#dev 2019-04-30

2019-04-30 UTC
[tantek] joined the channel
#
GWG
I'm looking at cache control headers for IndieAuth
KartikPrabhu joined the channel
#
@PupaBeaumont
↩️ Según guitarras fuertes, bajos y baterías densas, hablamos de metal como un gran subgénero del rock proveniente del blues, hardrock y hasta la psicodelia rockera. Hay microsub géneros como el Doom, Thrash, Deep, Death... Y fusiones con el Industrial, Punk y sonidos electrónicos.
(twitter.com/_/status/1123044205427855361)
tbbrown and [tantek] joined the channel
#
[tantek]
!tell snarfed figured out my broken atom feed. Turns out a PHP 5.3 -> 7.2.13 update (when I migrated web hosts) changed how unspecified/default params worked, and a call without params which used to work started silently breaking. Fixed and cranked my feed items up to 64 so anyone polling should see everything posted since I migrated.
#
Loqi
Ok, I'll tell them that when I see them next
[Rose], [tantek], cweiske and sebsel joined the channel
#
Ruxton
[tantek]: I wondered why when I opened indingenous the other day there was only a couple from you, now your feed is good it's showing many :)
swentel joined the channel
#
[tantek]
Ruxton that’s odd as Indigenous should be following my higher fidelity h-feed on my home page which has been working this whole time.
#
[tantek]
Atom is downlevel, lower quality, and for old style non interactive readers.
#
[tantek]
Double check your subscription to make sure you’re subscribed to https/tantek.com/
#
Ruxton
I was looking at it on Thursday or Friday and there was only 2 items, today there's many more
#
cweiske
[tantek], my feed reader showed 40+ new entries from your page
#
cweiske
somehow your feed item IDs must have changed
gxt, [audioundergroun and [kevinmarks786] joined the channel
#
[kevinmarks786]
Interesting Geo format. Is sqlite the new car for static Data? https://www.geopackage.org/
#
Zegnat
That is interesting
#
Zegnat
SQLite themselves tried something like this to make it an archive (think zip) format. And the idea is pretty good, because you have infinite extensibility through tables
[Rose] joined the channel
#
GWG
Trying to map IndieAuth scopes to WordPress capabilities. Not a pure match
#
Zegnat
Hm? Anything can be a scope in OAuth. Any reason you can’t list all of WPs capabilities?
#
Zegnat
At work we connect to a platform where the scopes end in /r and /w depending on whether we require read or write access to things under a scope.
#
Zegnat
Add as much granularity as you want
#
GWG
Zegnat, I realized that if you get a token from the WordPress IndieAuth endpoint, it doesn't lock down permissions. It relies on the Micropub or other endpoint to do so
#
GWG
I am trying to make it work at the auth level instead
#
GWG
That means that I have to, for example, restrict the ability to edit_posts,. WordPress capability, when the IndieAuth scopes update isn't present
#
sebsel
But IndieAuth does not prescribe a update-scope, right? The server (so wordpress) can say: these are my scopes. And then in the IndieAuth flow, these scopes are just passed along as a list.
#
sebsel
Someone correct me if I'm wrong
#
sebsel
It's the user that picks the scopes from that list that seem reasonable for the app to have. And the app can make suggestions like "I want to update things", but in the end it's up to the server to declare and the user to pick
#
sebsel
hm, although the wiki indeed mentions a fixed list https://indieweb.org/scope
#
Zegnat
Yeah, I am still not sure what the correct way to continue there is. Obviously clients must ask for scopes, and it is good to standardise those. But if you control the entire flow, you are free to add and check for completely different scopes
#
Zegnat
E.g. a client requesting "create" could be given a token that contains the scope "wordpress/update". And the WP Micropub endpoint may ignore "create" completely and only check for "wordpress/update" to see if the current request is allowed to update an existing post
#
sebsel
yea, you can do the mapping when the client requests scopes, but then still let the server work with its own scopes
#
sebsel
so you still show your own scopes to the user, but tick the boxes according to the create/update the client requests
#
Zegnat
The problem with this is if your micropub endpoint and indieauth endpoint are separate software. Then your auth endpoint need to know about the scopes the mp endpoint wants
#
GWG
Which is why it is easier to decide which existing permissions map to common scopes
#
GWG
I may propose some new scopes
[jgmac1106] joined the channel
#
GWG
For example, the feature I added about returning basic profile data isn't fully documented
#
Loqi
[dshanske] #31 Returning Profile Data
#
GWG
Should this be protected by scope?
#
GWG
I remember talking about this with aaronpk, but I didn't document it.
#
GWG
And I am curious what people think about what Apps with a token should get by default
#
Zegnat
A scope was mentioned in the discussion, GWG: https://chat.indieweb.org/dev/2019-02-18#t1550532726528800
#
Loqi
[aaronpk] this is more like the "profile" scope in openid connect
#
Zegnat
I linked to that line in one of my comments on the GitHub issue
#
GWG
Thank you
#
Zegnat
The question is, are there any properties that should be made available by default
#
GWG
I need to dump it into the scope page
#
Zegnat
E.g. is there an expectation that there will be a profile name for authentication, always? Or will everyone who wants a display name need to request full profile scope
#
GWG
I am giving it out for all WordPress users freely
#
GWG
Probably should add a setting to let people decide
#
Zegnat
If the information is already public on the profile page itself (the URL they authenticate as) it feels OK to not require a scope
#
GWG
Yes. Which is why I made that decision
#
GWG
But people should be able to turn it off.
#
Zegnat
Gotcha, yes, that makes sense
#
Zegnat
I was just thinking in case you were putting account info in there that is available in the WP backend but not neccessarily made public through the site
#
GWG
Either way, need to dump some of these discussions into appropriate places when I have the chance
#
Zegnat
That is the case you need to be careful of
#
GWG
I am not
#
GWG
Though not everyone turns on avatar images, for example, even though it is on by default
#
GWG
And there is display name vs actual name as a setting
#
GWG
Drupal and WordPress are the only implementors of profile return I think
#
GWG
And Quill is the only client. I forget if swentel added it to Indigenous
#
GWG
Need to document that too
#
GWG
And see who else might...open some issues
#
GWG
Also have to pack, add projects to the Berlin page, go to work, etc
#
Zegnat
I think one of the future reasons for this option we had in mind was for platforms that might be interested in supporting indieauth as login option. That way they can have a display name and photo, e.g. for discussion forums
#
Zegnat
But not sure anyone is actively working on such an integration
#
swentel
GWG, not yet
#
swentel
bit slow nowadays
#
GWG
swentel, sorry I will miss you again in Europe
#
GWG
But, what other Micropub clients might benefit from it?
#
GWG
And Microsub?
#
Zegnat
Do either of those really benefit of it? What is the benefit for them?
#
GWG
Displaying the name and image of the user is common in clients
#
Zegnat
Hmm. I guess? I don’t think I have ever used a reader that displayed my information
#
swentel
indigenous for android is able todo that, I now parse that info myself when authenticating
#
swentel
gives it nice touch
#
Zegnat
Hmm, yeah, I see that. I guess I was trying to think of a functional benefit.
#
Zegnat
Not to cast shade at displaying who is logged in at all though!
#
Zegnat
Definitely a nice touch
#
GWG
Exactly
[Rose] and [jgmac1106] joined the channel
#
[jgmac1106]
eventually I want group social readers, I would love to have multiple people authenticate into same channels, would provide functionality dispalying who is logged in
[tantek] joined the channel
#
[tantek]
Ruxton, cweiske, thanks for heads up. It’s possible I changed my atom IDs to use https rather than http which would have changed everything, or I had 40+ new posts since I transferred hosts more than a month ago
#
[tantek]
I wonder what is the best practice for using URLs as atom IDs, http or https or just pick one and stick with it forever?
#
[tantek]
I did up the number of items to 64 so that feed subscribers would see everything I posted since IWC Austin which is when I started the site transfer process.
seblog joined the channel
#
[jgmac1106]
Job for Elixir folks or those with passion for back end development ....and you can make sure all the building blocks get added...they are using React on the front end
#
Zegnat
ActivityPub in Elixer? I guess there is already prior art there
#
[jgmac1106]
yep already made the introductions to folks
#
[jgmac1106]
not a bad prototype...just a collection of bookmarks
[dmitshur], [jgarber], eli_oat and [kevinmarks] joined the channel
[eddie], snarfed and seblog joined the channel
#
@jackjamieson
↩️ IndieAuth for WordPress Question by David Shanske > Thinking about the necessity of maintaining IndieAuth code in the Micropub plugin and now the Yarns Microsub plugin for WordPress. I wanted to put out to any WordPress user for some input. The… https://jackjamieson.net/?p=5334
(twitter.com/_/status/1123254415819980805)
jeremych_, [tantek], snarfed, gRegorLove, [schmarty] and chrisaldrich joined the channel
#
snarfed
submitted bridgy for twitter's (new?) api review just now. cross your fingers, all.
#
Loqi
snarfed: [tantek] left you a message 13 hours, 29 minutes ago: figured out my broken atom feed. Turns out a PHP 5.3 -> 7.2.13 update (when I migrated web hosts) changed how unspecified/default params worked, and a call without params which used to work started silently breaking. Fixed and cranked my feed items up to 64 so anyone polling should see everything posted since I migrated.
[jgmac1106], [eddie], snarfed and [tantek] joined the channel
#
[tantek]
why is there a new twitter api review?!?
#
[tantek]
is relieved Loqi doesn't answer why is questions, yet
#
[tantek]
gives Loqi a why
#
Loqi
gives back the why
#
[tantek]
exactly
snarfed, tbbrown and [cleverdevil] joined the channel
#
[cleverdevil]
Some interesting details from Brent Simmons on his plans for sync in NetNewsWire - http://inessential.com/2019/04/29/netnewswire_syncing_implementation_roadm
#
[cleverdevil]
Could be some useful nuggets in there for Microsub server implementors.
snarfed, [jgarber] and [eddie] joined the channel
#
[eddie]
Very interesting. aaronpk had talked about this strange behavior issue he had run into with Aperture. This is an interesting solution https://github.com/brentsimmons/NetNewsWire/blob/master/Technotes/ArticlesAndStatuses.markdown#strange-behavior
#
[eddie]
Essentially purging the article's data but holding on to this small bit of metadata allows you to know that you've seen the post before (and WHEN) even if it's hanging around in a feed with no date
#
[eddie]
!tell aaropk You mentioned before Aperture having an issue with deleted posts reappearing after they are deleted from storage. This is an interesting potential approach https://github.com/brentsimmons/NetNewsWire/blob/master/Technotes/ArticlesAndStatuses.markdown#strange-behavior
#
Loqi
Ok, I'll tell them that when I see them next
#
[eddie]
no typo username!
#
[eddie]
haha oh well, you are here to see it
#
aaronpk
now I forgot how I solved it
#
aaronpk
ah, I always store whatever is in the current feed
#
aaronpk
and only delete items after they've left the feed
#
[eddie]
ohhhh that's right!
#
aaronpk
that was happening way more than the edge case he's describing there
#
aaronpk
and my solution would still have that bug if a really old article reappeared in the feed
[Rose] joined the channel
#
[Rose]
If it used the GUID as the ID, theoretically it would also fix the NPR issue that just happened with podcasts (they put everything in everyone else's feeds)
#
[eddie]
aaronpk Yeah, once you purge the metadata the issue would still exist
#
aaronpk
also the storage issue isn't actually about byte count (other than images of course)
#
aaronpk
at the point you're storing an article's metadata, it isn't actually that big of a deal to add another 20kb of text for the article itself
#
aaronpk
the slowdown comes from the row count in the database and its index
#
[eddie]
That's true. His app is just dealing with a single user's subscriptions so likely a magnitude less than Aperture
#
snarfed
more importantly, aperture is a service, but netnewswire is a local app (i think?), so the decisions around storage and cost are totally different
leg, KartikPrabhu and gxt joined the channel
#
gRegorLove
what is netnewswire?
#
Loqi
It looks like we don't have a page for "netnewswire" yet. Would you like to create it? (Or just say "netnewswire is ____", a sentence describing the term)
#
gRegorLove
what is Evergreen?
#
Loqi
Evergreen is an open source feed reader for MacOS that is under development https://indieweb.org/Evergreen
[eddie], KartikPrabhu and [kevinmarks786] joined the channel
#
GWG
Evening
#
GWG
aaronpk: There was something I was going to ask you.
#
aaronpk
... what was it?
#
GWG
I don't remember
#
GWG
I was hoping typing it would jog my memory
#
GWG
I am still waiting for someone to review an IndieAuth PR as I solved another problem with headers
[tantek] and gRegorLove_ joined the channel
#
GWG
Goal is to reduce issues on other repos
#
snarfed
GWG: i use the micropub plugin, and external indieauth, and i'd definitely rather keep it that way
#
snarfed
i prefer to self host fewer things, not more, and i'm not alone in that
#
GWG
That's why I'm asking.
#
GWG
And the other question is whether there is an easier way to maintain. Maybe spinning the IndieAuth external code into a repo that can be included in multiple plugins
#
aaronpk
huh my inclination is to think of the indieauth plugin as reducing the number of moving parts, and since i'd already be selfhosting the wordpress blog, it's not another thing to self-host since it's built in
#
GWG
aaronpk: Which is my opinion, but not snarfed's and he probably isn't alone
#
snarfed
but it also switches the underlying auth from silo to self-hosted, and i do some slightly exotic things with that, which i'd rather not depend on a plugin integrating nicely with
#
GWG
aaronpk: That is what I wanted to ask you
#
GWG
web sign-in.
#
snarfed
(my site's auth isn't really that exotic, just uses standard features in core and jetpack for 2FA etc...but still)
#
GWG
snarfed: That would actually work with IndieAuth
#
snarfed
oh i'm sure it might. i just like to outsource as much plumbing as i can to bigger cos and silos instead of self-hosting. better maintenance, security, etc, and still swappable when necessary without user-visible changes
#
GWG
snarfed: So, how do I make it so I'm not maintaining two versions of the same thing effectively?
#
snarfed
library
#
GWG
So, I should take class-micropub-authorize, fork it into its own repo, and make it a dependency of Micropub?
#
snarfed
i don't know the codebase or PHP details. i just know library is the answer.
#
GWG
The other question is web sign in, the vestigial organ of the IndieAuth plugin
chrisaldrich joined the channel