#dev 2022-09-14

2022-09-14 UTC
AramZS and alex11 joined the channel
#
@eniehack
↩️ digital gardenを構築するなら、リンク構造をwebmentionで見せられると楽しそう(正直Quartzの手法の方が効率がよいと思うけど >トラックバック的なビューが無い > Scrapboxでは「このページにリンクしているページ」という表示が可能だが、Scrapbogusだと不可能。がんばって全文検索することになる。
(twitter.com/_/status/1569883432859336706)
[Murray]1, [Jamie_Tanna], GWG, [Jamie_Tanna]1, tetov-irc, strugee, chenghiz_ and [manton] joined the channel
#
[manton]
@GWG Not really IndieWeb-related, but do you have any experience with WP plugins and featured images? I’m helping someone with a custom theme, and `the_post_thumbnail()` doesn’t seem to work despite a featured image being set… Jatpack’s `og:image` works fine, though. Been unraveling code trying to debug and I’m a little stuck.
#
[manton]
`get_post_thumbnail_id()` also returns 0 even though I can clearly see the featured image in the editor and from XML-RPC calls.
mro, AramZS and gxt joined the channel
#
GWG
[manton]: Is the feature enabled?
#
corlaez
Is there a self contained client? So far I get there is a server and a client... and i can use say Aperture... but is there a simpler way to do it such as an RSS client that is just the client fetching a page without a service in the middle? (I don't want to rely on a server, not mine nor a third party's)
#
corlaez
a client that will read a website with microformat h-feed and subscribe to changes
#
corlaez
the simplicity of RSS is what I am looking for, no need for a server in between
#
aaronpk
"and subscribe to changes" implies there's something a little more complicated than just fetching a page, but are you basically asking if there is a self-contained desktop reader app?
#
[manton]
@GWG I do have `add_theme_support( 'post-thumbnails' )` if that’s what you mean… I’ve actually decided to punt on this and work around the issue another way, so no big deal. Will revisit at some point probably.
#
GWG
[manton]: Sorry... working so a bit slow
#
[manton]
@GWG No worries!
AramZS, lagash, [Ben_Myers] and geoffo joined the channel
#
corlaez
Yes, a self contained desktop reader
#
[tantek]4
corlaez, one challenge for a "self contained desktop reader" is that it can't support modern real time notifications via WebSub, that sites with feeds support.
#
[snarfed]
big for more technical wordpress.com users: they now support SSH, including wp-cli: https://wordpress.com/blog/2022/09/07/ssh-now-available-for-business-and-ecommerce-sites/
#
corlaez
[tantek] I see...
#
corlaez
what do you mean structural? aaronpk
#
aaronpk
the core concept of monocle and other similar readers is that they are only a viewer for data stored on "your" server
#
aaronpk
because the data is not stored in the reader itself (monocle), it needs a token in order to access the data from your server
#
aaronpk
so that's why it needs indieauth, because it's more than just "logging in" to the reader
#
corlaez
uhm interesting, I will have to learn more about indie auth then. the naming around auth doesn't help
#
aaronpk
it's "indieauth" like "oauth" but indie :)
#
corlaez
Not sure if "dev" or not, but there is something that bugs me about the servers... the cost of storage, running it and complexity can be a barrier for many
#
corlaez
Not to mention data duplication. The data is already on all the other sites, the reader could just grab them directly and parse if needed.
#
corlaez
Real time features may be lost, or perhaps could be implemented differently. Websockets come to mind. In that case real time depends on each website rather than the consumer of the info.
#
corlaez
the websocket message could just be a URL that is to be refetched by clients subscribed to it. A light message that can be acted upon and then discarted
#
aaronpk
it's not really data duplication, it's more like caching
#
corlaez
Just wanted to speak about this in case someone else felt this or already tried something like that.
#
aaronpk
ultimately a desktop reader app would have to store a local copy of the post anyway in order to show it too
#
aaronpk
also what do you expect to see when you open the reader app? if you want anything other than a list of sites and browsing them one by one, you need to do more complicated things with storing copies of posts
#
aaronpk
it sounds like maybe what you are describing is actually just a list of web pages to go visit in a browser :)
#
aaronpk
the browser is the reader, there's only one copy (other than the browser cache) of the web site, and bonus points for the author being able to choose how they want to present their site to you
#
corlaez
Uhm I think I see what you are saying. cache is valid for sure
#
corlaez
I guess that I feel that the caching part (the microsub server) and client could be in the desktop
#
corlaez
I guess you would loose some state tracking between devices
#
aaronpk
sure, you could definitely do that with all the existing parts described by the microsub and microformats specs
#
aaronpk
but yeah you lose state tracking across devices and it would only be able to fetch new posts when your computer is online
#
corlaez
Awesome awesome. that makes sense. And regarding the lack of real time notifications via WebSub
#
corlaez
I feel maybe there could be a way to fix that with websockets. just thinking out loud
#
aaronpk
that ends up putting a lot more burden on the publisher to maintain a websocket server vs the websub architecture
#
corlaez
I don't know enough about websub. But the websocket could be a shared service. Once a website is deployed and the service is notified all connected readers get a prompt to reload the site
#
corlaez
I agree that asking every indie web to have their own websocket would be too much
#
aaronpk
IMO websockets is best for the last-mile hop between a browser and the site the browser is looking at. actually even then, eventsource is easier since you don't need the bidirectionality of websockets
#
aaronpk
both of them are browser APIs though, not really designed for server-to-server communication which can use simpler technology
#
aaronpk
oh yeah plus both of them rely on keeping persistent network sockets open, which isn't really scalable in the long term
#
aaronpk
websub isn't that complicated. basically the subscriber says to the hub "tell me when this page is updated". then the publisher tells the hub "hey I updated this page". then the hub sends a notification to all the subscribers that says "this page was updated"
#
corlaez
Ok, I see. I guess when I mean real time is only when I have the reader open I want real time. But, I see how server to server comms can be more efficient in websub
#
corlaez
and yes SSE does seems better than websocket for what I was talking about.
#
corlaez
Thanks! I think I am off to implement indie auth and check monocle
#
corlaez
IndieAuth.com is part of the IndieWeb movement to take back control of your online identity. Instead of logging in to websites as "you on Twitter" or "you on Facebook", you should be able to log in as just "you"
#
corlaez
so... with rel me auth I am still signing in with Twitter, GH, etc. but with indie auth there is a real me auth validation but then the sign in is actually just me
#
corlaez
it seems to be one step further than real me auth. (not sure if real me auth is really used as part of indie auth or not)
#
aaronpk
oh definitely don't start your indieauth journey at indieauth.com sorry
#
aaronpk
this is better for finding related articles and other services https://indieauth.net
#
aaronpk
relmeauth is not part of indieauth, but it's one way an indieauth server could authenticate the user. another option is just whatever password auth you have on your website
#
corlaez
ok I think it starts to make sense. https://indieauth.com/setup that domain still exists... but from a github thread it seems the way to go now is indielogin.com?
#
aaronpk
indielogin.com is tangentially related, but not the same
#
corlaez
oh wow, it's definetly the first time I stumble upon https://indieauth.net/
#
aaronpk
heh it's linked at the top of indieauth.com
#
aaronpk
one of these days i need to figure out how to move people off of indieauth.com but it still has a bunch of users
#
corlaez
gotcha. I usually avoid specs in favor for docs or other explanations ,that's how i missed it
#
aaronpk
ah fair
#
gRegor
It helped me to distinguish them when I realized rel-me-auth is leveraging other services to return your URL. E.g. the Twitter authorization you give during rel-me-auth is basically to retrieve your URL from your profile and return "yes, me=example.com"
#
corlaez
right and use that directly in other sites
#
gRegor
vs IndieAuth the spec lets you use your own services for authentication and authorization, like your WordPress login
#
corlaez
but indieauth allows you to identify yourself, first validating with password or real me auth and then issuing your own oauth tokens
#
corlaez
right, so it is all about what tokens you hand out... your own indieauth, the rel=me service realMeAuth
#
corlaez
thanks!
#
corlaez
++gRegor
#
corlaez
gRegor++
#
Loqi
gRegor has 8 karma in this channel over the last year (59 in all channels)
#
gRegor
Well, rel-me-auth doesn't give out an access token to the client. Authentication only.
#
aaronpk
Think of RelMeAuth (or any authentication flow) as confirming "the person in front of the computer does in fact control the URL they typed in to the login box"
#
corlaez
So, my brain is a rock when it comes to OAuth. Does that translate visually to real me auth asking only basic info access (name email maybe)
#
aaronpk
not even that because it's not OAuth at all
#
aaronpk
but sort of yes
#
corlaez
vs giving access tokens would be things like write a post, or edit this or that.
#
gRegor
hehe, it is rather confusing
#
aaronpk
yes, access tokens are all about accessing or modifying data
#
corlaez
Ok ok. I think I am making some progress.
#
corlaez
wait I am confused should I be using <link rel="authorization_endpoint" href="https://indieauth.com/auth"> in 2022
#
corlaez
? or was that the old service and indielogin the new one?
#
corlaez
github: About This service is being discontinued in favor of indielogin.com
#
corlaez
indie login's setup looks closer to relmeauth but also says that if you use indie auth then indielogin already works
#
gRegor
No, ideally shouldn't be using indieauth.com in 2022.
#
corlaez
but should I be using indieauth
#
aaronpk
the missing piece is that i haven't made an equivalent indieauth-as-a-service to replace indieauth.com yet
#
aaronpk
i've been hoping someone else will make a service, but in the mean time it's been built in to other things like micro.blog and wordpress, they are their own indieauth servers
#
aaronpk
there are various open source implementations of an indieauth server that you can run, but nothing that you can just sign up for like indieauth.com https://indieweb.org/IndieAuth#Server_Implementations
#
corlaez
https://aperture.p3k.io/docs aperture itself keeps recommending the use of indieauth, in general I have found many pages pointing to it
#
corlaez
thanks that helps
#
aaronpk
good catch
AramZS joined the channel
#
corlaez
but in a way this brings me back to why I would like a simpler way to use something like monocle. No indieauth server, no websub server, just plain old client parsing websites.
#
aaronpk
sure but how would you log in to it
#
[tantek]4
if it's purely on the client, and all it's doing is parsing public websites, there's no need to "log in"
#
aaronpk
i think that's called a browser
#
corlaez
you would loose a lot of state I imagine. perhaps the most important piece would be the list of websites
#
[tantek]4
corlaez, where do you store that list of websites?
#
corlaez
could that be realMeAuth + a rel monocle that takes to a page with that list
#
corlaez
one URL per line
#
corlaez
so corlaez.com/monocle.txt holds the websites I sub to
#
[tantek]4
corlaez btw it's rel-me and RelMeAuth, not real me, nor RealMeAUth
jacky joined the channel
#
aaronpk
that has the very unfortunate side effect of making your subscription list public which not a lot of people would want to do, but it is an interesting idea
#
aaronpk
by the way there's nothing wrong with the idea of building a microformats reader app for desktop that has no server-side component, you don't need to invent anything new to do that
#
[snarfed]
there's lots of prior art for pure client side feed readers, right? as an alternative to awkwardly hacking this into monocole, maybe look at adding h-feed support to one of them?
#
aaronpk
and yes if you wanted to actually build this, it's probably best to start with an existing RSS reader app and teach it how to read h-feed
#
corlaez
right right i just havent really found one with mf2 support
#
[tantek]4
aaronpk, a long time ago, it was the "norm" to make your subscription list public in the form of blogrolls
#
corlaez
yup and at that point no login or url with public list would be needed. I guess you can but at that point the list could just be in the rss reader
#
[tantek]4
corlaez, re: "havent really found one with mf2 support" <-- that's why aaronpk is suggesting you do that work! "teach it how to read h-feed"
#
aaronpk
the problem with most of the older feed readers is that they are read-only, so as soon as you want to go give yourself a way to reply to or favorite a post the whole model breaks down
#
aaronpk
that was the whole idea behind the push to "social readers" which don't start with the assumption that you are only reading https://indieweb.org/social_reader
#
corlaez
I see. I think I will look whats open source and give it a go. I don;t mind read only for now
#
[snarfed]
corlaez or even more hacky, grab an existing client side reader and use granary to convert any h-feed only sites to RSS/Atom
#
gRegor
It's quite old at this point, but I remembered aaronpk added mf2 support to selfoss https://indieweb.org/reader#Aaron_Parecki_selfoss
#
gRegor
PHP server software, not a desktop client though
#
angelo
gRegor and corlaez i see you both use rel=authn; is that for the reason described here? https://auth.hawx.me/
#
Loqi
relme-auth
#
gRegor
Yeah. I think I saw it on the wiki or in dev chat a while back; hadn't seen that page though
#
aaronpk
oh neat where'd that come from
#
aaronpk
indielogin.com also uses rel=authn https://indielogin.com/setup
#
Loqi
How to Set Up Your Website for IndieLogin.com
#
gRegor
Hm, it finds my Twitter and Github, but then hides the Twitter option, even though it has "authn"
#
angelo
but that's the intention behind it? to narrow the choices of rel-me auth? nothing to do with webauthn..
#
[tantek]4
what is rel-authn
#
Loqi
It looks like we don't have a page for "rel-authn" yet. Would you like to create it? (Or just say "rel-authn is ____", a sentence describing the term)
#
[tantek]4
is rel-authn only really described in a few comments in an issue on /RelMeAuth?
#
angelo
looks like it
#
angelo
and on auth.hawx.me ^
#
[tantek]4
if there really are two implementations, please start a /rel-authn stub article ASAP
#
[tantek]4
two *consuming* implementations
#
aaronpk
looks like it
geoffo joined the channel
#
angelo
hm auth.hawx.me showed both twitter and github then hid the twitter for me as well; i have no rel=authn specified; it also failed to complete my sign-in through GitHub so i'm not sure what i'm even signing in to
#
gRegor
Maybe it doesn't support Twitter auth anymore so hides it
#
[snarfed]
right, that's most likely
#
aaronpk
omg indielogin.com is already over 4 years old
#
aaronpk
i suppose more accurately, it's 2 years and 1 pandemic old
#
gRegor
!march
#
Kaja
It's March 928, 2020 (UTC)
jacky joined the channel
#
angelo
both https://indieweb.rocks/gregorlove.com and https://indieweb.rocks/corlaez.com show check marks for reciprocal rel=me but narrow it to only rel=authn for web sign-in support
#
gRegor
oof, how do I change that heading w/o making a new post on the homepage? XD
#
gRegor
But that's cool!
#
gRegor
Good reminder I need to remove that Keybase I never used
#
gRegor
That sign-in at the bottom is neat "If you are the owner of this site, you may sign in to administer this page.
#
gRegor
[Sign in as gRegor Morrill]"
#
aaronpk
keybase--
#
Loqi
keybase has -1 karma in this channel over the last year (-2 in all channels)
#
gRegor
angelo, I got a blob of JSON when I clicked that sign in button.
#
angelo
you get that if you're already signed in
#
angelo
it should be your session data, no?
#
angelo
how do you think i should handle your heading problem?
#
gRegor
I already closed it. I just cleared cookies and signed in again.
AramZS joined the channel
#
gRegor
angelo, I'm not too worried about the heading. Could maybe add text indicating "latest post" or something.
#
gRegor
Or the representative h-card info. I think my homepage has one.
#
gRegor
Oh wow, didn't realize Zoom bought Keybase
#
gRegor
and that they're not really maintaining it. cool cool
#
angelo
the sign-in stuff is still buggy. i'll make your post look more like a post.
jacky and tetov-irc joined the channel
#
corlaez
[snarfed] wow snarfed that's quite an idea indeed
#
corlaez
snarfed++
#
Loqi
snarfed has 21 karma in this channel over the last year (50 in all channels)
#
corlaez
[angelo] I can't recall where I read it (somewhere in the wiki I imagine) but yes the idea is that I only want to sign in with that rel=me and not the others
#
corlaez
So far it has worked for me
#
angelo
corlaez what instructions did you follow?
#
angelo
oh you don't remember
#
corlaez
I have seen some
#
Loqi
How to Set Up Your Website for IndieLogin.com
#
angelo
ah, thank you
#
corlaez
I also check other websites implementations here and saw that some used them
#
corlaez
https://indieweb.rocks/corlaez.com Level 2: Improve your personal identity and post multiple types of posts You've listed other profiles on silos you posse to.
#
corlaez
" the you posse to" is a little misleading as I don't posse anything
nertzy, AramZS and barnaby joined the channel
#
[tantek]4
then it evaluates to the empty set
AramZS_ joined the channel