#dev 2020-09-26

2020-09-26 UTC
#
sebbu
[fluffy], i have 2 sites (not mines) to tag-match, because i want to add a novel from one site to the other (all the metadata)
jeremycherfas, [mrkrndvs], geoffo, sp1ff, [tw2113] and VioletPixel joined the channel
[mrkrndvs], shoesNsocks1, shoesNsocks and KartikPrabhu joined the channel
dckc and jonnybarnes joined the channel
KartikPrabhu, [mrkrndvs], moppy, jonnybarnes, swentel, joshproehl, VioletPixel, [Chaitanya], [James_Gallaghe] and jeremych_ joined the channel
#
@wites
Auralite is a new social network that's mindful of your attention and respects your privacy. There are no ads, there are no anonymous profiles, and bots are clearly labeled as such. It embraces open-standards such as RSS or webmentions. It's a social net… https://ift.tt/335drXq
(twitter.com/_/status/1309818813752500230)
[LewisCowles], [James_Gallaghe], jeremycherfas, jeremych_, shoesNsocks, VioletPixel, Kongaloosh_, [chrisaldrich] and [schmarty] joined the channel
#
@nhoizey
↩️ This is fixed, looks like it's the first time I had encoded characters in an URL. https://nicolas-hoizey.com/links/2020/09/25/t-e-n-%C7%9D-t/#webmentions I wish there was a simple full featured webmention plugin for @eleven_ty, instead of many of us struggling with multiple implementations…
(twitter.com/_/status/1309862749023993857)
#
[chrisaldrich]
What is Auralite?
#
Loqi
It looks like we don't have a page for "Auralite" yet. Would you like to create it? (Or just say "Auralite is ____", a sentence describing the term)
#
Zegnat
He. I had both Auralite and Telepath popup in my reader today as new social networks. Same for you, Chris?
#
sebbu
nhoizey, just test / benchmark all implementations, note their differences, choose one and fix the issues it might have (like useful features only available in another one)
#
sebbu
or make a new one that's standard and support what all others do :D
#
Zegnat
I do not think nhoizey is in this chat?
nickodd joined the channel
#
[chrisaldrich]
Just the Auralite. Haven't seen telepath yet. Interesting? Anyone looked at it?
#
Zegnat
Have not looked much further than that article
#
[chrisaldrich]
Also that word "just"...
#
[chrisaldrich]
Nice+vc funding? I'll wager that's not going to work out for them. And real names with verified phone number? Ugh.
#
aaronpk
Wow is this 2010? A new social network again?
#
Zegnat
lol @ aaronpk
#
[chrisaldrich]
I suspect that simply by not amplifying fake news and meanness with algorithmic feeds, Facebook could be nice too, the problem is that wouldn't make money...
#
aaronpk
also that sounds like an incredibly difficult moderation problem
#
aaronpk
but for real, if anyone thinks they can start a new social network backed by VC money and *not* have it turn out like facebook and twitter, that's just delusional at this point
jeremycherfas joined the channel
#
aaronpk
Zegnat [schmarty] [manton] GWG et al: https://github.com/indieweb/indieauth/issues/58
#
Loqi
[aaronpk] #58 Allow clients to always exchange authorization codes at the token endpoint
#
Zegnat
Oh interesting. To me that just feels like another nail in the coffin for separate token and auth endpoints, aaronpk 😅
#
aaronpk
actually it doesn't change much there either
#
aaronpk
you could still have them be separate
#
aaronpk
i'm pretty sure tokens.indieauth.com will actually generate a token with no scope right now, so a client could already use it just for the login flow
#
Zegnat
I am just thinking that if a token endpoint is now also expected to be able to provide profile information, it is even harder to split it up... maybe.
#
aaronpk
it would just pass it through from the authorization endpoint
#
aaronpk
the token endpoint would go verify the authorization code at the authorization endpoint, which would return the full profile information, so it would really just pass that response through
#
Zegnat
Ah, true, it could just keep working as a pass-through, you are right
#
aaronpk
Zegnat: care to review? should be ready to go https://github.com/indieweb/indieauth/pull/59
#
Loqi
[aaronpk] #59 Adds PKCE, profile info, makes "me" optional in the request
#
Zegnat
Happy to! Just waiting for my water to boil at the moment, but will be right there :)
#
Zegnat
Hmm, aaronpk, what is the best way to review the final generated document?
#
Zegnat
git clone && php -S it is, hehe
#
aaronpk
heh suppose so
#
Zegnat
I find just reading the diffs on GitHub is a little annoying when we are talking about text changes like these
#
Zegnat
I think I spotted a completely unrelated error to this PR now
jeremycherfas joined the channel
#
Zegnat
Apparently I have not done a full reread of the spec in a bit
#
Zegnat
I am just reading through now, and anything that jumps out at me will be a comment on the PR.
#
Zegnat
Cannot do that as part of a GitHub review because you can only review lines that are actually changed as part of the PR
#
aaronpk
i'll push an update
#
Zegnat
"The endpoints discovered MAY be relative URLs, in which case the client MUST resolve them relative to the profile URL according to [URL]."
#
Zegnat
Hmm. Is the following in 4.1 really true?
#
Zegnat
Feels like to me that relative URLs must be resolved against the current document URL, not the (canonical?) profile URL? But I am not sure.
#
aaronpk
you're right
#
Zegnat
Sorry for all the off-topic comments, aaronpk. Like I said, first time in a while I am critically reading it rather than looking for specific answers
#
aaronpk
might as well knock these out too tho
#
aaronpk
okay pushed that too
#
Zegnat
I forget what we said at the popup, were we going to require S256 for IndieAuth? Just wondering because as written I think we allow for everything? And I seem to vaguely recall that we maybe did not wanted to support "plain"
#
aaronpk
true because i said refer to PKCE for details
#
aaronpk
i wonder if the disclaimer in PKCE is enough already though
#
Zegnat
Yeah. So by my current reading plain is allowed, and is the default per PKCE spec. Was just wondering if we had decided to ban plain or not
#
aaronpk
"The plain transformation is for compatibility with existing
#
aaronpk
deployments and for constrained environments that can't use the S256
#
aaronpk
transformation."
#
aaronpk
and if we just always use S256 in the examples and such that might be enough to get the point across
#
aaronpk
my worry is: 1) i don't want to _limit_ indieauth from using e.g. S512 in the future, and 2) I generally want to avoid adding additional things to the spec beyond OAuth if possible
#
Zegnat
Will leave that to your disgression. I think https://tools.ietf.org/html/rfc7636#section-7.2 also makes the case very clear, but I know from experience that people will not read that far into the RFC because they will look for implementation details and not the security considerations...
[Will_Monroe] joined the channel
#
Zegnat
"The resulting profile URL MAY be different from what the user initially entered, but MUST be on the same domain." in 5.3.2 and 5.3.3, is that outdated after the introduction of 8.1?
#
aaronpk
oh shoot, i thought that was still required until https://github.com/indieweb/indieauth/pull/56
#
Loqi
[Zegnat] #56 Remove requirement for same domain
#
Zegnat
Oh, maybe I am mixing things up ... rechecking
#
aaronpk
no i think you are right
#
aaronpk
should be "MAY be different from the canonical profile URL as resolved by the client, but MUST be on the same domain"
#
aaronpk
and can be dropped after we agree on #56
#
Zegnat
Yeah, that is it
#
Zegnat
Wonder if it should point at 8.1 for validating a differing URL explicitly
#
aaronpk
probably
#
Zegnat
I think that might help all client developers a lot. More so than the link we currently have to Redirect Examples, which is only important for a small subset of service developers.
#
aaronpk
okay that is also pushed
#
Zegnat
Sorry for all the nitpicks so far, only at 5.3.4 now :P
#
Zegnat
6.2: "The token endpoint verifies the access token using [...]". s/using/used/
#
aaronpk
stepping out for a bit... will catch up on these later! thanks in advance!
#
Zegnat
Almost through, don't think I will come up with anything new other than maybe the odd spelling/grammar thing
#
Zegnat
Yep. I think that was all I am going to spot on this read through :) Left the things you had not pushed yet as comments.
#
Zegnat
aaronpk++ for the big undertaking of converting the popup call into an actual spec update
#
Loqi
aaronpk has 72 karma in this channel over the last year (249 in all channels)
jeremycherfas and [schmarty] joined the channel; nickodd left the channel
#
[schmarty]
zegnat++ aaronpk++ !
#
Loqi
zegnat has 29 karma in this channel over the last year (80 in all channels)
#
[schmarty]
Oops I forgot about punctuation. aaronpk ++
#
[schmarty]
gives up on karma for now but nevertheless applauds aaronpk's spec work!!
flex14 and jeremycherfas joined the channel
#
sebbu
talking about spec, i should check if i could convert the site's exports to a common format, so i could convert back, so from site to site
#
aaronpk
Zegnat++ thanks for looking it over! going to make the last changes now
#
Loqi
Zegnat has 30 karma in this channel over the last year (81 in all channels)
[snarfed] joined the channel
#
sebbu
[snarfed], except it's not about social networks
#
sebbu
sites like wlnupdates, novelupdates, trackr.moe, kenmei, webnovel, livraddict, goodreads, librarything, seriebox, myanimelist, kitsu, anilist, anime-planet, anidb, etc...
#
aaronpk
Zegnat: pushed the last fix! can I get a PR approval so I can deploy it?
#
Zegnat
refreshes GH
#
sebbu
several of them can keep track of the same things, so i'ld want to ensure i have the same library on all
#
sebbu
especialy since i want to update them all at once later :D
#
Zegnat
aaronpk: done
#
sebbu
some of them don't even have API, so i'm forced to scrape and parse the website's HTML
#
Zegnat
Oooh, I did not know about wln
#
Zegnat
I did scraping for mangaupdates once, sebbu. Huge pain. I just ended up abbandoning that.
#
sebbu
Zegnat, there's a CSV export now (i just tested to export my data)
#
sebbu
but sure, there's not the manga informations
#
sebbu
that's just my reading lists
#
sebbu
but i might do that later
#
Zegnat
I wanted to be updated about manga updates, haha
#
sebbu
my main usage/requirement is retrieving the reading list, backuping it, then updating/syncing it myself
#
sebbu
for now, it's like [i set up dropbox syncing in moon+reader] "i read epubs/pdf/cbz in moon+reader" "i retrieve the positions from dropbox" "i retrieve my reading lists from the sites" "i update my reading lists with the new positions"
[michael_lewis] joined the channel
#
[michael_lewis]
Re Telepath "right now, the company doesn't really have a plan to make money, and the cost of growing and scaling its moderation before user numbers means it will have high costs up front" - I've seen that so many times now, and do you know what they'll almost certainly end up doing just like everyone else to monetise (and they will have to monetise with all their VC funding)? Advertising. And the consumer will become the product yet
#
[michael_lewis]
again.
#
sebbu
i already support webnovel.com (main source of web/light novels), wlnupdates (good tracker site) and support for novelupdates is incoming (big db)
lexly joined the channel
#
aaronpk
*whew* got those changes done just in time, they just published the talk videos today!
#
sebbu
(where i get the epub/pdf/cbz is out of scope of the project, but i *could* read tachiyomi's db or myanimelist's history to replicate new reading positions
#
Zegnat
aaronpk: hahaha, I was wondering if the review rush would be related to that
#
Loqi
hehe
#
Zegnat
I started watching your video at work yesterday but never made it all the way through
#
Zegnat
(Not because of the video, because of work.)
VioletPixel joined the channel
#
[michael_lewis]
Catching up with the earlier tags/keywords discussion, what I reckon happened is that a lot of people stopped using them because the SEO "experts" said they were a waste of time after Google stopped using them in their rankings, and Google did that because of all the "keyword stuffing" and the like.
#
aaronpk
Zegnat: hehe yeah as I was working on the talk I realized I needed to get these changes done before the conference
KartikPrabhu joined the channel
#
[michael_lewis]
Anyway, if anyone's got any good ideas for how to help with new personal websites discovery, let me know, because I'm not convinced the current facets (including tags) on Browse Sites works that well. I added the Newest Pages as an alternative discovery mechanism, but again still not convinced that's the best answer either.
#
sebbu
yeah, and there's no standard of tags/keywords, meaning you must keep a similar/identical database
#
sebbu
(not a standard of specifying them, but a standard of what to use as tag/keyword, ie a name instead of another synonym, infinitive verb vs past participle, passive form or not, etc...)
KartikPrabhu and geoffo joined the channel
#
GWG
I need a list of things I need to update about my IndieAuth implementation now
#
GWG
Is there a highlight reel?
#
Zegnat
Yes: the changelog ;)
#
Zegnat
It is mostly profile information (did you already support that?) and PKCE: https://indieauth.spec.indieweb.org/#changes-from-09-august-2020-to-this-version
#
aaronpk
both of which you already support IIRC
#
GWG
aaronpk: I did the PR for Quill on that, so yes, but I need to see the return to make sure I adjust
#
GWG
Also, changing some things to be optional
#
GWG
The list is so I can check them all
#
GWG
I have 2 merged PRs I haven't deployed to the WordPress.org repo
#
GWG
I figure I should check for 1.1 compliance first and see if there are any other quick tweaks
#
GWG
Of course I owe [chrisaldrich] a Microformats 2 post first.. it's 4 years late
#
[chrisaldrich]
Hopefully the somewhat expanded notes I moved to the wiki from the session will help your 2nd post GWG....
#
[chrisaldrich]
I've already outlined a post of my own....
#
GWG
I have an outline I started
#
GWG
I'll look at the notes too
VioletPixel, [grantcodes], jeremycherfas, [fluffy], shakeel and [tw2113] joined the channel