gRegorLoveI'm finally working on splitting out favorites and photos (and probably replies) from my notes stream. I think I'm going to do a channels thing similar to p3k.
[manton]It doesn't seem compatible with Micro.blog's IndieAuth endpoint since shpub sends a redirect_uri of 127.0.0.1. Doesn't appear to be whitelisted in a <link> tag anywhere either.
Zegnat“It doesn't seem compatible with Micro.blog's IndieAuth endpoint since shpub sends a redirect_uri of 127.0.0.1. Doesn't appear to be whitelisted in a <link> tag anywhere either”
Loqi[Zegnat] If local shpub knows its own IP and port, it could theoretically already set client_id to shpub.com/?port=1111&ip=127.0.0.1 and have shpub.com serve a dynamic redirect_uri value.
Loqi[Zegnat] If local shpub knows its own IP and port, it could theoretically already set client_id to shpub.com/?port=1111&ip=127.0.0.1 and have shpub.com serve a dynamic redirect_uri value.
ZegnatI do wonder if that would make it easier for attackers to intercept the redirect, and thus intercept the auth code ... maybe that would be a reason to support https://www.oauth.com/oauth2-servers/pkce/ on IndieAuth ... needs more thinking
barpthewire1, jeremych_, [jgmac1106], [mrkrndvs] and pointfree13 joined the channel
petermolnarI'm clicking through some of the indie webring pages, and while I'm surprised on the amount of good photos I'm finding, I'm also surprised a bit on the two polar endpoints of performance I'm finding: either very snappy, very small sites, though some of them could do with some kind of indication for link vs text ( http://sawv.org/ ) or fascinatingly underoptimised ones, eg: https://oyam.ca/blog/archive.html - a single page for 10 y
[grantcodes]!tell cleverdevil Yeah it's a bit iffy for me too. Don't know if anyone knows any other image proxy services that support resizing on the fly like that
NinjaTrappeurI'm the guy who implements webmentions for lobsters, I am wondering if you plan to change your ruby webmention client architecture anytime soon
NinjaTrappeurYup, that's my problem, this does not really fit my workflow... I'm gonna read further to see if I can trivially expose a way to "plug" my HTML. I guess it'll still gonna need to get the HTTP headers from one way or another.
[Petrk]I could test the function on IndieLogin.com and it works well, but now I want to implement it as provider and how to make it work with applications where login information are requested. But I dont know how to work with POST requests and how to verify it. With cURL I could test in my terminal, but I dont know how to make that work in productive way. I hope you can help
[Petrk]I want to build up a regional digitalization network for companies and people who provide own web services like blogs, information sites etc. For that I want to set up a Identity service for free, no costs, no commercialization. I have made first trials with simpleID for openID, but the protocol seems to be nearly dead(?), OAuth2 were better, but its harder to setup, more complex and I dont have a server to provide it independent from another co
[Petrk]found IndieAuth and it seems to be really easy to use, but I dont know how to use it after I get the code from callback and how to implement this in application like nextcloud, humhumb, rocket.chat, friendica, etc... I joined the slack channel here, because I hope I can talk and get help from people who have more experience in it.
aaronpkhm, if you're trying to get people to be able to log in to things like nextcloud, that's going to require quite a bit of work to modify that software to work with it
[Petrk]I mean IndieAuth work, but the problem is the integration in services, if no "client" in popular software is using IndieAuth, how it can be used?
Zegnat[Petrk], the services that are interested in allowing people to login with IndieAuth will have to add that capability to their software. You’d want to ask Nextcloud to support it, or built a plugin for Nextcloud, if that is what you are after.
ZegnatThat depends. Did you check that Nextcloud / Humhumb / RocketChat / Friendica / etc all support OpenID? If they do not, that will give you the same issue
[Petrk]@Zegnat, Nextcloud provide a plugin, humhub has developer instructions, rocketchat provide that as in work in github issues, friendica provide openid natively
[eddie]aaronpk: I’m thinking through steps regarding detecting and sending responses to ActivityPub posts. Let me know how this measures up to yours. Seems like what I’m thinking is: 1) Fetch the targetUrl as JSON, if that fails it’s not ActivityPub. 2) If you receive a response, check for @context to contain “https://www.w3.org/ns/activitystreams” in the response data to verify it’s ActivityPub. 3) Check the attributedTo variable to retrie
aaronpksending replies is a bit tricky because you need to also include a "Mention" in the tags array, and also you need to include the person's "preferredUsername" in the post text for mastodon to show it as a notification
aaronpkoh and then when you're sending a reply, unless you also serve that at a URL that sends back JSON (or support conneg), it will "look weird" to people on other servers since they won't be able to interact with it
sknebelaaronpk: did you mention that to the mastodon devs? If they're looking to make interoperability easier, "error messages" is comparatively low hanging fruit...
[eddie]Mastodon does conneg, though. So I need to actually do 2 queries rather than prioritize, right? Because Mastadon would return text/html rather than ActivityPub if I prioritize text/html?
aaronpkmastodon is definitely not meant for one person, you'll end up with an empty "home timeline" and a bunch of the features won't make sense. but i know some people who are doing that anyway.
[manton][cweiske] @Zegnat Sorry, catching up... Micro.blog doesn't actually check <link> for redirect URLs yet, so that's an improvement I need to make. But regardless, it seems like shpub will break for any IndieAuth provider that enforces the redirect check for security.
[manton]It seems like shpub could be modified to always use localhost for the redirect, which is more easily whitelisted, but maybe I'm missing something. I've only used it very briefly.
ZegnatI think this is a case where shpub is running on a remote machine. You then need to authenticate and use your local browser to authenticate. The redirect uri however needs to loop back to the remote machine.
aaronpkthe big picture is that until we get all the edge cases of this worked out, it's probably best for the authorization server to show a warning (and maybe even make the user click something to confirm) if the redirect uri isn't registered or doesn't match
Zegnatsknebel, any idea if using xip.io (or something like it) would leak information? Logging policies? That’s the one thing I thought of as a point agains a dynamic client_id page (example.org/shpub?ip=1.2.3.4&port=1234): it means every time you authenticate with shpub you tell someone else about the IP you are on.
ZegnatThe wildcard registration may even be more private (regardless of secure) as you don’t have to inform the third party client_id hoster of where you are going.
Loqi[Zegnat] @sknebel points out [in chat](https://chat.indieweb.org/dev/2018-08-13/1534192339261900) that clients are already able to work with variable redirect URLs by passing the `redirect_uri` value along to a specially crafted page at `client_id`. Example:
...
snarfed, snarfed1 and jgmac1106 joined the channel