#dev 2019-04-17

2019-04-17 UTC
#
aaronpk
without going back through all those posts in detail, i think there are two things happening
#
aaronpk
1 - people are misunderstanding indieauth which is mostly my fault and is taking me a long time to fix
#
aaronpk
2 - developers of things like gitea usually want an email address for users so that they can send notifications from the system, which has always been a pain point with OpenID even going back to the beginning
#
[tantek]
those are both good insights, except the part about mostly your fault - I think this is something we can share responsibility and help fix as a community, so if there are ways you can delegate pieces of it to help it along, please reach out!
#
[tantek]
the second in particular is *very* interesting. clients of SSO still want a way to notify users that use that SSO via (some) identity
#
[tantek]
^^^ this.
[Michael_Beckwit joined the channel
#
[Michael_Beckwit
don’t beat yourself up a lot aaron
#
[tantek]
we have been using "send a webmention to someone's home page" as an adhoc way of "notify someone", but perhaps that deserves formal specification
#
[tantek]
because then with IndieAuth you would get a built in way to notify someone
#
[tantek]
send a webmention to the URL they used to sign-in!
#
KartikPrabhu
sounds like another overloading of webmention
#
[tantek]
nope it's existing use
#
KartikPrabhu
usually a homepage mention is if I mention someone by linking to their homepage. Not sur it is the same as a "notification"
#
KartikPrabhu
where notification = something like "you have 5 emails"
#
KartikPrabhu
not objecting to person mention
#
[tantek]
KartikPrabhu that's precisely the use case of that
#
[tantek]
any service that wants to "send" notifications typically has a list of them that they are sending / have sent you on their own "notifications" page for you in particular
#
[tantek]
each of those notifications is itself is essentially a post
#
[tantek]
that mentions you by your home page, a person mention
#
[tantek]
thus sending you a webmention, thus the *sending* part of a notification
#
KartikPrabhu
oh well, sounds weird to me if my reader or some other app sent a homepage mention to say "you have 10 new articles to read"
#
[tantek]
that's a bit of a strawman as that's not really an interesting notification and I'd consider notification abuse (silos do that when you've ignored them a while)
#
[tantek]
presumably if it's a service you actually like / want to keep using they have some way to configure your notification references, i.e. what you see when you view your notifications page on that service
#
aaronpk
One important aspect of those notifications is that they have to be private
#
aaronpk
also from a practical standpoint, i don't want to require these developers to also understand and implement home page webmentions in order to use IndieAuth
#
aaronpk
also because there is relatively little support for receiving and viewing these home page webmentions right now
#
aaronpk
I would much rather say here's how you can get someone's email address after they authenticate with IndieAuth
#
[tantek]
short term vs long term
#
[tantek]
what is a capability URL
#
Loqi
It looks like we don't have a page for "capability URL" yet. Would you like to create it? (Or just say "capability URL is ____", a sentence describing the term)
#
[tantek]
forgot what else we call those
#
[tantek]
what is a private webmention
#
Loqi
The Private Webmention protocol is an extension to Webmention that supports sending and verifying Webmentions for posts that require access control https://indieweb.org/private-webmention
#
aaronpk
I'd love to work towards a good long term solution but in the mean time I don't want to hold up adoption because we don't like email
#
[tantek]
parallel approaches
#
[tantek]
just captured the longer term brainstorm here, feel free to comment / iterate: https://indieweb.org/notification#Notification_Protocol
#
[tantek]
aaronpk the email a discovery shortcut is "get email property from the representative h-card at their identity URL"
#
[tantek]
s/a discovery/discovery
#
[tantek]
either way I think these should be extensions to IndieAuth, not part of the core spec
#
[tantek]
not everyone is going to need them or need to / want to provide them
#
jacky
wow loads of scrollback
#
aaronpk
We've been through this one before. People don't always want to publish their email on their home page. Returning different content to authenticated requests ends up being a bit of work. At that point it's easier to return the email address as part of the IndieAuth response.
#
aaronpk
In fact openid connect already defines an OAuth scope apps can request in order to request the user's email address, which we should probably just reuse
#
aaronpk
(The good news is as email deliverability becomes harder and harder, email becomes a less desirable notification channel, but we're a long way from it being irrelevant)
#
[Michael_Beckwit
you know you’re old when you were legitimately excited to receive an email, and it very likely wasn’t spam
#
aaronpk
You've got mail
#
GWG
aaronpk: Re the email scope issue...what would that scope be? The profile scope?
#
aaronpk
it's just called "email"
#
aaronpk
"profile" covers things like full name
#
GWG
Well, curious how that would work in Indieauth.
#
GWG
I'm still on the...If I build it, someone will come idea
#
aaronpk
didn't you implement something like this in the wordpress plugin?
#
GWG
aaronpk: I only implemented returning name and avatar for all scopes.
#
GWG
Nothing more granular.
#
aaronpk
that's right
#
GWG
If someone has a use case for more data, I'd implement it
#
aaronpk
so this would be returning their email address the same way as the name/photo if the "email" scope is requested
#
GWG
So, every time you used your token or authenticated?
#
aaronpk
just in the authentication response
#
GWG
Okay.
[chrisaldrich] and snarfed joined the channel
#
snarfed
"if you build it, they will come" is kind of the opposite of scratch your own itch :P
[Michael_Beckwit joined the channel
#
[Michael_Beckwit
a marketer’s dream, because they don’t have to do any work
#
GWG
Well, I've implemented things in the hope others would reciprocate, but so far, no one has suggested they need that yet
snarfed joined the channel
#
GWG
Personally, expiring tokens is higher on my list.
[tantek] and [Michael_Beckwit joined the channel
#
Ruxton
ugh. move mailserver to new vps, upgrade mail server, something broken, no time for this, restore backup to new vps, still broke, change 2 host entres.. OH IT WORKS. shit, could of fixed that upgrade easily :(
#
[Michael_Beckwit
self hosted mail is one area i don’t want to attempt managing
#
[Michael_Beckwit
i’m kind of hoping that protonmail is a good alternative to the Googs
ingoogni joined the channel
#
jacky
[Michael_Beckwit]: I debated using them
[jeremycherfas] joined the channel
#
jacky
my thing was their lack of a native SMTP/IMAP setup since that's how I handle mail locally and on my phone
#
[jeremycherfas]
I like Fastmail, except for the inability to batch delete attachments but not the email they were attached to. Unless anyone knows differently.
#
jacky
yeah, fastmail is what I'm using now
#
[jeremycherfas]
Any way to script it?
#
Ruxton
self-hosted mail is great, "i didnd't receive x" "cool story, i sent it, here is log"
#
[jeremycherfas]
Anyone can write a log entry. 😀
#
jacky
[jeremycherfas]: not to my knowledge :(
[kevinmarks] and gRegorLove joined the channel
#
[kevinmarks]
On the "generated forms" discussion, inkstone is an illuminating example - it has a customisable way to ass multiple form elements to the ui, but they do end up a bit generic.
krychu, jjuran and [kevinmarks] joined the channel
#
GWG
I need an effective way to do webmention verification on a json object/array in php, as noted in the specification.
#
GWG
Any suggestions?
#
aaronpk
Like checking if a URL appears in a JSON object?
#
aaronpk
If you don't care where in the JSON it is it's a pretty simple recursive function to look at all the values for a match
ingoogni and [Rose] joined the channel
#
GWG
Wondering if I should worry about https vs http though
#
GWG
Also, can't find any php webmention implementation that does media type rules. Haven't checked other languages yet
#
GWG
php- mf2 uses xpath/domdocument so I figured I could use that and send the already generated domdocument into php-mf2 to avoid doing it twice
#
GWG
It also will allow for fallback onto other properties if there are no or few microformats on a page.
#
GWG
Have to be aware of possible poor markup by people who installed the WordPress plugin
#
GWG
I feel this webmention project may last till Summit
[kevinmarks] joined the channel
#
[kevinmarks]
if the json is in a string, why not do a string match first?
#
aaronpk
false positives?
#
aaronpk
if you're looking for http://example.com/ then http://example.com/foo would match even though that is not the same
#
[kevinmarks]
Sorry, that was unclear: I meant do a string match first, as that will give a quick no, then do the recursive search to fully confirm.
[Rose] joined the channel
#
GWG
Then I have fragments
gRegorLove and [eddie] joined the channel
#
[eddie]
hmm aaronpk if I subscribe to two different feeds in the same channel, and one feed has truncated info and the other does not for the same post (same uid) do you know what will happen? Will I get two posts? will it be first come first serve or the one with more info?
#
aaronpk
right now aperture doesn't do any de-duping of content between sources
#
aaronpk
so you'd see both
#
aaronpk
there are a bunch of considerations once i start mixing data between feeds which i haven't totally thought through yet
#
[eddie]
Makes sense :thumbsup:
#
[eddie]
definitely the safest approach 🙂
#
aaronpk
i suspect it will be connected to eventually fetching the canonical content for items too
#
aaronpk
since right now everything only comes from the feed, no additional fetching
#
[eddie]
ohhh yeah that makes sense
#
aaronpk
i do want to solve it though, because right now i have a channel following a twitter search and also a twitter list, and i see duplicate tweets from a few accounts :)
#
[eddie]
because really, if you are fetching the canonical content, feed source is a lot less important
#
aaronpk
yep exactly
#
aaronpk
the thing i want to avoid is having a situation where e.g. your website could claim to have a url that matches a post on tantek's website and override the content from that
#
[eddie]
ohhhh yeah
#
[eddie]
that would be bad and could easily happen as a mistake or malicious
#
aaronpk
limiting it to the domain is obvs a safe solution, but then that doesn't work in all the cases of things like granary or indienews
#
[eddie]
micro.blog as well
#
aaronpk
oh yeah totally
#
aaronpk
so those are the things i need to think through before i start mixing content from sources
#
aaronpk
(also sidenote that this thankfully has almost nothing to do with the microsub spec itself)
#
[eddie]
Yep, exactly. Which is pretty good
[kevinmarks] joined the channel
#
[kevinmarks]
or the daring fireball thing where the url is the external site that you may also sub to
#
aaronpk
i'm becoming less and less convinced that those "linkblogs" are something we want to model
#
aaronpk
at least, modeling in a way other than treating it as just a regular post with a link in the content
ingoogni, jackjamieson, snarfed, [kodepoeten], seblog, sebsel and [manton] joined the channel
#
[manton]
Micropub media endpoint question for folks: Micro.blog automatically creates a poster frame when a video is uploaded. I'm thinking of returning that somewhere in the media endpoint response. Is there any precedent for doing that either in JSON or in an extra HTTP header, e.g. X-Poster-Frame or something like that?
dougbeal|iOS joined the channel
#
[manton]
The spec says the response is undefined, although I do include some JSON for convenience, so I could put it there too. That would platform-specific and outside the scope of Micropub, I think.
#
GWG
I include the return from WordPress
#
GWG
manton, we have a discussion on this
#
Loqi
[dshanske] #13 Response from Media Endpoint
#
[manton]
@GWG Thanks!
[tantek], calumryan and [grantcodes] joined the channel
#
[grantcodes]
Do you use a json body for that GWG?
leg, jackjami_, ingoogni, [kevinmarks], gRegorLove_ and [Rose] joined the channel
#
[Rose]
Has the IndieWeb community considered submitting some of the awesome projects they've made here? https://github.com/Kickball/awesome-selfhosted
#
Loqi
[Kickball] awesome-selfhosted: This is a list of Free Software network services and web applications which can be hosted locally. Selfhosting is the process of locally hosting and managing applications instead of renting from SaaS providers.
#
[Rose]
(Posting in Dev, because I think the developers should be involved 😉)
#
[Rose]
Good point! But none of Aaron's stuff is 😛
#
[tantek]
wow that's a long set of long lists!
#
Loqi
ok, I added "https://github.com/Kickball/awesome-selfhosted" to the "See Also" section of /projects https://indieweb.org/wiki/index.php?diff=59367&oldid=59357
#
Loqi
[Kickball] awesome-selfhosted: This is a list of Free Software network services and web applications which can be hosted locally. Selfhosting is the process of locally hosting and managing applications instead of renting from SaaS providers.
#
[Rose]
It's a very useful list for people looking to keep their data on their servers or under their control!
#
[Rose]
There's also a sysadmin one.
#
Loqi
[n1trux] awesome-sysadmin: A curated list of amazingly awesome open source sysadmin resources.
#
Loqi
ok, I added "https://github.com/n1trux/awesome-sysadmin" to the "See Also" section of /projects https://indieweb.org/wiki/index.php?diff=59368&oldid=59367
#
Loqi
[n1trux] awesome-sysadmin: A curated list of amazingly awesome open source sysadmin resources.
chrisaldrich, [kimberlyhirsh], ingoogni, [Michael_Beckwit, [chrisaldrich] and snarfed joined the channel
#
GWG
[grantcodes]: Yes, but I don't do anything official
snarfed, [Michael_Beckwit, [dmitshur], [tantek], [schmarty], [jgmac1106], [chrisaldrich], [kevinmarks] and [dougbeal] joined the channel