#dev 2021-04-25

2021-04-25 UTC
#
aaronpk i wonder if at some point i'm going to regret not using a database for this... right now i'm continuing on the path of hacky filesystem-only solutions
#
aaronpk (adding some new features to oauth.net that require maintaining state and some dynamic lists)
#
jacky throw sqlite at it! lol
#
aaronpk i think that might actually make it worse haha
#
jacky ohno lol
#
lahacker is there a standard or a general name for using your TLS cert to sign/encrypt things other than HTTPS sessions?
#
jacky hmm
#
jacky a standard, I don't know
#
jacky but the name gives me some sort of "Web of Trust" kind of vibe
#
vilhalmer you might poke around ssh documentation, it has cert auth
#
vilhalmer I don't know of a general term off-hand
#
lahacker JSON Web Token relies upon JSON Web Signature and JSON Web Encryption; "The tokens are signed either using a private secret or a public/private key."; the Python library FAQ discusses using a x.509
#
lahacker thanks jacky right when you said "web" i remembered
[schmarty] joined the channel
#
[schmarty] lahacker: do any of those standards mention using a site's TLS keys for signing? I'd expect them to be separate keys.
#
lahacker https://pyjwt.readthedocs.io/en/stable/faq.html
#
lahacker i'm no cert expert and i haven't yet tested it
#
aaronpk mixing TLS with application logic is a dangerous path to go down
#
vilhalmer yeah using the same cert seems like a recipe for accidental exposure
#
aaronpk e.g. as soon as you deploy to a CDN like cloudflare the whole thing breaks down since you no longer have access to your TLS key
#
lahacker looks like let's encrypt somehow forbids it too: https://community.letsencrypt.org/t/x509-cert-for-signing-files-digital-signatures/67799
#
KartikPrabhu we should use NFTs
#
KartikPrabhu jk jk :P
#
Loqi yea!
[snarfed] joined the channel
#
[snarfed] lahacker: obligatory, https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid and https://paseto.io/
KartikPrabhu joined the channel
#
jacky ah thanks for the reminder re: PASETO
dhanesh, loicm, __minoru__shirae, [fluffy], Pommy and KartikPrabhu joined the channel
#
@indigitalcolor I set up a fork of @mxbck’s webmention analytics and it provides a better view of some of the more bespoke webmentions I’ve gotten directly from creators outside of Twitter (like a convo across sites about me debugging http://brid.gy on @LWJShow) https://github.com/maxboeck/webmention-analytics (twitter.com/_/status/1386321024984043533)
#
@indigitalcolor I set up a fork of @mxbck’s webmention analytics and it provides a better view of some of the more bespoke webmentions I’ve gotten directly from creators outside of Twitter (like a convo across sites about me debugging http://brid.gy on @LWJShow) https://github.com/maxboeck/webmention-analytics (twitter.com/_/status/1386321024984043533)
shoesNsocks, [KevinMarks], vilhalmer, [snarfed], [chrisaldrich], Paul[m]5, Caleb[m]1, Seirdy and minoru_shiraeesh joined the channel
#
@rtaylormcknight .@indigitalcolor love the webmentions section and design of your site https://aboutmonica.com/blog/adding-environment-variables-to-github-actions (twitter.com/_/status/1386407664964440068)
[Rose], indri, alex11, [chrisaldrich] and Seirdy joined the channel