[chrisaldrich], samwilson, [jeremycherfas] and [KevinMarks] joined the channel
#[KevinMarks]The slicing makes sense if you expect people to not watch all of it too
#[KevinMarks]Another trick is to upload to YouTube so they encode it then download it again, as they have had a team of experts tuning the encoding quality/bit rate for a while now.
nsh, nertzy, [KevinMarks], [schmarty], barnaby and capjamesg joined the channel
#capjamesgHello IndieWeb! Could someone please send a webmention to https://jamesg.blog/printer/? I'm going to be testing my webmention printer tomorrow and will need a recent webmention (and I'd like my first message to be from a community member!).
#barnabyindieauth question: according to the spec, an authorization code MUST become invalid once exchanged for an access_token
#barnabyif the exchange request results in an error, should the authorization code remain valid?
#aaronpkgood question, let me see if the oauth spec says antyhing about this
#barnabyI’ve been reading through it myself and couldn’t find anything
#aaronpkyeah IETF RFCs can't change, but you can still think of OAuth as a "living standard" in that things get added and removed to it over time by publishing new RFCs
#aaronpkif you want to know about the state of things within a particular working group you have to get more involved and follow the group's mailing list and such
#barnabyso unless a different spec expands on this, I guess the question is, is “one use” one attempted request, or one successful request
#barnabyalso neither spec response example lists the Cache-control header in the auth code issuing redirect response, but I guess it’d be suitable there too
#Loqi[aaronpk] #82 Clarify what should happen to authorization codes on an error response
#aaronpkbut my instinct is that they should be invalidated
#barnabyhmm I’m curious how existing implementations handle this
#aaronpkthe reason being the only way to get a valid auth code is if you are the legitimate client or if you stole one. the legitimate client should have no reason to make a request with a valid auth code that is invalid for some reason. an attacker might be able to do more things with the stolen auth code if it remains valid
#barnabyyeah that’s a good argument for invalidating an auth code on an invalid request
#barnabyexpires_in: (seconds) is the official way of communicating token lifetime information, right?
#barnabyI’ve been using valid_until: epoch seconds, but if expires_in is official then I’ll change up my default implementation and interface documentation to use that
#[jacky]I kind of wish there was a 'expires_at' versus 'expires_in'
#barnabytoken lifetime is an implementation detail left up to the consumer in my library, but I want to at least point people in the right direction
#[jacky]Frankly the mentions can be parsed in whichever format you define (it'd send the URL to something like granary or x-ray or your own tool for parsing a page) so it doesn't need to be in Microformats land
#barnabyso correct me if I’m wrong, but it looks like your parser is using hard-coded lists of h-* classnames and property classnames
#barnabymicroformats2 is designed to be generic, using the classname prefixes to determine how to parse elements, but not needing hard-coded lists of property names
#[jacky]Tbh I would have done the same re: class names to base the tests and then refactor to see if it still works with the expected classes (and then throw a wrench 🔧)
#barnabyone of the reasons for this was that a lot of the classic microformats parsers were necessarily based on hard-coded classnames, and they were a lot of work to maintain and went out of date quickly
#barnabyso I’d recommend thinking about how you could implement generic parsing. I get that it’s more difficult in rust, especially if you want to end up with nice rust-like data structures rather than a big hash map
#[jacky]That shouldn't be too hard with the [serde(flatten)] approach
#LaBcasse[m]I wanted to use a struct with known field for the h-* element. So, I need to hard-code the properties.
#barnaby[jacky]: did you have any ideas about how to handle generic mf parsing in rust? my intuition would be to have the parser build a big hash map, and then have consuming code which turns it into a strongly typed application-specific struct structure
#aaronpki am still looking into this indienews issue and i am very confused about what's wrong with it
#mgdm[jacky]: oh excellent, I'll have a look, thanks!
#barnabyLaBcasse[m]: that’s fine for a parser which only you use (and if that’s your goal then there’s no problem!)
#LaBcasse[m]But at the end you need to hard code the translation from the key to the field
#[jacky]Barnaby: I was thinking of leaning on serde to handle deserialization. We have some "base" properties for objects that can be made recursive and as long as it's defined with some expected things (like "type") it should work!
#barnabybut if your goal is to make something which is useful for other people, having a generic parser, producing generic data which application-specific code then consumes is the way to go
#LaBcasse[m]Ok, so it requires to build a two-layer parser, one generic returning a hashmap and another more static returning nice structures ?
#barnabyyep, that’s the pattern which mf 2 parsing code usually follows
#sknebel(because you want that for some use cases. but not for others, as we see here)
#sknebelLaBcasse[m]: Activitystreams2, the data format used by Activitypub/Fediverse
#barnabygiven that mastodon publishes mf2, I wonder how many sites which support AS2 content negotiation *don’t* also publish mf2
#aaronpknormally it's the case that if there is as2 it's more reliable than the html, mainly because of wordpress' legacy mf1 classes that continue to cause problems
#barnabyheh, this would actually be an argument for having some sort of text/html+mf2 MIME type
#barnabyif AS2 is negotiated but no link is found, additionaly request HTML and parse for mf2?
#barnabyI guess that’s a bit awkward to do if XRay is decoupled from the indienews parsing logic
#LaBcasse[m]<aaronpk "normally it's the case that if t"> Ok, it explains my error, but there should be a failback using HTML if AS2 do not contains the syndication, no ?
#aaronpkquite separate, it would take a bunch of fiddling
#barnabyI’ve had similar issues with my mention handling code delegating to an external parsing+archiving library
#barnabyit seems like webmention handling is complex enough to justify structuring things such that having multiple code paths and fallbacks is possible
#barnabyeither that, or XRay would need to do both by default and return a dataset containing all of the results
#aaronpki don't like the idea of always fetching twice
KartikPrabhu joined the channel
#aaronpki'd need to add a config option to XRay to tell it to not send the Accept headers, then indienews could choose to do the extra fetch
#aaronpkthis is also somewhat unique to indienews which is expecting the link in the syndication property rather than anywhere in the entry like normal webmention receiving
#barnabyfor something like indienews, it’s still a small number of requests overall
#LaBcasse[m]Sorry for my corner case, maybe it is better to not fix this bug.
#aaronpkfetching twice for indienews i don't mind, but i don't want xray to always fetch twice every time it encounters non-html
#barnabyI suppose a generic solution would be to optionally pass xray a list of properties which the consuming code is interested in, and if it knows that some of them are not supported by AS2, then it negotiates for HTML
#LoqiXRay is an open source API that returns structured data for a URL by parsing microformats and following other indieweb algorithms, and is part of the p3k suite of applications https://indieweb.org/XRay
#LaBcasse[m]Is XRay able to read the schema.org embedded data ?
#aaronpkno, that data is generally too unreliable and not detailed enough to be useful for the things xray is for
#LaBcasse[m]True, it is difficult to reuse these data. I wonder what kind of data is useful to gather for reusing the webmention, so the webmention receiver I created gathers a lot of thing.
#[jacky]mdgm: if you attempt to set it up and need help, feel free to ping me here or to sign in at https://git.jacky.wtf and leave a issue!
#barnabyargh I thought I had a good way of having my indieauth authorization flow be stateless but only have to fetch the client_id once
#barnabybut now I realised that if I want the error reporting to strictly comply with the spec, it needs to fetch the client_id multiple times
#barnabyas the first thing to do on any request is to fetch the client_id and validate the redirect_uri, so that other errors can be reported to the client app via a redirect
#barnabyhmm I suppose I can limit the number of requests by skipping fetching the client_id if the redirect_uri itself sufficiently matches the client_id
#aaronpk"If a client wishes to use a redirect URL that has a different host than their client_id, or if the redirect URL uses a custom scheme..."
#barnabybut probably the better way to do this is just to allow the library consumer to add a caching adaptor to the HTTP request callback if they want to avoid excess requests
#mgdm[jacky]: I'm opting into a little bit of self-inflicted complexity by trying to deploy this on NixOS, heh, so it might be a wee while before I get it to boot :-)
#[jacky]Haha tbh I'm even down to take patches to help it work under Nix! I did optimize it a bit for a Docker/Dokku/Heroku-esque setup but I'm eager to see how else it can be deployed
#aaronpki literally can never remember the difference between @media (max-width: 700px) and @media (min-width: 700px)
#LaBcasse[m]Me neither, but I also have problems with the difference between left and right ^^
#barnabyhuh, I’ve always found them pretty intuitive. styles in the block with max-width apply when the viewport is, at most, that value
#mgdm[jacky]: should lighthouse work with the published version of indieweb? I note that the Cargo.toml currently points at a local checkout
#barnabymaybe something like (@viewport <= 700px) {} might have been more familiar to programmers
#barnabybut I guess there’s some CSS reason for the existing syntax
#[jacky]Ah crap, it should. I'm outside right now but I can publish that
#aaronpki guess it's the "at most" or "at least" that i keep getting backwards
#aaronpki think it's because "max-width" means "this size or smaller" and "min-width" means "this size or larger"
#barnabyyeah, it’s weird that those keywords can mean opposite things in different contexts
#aaronpkso wechat is odd, your personal QR code is actually a URL, but visiting that URL doesn't do anything useful, it just redirects to teh app website
#aaronpkif you scan the QR code in the app then it will navigate to your profile in the app
#barnabyahhh I love automated testing. it only took a few minutes to refactor my IA library to validate parameters in the right order and always return errors the correct way, while maintaining the same test coverage
#barnabywell, okay, 40 minutes, but that’s still quite fast
#barnabyto anyone interested in PHP IndieAuth/Micropub server development, I’d be very grateful for feedback about this README and the specific API docs linked from it: https://github.com/Taproot/indieauth
#Loqi[Taproot] indieauth: A PSR-7-compatible PHP IndieAuth Server Implementation
#barnabythe docs are by no means complete, but I’d be curious for first-impressions of how clear the usage examples and API docs are, and any issues you’d anticipate using the library with your web framework of choice
#barnaby(also, the test cases in ServerTest may be of interest to other IA server developers! some of them get rather specific)
#aaronpkok my rel=me link for wechat links to the wechat URL, which as far as I can tell is useless, but I wrote some JS to pop up the QR code if you click it