#dev 2019-11-07

2019-11-07 UTC
#
sknebel No hurry, but if you could test if quill in Firefox uses the media endpoint properly bwould be interesting
#
sknebel For me it uploads the photo, but then puts the photo in the micropib request again instead of using the URL of that uploaded photo
#
GWG On Android only?
#
GWG sknebel: What would be the testing protocol?
#
sknebel Post a note in quill with an attached photo
#
sknebel After you select the photo, it should upload it and show the preview of it
#
sknebel Then submit the actual post and check your logs etc if it used the uploaded photo, or sent it again on a formencoded request
#
GWG Hmm..I have to remember if I configured my logs that way
#
sknebel Yes, only seeing that on Android right now, but wonder now if there's some way of getting a session messed up
#
GWG I may manually add a log setting for that.
#
GWG Just finishing dinner right now.
#
sknebel Again, no hurry at all, I haven't looked to deeply into it myself yet
#
mblaney ok thanks again [jgmac1106] I'm going to make some changes to the default set up but first page of documentation is up: https://i.haza.website/edit-your-profile
#
[jgmac1106] mblaney++
#
Loqi mblaney has 3 karma in this channel over the last year (12 in all channels)
tbbrown__ and [fluffy] joined the channel
#
sknebel this seems interesting: https://blog.webrecorder.io/2019/11/06/self-hosted-archival-embeds.html
#
Loqi Contact Us
#
sknebel lol
[snarfed], tbbrown, gRegorLove, beko, [Michael_Beckwit, [tantek], swentel and cweiske joined the channel
#
swentel so, dumb question maybe, but for websub you only expose the hub link tags on pages where people want you to subscribe to right ?
#
swentel And if people want to subscribe, they send that exact url to to the hub.
#
swentel s/to to/to
[LewisCowles] joined the channel
#
[LewisCowles] !tell aaronpk updated branch. I may look at adding some tests next
#
Loqi Ok, I'll tell them that when I see them next
#
[LewisCowles] What needs testing on an android?
#
[LewisCowles] Is there a testing script?
#
jacky swentel: yeah
#
jacky that makes sense
#
jacky b/c you'd send that page to the hub so you can sub to it
#
swentel ok thanks, makes sense indeed.
#
Loqi Ok, I'll tell them that when I see them next
#
petermolnar !tell aaronpk any thoughts on https://github.com/aaronpk/Aperture/issues/76 ?
#
Loqi [petermolnar] #76 consider to be google for tumblr
[qubyte] and [tonz] joined the channel
#
swentel hmm aaronpk do you think you could tag a release for p3k-websub ? or are you using other libraries to discover/subscribe
#
Loqi aaronpk: [LewisCowles] left you a message 1 hour, 48 minutes ago: updated branch. I may look at adding some tests next
#
aaronpk Huh
#
Loqi aaronpk: petermolnar left you a message 49 minutes ago: any thoughts on https://github.com/aaronpk/Aperture/issues/76 ?
#
aaronpk petermolnar: sounds reasonable
#
aaronpk swentel: I'm not sure why there aren't any releases tagged. I don't actually remember writing that tho lol
#
swentel aaronpk, heh, well I'm writing a websub component for the drupal indieweb module, and I'm too lazy to write the discover part. That little library seems to do it well :) (actually, haven't tested it yet)
#
swentel I could just copy/paste parts of it of course
asymptotically joined the channel
#
aaronpk Oh look I can tag a release from my phone
#
aaronpk https://github.com/aaronpk/p3k-websub/releases/tag/0.0.1
#
swentel hehe, cool
#
swentel thanks
#
aaronpk this code comes with no warranty whatsoever
#
aaronpk lol
#
swentel that's totally fine :)
#
swentel if it finds the hub, I'm already glad
gRegorLove joined the channel
#
@mattiasgeniar ↩️ that `htop` header was indeed very distinguishable from all other blogs ... i hope this new layout is too, gotta get used to it :) for the comments: i keep hearing good things about webmention, seems easier to integrate (twitter.com/_/status/1192388163475591169)
#
@lcveades ↩️ @venadek microsub. (twitter.com/_/status/1192392044246814722)
#
swentel aaronpk, discovery still works, it finds the hub for your primary feed. Next up, testing subscription.
#
aaronpk great
swentel_, swentel, [jgmac1106] and M9uapawDiscord[m joined the channel
#
@freekmurze ↩️ @ArnabWahid https://freek.dev/1406-how-to-add-webmentions-to-a-laravel-powered-blog (twitter.com/_/status/1192408190824198144)
#
swentel aaronpk, trying out websub.rocks for testing. subscribe and subscribe are fine. But I fail to see how I can get a notification in - trying out test 300, but when I see the blog I don't know what todo there :)
#
swentel I guess switchboard.io also does async validation right? websock.rocks does it immediately when trying to subscribe, kind of annoying in a way I guess (but makes sense too)
#
aaronpk Hm i don't remember the details of the tests anymore, it's been a while
#
swentel no problem
jbove and LostSheep joined the channel
#
swentel well, I can subscribe to your feed
#
swentel let's see if I see notifications coming now :)
#
swentel I'll fix them when I see them
#
LostSheep greetings all
jeremych_ joined the channel; fLsh42Discord[m] left the channel
#
@ramsey ↩️ First I’ve heard of it. Is there more information about it? I can’t find much on their homepage. Is it an open source project? Federated? Using webmentions, micropub, activity streams? (twitter.com/_/status/1192439468231417856)
gxt joined the channel
#
aaronpk https://twitter.com/jacobian/status/1192440303439007746?s=21
#
@jacobian I applied for a Twitter developer account to use @simonw's twitter-to-sqlite, and got rejected. Apparently apps for personal use are no longer allowed. Cool cool cool cool cool. https://pbs.twimg.com/media/EIxmImvWwAEq8rU.png (twitter.com/_/status/1192440303439007746)
#
aaronpk Oh no twitter isn’t allowing new developer accounts even for personal use
[tantek] joined the channel
#
[tantek] Wow
fauno_ and [chrisbergr] joined the channel
#
[chrisbergr] Is it possible that they will take away your existing developer account if they notice that it is only used for personal projects?
#
aaronpk I doubt it, they usually don't work that way
#
aaronpk it's too hard to determine that. It's easier to hold back new features
#
aaronpk e.g. if you want the new streaming api then you have to make a new application and such
#
[chrisbergr] okay.
[grantcodes] joined the channel
#
[grantcodes] Oh that sucks. Just as well I have a few already approved apps... I don't want to lose my daily generated twitter banner 😛
[KevinMarks] joined the channel
#
[KevinMarks] Interesting OAuth implementation bug https://blog.teddykatz.com/2019/11/05/github-oauth-bypass.html
#
Loqi Bypassing GitHub's OAuth flow
[tonz] joined the channel
#
aaronpk I saw that
#
aaronpk good tip for everyone building an authorization interface
[snarfed] joined the channel
#
petermolnar heh. one more nail in silo coffins.
[manton] joined the channel
#
[snarfed] eh no indieweb isn't inherently better at security specifically. it's likely worse, purely due to way fewer resources and expertise
#
[snarfed] on the other hand, it doesn't carry the risk of breaches affecting tons of people, which is good
#
[snarfed] (SPOAs notwithstanding 😎)
#
petermolnar oh, the nail was for the twitter rejecting dev accounts
#
[manton] [snarfed] I was thinking about that yesterday with that news of Twitter employees looking up private info for Saudi Arabia. That's easier when you have many accounts concentrated in one place.
#
[snarfed] ah, sorry petermolnar
#
[snarfed] [manton] yup. shades of the generation ago "macs are more secure than windows" arguments, which mostly boiled down to target size incentive
#
[snarfed] but it applies to plurality/monoculture too. eg the vast majority of indieweb sites are either wordpress or known. (https://indiemap.org/docs.html#data-mining )
#
[snarfed] there are lots of good reasons to go indieweb! security may not be high on that list, but that's ok.
#
[snarfed] (privacy, on the other hand, may be!)
#
[manton] Agreed. Except maybe the part about Mac vs. Windows which is a different debate. 🙂
#
[manton] I did a bunch of stuff in the classic Mac OS web server community (WebSTAR, etc.) and those old servers without unix were pretty secure. 🙂
#
petermolnar my father used to run their company emails on VMS with DECnet in the background. Good luck hacking something that's not even tcp/ip
#
[manton] Haha.
[snarfed]1 and [chrisbergr]1 joined the channel
#
petermolnar [snarfed] the world leaning towards wordpress monoculture is terrifying in my opinion
#
[snarfed]1 eh. complicated. https://snarfed.org/2010-10-08_standards_or_diversity_monoculture_or_fragmentation
#
[snarfed]1 fortunately we're pushing plurality here
[jgmac1106] joined the channel
#
@swlkr ↩️ TIL bridget, webmentions and indieweb https://brid.gy/ (twitter.com/_/status/1192479329541742593)
#
@swlkr ↩️ TIL bridget, webmentions and indieweb https://brid.gy/ (twitter.com/_/status/1192479329541742593)
[tantek] joined the channel
#
[snarfed]1 go bridget go
gRegorLove and [cleverdevil] joined the channel
#
GWG aaronpk: Might want to keep an eye on https://github.com/WP-API/authentication
#
Loqi [WP-API] authentication: The home for design & development of a core WordPress REST API authentication solution
#
aaronpk Oh boy ok
#
GWG I am watching their chat
#
GWG dynamic client registration
[KevinMarks] joined the channel
#
[KevinMarks] is that Bridget pronounced the French way?
#
GWG [KevinMarks]: I thought that might be [snarfed]'s new community manager.
#
GWG aaronpk: Is that in your book?
#
aaronpk I think I mention it briefly
#
aaronpk The description in their repo seems reasonable
#
aaronpk Thankfully it's not what that other guy was saying
#
[snarfed]1 sounds like mastodon's
#
aaronpk I wonder if I can nudge them towards IndieAuth without ever actually saying it
#
GWG aaronpk: I tried, I don't think I had success
#
GWG They agreed that they will be building frameworks so I could add IndieAuth
#
aaronpk If you go in asking for IndieAuth then they look at it and are like what
#
[cleverdevil] kadam is a nice guy. Reasonable.
#
aaronpk so instead I will try to encourage them to do things that IndieAuth does without ever naming it
#
[cleverdevil] Worth trying! But, given WordPress history, I’m guessing they end up inventing something instead :)
#
aaronpk ugh I hope not
#
aaronpk at least the initial comments look like they're using OAuth as a template
#
[cleverdevil] Hey I’d love to be wrong. Seven years at DreamHost made me pretty jaded about WordPress haha.
#
GWG aaronpk: That's why I volunteered to comment and asked you to monitor the repo
[chrisaldrich], eli_oat, asymptotically, ola, [asuh], leg and [LewisCowles] joined the channel
#
[LewisCowles] Does anyone know about iframe communications changes between firefox 60 and 68?
#
[LewisCowles] I have a friend who is currently undergoing chemo and he’s suffering a bit with something he’s doing between iframes. I’d really like to help him
#
[LewisCowles] > Some time between Firefox60 and Firefox68, code I had written over many years while teaching to communicate with IFrames has stopped working. The changes are supposed to make it more difficult for hackers to exploit them. Details as to what they have done are sparse, not helped by the fact they seemed to have screwed their own relevant wiki pages in the process. I’m currently working through my scripts to get them working again, but it
#
[LewisCowles] a slow process. The iframe has two parameters, ‘allow’ and ‘sandbox’ which I suspect hold the key. Most tutorials on the subject are also screwed in the same way my code is, so not much help there either.
KartikPrabhu, leg and eli_oat joined the channel
#
[LewisCowles] I’m thinking he either has default content-security policy issues or another missing http header
#
[LewisCowles] I know I added this to a ruby app at work. TBH I try to avoid frames of all kinds
#
[LewisCowles] response.headers["X-Frame-Options"] = "ALLOWALL"
#
[LewisCowles] ```
#
[LewisCowles] response.headers["Content-Security-Policy"] = "frame-ancestors #{frame_host}"
#
[LewisCowles] ```
eli_oat, [snarfed], gxt and [LewisCowles]1 joined the channel; HerculanoDiscord left the channel
#
@brokencodebot Fix broken webmention-tools send command (twitter.com/_/status/1192558028538683392)
#
jacky lol
#
beko[m] https://twitter.com/brokencodebot/status/1192554254210412551
#
@brokencodebot http://www.victoriassecret.com - design is broken (twitter.com/_/status/1192554254210412551)
#
beko[m] sounds like the bot one has to follow xD
[manton] joined the channel
#
[manton] IndieAuth question if [aaronpk] or anyone has thoughts on this... Micro.blog as an auth provider currently assumes you have a hosted blog on Micro.blog, so if you delegate an external blog to Micro.blog's auth URLs, things don't work when Micro.blog is figuring out what to put in the "me" URL response. But I'm think if an external URL is verified on your account, I could support it. Does that make sense or are there any security concerns I
#
[manton] should think about?
#
[manton] The use case is you have a static site somewhere and auth with Micro.blog to use Aperture, etc.
#
[manton] (This also might just be a bug and should have always worked that way.)
[jgmac1106], [benatwork], [LewisCowles], [KevinMarks], KartikPrabhu, [tantek] and NickVennerDiscor joined the channel
#
[manton] Pretty sure I'm going to change this so that it works in Micro.blog. Seems like a good change. Carry on. 🙂
#
[jgmac1106] manton++ no more checking your email to login!!
#
Loqi manton has 19 karma in this channel over the last year (52 in all channels)
#
[jgmac1106] go to hang on micro.blog and 3 hours later I am almost through the email I wanted to avoid
#
GWG [manton]: I still need to figure out those posse challenges.
#
GWG [eddie] had some solutions, but haven't seen him around much
#
[jgmac1106] Wp->micropub->micr.blog do that gwg
#
GWG [jgmac1106]: How?
#
GWG Did I miss a way to do that if you self host?
#
[jgmac1106] I don't have the slightest, I was using the RSS feed
#
[jgmac1106] as long as the post kind RSS feeds are proper for note, photo, article, reply everything should work
#
[jgmac1106] ...well reply I don't know how that works
#
[jgmac1106] I just wish the POSSed notes showed up on my micro.blog site and not just in the feeds
#
GWG It works well enough, but I don't get back the links for rel syndication
#
gRegorLove [manton] I think as long as the domain doesn't change between what's entered and what's the auth endpoint returns. e.g. if I enter micro.blog/gregorlove as my profile, it would be go against spec for the auth endpoint to return gregorlove.com
#
gRegorLove but if I entered gregorlove.com -> mb auth endpoint returns gregorlove.com, should be ok
NickVennerDiscor left the channel
#
mblaney I just tried setting up twitter-atom for a new twitter account, this makes me sad: https://mblaney.xyz/2019-11-08-oh_no_httpstwitter-atomappspotcom_is_one_of_m
#
Loqi [Malcolm Blaney] oh no https://twitter-atom.appspot.com is one of my favourite things but looks like I can't recommend it any more?? 😭
[snarfed] joined the channel
#
[snarfed] yeah that may be true, sadly
#
[snarfed] and i can't run a service for everyone using my own twitter app because they shut it down
#
[snarfed] https://snarfed.org/2013-07-09_twitter-atom-is-back
#
[snarfed] (shh technically granary actually is this but please don't evangelize it or it will get shut down too 😎 :crossed_fingers:)
#
mblaney snarfed I don't want to keep using it as is, knowing my token is going to get revoked at some point too...
#
[snarfed] eh they're pretty long lived, they don't expire
#
mblaney what do you think about switching to the facebook-atom scraping model?
#
[snarfed] sure! feel free to send a PR 😎
#
mblaney ok cool will look into it
#
[snarfed] i was mostly joking. the scraping is the easy (ish) part. the endless arms race of evading their bot detection is the hard part.
#
mblaney do you have more details on that? if scraping was more distributed would that be less detectable?
#
[snarfed] oh god, lots, all over the web. there's a whole sketchy cottage industry here. a brief taste in https://github.com/snarfed/bridgy/issues/854#issuecomment-548844715 . rotating IPs, spoofing User-Agent, running some bits of JS to generate reasonable-looking browser fingerprints...it really is an arms race
#
Loqi [snarfed] agreed on all counts. i share your frustration! i actually wrote that crawler you mentioned, a bit ago. www.facebook.com uses JS, so crawling that is hard, but m.facebook.com (with a logged in session cookie) is pure HTML and eminently scrapeable,...
#
[snarfed] indieweb as a hobby, i like. evading big competent teams' bot detection as a hobby, no thanks.