#dev 2019-05-24

2019-05-24 UTC
[jgarber] joined the channel
#
[jgarber] Thanks, y’all!
#
[jgarber] `redirect_uri` is part of the IndieAuth spec: https://www.w3.org/TR/indieauth/#4-2-2-redirect-url
#
[jgarber] doubleloop: Good catch on the `media_endpoint` bug. That’s _probably_ an issue upstream in indieweb-endpoints-ruby: https://github.com/indieweb/indieweb-endpoints-ruby
#
Loqi [indieweb] indieweb-endpoints-ruby: A Ruby gem for discovering a URL's IndieAuth, Micropub, Microsub, and Webmention endpoints.
#
[jgarber] Luckily I know the guy that works on that… 🙃
#
GWG Okay, can't filter values in kses. So much for that.
mblaney and gxt joined the channel
#
GWG Wonder if it is worth bundling HTML Purifier for that
miklb, benwerd, snarfed and [jgarber] joined the channel
#
[jgarber] I’m spending way too much time poring over https://tools.ietf.org/html/rfc8288 (and its predecessor https://tools.ietf.org/html/rfc5988) and found something mildly interesting…
#
[jgarber] relation-type = reg-rel-type / ext-rel-type
#
[jgarber] ext-rel-type = URI ; Section 3 of [RFC3986]
#
[jgarber] reg-rel-type = LOALPHA *( LOALPHA / DIGIT / "." / "-" )
#
[jgarber] ```
#
[jgarber] ```
#
[jgarber] The above defines valid `rel` values in HTTP Link headers. The URI bit makes sense. That’s how we got the original `rel="http://webmention.org/"` value before `webmention` made its way onto IANA’s blessed list (here: https://www.iana.org/assignments/link-relations/link-relations.xhtml).
#
[jgarber] What caught my attention is that underscores aren’t allowed according to the `reg-rel-type` pattern above. So, `rel="authorization_endpoint"` in an HTTP Link header is _technically_ invalid. Am I reading that right?
#
[jgarber] (Not that it matters practically, of course…)
#
[jgarber] Also worth noting that even IANA doesn’t stick to the specified format above. The registered `convertedFrom` relation name is invalid. 🙃
snarfed joined the channel
#
jacky anyone has tips for authenticating a IndieAuth app on a desktop environment?
#
jacky I'm working on parts of one (for Linux)
#
jacky and I'm thinking about adding explicit support to my site for one
#
jacky I see https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uris-native-apps/ pointing to using custom app handlers
#
jacky but I don't know how that flies in a cross platform way
#
jacky (I know how to do that pragmatically for Linux/XDG environments)
KartikPrabhu joined the channel
#
jacky this looks like a standards-suggested way https://tools.ietf.org/html/rfc8252#section-7
#
jacky it'd be easier for me to open a server on the user's machine and do that
treora joined the channel
#
jacky hmm that looks like the only option
#
jacky this might break with indieauth tho https://indieauth.spec.indieweb.org/#redirect-url
#
jacky oh wait, no; it only wants the auth server to ask the user to be sure if it's the right place to go to
#
jacky https://indieauth.spec.indieweb.org/#preventing-phishing-and-redirect-attacks
[eddie] joined the channel
#
[eddie] jacky: currently most native apps use IndieAuth by the redirect url being a url on the same domain as the client_id and then the redirect_url redirects to the native app url.
#
[eddie] So in Indigenous this is something like: https://indigenous.abode.pub/iOS/auth/redirect which then sends the user to indigenous://auth/callback
#
[eddie] I originally tried putting the native callback scheme directly into the redirect_uri found on the client_id but there were some IndieAuth authorization endpoints that didn’t check the redirect_uri so I made the pragmatic approach rather than the official approach
KartikPrabhu joined the channel
#
jacky how does that redirect from the app trigger work? [eddie]
#
jacky I'm guessing since you know it's for iOS, you can just do that
#
jacky I can make a page that'll emit the code to the page in a hidden way but my app will know to scan for
#
[eddie] Yeah it’s an iOS only app
#
[eddie] Will your app only be on Linux?
#
jacky nope. It'll be built using Rust and Qt so it _should_ work on Windows and macOS as well (someone mentioned interest in getting it on macOS)
#
[eddie] Ohhhh yeah that’s tricky
#
[eddie] So far it’s been apps that just work on Android OR iOS OR macOS
#
[eddie] etc
#
jacky gotta love the OR lol
#
[eddie] Lol yep
#
[eddie] So yeah having an app that runs on multiple sites would probably need to inspect and see if it can determine what OS it is from the user agent or something
#
jacky hmm
#
jacky I think I might just go that same route - showing a page that's like a "success one" but opt to have the token presented somewhere in the HTML of the page
snarfed joined the channel
#
[eddie] I guess you could also have “open in” with the various OSes listed if you know what the url schemes would be for each OS
#
[eddie] so the person ends up on the success page and can either click on their OS to open the app or click to copy and paste the token
#
jacky yup yup
#
[eddie] I think Indiepaper was doing something similar where it provided the token, a profiled bookmarklet, an open in the macOS app and directions for the shortcut
#
[eddie] Pre-filled bookmarklet
#
aaronpk Custom url schemes are pretty widely supported across platforms i thought
#
aaronpk using that with the technique [eddie] mentioned is probably the best approach
#
jacky ah okay
#
jacky so I looked up custom url scheme (specifically that)
#
jacky this is not well documented lol
#
jacky at least for Linux
#
jacky like I know how it works on macOS
#
Ruxton yaay the internet is super-down in my hood and is probably going to be for a while :~(
#
Ruxton aaronpk: custom url schemes are dying.. OSX denies them hard, iOS and Android got rid of them and Windows is moving away from them, but they still work
[Rose] joined the channel
#
[Rose] Interesting you say that as Shortcuts for iOS, the app Apple released last year, makes heavy use of URL schemes.
#
[Rose] And they also keep promoting apps that use URL schemes.
#
Ruxton maybe it's the other way around windows/osx, it's been a year since i butted heads with it
#
Ruxton yah so this is what OSX does now, you have t allow it every time https://appleinsider.com/articles/18/09/05/remote-macos-exploit-using-custom-url-schemes-demonstrated-by-security-researcher
KartikPrabhu joined the channel
#
jacky Ruxton: spotify:/// links are how they open for me on Android
#
jacky that + URL matching
#
jacky (like `https://open.spotify.com/${ID}` jazz)
#
jacky all this to say: I wanna keep indieweb stuff going without having to open my web browser lol
#
Zegnat !tell jgarber Yes, you read the RFCs on link relations right! https://github.com/indieweb/indieauth/issues/17
#
Loqi Ok, I'll tell them that when I see them next
#
Loqi [Zegnat] #17 Link relations in HTTP Link header conflict with RFC 5988.
#
Ruxton cool new idea from github for supportng devs of opensource - https://github.com/sponsors
[Rose], [tonz], [frank], leg, mattl_, stevestreza, ludovicchabant, willnorris, miklb, [calumryan], KartikPrabhu, [jeremycherfas], [jgmac1106], [kimberlyhirsh] and [grantcodes] joined the channel
#
[grantcodes] !tell doubleloop yes sorry, I moved photo.postrchild.com to heroku and didn't realise that you have to pay for ssl certificates there, so it's currently just on http
#
Loqi Ok, I'll tell them that when I see them next
#
GWG Morning all
[jeremycherfas] and [jgarber] joined the channel
#
[jgarber] Zegnat: Ah, fantastic. Thanks for that link to indieweb/indieauth#7!
#
Loqi [jgarber]: Zegnat left you a message 5 hours, 45 minutes ago: Yes, you read the RFCs on link relations right! https://github.com/indieweb/indieauth/issues/17
KartikPrabhu joined the channel
#
Zegnat No problem :) Some of us have spent way too much time reading the same spec over and over, haha
KartikPrabhu joined the channel
#
[jgarber] I’m the latest in a long line of frustrated readers of RFCs 5988 and 8288. 😂
#
Zegnat [jgarber]: if you want frustration, I compiled all the links in https://indieweb.org/JSON#Specs ;)
#
Zegnat When the spec editor recommends you use a different spec, you know you have issues
[jeremycherfas] joined the channel
#
[jeremycherfas] [tonz] Your post replying to my Utrecht write-up did not show up as a webmentions, possibly because the u-in-reply-to in the section does not enclose my url.
[tonz] joined the channel
#
[tonz] odd. I’ll check.
#
[jeremycherfas] I then pinged myself, just to check, and the result is a disaster on my site.
#
petermolnar > I then pinged myself - is this the new version of I sent myself an email to test the out of office auto-response?
#
[jgarber] Zegnat: Ohhhh nooooo 😭
[tantek] joined the channel
#
[jeremycherfas] No. It is the new version of setting up a fake identity to email yourself to check you email rules.
#
aaronpk So with IndieAuth, and OAuth in general, you *need* to get the user to sign in in a browser to maintain the overall security of the flow
#
aaronpk at some point in the flow the user has to be in the browser. Doing anything else opens up a lot of opportunities for phishing attacks and other things
#
aaronpk that said, a redirect back to the app isn't always possible, for example when you're logging in on a device that doesn't have a browser like an appletv
#
[tonz] Wondering out loud : how would I go about setting up indieauth to log into a yarns microsub server in a different WordPress instance and then use micropub in a reader to post to a different WordPress instance? Kinda like authenticate with aperture and then post to my blog, use yarns as an outside server. Anything where I should start reading specs or code to dive into it?
#
[jgarber] Zegnat: So speaking of Link header parser… turns out we’ve got something in-house: https://github.com/indieweb/link_rel_parser-ruby
#
Loqi [indieweb] link_rel_parser-ruby: Parse HTTP `Link` headers into a structured format
#
Zegnat Oh interesting
#
Zegnat I have only used Ruby for a few weeks years ago, so I have never looked at what tooling is there
#
[jgarber] For the indieweb-endpoints.cc stuff, I’m taking a second look at the relying code. That led me down the RFC rabbit hole and has me re-thinking how I’m parsing Link headers. Which… led me to digging through rubygems.org for existing libraries which… led me to [shaners]’ indieweb/link_rel_parser-ruby repo.
[aaronpk], [schmarty], [kimberlyhirsh], [frank] and [tantek] joined the channel
#
[tantek] [jgarber] while your looking at ruby parser stuff, how good is the ruby mf2 parser these days and are there any improvements / updates than can be pushed out quickly (without too much work)?
#
[tantek] you’re* looking
[jgarber] joined the channel
#
[jgarber] 😬
#
[jgarber] I haven’t looked at it in a bit. Been focusing on other stuff. But my memory is that it needs some love.
#
[tantek] There’s a feed reader (I don’t recall which one) that uses ruby and had a bad early experience with the parser, and it would be great to go back to them with an update, so they can add h-feed support
#
aaronpk IIRC last time they were using the first parser, which has since been completely rewritten
#
aaronpk the current one is much more in line with the rest of them, and I think is only missing some of the most recent parsing changes
[Rose] joined the channel
#
[jgarber] I’d have to refamiliarize myself with the state of the gem before making any judgments beyond the above.
#
[tantek] Right. And it would be good to at least make sure it handles various folks’s h-feed on their homepages before sending another request
#
aaronpk "handles" is an interesting concept
#
aaronpk parsing is one thing, but normalizing and authorship discovery is a whole different project
#
[tantek] Right.
#
[tantek] That sounds like something to at least provide an informative heads-up about in the h-feed spec
#
aaronpk i'm still not really happy with the state of things in that regard. it's not a good story to tell people right now
#
[tantek] And if there’s convergence among h-feed consumers, we could make it a MAY or SHOULD in the spec
#
[tantek] Are there aspects you feel are known well enough to add as informative guidance to the h-feed spec? File an issue for it?
#
aaronpk for consuming?
#
[tantek] Yes
#
aaronpk yes things are reasonably stable in XRay/Aperture/Monocle right now
#
aaronpk and I worked with adactio on fixing his site so that his author info shows up right now too
#
[tantek] Using the same code? Or same approach / algorithms but difference code but same implementer?
#
aaronpk (thankfully that was a simple fix for him, he just needed to change the link from adactio.com/about to adactio.com and things magically worked)
#
aaronpk XRay is where all my logic is implemented, and that's what Aperture uses to parse feeds
#
sebsel yes a lot of things are "does XRay work" at this point, right?
#
sebsel is there an other place that also does the authorship stuff?
#
aaronpk https://indieweb.org/authorship#Implementations
#
sebsel ok, not that bad then
[jeremycherfas], [jgmac1106] and snarfed joined the channel
#
sknebel Authorship is fairly well documented I think
#
sknebel Things like multiple feeds, pages that don't have top level feeds etc on the other hand...
#
aaronpk and then tantek.com
#
sebsel goes to discover tantek.com by hand
#
aaronpk now that i think about it...
#
aaronpk i'm not really comfortable asking people to implement h-feed parsing until we have an h-feed validator
#
aaronpk otherwise when something isn't working, people don't know whether it's their fault or the publisher's fault
#
[jeremycherfas] [tonz] I have now had time to look at your webmention, and I think I see what is happening. Although it looks fine in x-ray http://xray.p3k.io/parse?url=https%3A%2F%2Fwww.zylstra.org%2Fblog%2F2019%2F05%2F7080%2F&pretty=true `webmention.heroku.app` is picking up an additional field called name that contains a large amount of stuff from your site. The problem is, I cannot see where it is getting that from. Looks like it could be another fe
#
[jeremycherfas] The content I am receiving mentions Rebecca Blood, and your post from 2003 about BlogTalk, which brings you and me full circle. But I cannot for the life of me discover how it is getting into the webmention.
#
sknebel Sounds like possibly old parser that still does implied name more often
#
sknebel Can take a look tonight
[Ana_R] joined the channel
#
[Ana_R] Hi everyone, I hope this is the right channel to ask (i’m so sorry if it isn’t and i will move the convo elsewhere). I think I missed a crucial step and I really can’t figure out where I went wrong. This is about using webmentions.io
#
[Ana_R] I have one blog post that has 3 webmentions (this one https://www.ohhelloana.blog/blogging-and-me).
#
[Ana_R] For some reason I can’t “connect” Brid.gy with webmentions.io either and I know it must be something i’ve done wrong but I can’t figure out what. I thought I had everything necessary on my `<head>`
#
[Ana_R] I can see them when I do a request to the API using javascript but whenever I sign in on webmentions.io there is nothing on my dashboard. I always thought it was normal until I realised yesterday that turns out people see the list of webmentions there…
#
[Ana_R] Did anyone go through something similar?
#
[Ana_R] Thank you so much in advance.
#
[jeremycherfas] [aaronpk] ^^^ Would it be worth picking up the plural version of the URL?
#
aaronpk [Ana_R]: hmm, it looks like you have two different accounts on webmention.io
#
aaronpk the webmentions are going to your ohhelloana.blog account but when you sign in you end up at www.ohhelloana.blog
#
aaronpk did you change your site from no-www to www at some point?
[schmarty] joined the channel
#
[Ana_R] Ohhhhhhhhhhhhhhhhh - if i did that, it was an accident 😐 I must have done something silly when doing something domain/HTTPs or switching hosting (i don’t know a lot about this to be honest). I’m so sorry about this, I knew this was somehow my fault. How can I fix it?
#
[Ana_R] 😓 thank you [aaronpk]
#
aaronpk do you want your website to be https://www.ohhelloana.blog or https://ohhelloana.blog?
#
[Ana_R] and *not if , I clearly messed up
#
[Ana_R] I always mention it without the www so, https://ohhelloana.blog
#
aaronpk ok cool, then this will depend on your hosting provider. some of them have a checkbox where you can decide which one will redirect to the other one
#
aaronpk what's your new web host?
#
[Ana_R] Netlify - okay, I see there that I do have the www
#
aaronpk great so figure out if there's a way you can get netlify to redirect to the no-www version. then next time you sign in to webmention.io you should see everything there
#
[Ana_R] awesome - thank you so much for your time!
[jgarber] and miklb joined the channel
#
[jgarber] There is!
#
[jgarber] You can configure www to be a domain alias for the primary domain in Netlify’s Domain magement interface.
#
GWG aaronpk: Did I see we might start validating h-feeds? If so, where do I add my +1?
#
[Ana_R] !!!! everything works!!! i’m so happy! Thank you!!
#
aaronpk woo awesome!
benwerd and [tantek] joined the channel
#
[tantek] nowww++
#
Loqi nowww has 1 karma over the last year
#
[tantek] GWG check indiewebify me issues for an existing issue to add h-feed validation and 👍 it, if not found, file an issue requesting it!
snarfed joined the channel
#
GWG [tantek]: Is there a repo for h-feed issues like we have for h-entry?
#
[tantek] Good question, check the h-feed spec for its issues link
#
[tantek] A validation would make more sense in indiewebify.me tho
snarfed joined the channel
#
GWG Yes, but there are related spec questions
#
GWG For example, should you only have one h-feed per url?
#
[schmarty] i'd love to see a "validator" that shows previews for how different readers will show a given post.
#
GWG Should your h-feed be referenced by a rel feed?
#
[tantek] [schmarty] worth filing an issue on the existing h-entry validator for that
#
[tantek] GWG why?
#
[schmarty] GWG: i don't expose my h-feed as a rel=feed because it's redundant. the page itself *is* the feed.
#
GWG To which?
#
[tantek] GWG the default answer to extra work is NO
#
[schmarty] i only reference "sidefile" type feeds with rel=feed, like my atom feed.
#
GWG I am wondering about the extra work I have to do on the processing side
#
GWG By the way, I agree about the redundancy
#
GWG https://github.com/indieweb/indiewebify-me/issues/13
#
Loqi [jeena] #13 Add test for feed/index/homepage with h-entries
#
GWG Microformats repo has an h-entry but not h-feed repo
#
GWG Re h-feed, then we get to implied h-feed, where I have to figure out what many h-entrys on a page are meant to mean
#
GWG There are things that would help
#
GWG Then there is the question of why a feed would be the child of an h-card..
#
GWG I am not complaining, just think we should document these things
#
GWG I had the hardest time trying to write code to make all of this work for Microsub
#
GWG Hoping to save someone else the trouble by deciding how these things work in the spec and documenting appropriately
[Rose] joined the channel
#
[schmarty] GWG: this sounds like one of those times where the spec isn't complete and there isn't documentation collecting examples from the wild to try and shape a consensus.
#
GWG Exactly
#
[schmarty] iirc the next step would then be to start collecting examples somewhere
#
GWG Where?
#
[schmarty] at the very least, you could make a subpage on your user page to collect examples you are seeing, particularly ones that require to to write special-case code.
#
[schmarty] maybe: document your implementation that way, including examples of each kind of feed that caused you to make a certain implementation choice
#
GWG I need to clean up my code
#
GWG And comment it
#
GWG That will help writing it
[jgmac1106] and [anomalily] joined the channel
#
[tantek] examples of what?
#
[schmarty] tantek: examples of ways to represent an h-feed on a page that might require different handling. E.g. explicit top-level h-feed, implied h-feed from a bunch of top-level h-entry, h-feed nested in h-card, ...
#
aaronpk i have a domain to host examples of stuff like that on :)
#
[tantek] [schmarty] all those sound like examples that could/should already be documented on /h-feed
#
[schmarty] GWG ^^ a place to document!
#
[tantek] with nested list-item analysis below each example
#
[tantek] in the IndieWeb Examples section
[chrisaldrich] and [tonz] joined the channel
#
[tonz] [jeremycherfas] that's even odder. The stuff about Rebecca Blood you receive is from my 'on this day' widget. I blogged her keynote at blogtalk and that is 16 years ago today.
#
[tonz] [jeremycherfas] there is no reason it should pick up my full side bar like that. I have seen that before, with Franks blog. Maybe I at least should restrict that widget to front page
gRegorLove, [Rose] and [eddie] joined the channel
#
jeremycherfas And it was very good to be reminded of it, when the world was young.
KartikPrabhu and leg joined the channel
#
GWG What is nested list-item analysis?
#
Loqi It looks like we don't have a page for "nested list-item analysis" yet. Would you like to create it?_ (Or just say "nested list-item analysis is ____", a sentence describing the term)
[chrisaldrich], [schmarty], [cleverdevil], benwerd, KartikPrabhu, leg and [tantek] joined the channel
#
[tantek] GWG, see /video#IndieWeb_Examples for examples of nested list-item analyses of specific publishing examples
[Ana_R] joined the channel
#
[Ana_R] Okay, I have one more question if that’s okay - because I messed up with my urls people have interacted with me with the (www) and without it. So when I do two different requests to the webmention.io api (one to https://www.ohhelloana.blog/ and another to https://ohhelloana.blog/) I get different responses.
#
[Ana_R] I think I fixed my redirect issue so I suppose this only happens in past posts. I guess I would have to do the two requests and “merge” the results right? Or this there another way to fix this (or does it even need to be fixed)?
#
[Ana_R] On a positive note: I thought I only had 3 webmentions! Turns out I actually have around 50 and found blog posts replying to me and it is really nice 🤗
#
aaronpk i have an open issue to handle this better, but for now you can put both URLs in the API request to fetch webmentions
#
aaronpk https://github.com/aaronpk/webmention.io#find-links-to-multiple-pages
#
Loqi [aaronpk] webmention.io: Easily enable webmentions and pingbacks on any web page
#
[tantek] [aaronpk] ooh would this work for my protocol neutral feature request? Eg requesting both http and https simultaneously?
#
aaronpk yep! your proposed solution is definitely better, but this works right now
#
[tantek] Hah you could redirect serverside if target param starts with // to target[]= http and https versions!
#
[tantek] is tempted to try writing a pull request for this
#
aaronpk i think i'd rather solve it properly
#
[Ana_R] Of course! sorry, it’s already late Friday here, I completely overlooked at API option for this scenario 😓. That’s perfect! Thank you [aaronpk]
[cleverdevil] and snarfed joined the channel
#
doubleloop [Ana_R]: nice, high-five on getting the webmentions working :D
#
Loqi doubleloop: [grantcodes] left you a message 11 hours, 35 minutes ago: yes sorry, I moved photo.postrchild.com to heroku and didn't realise that you have to pay for ssl certificates there, so it's currently just on http
#
[tantek] Awww ok aaronpk then I’ll hardcore the http or https target[]= query into my code instead as a workaround. Ok if I document the workaround in the issue?
#
[tantek] hardcode*
#
aaronpk sure
[chrisaldrich] joined the channel
#
aaronpk wordpress << https://bitsplitting.org/2019/05/24/unloved-patches/
#
Loqi ok, I added "https://bitsplitting.org/2019/05/24/unloved-patches/" to the "See Also" section of /WordPress https://indieweb.org/wiki/index.php?diff=61664&oldid=60828
[Rose] and snarfed joined the channel
#
GWG Should I give an amen to that?
[cleverdevil] and [tantek] joined the channel