#dev 2022-01-19

2022-01-19 UTC
jacky and Matt[m] joined the channel
#
[tantek]
I mean sure I have a separate favico.ico thing too but very little uses it
#
[tantek]
legacy only
#
aaronpk
i don't think i would call browsers legacy just yet :P
JBritSteele joined the channel
#
[snarfed]
^ all the different avatar/icon options are fun, but it's worth emphasizing that browsers and webmention receivers each have their own rules (algorithms) for finding the favicon/profile picture that they should display for a given site/author, right? https://en.wikipedia.org/wiki/Favicon#Standardization and https://microformats.org/wiki/representative-h-card-parsing , respectively
#
[snarfed]
(compliance is always imperfect, but still)
KartikPrabhu, KartikPrabhu1, Seirdy, jacky, jessealama and [tonz] joined the channel
#
[tonz]
I’m writing a small personal micropub client in php. I use it to post to my WordPress Micropub endpoint, to create entries. I send posts to the end point as form-urlencoded. Things go fine unless the html content contains an SVG statement. Whenever an SVG statement is in the submitted HTML for the h-entry, the end point returns a 403 error. Is there something in the Micropub spec that explains this? Any top of head suggestions for
#
[tonz]
things to check / look into? I’ll ask in #indieweb-wordpress about the micropub plugin specific things that might play a role.
#
GWG
[tonz]: WordPress might be forbidding it due it's restrictions on side loading svga
#
GWG
SVG files
#
GWG
I've never tested that
#
GWG
If you could open an issue with the HTML... I'll experiment
#
Ruxton
the filetype checker is broken, there's a super old request to fix it in core
#
Ruxton
i poked the contributor working on it and he updated the patch a few months ago but it's not getting pulled in
#
Ruxton
if i remember correctly, this happened for me mostly when using the media upload endpoint
#
Ruxton
i went tore through the micrpub plugin trying to find the issue only to find it was in core and known about for SEVEN YEARS
#
Ruxton
i think it just needs someone to review it so it can go into core :(
jessealama joined the channel
#
[tonz]
@GWG I’m not loading an SVG _file,_ there is a <SVG></SVG> statement in the html POSTed e.g. “This is some text <SVG></SVG> this is more text” fails (with or without the path info etc). In fact the mere presence of “<SVG” somewhere in the html makes it fail.
#
Ruxton
super odd, [tonz] i can't recreate that :/
#
Ruxton
I just tested a few variations of it and they all went in :/
#
[tonz]
can I mail you my script. Maybe it is in the way I build up the call to the endpoint? Or post it somewhere?
typ1cal_c0ffxe3 joined the channel
#
[tonz]
Added the php code used to the issue
Tommy1, tetov-irc, jacky and Loqi joined the channel
#
jacky
once I figure out this date-based cursor pagination thing, I'm def writing a post
#
jacky
I know this is a common-ish thing
#
[KevinMarks]1
yes, it's one of those tricky edge case things always
Guest6 joined the channel
#
[KevinMarks]1
it's a similar case to etag/LastModified in that you want to be handing the server a token that identifies the boundary you last saw rather than an offset into the list, so it can handle the case when the list has changed
#
[KevinMarks]1
trickier when the sort order isn't date though.
#
capjamesg[d]
jacky I really struggled with date-based cursor pagination. I resorted to using DB IDs instead. They probably shouldn't be autoincremented but oh well since I'm just building for me right now.
Seb[d] and KartikPrabhu joined the channel
#
Zegnat
capjamesg[d]: what is wrong with auto-incrementing IDs? As long as you either a/ do not make it possible to load data using those IDs, or b/ only have publicly accessible content so you do not care about enumeration attacks, those seem perfectly fine to me?
#
[aciccarello]
capjamesg[d] Nice article on setting up the PWA metadata. Now you just need to get a service worker setup with a share target 😁
#
[aciccarello]
I guess you don't even need a service worker for share target.
#
capjamesg[d]
The web share targets confuse me. What do they allow me to do?
#
capjamesg[d]
Oh I see.
#
capjamesg[d]
I wonder if it works on Firefox iOS.
#
petermolnar
what is webactions?
#
Loqi
A web action is the interface and user experience of taking a specific discrete action, across the web, from one site to another site or application https://indieweb.org/webactions
P1000[d] joined the channel
#
aaronpk
the web push api was way easier to deal with than i expected
#
aaronpk
i think i was confusing it with the older non-standard versions which required getting API keys from google and such
#
aaronpk
also i just realized the real reason all these sites are adding notifications... when the site registers for notifications it returns essentially a unique identifier for that browser, and it's the same identifier if the user returns later
#
aaronpk
which basically means it's the ultimate tracking cookie without using cookies
#
[tantek]1
uh really? that seems worth posting something about if that's true. has someone done that analysis / testing?
#
[tantek]1
e.g. does it cross private-browsing barriers?
#
aaronpk
chrome disables notifications in incognito mode
#
aaronpk
it's also unique to the site, so it's not like you can correlate users between different websites
#
aaronpk
but it's basically a persistent identifier for a browser-and-website pair that doesn't require storing cookies
#
[aciccarello]
Does it generate that even without the user allowing notifications?
#
aaronpk
no of course not
#
[aciccarello]
Oh, okay. I assumed it was always just for increasing traffic. Either way it's annoying how it's abused.
#
aaronpk
yeah me too. but then once i saw this it makes much more sense
#
[tantek]1
uh aaronpk re: "it's also unique to the site, so it's not like you can correlate users between different websites" that's not how "different websites" get around that. 1 - there are domains owned by the same entity that share info on the backend. 2 - there is adtech that asks domains to provide identifiers that they can then correlate on the backend.
#
aaronpk
i mean by itself
#
aaronpk
now i am curious what happens if one domain iframes in a notification request from another domain
#
aaronpk
lol welp, you can definitely rig that up
#
aaronpk
adtech co runs a browser notification service, gets customers to include some code on their site to request notifications, adtech co can correlate users across all their customers domains
#
[tantek]1
uh that's worth at least a brief blog post
#
[snarfed]
I'd be curious to see numbers on notification opt in. obviously a bigger deal if it's eg ~50% vs ~5%
#
aaronpk
thankfully there's lots of stats on that cause it's big business :)
#
[snarfed]
I figured. useful!
#
[snarfed]
I also wonder how it changes if the domain in the prompt isn't the site you're on, ie it's the shared ad tech domain. maybe not much if "users don't read," but still, curious
#
aaronpk
some quick searching is turning up numbers like 10-12%
sp1ff joined the channel
#
[snarfed]
yup, so not a silver bullet third party cookie substitute, but definitely could be one more fingerprinting tool in the toolbox
#
aaronpk
oh interesting, one minor detail
#
[snarfed]
(if the domain thing doesn't reduce those numbers too much, which it very well may)
#
aaronpk
i don't get the prompt unless i visit the actual domain that's requesting the permission
#
aaronpk
but if i've already granted permission, then the re-registration works from when it's in an iframe
#
aaronpk
so that basically kills that idea
#
[snarfed]
yup. good find
JBritSteele joined the channel
#
[tantek]1
right, that makes sense. iframes can't request notifications
#
aaronpk
yeah it's weird tho because the same code that shows the notification request *can* run in the iframe, it just results in a failure unless you've already accepted permission
#
sknebel
do you need to run the register code? cant you query the state of the existing subscription?
#
aaronpk
yeah looks like there is a method to check the status https://developer.mozilla.org/en-US/docs/Web/API/PushManager#methods
#
sknebel
and the "runs but fails" kind of makes sense, thats the usual design around those. you can try and get told "no" if the prompt can't be made for whatever reason
#
[tantek]1
exactly
JBritSteele and jacky joined the channel
#
capjamesg[d]
What is a service worker?
#
Loqi
service workers are scripts that run in the background, separate from tabs with the site open, and are commonly used for offline functionality and push notifications https://indieweb.org/service_worker
#
capjamesg[d]
What would an offline feed reader look like?
#
capjamesg[d]
The reader would have to save any interactions you want to make and then send them when you connect to the internet.
#
aaronpk
seems reasonable
#
capjamesg[d]
And maybe make your feed and notification pages accessible. But only your first 20 entries or so.
#
capjamesg[d]
And maybe allow for posting but those changes will be synced when you connect to the internet.
#
capjamesg[d]
I don’t know much about service workers so I think I have quite the learning journey ahead.
#
capjamesg[d]
How does Quill do it aaronpk?
#
aaronpk
good question
#
aaronpk
i think i made that when i was first learning about service workers
#
aaronpk
IIRC the editor page is entirely cached and usable offline. but the post button doesn't do anything unless you're online
#
aaronpk
and it only supports one active draft, so it's not a full featured offline editor
#
[tantek]1
capjamesg[d], offline feed reader? you mean like nearly every podcast listening app?
maxwelljoslyn[d] joined the channel
#
capjamesg[d]
[tantek] Very true!
#
capjamesg[d]
I’m thinking about this from a Microsub perspective though.
#
[tantek]1
not sure why people treat audio and text consumption differently in terms of offline
#
capjamesg[d]
So I would need to support saving posts locally.
#
aaronpk
also presumably thinking about this from more than just the consumption side
#
capjamesg[d]
Yes. I understand the consumption side.
#
[tantek]1
from the user experience side yes
#
[tantek]1
people seem to "get" that their audio should be available offline but are willing to tolerate latency, delays, network foo to read text?
#
capjamesg[d]
I have never used a service worker before so I’m trying to piece together the best first steps in my mind.
#
capjamesg[d]
I think I’ll try and serve a page a user has visited from cache first and then figure out the rest once I have done that.
#
capjamesg[d]
It looks like adactio has written a book on service workers too!
#
capjamesg[d]
[tantek] by the way, I updated my feed reader interface to include navigation similar to Instagram:
#
capjamesg[d]
Still work to do but it’s a start.
#
[tantek]1
capjamesg[d] I implemented a relatively minimal Service Worker during IWC SF
#
[tantek]1
pretty sure my notes about it are there in the session description or maybe a link to the blog post
#
capjamesg[d]
What did you use it for?
#
capjamesg[d]
Oh I see your example on the service worker page. Exciting!
#
[aciccarello]
I've used service workers mostly for providing offline caching and occasionally request intercepting.
#
capjamesg[d]
Hm. I have just read that you can’t save data to local storage in a service worker…
#
[aciccarello]
No you can't but there is a caching api
Osvik[d] joined the channel
#
@moondeerdotblog
Updated plugin-conversation (aside from the README) to utilize Sass style parameters and statically fetched JSON feeds. These two comments happen to be reply tweets bounced over by http://Brid.gy: https://github.com/moonbuck/plugin-conversation
(twitter.com/_/status/1483918542944800777)
jacky and strugee joined the channel
#
[aciccarello]
This library is really useful for PWA caching https://developers.google.com/web/tools/workbox/
#
[snarfed]
capjamesg you may be interested in https://snarfed.org/posting-to-the-indieweb-from-your-phone, old and hand wavy and micropub only but similar ideas
#
[snarfed]
and [tantek] is right, offline support should be expected in readers, and fortunately most big feed readers' mobile apps have had it for a while now, it's pretty common
#
[snarfed]
probably less so on web, if only because PWAs themselves are rare, much less offline support
tetov-irc joined the channel
#
[aciccarello]
PWA install experience is still sub-optimal unfortunately
#
[tantek]1
it's not really well specified from an ecosystem perspective tbh