#dev 2020-11-22

2020-11-22 UTC
#
sknebel I guess asking Simon for feedback is a good idea?
#
aaronpk definitely
#
aaronpk extra comma looks better
#
Zegnat Did Simon have a problem with verification, or just with what was and was not a profile URL? (https://github.com/indieweb/indieauth/issues/65)
#
Loqi [Zegnat] #65 Clarify that discovery does not neccessarily start at a Profile URL
#
Zegnat Although I think this may also solve that, as I think this removes all the places that refered to the initial input as a profile URL?
#
aaronpk does it?
#
sknebel I'm mostly picking him as someone with a working idea of the spec but not the years of assumptions behind it we do
#
aaronpk not quit
#
aaronpk e
#
sknebel (and fresh memory of the first part)
#
aaronpk not quite all the references, i found some
#
Zegnat Ah, yeah, I see a couple more too
#
Zegnat I did not want to do that in my original PR. I started it, but then removed it again, I now remember
#
aaronpk yeah let's do that separately
#
Zegnat I think I am happy with this. We can probably go back and forth on wording for all eternity. But I feel like this is describing exactly what we want clients to do now
#
sknebel it says the right thing, yes
#
sknebel so wording improvements don't change implementations
#
aaronpk okay is this worth publishing a new snapshot then?
#
sknebel I'd say so, yes.
#
Zegnat Unless we think we can get some other smaller issues resolved within the weekend too? Don't think it is worth sitting on it for much longer otherwise
#
sknebel I thought aaronpk meant that specific PR
#
sknebel "release" is just merge and automation pushes it
#
sknebel right?
#
aaronpk well there's updating the date in the header and pulling it out into its own dated URL
#
Zegnat No, I think the source to spec folder is a manual conversion
#
aaronpk if we want to update the actual spec page https://indieauth.spec.indieweb.org/ i have to do a manual step or two
#
Zegnat It would be a little interesting to have something like /draft on that subdomain that does reflect the latest changes from the repos source folder 🤔
#
aaronpk heh
#
aaronpk that's originally what this whole site was before the w3c version was finalized
#
sknebel I think we probably can fix the " all the places that refered to the initial input as a profile URL" bit tomorrow?
#
aaronpk that seems like a good one to include in a new version yeah
[Emma_Humphries] joined the channel
#
sknebel (or rather, "today" as in "same day as today" and maybe even "today" as in "the current awake period of aaronpk"... :D)
#
Zegnat That was what I was thinking. If we think we can work on #65 tomorrow, or maybe knock in some other small ones too (like #18), I am all for merging this PR now but cutting a new version tomorrow
#
aaronpk it's already dark here
#
sknebel it has been dark here for quite a while :D
#
sknebel (I need to order more lights for my flat too...)
#
Zegnat As long as we do not forget and wait anothrer month with the new version, I can totally wait. I should probably start thinking about sleep
#
sknebel 64 hours until did we release a new indieauth snapshot yet?
#
Loqi I added a countdown scheduled for 2020-11-24 5:18pm CET (#6814)
#
sknebel !cancel 6813
#
Loqi Okay, I cancelled it!
[KevinMarks] joined the channel
#
[KevinMarks] Google seem to restricting OAuth to a google account to approved browsers? https://developers.googleblog.com/2020/08/guidance-for-our-effort-to-block-less-secure-browser-and-apps.html
#
aaronpk no, they're restricting where they allow their sign-in page to be embedded, instead *requiring* apps to use oauth
#
[KevinMarks] ah, OK, that makes more sense. Very unclear post.
#
sknebel basically they are saying "if you want to have people login, have them do OAuth through a standard browser"
#
sknebel not have them do the OAuth flow in your weird custom embedded browser (where you could do whatever)
#
sknebel or have them give you the password and do it in a hidden browser or sth
#
aaronpk this is pretty common in mac apps for example, where the mac app will open a little mini browser
#
aaronpk which is super sketch
#
sknebel HN already is smelling the world conspiracy to supress youtube-dl again. but well, HN, ...
#
sknebel (* a vocal subset of HN is ...)
#
[KevinMarks] so this would be OK for Brave and Beaker?
#
sknebel yes
#
sknebel they do run JS and aren't headless automated things
#
sknebel which is basically the requirements
#
aaronpk they're tryign to block things that don't behave like "regular" browser but are still technically capable of being a browser
#
sknebel right. OAuth is not doing that much if you do an oAuth flow in an embedded browser that logs your password
geoffo and KartikPrabhu joined the channel
#
@simonw Weeknotes: datasette-indieauth, datasette-graphql, PyCon Argentina https://simonwillison.net/2020/Nov/22/weeknotes/ (twitter.com/_/status/1330326967841746944)
[chrisaldrich], KartikPrabhu, sp1ff, nickodd, dhanesh, schmudde and Loqi joined the channel
#
aaronpk Loqi!
#
aaronpk Zegnat++
#
Loqi Zegnat has 31 karma in this channel over the last year (91 in all channels)
#
petermolnar Had anyone experimented with max char per line markdown here? Apparently it's trickier, than I thought; even if I try to use pandoc to input=markdown, output=markdown, just use line-width 72 char, it tends to break, as in mess up certain things, or even leave footnotes off a document.
#
Zegnat I do try to stick to a max line length, e.g. https://raw.githubusercontent.com/Zegnat/browserext-window-merger/develop/README.md but I do that manually not with any tools (other than maybe fold on the command line to check I did it right)
#
Zegnat I also realised, aaronpk, that with the creation of verification as a separate step, it should probably be added to the flow diagram and list up top. Left that as a change request before merge.
#
aaronpk Good call
#
Zegnat It still takes me entire re-reads of the spec (often for different reasons) to figure that stuff out. I am glad I am "just" reviewing a relatively short spec and not a series of books. Kudos to professional editors.
#
jamietanna[m] Oh damn yeah that's fair aaronpk, probably for the best it can't be used further 😳
#
nolith aaronpk: a PR for dropping GitLab scope to `read_user` instead of the default `api` scope. https://github.com/aaronpk/IndieAuth.com/pull/205
#
Loqi [nolith] #205 Change GitLab OAuth scope to read_user
#
aaronpk Zegnat: updated my PR!
#
aaronpk just realized both of these PRs are modifying that flow diagram so they're gonna conflict
#
aaronpk guess i'll fix it in mine
#
Zegnat Oh, yeah, I have a PR that changes the flow diagram, true.
#
Zegnat I am also happy to update my PRs in case any conflicts come up from the URL verification work.
#
aaronpk too late
#
aaronpk oh nice the plaintext version of the diagram was merged successfully
#
Zegnat I step away for like 10 minutes .... :P
#
Zegnat checks GH notifications
#
Zegnat Approved
#
aaronpk alright, got your other ones merged in too (minus the Accept header one, see discussion)
#
aaronpk this feels like it's probably enough to publish as a snapshot version
#
Zegnat Seems good to me. I think it got some major rejiggering done that we put on pause before. Plus always nice to get some smaller issues handled.
#
aaronpk oh hm this is an easy one too i think https://github.com/indieweb/indieauth/issues/64
#
Loqi [aaronpk] #64 Clarify what an AS should display if no app information was discovered at the client ID URL
#
aaronpk actually
#
Zegnat Oh, yeah, I just have 0 opinion about that one
#
aaronpk now i wish i remembered the context of this
#
aaronpk the spec says in several places that the client_id should be displayed
#
Zegnat It does, yes
#
aaronpk another question... does the URL spec use "hostname" or "domain"?
#
Zegnat URL spec only has "hostname" as an alias for "host", I believe
#
aaronpk i'm thinking we should change our uses of domain to match
#
Zegnat domain is a type of host
#
Zegnat domain per URL spec is actually https://tools.ietf.org/html/rfc1034
#
Zegnat and host can be domain or IP address
#
aaronpk There's one place that specifies the host has to be a domain name
#
Zegnat (or opaque / empty, but that does not really apply to us)
#
aaronpk but other than that I think using "host" is more clear
#
aaronpk I've gotta stop for now but im going to hold off on publishing until we decide on that change too
#
Zegnat 👍 thanks for all the work, aaronpk++
#
Loqi aaronpk has 68 karma in this channel over the last year (228 in all channels)
#
Zegnat For the next push I think #58 and #62, to see if the exchange flow can be further streamlined. But I would not want to hold off on snapshot until then
[tantek], nickodd, gxt, kingpapa, [Raphael_Luckom] and [Aaron_Klemm] joined the channel
#
[tantek] via petermolnar, https://vgai.de/posts/manual-until-it-hurts/
#
GWG Zegnat, enjoying the updates
#
[tantek] I was considering setting up logging like that too but then it just seemed like another queue to check and manually do things with.
#
[Aaron_Klemm] Bringing this discussion over from #indieweb-chat. The criticism was raised that it's confusing to comment on a site by logging into one's own site. Recently, after installing a Pleroma instance, I really enjoyed this workflow: Find out about someone you want to follow -> google that person to find their mastodon profile -> click follow on their profile -> get a popup and auth back at my own Pleroma server. I love it. I want everything to
#
[Aaron_Klemm] work like that, so I remain bullish on using one's own site to do [whatever] elsewhere, and I want to understand if this community is also, or if the consensus is to obscure it. I still think it can be won.
#
[tantek] this is the key bit: "click follow on their profile -> get a popup and auth back at my own Pleroma server."
#
[Raphael_Luckom] My impression is that there are three solutions that have been explored:
#
[Raphael_Luckom] 1. Native mobile
#
[Raphael_Luckom] 2. social reader
#
[Raphael_Luckom] 3. redirect-to-your-site-to-comment (what I think [Aaron_Klemm] is describing)
#
[Raphael_Luckom] Is that accurate or are there others?
#
[Raphael_Luckom] well, also there are more manual things
#
[tantek] Number 3 is what uses /webactions to do so
#
[tantek] or potentially browser bookmarklets
#
[tantek] not sure if that's worth mentioning separately
#
[Raphael_Luckom] so maybe there are three UIs under consideration--native mobile, social reader, or your site--and /webactions and bookmarklets are paths to using your site's UI
#
[Aaron_Klemm] Browser extension might fit on that list, though I don't know if it's been explored.
#
[tantek] yes Browser extension would be a better way of doing something like bookmarklets
#
[tantek] [Aaron_Klemm] there was one that BarnabyWalters wrote back in 2013 that turned all the Reply etc. buttons on Twitter into links that did the same thing using your personal site
#
[Raphael_Luckom] [Aaron_Klemm] when you ask "if this community is also, or if the consensus is to obscure it."--is that because you're interested to implement it but you'd want to make sure people would _use_ it, or did you have something else in mind?
#
[tantek] so while looking at anything on Twitter, you could click reply, and it would pop-up a text box to type into that would post to your site which would POSSE thread it back to the tweet you were looking !
#
Zegnat GWG I hope the updates continue to make the IndieAuth spec easier to follow (and implement)
#
[tantek] pretty sure that Browser extension is still on the /webactions page
#
Zegnat "so while looking at anything on Twitter, you could click reply, and it would pop-up a text box to type into that would post to your site" sounds like Omnibear
#
Zegnat What is Omnibear?
#
Loqi Omnibear is a browser extension for posting text notes, replies, bookmarks, and likes to your website using Micropub https://indieweb.org/Omnibear
#
Zegnat If I remember correctly, it even recognises when you are on Tweets
#
GWG I was thinking of Omni bear as an option
#
GWG Zegnat: I need to get back to that PR
#
[tantek] I recall something more like the "WebAction Hero Toolkit"
#
GWG That's in need of a new maintainer
[snarfed] joined the channel
#
Zegnat Hmm, I should revisit the indie actions at some point, it looks like a blocking bug [tantek] and I discussed 2 years ago (https://bugzilla.mozilla.org/show_bug.cgi?id=1196151#c7) might be fixed.
#
[Aaron_Klemm] [Raphael_Luckom] Good question. I think I just want to know if the dev efforts are heading toward more support for encouraging these use-cases or not. I have a few vague ideas of things to implement to help out those use-cases, but I'm behind on understanding the issues. Slowly I'm getting there. This helps a lot.
#
[Raphael_Luckom] yeah I'm in that position too--pretty far behind; I started to describe "social readers" before tantek said that was already a thing
#
[Aaron_Klemm] Right...exactly, "inventing" things that have already been invented, or, in my case, not understanding all the tech blockers.
#
[Raphael_Luckom] but i do love finding out that the thing I planned to spend my whole week writing can just be dropped in from somewhere. That's really nice. I feel that way about a lot of the indieweb protocols
#
[Raphael_Luckom] There's also a lot of stuff that works so well that no one notices it. I've never once lifted a finger to set up atom or RSS, but I doubt I could find any cms that wouldn't give it to me.
[Raphael_Luckom], stevestreza, oenone, jacky, MrHyde, gbmor, blueyed, geoffo, [KevinMarks] and schmudde joined the channel; nickodd left the channel
#
[KevinMarks] The hope is to bake in microformats like that but it's got harder more recently. What we learned was that adding tests for them was key.
#
[KevinMarks] When I helped add them to Blogger we didn't do that, so they have decayed. WP is similar, they have vestigial mf1 markup.
#
[KevinMarks] Whereas when Ben added them to mastodon, because there were tests as part of that, they're maintained.
geoffo, leg and jamietanna joined the channel
#
jamietanna Ooh I've not seen Omnibear in a while, looks really good, although for me it doesn't seem to be replacing the "like" on i.e. Twitter - is it meant to?
[schmarty] joined the channel
#
[schmarty] catching up on some earlier discussion and thanks for the ping in chat, tantek 😄
#
[schmarty] not sure where it fits into the discussion here but there are some in-between ways to do replies and posting on mobile, like using the device native "share" functionality with Shortcuts on iOS.
#
[schmarty] when i was on Android some years ago i had some other automation to, for example, take the URL of the current browser tab and open it as a reply / like / etc in Quill
#
aaronpk i still do that on ios with a chrome bookmarklet!
KartikPrabhu, gxt and leg joined the channel
#
jacky hey [Rabble] do you still have some work/ideas around SSB and IndieWeb bridging?
#
jacky I can't find that repo you had, looking to see if I can start peeking at that
[KevinMarks] joined the channel
#
[KevinMarks] With the SwiftKey keyboard I get multiple copy paste buffers so I can copy the url and pull quote separately, so I can manual as it hurts less
schmudde joined the channel