#dev 2022-11-20
2022-11-20 UTC
geoffo and mro joined the channel
# mro c+p - what a sad UX.
# mro haven't considered deadend an option.
# mro what was wrong with the prior callbacks?
# Loqi It looks like we don't have a page for "wrong with the prior callbacks" yet. Would you like to create it? (Or just say "wrong with the prior callbacks is ____", a sentence describing the term)
# mro ic, is there a writeup somewhere?
# Loqi indie-config is a way to setup your IndieWeb site to make itself available to your web browser to recognize webactions like reply & like buttons on other sites, and then delegate handling of those actions to your site https://indieweb.org/indie-config
# mro thx
# mro what about a bookmarklet like at https://demo.shaarli.org/admin/tools?
# mro uid/pwd demo/demo
gRegor joined the channel
# gRegor !tell jamietanna https://editor.tanna.dev/ appears to not send a `state` parameter when I try to sign in
# gRegor If you're wanting to sign other people in to your site or some app you're working on, you'd want to follow https://indielogin.com/api
# gRegor vs if you're trying to sign in to some other app with your own domain name, like the indieweb wiki, you'd want https://indielogin.com/setup
gxt joined the channel
gxt joined the channel
# [tantek] gRegor, add yourself! https://indieweb.org/Bridgy_Fed#IndieWeb_Examples
geoffo and gxt joined the channel
gxt, slyduda, tbbrown and [fluffy] joined the channel
# [fluffy] Just got an interesting weird webmention via webmention.io: https://cagrimmett.com/ sent a mention to beesbuzz.biz via the indieweb webring, which I guess resolved to my site when validation happened to take place.
# [fluffy] I’m guessing that when the mention was sent, the `https://xn--sr8hvo.ws/%F0%9F%91%8A%F0%9F%93%88%F0%9F%98%8C/previous` link resolved to beesbuzz.biz, which then offered `webmention.io/beesbuzz.biz/webmention` as the endpoint, and since the link in question was indeed present, it was accepted and then delivered to my dashboard. Which makes me realize there’s a potential, if obscure, spam attack vector enabled by webmention.io.
# @tonysull_co The indieweb. A tale as old a time.
RSS let's you follow a site's new content
Webmentions let's sites reply to each other
Twitter let's hikers keep their families updated via SMS
Activitypub adds a pubsub model
Everyone turns on Twitter...only to find Activitypub doesn't scale (twitter.com/_/status/1594195851911757824)
# @MikeWMerritt Apologies for a bunch of spammy tweets over the last few days. Been trying to integrate #webmention from Twitter to my site and didn't fully understand how it works until now. (twitter.com/_/status/1594197000425246723)
# @jaxroam ↩️ Making my Mastodon homes, but considering #bridgy or something to unify platforms that do support #ActivityPub with those that don't.
https://brid.gy/ (twitter.com/_/status/1594199913453305859)
# @tonysull_co Officially getting old... I still don't understand why I need Mastodon when we still have RSS + Webmentions (twitter.com/_/status/1594203449968803840)
lockywolf and mro joined the channel
# [jamietanna] gRegor thanks re editor.tanna.dev missing `state`! I'll try to get to that today. Is that blocking you logging in?
# Loqi [jamietanna]: gRegor left you a message 7 hours, 59 minutes ago: https://editor.tanna.dev/ appears to not send a `state` parameter when I try to sign in
mro joined the channel
# [jamietanna] Happy to chuck `state` in as well, but from what I've read, using PKCE should fill the same purpose?
petermolnar, IWDiscordRelay, mouse[d] and mro joined the channel
# IWDiscordRelay <capjamesg#4492> What is serverless?
mro and barnaby joined the channel
# [jamietanna] capjamesg was that to trigger Loqi? If so I guess Discord bridge still doesn't cause it
gxt joined the channel
# IWDiscordRelay <capjamesg#4492> I was curious more generally.
# @malkav30 ↩️ Je suis tombé sur cet article qui date un peu mais qui donne également une vue éthique et technique sur les commentaires d'un point de vue #indieweb : https://sebastiangreger.net/2018/05/indieweb-privacy-challenge-webmentions-backfeeds-gdpr (twitter.com/_/status/1594319559741292544)
# @kevinmarks ↩️ This is a good call. You can interoperate between http://micro.blog and mastodon smoothly, or you can wire up your own website with http://fed.brid.gy - different levels of tech engagement (twitter.com/_/status/1594332678593060865)
sebbu and sp1ff joined the channel
# [jamietanna] Gotcha capjamesg. The best descriptions of it I've heard describe it as "pay for what you use" and "scale to zero" - unlike traditional servers where you're paying regardless of how much you use it
# [schmarty] for folks grabbing twitter archives, today i learned that your archived tweets are (of course) full of `t.co` links that need unfurling. https://inkdroid.org/2022/11/20/t-dot-co/
mro, jonnybarnes, win0err and dtinth joined the channel
# @tonysull_co ↩️ @BHolmesDev Which brings us to https://fed.brid.gy/, a tool for effectively making an indieweb site with Webment… https://twitter.com/i/web/status/1594392019463712768 (twitter.com/_/status/1594392019463712768)
# Loqi ok, I added "https://twitter.com/nurijanian/status/1593982488044453889" to the "See Also" section of /graphics https://indieweb.org/wiki/index.php?diff=84506&oldid=75204
# [tantek] diagram << ^ https://pbs.twimg.com/media/Fh72n66XgAMhqv6.jpg
# Loqi ok, I added "^ https://pbs.twimg.com/media/Fh72n66XgAMhqv6.jpg" to the "See Also" section of /graphics https://indieweb.org/wiki/index.php?diff=84507&oldid=84506
# IWDiscordRelay <jacky#7226> indeed
# IWDiscordRelay <jacky#7226> like now I _kinda_ get why mastodon and what not do hotlinking but sheesh
# IWDiscordRelay <jacky#7226> [manton] could imagine it pop up on the internet archive (hopefully)
# IWDiscordRelay <jacky#7226> [tantek]: that's worth posting + boosting 🙂
# [tantek] Twitter << How to export: be sure to unfurl your t.cos in your archives when you receive them since the t/.co domain will likely stop working when Twitter shuts down: https://inkdroid.org/2022/11/20/t-dot-co/
# Loqi ok, I added "How to export: be sure to unfurl your t.cos in your archives when you receive them since the t/.co domain will likely stop working when Twitter shuts down: https://inkdroid.org/2022/11/20/t-dot-co/" to the "See Also" section of /Twitter https://indieweb.org/wiki/index.php?diff=84509&oldid=84497
# [jamietanna] When I've previously exported them there's the full data available including the raw URL and which t.co it corresponds to - pretty sure that's still there, just need to dig into the `tweet.js` static tweet export
# IWDiscordRelay <jacky#7226> oh that's good to know
# [iambismark] Url shorteners are one of the great evils Twitter has brought about in the world…
# [iambismark] I worked at a long defunct startup where we had a url shortener explicitly for sharing to twitter.. it never got big, only in the tens of thousands of links… before we shut everything completely down I pulled a dump of all the links redirects… I wonder if I should do something with that…
# Loqi URL shortener is a service that turns a typical longer URL, like a permalink, into a much shorter URL, typically using a short domain, often per-site both for some silos, and several indieweb sites https://indieweb.org/URL_shortener
# [iambismark] Will do. I know when I last did my twitter dump there were a few old tr.im links in there that I wasn’t able to reverse engineer via context… in the grand scale of things not a big deal but still frustrating.
# [jamietanna] [tantek] confirmed from an export from 2022-10-29 in `data/tweets.js`:
# [jamietanna] "symbols" : [ ],
# [jamietanna] "hashtags" : [ ],
# [jamietanna] ``` "tweet" : {
# [jamietanna] "urls" : [
# [jamietanna] "user_mentions" : [ ],
# [jamietanna] "entities" : {
# [jamietanna] ```
# [jamietanna] where `urls` has:
# [jamietanna] "url" : "https://t.co/J34cTvrAq0",
# [jamietanna] ``` {
# [jamietanna] "expanded_url" : "https://www.jvt.me/mf2/2022/10/vi5cm/",
# [jamietanna] "display_url" : "jvt.me/mf2/2022/10/vi…",
# [jamietanna] "indices" : [
# [jamietanna] "49",
# [jamietanna] "72"
# [jamietanna] },```
# [tantek] We had to do a whole clean-up project at microformats.org to "repair" the use of tr/.im URLs: https://microformats.org/wiki/tr.im
mro joined the channel
# IWDiscordRelay <jacky#7226> what are ddos
# IWDiscordRelay <jacky#7226> hm thinking about a good 'window' of time to add to mitigate/reduce DDoSing someone to check for their endpoints (like if someone else was going to try to use Sele for it)
# IWDiscordRelay <jacky#7226> I do have CORS enforced maybe requiring them to be logged in would be good to
geoffo joined the channel
# IWDiscordRelay <jacky#7226> Gotcha, I was thinking of someone trying to use it as a 'trusted' vector to send a bunch of checks (b/c it doesn't cache them currently)
# IWDiscordRelay <jacky#7226> (I see amplification being possible due to the lack of caching of results)
# IWDiscordRelay <jacky#7226> so might just stick to that
# IWDiscordRelay <jacky#7226> so there's a page I'll be adding where you can enter a URL to check if your site's good to go for IndieAuth support, kinda like https://indiewebify.me/
# IWDiscordRelay <jacky#7226> you could just click the button n amount of times (and it'd be up to the browser to fire off those requests)
# IWDiscordRelay <jacky#7226> I _think_ though, writing this out, that you're right
mro and win0err joined the channel
# IWDiscordRelay <jacky#7226> nice
win0err and strugee joined the channel
# [tantek] I feel there's something here. SOMETHING motivated people to share their @-@ addresses in their Twitter profiles, then Twitter names etc. instead of "just" sharing their Masto profile URLs. That indicates to me that there's still some usability reason that makes @-@ work "better" (more reliably?) for people.
# [tantek] posting link here from stream because it seemed quite topical to these discussions: https://www.jasontucker.blog/14183/mastodon-indieweb-and-the-fediverse
gRegor joined the channel
# gRegor [jamietanna], yeah, my reading of https://indieauth.spec.indieweb.org/#authorization-request-p-6 was that `state` was still required, so I can't log in. Haven't dug into the OAuth PKCE specs, so I don't know if that's an oversight or not.
# IWDiscordRelay <jacky#7226> okay the one thing of Sele I have working (lol) https://sele.jalcine.dev/test
# IWDiscordRelay <jacky#7226> please break it
# IWDiscordRelay <jacky#7226> lol I just saw that XSS test 😛
# IWDiscordRelay <jacky#7226> hmm okay might need to run rep-hcard on URLs
# IWDiscordRelay <jacky#7226> hehe I can see a case for not having it on your homepage and only on your rep h-card
# IWDiscordRelay <jacky#7226> nice! the less info, the more okay things are
# IWDiscordRelay <jacky#7226> not yet - that's part of another test I want to add; to attempt sign in and remotely show the info from a `profile` request
# IWDiscordRelay <jacky#7226> I was thinking about running the rep h-card on the returned URL
# IWDiscordRelay <jacky#7226> that's a good idea (and I could catch that maybe as a hint to the person)
# IWDiscordRelay <jacky#7226> I know that one thing I do want is a per-client profile response
# IWDiscordRelay <jacky#7226> is there a way to get a human friendly name of an issuer for IndieAuth? I'm thinking of doing a h-app parse of the `issuer` field
# IWDiscordRelay <jacky#7226> that way, Sele can say "Taproot is providing IndieAuth for you" (a bit of an that it's using the right thing)
# IWDiscordRelay <jacky#7226> *an affordable
# IWDiscordRelay <jacky#7226> *affordance! lol
# IWDiscordRelay <jacky#7226> oh really? I figured that it'd be the name of the IndieAuth server (from https://indieauth.spec.indieweb.org/#indieauth-server-metadata)
# IWDiscordRelay <jacky#7226> hm, I can fall back on rep h-card if not found
# gRegor Right, but that metadata is on the personal website, e.g. https://gregorlove.com/indieauth-metadata-endpoint/?pretty=1
# IWDiscordRelay <jacky#7226> it'd be a service for people!
# IWDiscordRelay <jacky#7226> but I can also see the case of those who have it in-built reporting themselves
# IWDiscordRelay <jacky#7226> oh so lemme back up, lol
# IWDiscordRelay <jacky#7226> so when you visit https://sele.jalcine.dev/test?me=https%3A%2F%2Fgregorlove.com
# IWDiscordRelay <jacky#7226> the blue is reporting the value of `issuer` for that URL, not the one entered
# [jamietanna] Sorry gRegor yep that's my bad! Should be deployed in the next couple of mins :crossed_fingers::skin-tone-4:
# IWDiscordRelay <jacky#7226> if someone was using a in-built solution, I can see it setting `issuer` to one's site
# IWDiscordRelay <jacky#7226> but if someone's like using [jamietanna]'s solution, https://sele.jalcine.dev/test?me=https%3A%2F%2Fjvt.me would show a different URL since it's a separate tool
# IWDiscordRelay <jacky#7226> I'm wondering if I can get a name for such a tool to make that more clear
# IWDiscordRelay <jacky#7226> falling back to the URL is okay for me
geoffo joined the channel
# angelo has anyone implemented a device flow on their indieauth server? https://www.oauth.com/oauth2-servers/device-flow/authorization-request/ starts with what looks like a POST to the auth server's token endpoint. would it be correct to kick off the flow with a `device_endpoint` URL in my indieauth-metadata file instead?
jamietanna joined the channel
# jamietanna Not yet angelo but I'm interested in doing it :)
# jamietanna gRegor lemme know if editor.tanna.dev works for you, and sorry for the very clunky experience, I'd built it as a hacky solution for me - with longer term hopes to clean it up to be more usable for folks, but been a busy couple of months so lower on the priority
# jamietanna Welcome any feedback :)
# gRegor Totally understand /life_happens
# [schmarty] angelo: i made an indieauth proxy that does the device flow parts. source on glitch! https://veil-mirror.glitch.me/
# [schmarty] oop here's that source https://veil-mirror.glitch.me/
jamietanna joined the channel
# jamietanna woop :)
barnaby joined the channel
# mro tantek, you say you tried bookmarklets and add-ons - I think they're inevitable. Is there a write-up of your findings?
# @nathanpc RT @mxbck@front-end.social
Do you collect webmentions on your site? I like them, but it can be hard to filter them and see what's going on.
I made this free tool to analyze and chart webmentions that you can use to see monthly …
https://front-end.social/@mxbck/109377803509920444 (twitter.com/_/status/1594444539325870080)
mro joined the channel
# [jamietanna] Has anyone looked into updating webmention.io to understand `follow-of`? Seeing notifications come in from Mastodon as a `mention-of` right now
GWG joined the channel
# [jamietanna] Thanks, I thought I'd seen it before
GWG joined the channel