
#
Zegnat
(If anyone needed an example of how not to write neat and manageable code.)
wagle joined the channel
#
skippy
"A messy codebase is the sign of a well monetized application"
swentel joined the channel
#
Zegnat
I am blaiming you for this, you know, skippy. I think you were the last person to ask if there was a token endpoint to go with selfauth ;)
#
skippy
haha!
#
skippy
hey, the less i can rely on rando services hosted by other people, the better.
#
skippy
oh, i just saw the XPath stuff you're doing. Sorry. Didn't mean to send you down THAT rabbit hole!
#
Zegnat
The XPath in that gist was some of the quickest code to write. I am more than familiar with DOM at this point.
#
Zegnat
I have taken aaronpk’s implementation of the relative URL resolver with me for bed time reading now ;)
#
skippy
i think i asked this before, and I dont think I fully understood the answers: if I send a "repost" to my Micropub endpoint, what is the "normal" or common behavior? Does the endpoint fetch the content of the original for display on my side? do I manually copy-paste the content and send that along with the repost-of URL?
#
Zegnat
I think the few people who have implemented reposts post it the same way as they do a like: just the URL. Then the server fetches context to display. But not sure.
#
pstuifzand
Yeah, just the repost-of url and micropub endpoint should fetch and parse the content
#
aaronpk
yep that's what I do. the client sends just the URL and leaves it up to the server to decide how to handle that
#
aaronpk
for a long time I was showing reposts and likes on my site as just the URL even. once I finished XRay then I made my micropub endpoint go and expand those posts to show the reposted/liked contetn
#
skippy
thanks all.
[jgmac1106] joined the channel
#
pstuifzand
skippy: I read on github that selfauth doesn't have a token endpoint
#
skippy
it doesnt; but i have a token endpoint defined in my <head>
#
skippy
i'm using tokens.indieauth.com/token for now.
#
pstuifzand
is it possible to use selfauth and tokens.indieauth.com together?
#
skippy
yes. it works for Quill, and Indigenous for Android.
#
pstuifzand
did you install the latest version of Wrimini?
#
skippy
11 hours ago. i dont see a newer offering in Google.
#
pstuifzand
it's strange that you can't use https://, I did just that a few minutes ago
#
skippy
oh! that seems to work now! Just tried again. wasnt working yesterday, before the most recent update
#
skippy
but the app still crashes when Firefox Focus tries to open the link with the app.
#
pstuifzand
That's something I can try
#
pstuifzand
I must confess that I only tried chrome, for the roundtrip
#
aaronpk
that's odd, why would firefox vs chrome behave differently in that situation?
#
swentel
oh skippy, will release the png/jpg confusion also tomorrow when uploading files :)
#
skippy
note: my default browser is Firefox FOCUS, not plain old Firefox. :)
#
skippy
swentel: sweet!
snarfed joined the channel
#
pstuifzand
ok, I got a crash as well, in Firefox Focus
#
skippy
i have multiple browsers installed. could wrimini ask me which browser to use? maybe it would work with regular firefox?
#
pstuifzand
regular firefox also seems to crash
#
pstuifzand
at the moment only chrome works that I know of
#
aaronpk
I am struggling to think of a reason a different browser would cause this problem
#
skippy
does Android have a built-in webview thingie, so you dont need to rely on an external browser for the link?
#
pstuifzand
that was what I had, but using real browsers looked like the better way to go
#
swentel
Indigenous uses the internal webview element
#
swentel
gave up on relying on browsers long ago
#
aaronpk
don't use an internal webview
#
Zegnat
skippy, if you use the German Firefox Klar you get better privacy defaults (unless they changed that). In case your choice for Focus is because of privacy.
#
aaronpk
looks for a link
#
pstuifzand
I just tested with Firefox Focus, Firefox and Chrome, and it seems only Chrome works for now
#
aaronpk
see also: google now explicitly blocks embedding their oauth screen in a webview https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html?m=1
#
swentel
yeah, I'm swithing the authentication for that soon
#
swentel
it's brittle atm, it should use the Android Account system
#
swentel
well brittle, it works, it's just not pretty :)
#
swentel
didn't know this was about authentication, only following with one eye .. in full patching modus for drupal sec release pff :/
eli_oat joined the channel
#
GWG
pstuifzand: Will the settings option do something eventually in Wrimini?
#
pstuifzand
I think I'll removed it in the next version
#
GWG
pstuifzand: Okay.
#
GWG
I'm having trouble seeing Syndication Targets in both Micropub Android clients
[matthilt] joined the channel
#
pstuifzand
Do you support q=config or q=syndicate-to, or both?
#
GWG
pstuifzand: Both.
#
aaronpk
wow I can't even type a URL into chrome anymore
#
aaronpk
it seems to be overly aggressively trying to autocomplete the thing i'm typing
#
GWG
It is where I test Micropub server enhancements before moving them to my main site
#
skippy
Zegnat: I do use Firefox Focus for modest privacy improvements over normal Firefox. Can I use Klar in English?
#
pstuifzand
I found and fixed the crash that happens with Firefox and Firefox Focus. I will upload a new version now.
#
pstuifzand
It will become available probably in a few tens of minutes.
#
GWG
The syndication targets work in Quill, at the least.
#
GWG
aaronpk: https://tiny.n9n.us/?micropub=endpoint&q=syndicate-to - This is formatted correctly, isn't it?
#
aaronpk
unauthorized (which is correct)
#
pstuifzand
I looked up what happens with syndication targets.
#
pstuifzand
The client uses both q=config and q=syndicate-to
#
swentel
GWG, if you refresh them, you don't see them?
#
pstuifzand
Oh no, I only supports syndication targets in q=config, the other function isn't called :(
#
GWG
I support them in q=config
#
GWG
They are there.
#
GWG
swentel: Correct.
#
swentel
interesting
#
GWG
Could it be the fact it is a query string to begin with?
#
swentel
I see the problem
#
Loqi
[swentel] #55 Fetch syndications on authentication
#
aaronpk
there is a note about that in the spec https://www.w3.org/TR/micropub/#querying
#
GWG
aaronpk: Maybe it is time to fix that?
#
aaronpk
fix what?
#
GWG
aaronpk: To make it so the WordPress Micropub endpoint isn't a query string
#
GWG
The webmention one used to be. I rewrote that
#
aaronpk
I thought that was dependent on the server config
#
GWG
aaronpk: Not really. snarfed used the code from the webmention endpoint to create the micropub endpoint. I rewrote the webmention endpoint.
#
aaronpk
I guess I always assumed it was something you had to change in an .htaccess file or nginx config
#
GWG
aaronpk: No.
#
GWG
You could do it that way
#
GWG
But, I could rewrite it using the REST API, which supports permalinks
#
aaronpk
oh, gosh
#
aaronpk
if you *can* make it work without query string params by all means please do
#
GWG
aaronpk: Why oh, gosh?
#
GWG
aaronpk: You know how I wrote an IndieAuth endpoint during my last vacation
#
aaronpk
I always assumed it was a technical limitation
#
GWG
I need another vacation
#
GWG
aaronpk: You didn't notice when the webmention endpoint changed from ?webmention=endpoint to /wp-json/webmention/1.0/endpoint?
#
aaronpk
tbh I did not
#
aaronpk
I was paying attention to the indieauth plugin not webmention
#
GWG
aaronpk: I did the REST API thing around the Summit in 2016
#
pstuifzand
I doesn't seem to be a problem with the query parameters of the url. I wrote a test to check it, and it comes out as expected.
#
GWG
aaronpk: After Aaron Jorbin came to IWC NYC that year, we were talking and he was explaining to me you can use the endpoint creation functions of the REST API to create other types of APIs
#
pstuifzand
GWG: Do you have an example of the content?
snarfed joined the channel
#
GWG
pstuifzand: Click the link?
[miklb] joined the channel
#
GWG
snarfed: I was just thinking of you
#
snarfed
GWG: warm fuzzies!
#
GWG
snarfed: The ?micropub=endpoint vs a non query string issue. You based it on the old webmention code, I believe.
#
pstuifzand
"Unauthorized"
#
GWG
pstuifzand: Oops, forgot you have to have a login.
eli_oat joined the channel
#
GWG
One second...let me give you the output
#
GWG
snarfed: Maybe I'll fix that query string
#
snarfed
sounds low priority
#
snarfed
i'd vote for other things first :P
#
aaronpk
IndieWeb development-focused chat. This is where the sauce is made - Logs at https://chat.indieweb.org/dev/today - bridged with #dev in Slack
#
GWG
snarfed: What is on your high priority list?
#
GWG
snarfed: I was thinking of doing it as part of something on my list of a similar housekeeping nature
#
GWG
But I have syndication to fix first
#
snarfed
agreed! and lots other higher priority things in wordpress land. debug micropub "no location header" problem, lean on pfefferle to merge wm and semantic linkbacks, figure out how to integrate gutenberg blocks with https://github.com/snarfed/wordpress-micropub/issues/85 , etc
#
Loqi
[dshanske] #85 redesign to coordinate with other mf2 plugins and themes
#
snarfed
(and that's just the small subset i'm familiar with)
#
snarfed
but up to you
#
GWG
snarfed: I think the spec in Gutenberg is nearly settled down. but I really didn't want to do JS. Oh well. As for leaning on pfefferle...I don't want to lean on anyone...
#
GWG
I need to update my itch list
#
snarfed
they need to be merged. lean on him!
#
snarfed
it's been years too long
#
snarfed
and figuring out micropub redesign vis a vis blocks shouldn't require any JS iiuc
#
GWG
snarfed: My next project is improving Syndication using that hook we put in, and putting in a platform to syndicate that I can hook 'providers' into easily
#
snarfed
anyway. should probably be in #indieweb-wordpress
#
swentel
ooh, is there a indieweb-drupal
#
GWG
swentel: We can bring it up at the leadership summit
#
swentel
haha, one user lol
#
aaronpk
wait reall
#
swentel
two now hehe
#
swentel
but, not really necessary right now I think
#
swentel
people who know me will ping me on the drupal channels
#
aaronpk
I would love to see enough demand for that channel to make sense
#
GWG
swentel: How many drupal users of webmention and such are there? Out of curiosity?
#
KartikPrabhu
swentel: indieweb-wordpress mostly exists to avoid having a lot of wordpress specific talk here
#
GWG
KartikPrabhu: Yes, we got exiled
#
swentel
GWG, not many right now, mostly people using the 'linkback' module ..
#
aaronpk
tho that seems to be changing
#
swentel
GWG, dries is setting up his site though
#
aaronpk
the wordpress channel lately has been more about people asking about help with the wordpress plugins
#
swentel
that should get some traction I hope
#
GWG
aaronpk: So, are we scaring people off by talking dev in there?
#
aaronpk
so -dev ends up being where the plugin development talk happens
tantek joined the channel; GWG left the channel
#
aaronpk
I don't know, but I feel like i've seen an uptick in wordpress user chat there, from people who aren't involved in developing the plugins, rather using them
GWG joined the channel
#
GWG
aaronpk: I like that, to a degree
#
GWG
I think it is the micro.blog effect though
#
pstuifzand
JSON doesn't seem to be the problem, with the missing syndication.
#
aaronpk
yeah I think it might be a natural evolution of things
#
sknebel
swentel: just making sure, you've patched your drupal today?
#
swentel
still busy upgrading all company sites :(
#
swentel
there's a related contrib release
#
swentel
but they announced it later
#
swentel
which is pissing me off extremely atm
#
swentel
it's 1am already
#
swentel
should 've been sleeping nicely :)
#
swentel
oh well, these things happen of course
#
pstuifzand
GWG: can you check your access logs? What response code does Wordpress send?
leg joined the channel
#
GWG
pstuifzand: Is your header okhttp?
#
GWG
pstuifzand: I'm deleting the account and rerequesting it.
#
GWG
pstuifzand: I found something different
#
GWG
I have an invalid grant
#
GWG
So, you are using wrimini:// as your redirect_uri ad stuizand.eu/micropub as your client_id.
#
pstuifzand
it's a custom scheme to make android call the right activity when the browser redirects to that url
#
GWG
So, a few things there. Your SSL certificate is for peterstuizand.nl,
#
pstuifzand
I didn't expect the client_id to used in a GET request
#
GWG
"The client SHOULD publish one or more <link> tags or Link HTTP headers with a rel attribute of redirect_uri at the client_id URL."
#
pstuifzand
That seems to be the problem. I need to figure what I'm going to do there.
#
GWG
aaronpk: You wrote the spec. I have the endpoint checking to ensure the redirect_uri is on the same domain, and rejecting it if it is not. A future feature I want to put in is checking for alternative redirect_uris
#
GWG
aaronpk: Isn't that correct?
#
pstuifzand
I do have the wrimini.net domain now, so probably that will become the client_id in the future
#
GWG
It shouldn't allow this to avoid arbitrary redirects.
#
aaronpk
GWG: what i've done so far to avoid the strict checking is to show a warning to the user on the authorization screen that says that the place they'll be redirected to may not be safe
#
GWG
aaronpk: But would you agree, either way, your client_id should be a valid website?
#
aaronpk
the plan is eventually the authorization server will fetch the client ID URL and check that the redirect_uri is registered there, but in the mean time (since the only user of this is myself), the warning suffices
#
aaronpk
yeah the client_id should be a URL
#
GWG
aaronpk: That is what I planned on doing.
#
GWG
pstuifzand has a URL, with an invalid certificate.
#
aaronpk
heh interesting. and you're actually checking that right now?
#
GWG
aaronpk: I'm not, but when I manually went to see if it had redirect_uri whitelisting...
#
GWG
I noticed
#
GWG
aaronpk: The spec calls for the endpoint to check the client_id url to get an icon and such, and I'm not doing that yet either
#
pstuifzand
I can probably change the urls to https://wrimini.net/ and https://wrimini.net/oauth . Those should be acceptable urls in this case, right?
#
Loqi
Peter Stuifzand
#
GWG
pstuifzand: If you have a valid certificate, yes.
#
GWG
But it would still run afoul of my code checking in compliance with the specification.
#
aaronpk
yeah, ideally the server fetches the client_id to check the redirect_uri. this is the mechanism that takes the place of pre-registration of apps.
#
pstuifzand
So even if the domain is the same, it should also send Link headers?
#
GWG
pstuifzand: So, all you have to do is publish one or more <link> tags or Link HTTP headers with a rel attribute of redirect_uri at the client_id URL.
#
aaronpk
but if the client_id and redirect_uri is the same, then it's safe to redirect to without fetching the URL
#
aaronpk
client_id and redirect_uri are on the same domain
#
pstuifzand
not yet, but I will change to be like that
#
GWG
pstuifzand: It isn't the same. Your client_id would be https://wrimini.net and your redirect_uri would be wrimini://
#
Loqi
Peter Stuifzand
#
GWG
The custom scheme is not the same domain
#
aaronpk
so for native apps, you'd need to do the thing where the app whitelists the valid redirect URLs by icluding them on the client_id home page
#
pstuifzand
I don't think I need the custom scheme, I can use https, with the domain and a path /oauth
#
GWG
pstuifzand: Then that would solve the problem
#
aaronpk
at some point i'd like to start promoting the idea of using the PKCE extension for native apps, but that requires more work on both the client and server
#
GWG
aaronpk: I read about that in your book. That's the code thing?
#
aaronpk
it's an extra step the client does before beginning
#
GWG
aaronpk: Wait, I was thinking of device flow. Never mind
#
aaronpk
that would be fun too, but has more limited uses right now :)
#
GWG
aaronpk, what would be the use case for device flow?
#
GWG
Opening up the book for the PKCE chapter
#
aaronpk
the device flow is useful when you want some device that has no browser or keyboard to be able to post to your site
#
aaronpk
for example, my bar robot doesn't have a web browser or keyboard, so i'd need to authorize it to post to my site some other way
#
Loqi
[Aaron Parecki] Boulevardier
#
GWG
I think that I would want expiring tokens first
#
aaronpk
whenever it makes a drink for me, it posts to my site
#
aaronpk
haha yes, the ability to revoke applications is a good idea for this kind of thing
#
GWG
aaronpk: I have that feature. But I was talking about the refresh_token grant type
tomasparks joined the channel
#
swentel
ok, clients are updated, time for bed
#
swentel
night all
[unoabraham] joined the channel
#
pstuifzand
The release the will appear in an hour, has the new client_id and redirect_uri.
#
GWG
pstuifzand: I'll retest it then.