#GWGI'm looking at cache control headers for IndieAuth
KartikPrabhu joined the channel
#@PupaBeaumont↩️ Según guitarras fuertes, bajos y baterías densas, hablamos de metal como un gran subgénero del rock proveniente del blues, hardrock y hasta la psicodelia rockera. Hay microsub géneros como el Doom, Thrash, Deep, Death... Y fusiones con el Industrial, Punk y sonidos electrónicos. (twitter.com/_/status/1123044205427855361)
tbbrown and [tantek] joined the channel
#[tantek]!tell snarfed figured out my broken atom feed. Turns out a PHP 5.3 -> 7.2.13 update (when I migrated web hosts) changed how unspecified/default params worked, and a call without params which used to work started silently breaking. Fixed and cranked my feed items up to 64 so anyone polling should see everything posted since I migrated.
#ZegnatSQLite themselves tried something like this to make it an archive (think zip) format. And the idea is pretty good, because you have infinite extensibility through tables
#GWGTrying to map IndieAuth scopes to WordPress capabilities. Not a pure match
#ZegnatHm? Anything can be a scope in OAuth. Any reason you can’t list all of WPs capabilities?
#ZegnatAt work we connect to a platform where the scopes end in /r and /w depending on whether we require read or write access to things under a scope.
#GWGZegnat, I realized that if you get a token from the WordPress IndieAuth endpoint, it doesn't lock down permissions. It relies on the Micropub or other endpoint to do so
#GWGI am trying to make it work at the auth level instead
#GWGThat means that I have to, for example, restrict the ability to edit_posts,. WordPress capability, when the IndieAuth scopes update isn't present
#sebselBut IndieAuth does not prescribe a update-scope, right? The server (so wordpress) can say: these are my scopes. And then in the IndieAuth flow, these scopes are just passed along as a list.
#sebselIt's the user that picks the scopes from that list that seem reasonable for the app to have. And the app can make suggestions like "I want to update things", but in the end it's up to the server to declare and the user to pick
#ZegnatYeah, I am still not sure what the correct way to continue there is. Obviously clients must ask for scopes, and it is good to standardise those. But if you control the entire flow, you are free to add and check for completely different scopes
#ZegnatE.g. a client requesting "create" could be given a token that contains the scope "wordpress/update". And the WP Micropub endpoint may ignore "create" completely and only check for "wordpress/update" to see if the current request is allowed to update an existing post
#sebselyea, you can do the mapping when the client requests scopes, but then still let the server work with its own scopes
#sebselso you still show your own scopes to the user, but tick the boxes according to the create/update the client requests
#ZegnatThe problem with this is if your micropub endpoint and indieauth endpoint are separate software. Then your auth endpoint need to know about the scopes the mp endpoint wants
#GWGWhich is why it is easier to decide which existing permissions map to common scopes
#ZegnatE.g. is there an expectation that there will be a profile name for authentication, always? Or will everyone who wants a display name need to request full profile scope
#GWGI am giving it out for all WordPress users freely
#GWGProbably should add a setting to let people decide
#ZegnatIf the information is already public on the profile page itself (the URL they authenticate as) it feels OK to not require a scope
#ZegnatI was just thinking in case you were putting account info in there that is available in the WP backend but not neccessarily made public through the site
#GWGEither way, need to dump some of these discussions into appropriate places when I have the chance
#GWGAlso have to pack, add projects to the Berlin page, go to work, etc
#ZegnatI think one of the future reasons for this option we had in mind was for platforms that might be interested in supporting indieauth as login option. That way they can have a display name and photo, e.g. for discussion forums
#ZegnatBut not sure anyone is actively working on such an integration
#[jgmac1106]eventually I want group social readers, I would love to have multiple people authenticate into same channels, would provide functionality dispalying who is logged in
[tantek] joined the channel
#[tantek]Ruxton, cweiske, thanks for heads up. It’s possible I changed my atom IDs to use https rather than http which would have changed everything, or I had 40+ new posts since I transferred hosts more than a month ago
#[tantek]I wonder what is the best practice for using URLs as atom IDs, http or https or just pick one and stick with it forever?
#[tantek]I did up the number of items to 64 so that feed subscribers would see everything I posted since IWC Austin which is when I started the site transfer process.
seblog joined the channel
#[jgmac1106]Job for Elixir folks or those with passion for back end development ....and you can make sure all the building blocks get added...they are using React on the front end
jeremych_, [tantek], snarfed, gRegorLove, [schmarty] and chrisaldrich joined the channel
#snarfedsubmitted bridgy for twitter's (new?) api review just now. cross your fingers, all.
#Loqisnarfed: [tantek] left you a message 13 hours, 29 minutes ago: figured out my broken atom feed. Turns out a PHP 5.3 -> 7.2.13 update (when I migrated web hosts) changed how unspecified/default params worked, and a call without params which used to work started silently breaking. Fixed and cranked my feed items up to 64 so anyone polling should see everything posted since I migrated.
[jgmac1106], [eddie], snarfed and [tantek] joined the channel
#[eddie]Essentially purging the article's data but holding on to this small bit of metadata allows you to know that you've seen the post before (and WHEN) even if it's hanging around in a feed with no date
#aaronpkthat was happening way more than the edge case he's describing there
#aaronpkand my solution would still have that bug if a really old article reappeared in the feed
[Rose] joined the channel
#[Rose]If it used the GUID as the ID, theoretically it would also fix the NPR issue that just happened with podcasts (they put everything in everyone else's feeds)
#[eddie]aaronpk Yeah, once you purge the metadata the issue would still exist
#aaronpkalso the storage issue isn't actually about byte count (other than images of course)
#aaronpkat the point you're storing an article's metadata, it isn't actually that big of a deal to add another 20kb of text for the article itself
#aaronpkthe slowdown comes from the row count in the database and its index
#[eddie]That's true. His app is just dealing with a single user's subscriptions so likely a magnitude less than Aperture
#snarfedmore importantly, aperture is a service, but netnewswire is a local app (i think?), so the decisions around storage and cost are totally different
#LoqiIt looks like we don't have a page for "netnewswire" yet. Would you like to create it? (Or just say "netnewswire is ____", a sentence describing the term)
#GWGAnd the other question is whether there is an easier way to maintain. Maybe spinning the IndieAuth external code into a repo that can be included in multiple plugins
#aaronpkhuh my inclination is to think of the indieauth plugin as reducing the number of moving parts, and since i'd already be selfhosting the wordpress blog, it's not another thing to self-host since it's built in
#GWGaaronpk: Which is my opinion, but not snarfed's and he probably isn't alone
#snarfedbut it also switches the underlying auth from silo to self-hosted, and i do some slightly exotic things with that, which i'd rather not depend on a plugin integrating nicely with
#snarfed(my site's auth isn't really that exotic, just uses standard features in core and jetpack for 2FA etc...but still)
#GWGsnarfed: That would actually work with IndieAuth
#snarfedoh i'm sure it might. i just like to outsource as much plumbing as i can to bigger cos and silos instead of self-hosting. better maintenance, security, etc, and still swappable when necessary without user-visible changes
#GWGsnarfed: So, how do I make it so I'm not maintaining two versions of the same thing effectively?