#dev 2020-07-14

2020-07-14 UTC
[KevinMarks], KartikPrabhu, HbHighland, [tantek] and [pfefferle] joined the channel
#
@iamhirusi
↩️ Does the See Also section on the Webmention page (https://indieweb.org/Webmention#See_Also) work for now? I think it could use a separate section but want to know what you think.
(twitter.com/_/status/1282916985169252352)
#
jacky
ah that reminds me
#
@bixtweets
Hm. Something about the permalink change prevented a webmention from Microblog from showing up in WordPress.
(twitter.com/_/status/1282918065462632449)
KartikPrabhu and [tantek] joined the channel
#
jacky
really can't wait to begin experimenting with more protected content
#
jacky
I do think it's a bit of a blocker to a lot of other things (like even sharing friend lists so people can build personal communities)
dckc and moppy joined the channel
vika_nezrimaya and [KevinMarks] joined the channel
KartikPrabhu, djmoch_, aaronpk, Ruxton, [Ana_Rodrigues], [jgmac1106], [KevinMarks] and swentel joined the channel
#
GWG
Would an h-card ever link to an h-entry?
#
petermolnar
define "link" - as a u-url `a` element or some other way?
#
aaronpk
Sure why not
#
aaronpk
there's a "bio" field, I could see someone linking to a blog post from their bio
#
aaronpk
in fact mine might do that right now already
[schmarty] joined the channel
#
GWG
I'm trying to figure out if there is a possibility a webmention would be received where the source was an h-card, because the new webmention code doesn't account for that
#
GWG
It looks for a representative h-entry for a page and a representative author
[jgmac1106] joined the channel
#
[KevinMarks]
You can also link to organisations from an h-card, so if that org has an h-entry on their page,maybe
#
[KevinMarks]
Tantek links to some
#
[KevinMarks]
More like person tag, but for a corporate person
#
aaronpk
GWG: Instead of trying to anticipate all possible combinations, handle the most common 80% and write some sort of fallback display for the remaining 20%
#
aaronpk
in fact it's probably more realistically 95% and 5%
twomanytacos and [grantcodes] joined the channel
#
Zegnat
GWG: my h-card has send webmentions
#
Zegnat
In fact, I send one to aaronpk to earn a webmention sticker, if I am not misremembering
#
GWG
I'm just figuring out if I need to fix it
#
Zegnat
Though that was a homepage mention, not an article mention, so it probably would not show up anywhere
#
Zegnat
The link to aaronparecki.com is still in my h-card, if you care to check the source. Although I guess it isn’t technically part of the h-card as it does not have a class.
#
Zegnat
It just happens to be on the same page as my h-card, where my h-card is the main content of the URL. Just to break some more presumptions ;)
#
Zegnat
That said, I am not sure what there is to worry about? 99% of the time if the link was on an h-card, it will not be an in-reply-to property. So you can either show it as a plain mention, or maybe not show it at all?
dckc, [Erik], [pfefferle], [tw2113], b3u and [tantek] joined the channel
#
GWG
Zegnat: The webmention verification doesn't check properties..it is plaintext...so not media specific rules
[manton] joined the channel
#
Zegnat
In that case, GWG, since my home page is an h-card and has send webmentions, there is atleast one case where it happened.
#
Zegnat
(That case being me, however, does not mean that it is something that is very likely to happen. I am a bad indicator.)
[chrisaldrich], [jgmac1106] and nickodd joined the channel
#
[tantek]
Nah, you're an innovator 🙂
#
GWG
[tantek]: So are you, that's why every parser has a if url = tantek.com section
#
[tantek]
oh no wat. I really hope you're joking
b3u joined the channel
#
GWG
[tantek]: Well, not every one... but I know several had to special case your uniqueness
#
[tantek]
really hope no parser has to have *any* special rules for any specific domain / path. those ought to be kept open as issues to resolve one way or another
#
GWG
I know my code has a section about h-feed inside h-card that has a see tantek.com comment, but not a if url =
#
[tantek]
comments are fine though perhaps better in documentation of an algorithm in a spec or wiki so it can be openly iterated there
#
GWG
[tantek]: Pop-up microformats session?
#
@1Br0wn
↩️ Oh dear. My friendly WordPress admin installed the micropub plugin, and I added the “rel=me” link there, and to the blog on Twitter. Now I get (from indieauth): "Twitter login no longer works due to a change on their website"
(twitter.com/_/status/1283093465761447936)
KartikPrabhu joined the channel
#
[tantek]
Is it time to start deprecating that advice to use Twitter for rel=me?
#
[tantek]
I mean it's still possible if you use their proprietary API via RelMeAuth style coding
#
[tantek]
It's IndieAuth that has the limitation here right?
#
jacky
I wanna say yes but only after trying to see if they'll add it back
[manton], vilhalmer and [chrisaldrich] joined the channel; nickodd left the channel
#
[chrisaldrich]
GWG, on the h-card webmention question, I'm pretty sure that the reply context of Post Kinds when it includes an author, author url (homepage generally), and avatar doesn't send a homepage webmention does it?
#
petermolnar
so if twitter is out, that leaves github, and what else?
#
[chrisaldrich]
It would be nice if it did so that if I'm posting, for example, a read of a NYTimes article, I could include the authors actual website (instead of their NYT profile info) and they'd get a homepage webmention that I'd read their article. (Then they'd also have the option to assign that webmention to their (possibly hidden) PESOS copy on their own website.
#
aaronpk
Twitter is fine on indielogin.com
#
aaronpk
I worked around it (and made it more reliable/resilient) by using the api to check for the back link instead of looking for the rel=me
#
aaronpk
there's no point in requiring the HTML to have the rel=me if its available in the api since you have to use the api to authenticate anyway
leg and [tantek] joined the channel
#
[tantek]
there may be no "plumbing" point, but plumbing was never the whole point
#
[tantek]
rel=me is also part of the mental shift of thinking of your own site as the center of your stuff, and thus encouraging every other profile to link to it, even if for only human browsing & discovery. in some ways that's even more important / powerful than any specific machine-readable use-case
#
aaronpk
i think you missed what i'm saying
#
aaronpk
i'm talking about specifically the method by which the link from twitter to your website is verified
#
[tantek]
no that's exactly what I mean by plumbing-point
#
aaronpk
right, so the point is to encourage people to put their website in their twitter profile
#
aaronpk
whether twitter's web page contains the rel=me attribute doesn't really matter
#
aaronpk
that's plumbing
[KevinMarks] joined the channel
#
[KevinMarks]
So, can write up a "what twitter broke" page? Because their most recent Web update broke the intent workaround.
#
[KevinMarks]
Their web page doesn't contain the link any more
#
[tantek]
[KevinMarks] sure go for it, worth a dated subsection under /Twitter#Criticism
#
aaronpk
bidirectional rel=me verification may be useful for other purposes, but for relmeauth it isn't necessary
#
aaronpk
if on the other hand silos all supported oauth 2 with unregistered clients, then it would be useful, but as it stands every silo requires the developer to register an oauth client and each API is slightly different, so they all have to be special-cased anyway
#
sknebel
aaronpk: I think specific to the tweet the question is about the indieauth.com mechanism in WP Micropub. it in principle being possible doesn't help there that much
#
aaronpk
this is why i also keep pushing for the wordpress plugin to drop indieauth.com and switch to only the built-in indieauth server
#
sknebel
at the very least it should probably be only documented that way, even if the fallback still exists for existing users
#
[tantek]
oh boy, speaking of IndieAuth, I just found out about some drama that I kinda want to chat in chat first
#
GWG
aaronpk: I would love that
#
GWG
I don't want to support it either
#
aaronpk
GWG: what do you think about sknebel's suggestion of basically hiding it completely for new users?
#
GWG
And I'm the primary developer
#
aaronpk
only show the option if the setting already exists
#
[tantek]
that's a good suggestion
#
GWG
aaronpk: The current version only supports the endpoint...the remote code is in Micropub
#
GWG
I'm fine with Micropub requiring IndieAuth to work
#
GWG
But there were some objections
#
GWG
aaronpk: I have a PR I need to finish to move the remote endpoint code back into IndieAuth and remove it from Micropub
#
GWG
aaronpk: Regardless, I will remove IndieAuth.com as the default url for it
geoffo joined the channel
#
jacky
you know
#
jacky
I'm reading the WebID so far
#
jacky
and it looks like it can _complement_ OAuth2
[snarfed] joined the channel
#
[snarfed]
he's looked at written about some of the alternatives, like that. https://code.sgo.to/
#
[snarfed]
[tantek] i assume you heard elsewhere, out of band, that this is actually google's, and not just his?
#
jacky
oh this is interesting of a way to describe OIDC https://code.sgo.to/2020/06/02/openid-connect.html
#
[tantek]
snarfed, yes, and I'm disappointed, yet again, that Google has an NIH proposal in an area where there is an existing deployed standard with interop, and not even mentioned in their "Prior art" section.
#
[tantek]
(previously obv ScrollToTextFragment seemingly deliberately ignored the existence of Fragmentions until it was brought to their attention)
#
aaronpk
google is a member of the openid foundation and is a contributer to oauth, so i am really curious what's going on here
#
[tantek]
this is why I'm suspicious and find it hard to believe they just "didn't know" about IndieAuth
#
sknebel
it kinda reads like it's more openid connect extension? i.e. it pulls part of the flow into the browser, not replace it? (and a modification like that could very similarly apply to indieauth - although we typically don't distrust the IDP that way?)
#
sknebel
(from a quick read)
#
aaronpk
okay finally read it
#
aaronpk
i'm actually excited for browsers to play a stronger role in authentication
#
aaronpk
right now we have to treat browsers as a pipe that doesn't know what's going through it
#
aaronpk
this proposal makes the browser a real player in the negotiation
#
aaronpk
the goal is clearly to be used with the large existing IdPs, and doesn't really have anything to do with actual federated identity the way we think about it
#
aaronpk
for example, the proposed browser API would require defining which IdP to talk to when beginning the flow
#
aaronpk
if we wanted this to work with indieauth, the browser API would need to not require the RP to specify the provider since the browser would already know about it
#
aaronpk
e.g. instead of `let {idToken} = await navigator.credentials.get({provider: "https://accounts.example.com", ...});`
#
aaronpk
just `let {idToken} = await navigator.credentials.get()`
geoffo and KartikPrabhu joined the channel