#dev 2022-12-01

2022-12-01 UTC
[aciccarello], [jacky]1, [chrisaldrich]1 and Nuve joined the channel
#
[tantek]
Yeah we should collect the set of specs that would benefit from an update at W3C like at least Webmention, Micropub, and a few others that should be adopted as well beyond incubated, prototyped, implemented, and ready for formal standardization with test suites etc. like IndieAuth, Microsub. Could WebSub benefit from a minor update? Errata?
#
GWG
I'd like to see about adding some of the stable Micropub extensions to the spec.
Seirdy joined the channel
#
[catgirlinspace]
so i’m thinking of using deno+liquidjs (for templating) for building a new website that’s more indiewebified compared to my current website. does anyone have any advice on like, other ways i could do it or would this work ok?
#
[KevinMarks]
I don't know either of those, sorry. I like nunjucks for templates, though they tempt me to put more logic in the template side sometimes.
#
gRegor
what is liquidjs
#
Loqi
It looks like we don't have a page for "liquidjs" yet. Would you like to create it? (Or just say "liquidjs is ____", a sentence describing the term)
#
[catgirlinspace]
pretty much, yeah. just a js port i believe.
geoffo joined the channel
#
[catgirlinspace]
aaronpk how do you do storage for likes and bookmarks? i saw on the wiki page for p3k that text stuff is done on the file system. are likes and bookmarks the same?
#
[catgirlinspace]
(i might want to use the idea of putting stuff on the file system with an SQL db for caching things)
#
aaronpk
Yeah every post is the same
#
aaronpk
The likes also store the contents of the post I like so it ends up working well for that too
#
[catgirlinspace]
wait so do you iterate over the directories or something for when someone goes to https://aaronparecki.com then?
#
[catgirlinspace]
oh im blind. thx.
#
aaronpk
Yep everything except the post contents is DB driven, but the files on disk are canonical
benatkin, gRegor and gRegorLove_ joined the channel
#
[catgirlinspace]
neat. for webmentions then do you just send an api request to webmention.io when rendering a page?
[snarfed]2, [ender]1, [manton]1, [tantek]1, IWSlackGateway1, [KevinMarks]1, [schmarty]1, dtinth0, strugee-, wagle_, Zegnet and nsh- joined the channel
#
aaronpk
Webmention.io sends a web hook to my site and I store comments in the DB
#
[tantek]
what is nunjucks
#
Loqi
nunjucks is a templating language for JavaScript https://indieweb.org/nunjucks
rubenwardy, angelo, mro, porquilho, tiim, petermolnar, IWDiscordRelay, mouse[d] and [fluffy] joined the channel
#
Loqi
[Jeff Moss] #MastoAdmin Life: Trying to optimize images and page load times and you find out that the server thumbnail gets auto converted from whatever format you give it into a .png.So a 55k .webp thumbnail grows to a 1meg .pngGive it a 300k .png thumbnail? Co...
gRegorLove_ and [jamietanna] joined the channel
#
[jamietanna]
GWG or if we could at least produce spec-like structure for stable extensions, as digging through GitHub to see how to implement things isn't the nicest
geoffo and [eddie] joined the channel
#
GWG
[jamietanna]: Either way
#
IWDiscordRelay
<c​apjamesg#4492> [snarfed] Do you have a list of links on indieweb.org?
#
IWDiscordRelay
<c​apjamesg#4492> Or is there an easy way for me to get a list of wiki pages?
Nuve joined the channel
#
[tantek]
capjamesg -> #indieweb-meta
#
[manton]
I’ve been testing moving Mastodon accounts. Seems like all that is needed is knownAs aliases on the new account, and then the old account initiates moving followers. Anyone know if there is another step I’m missing?
#
aaronpk
i thought the old account also needs a knownAs
gRegorLove_ joined the channel
#
[snarfed]2
and they also allude to a Move AP activity https://docs.joinmastodon.org/user/moving/#Capa_1
#
[manton]
Doesn’t seem like it. There is a “movedTo” on the old account, but I assume that is optional.
#
[manton]
Yeah, the “Move” Activity is sent to everyone who is following you, telling that instance to update the following list.
#
[manton]
Just as a user, it is a pretty confusing system. Not sure how it could be better, though.
#
[manton]
I think I’m going to roll out my initial support for migrating _to_ Micro.blog and see how it goes. If it works well, I’ll add migrating _out_.
gRegorLove_, Nuve, gRegor, win0err and geoffo joined the channel
#
Loqi
[Polymer Witch] 🤔 I wonder if I could have mastodon signups sync into LDAP and use that for authentication on a loomio and a wiki? It would probably require them to be added as apps via OAuth and then give some sort of authentication of account.
[jacky] joined the channel
#
[KevinMarks]
You do need the dual authority to move. My initial suggestion was to use the rel=me for that, but they used an explicit knownAs
#
[manton]
In my testing, knownAs from the old instance doesn’t appear necessary. By initiating the move, you’re essentially saying the same thing, but it’s not added to the JSON. Unless I missed something. I’m going to test this again.
#
aaronpk
interesting, the docs explicitly say you have to have the link on both ends, so maybe that's a bug?
#
[manton]
It’s hard to verify after you’ve migrated because Mastodon locks your account.
#
[KevinMarks]
So do the instances the followers belong to check the knownAs on the destination?
#
aaronpk
yeah you need to have a second account to look at thing
#
[jacky]
I'm realizing that slowly my best option to use IndieAuth with apps is supporting OIDC (which is kinda sad)
#
[manton]
[KevinMarks] Good question… My “Move” implementation doesn’t, but maybe it should. I think I assumed that HTTP signatures were enough to verify the move request is legit.
#
aaronpk
what do you mean [jacky]
#
[jacky]
(like without having to send a patch or contribute)
#
[KevinMarks]
What happens if the followers' instance blocks the destination instance?
#
[jacky]
like I've been wrestling with adding it to Gitea but I'm seeing that it has support for OIDC 2
#
aaronpk
oh like other apps that have OIDC support already?
#
[manton]
[KevinMarks] I guess you lose that follower! It all feels a little flaky.
#
aaronpk
actually where do you see that [jacky]? I can only find their oauth provider docs
#
[manton]
Another part of migration that would be better with domain names is moving account A → B → C. A is not going to know about C, so the “this account has moved” isn’t totally right.
#
aaronpk
OpenID 2 is officially deprecated too so i would recommend they replace that if they really support OpenID 2
#
[jacky]
_dang_
#
[jacky]
it's in the settings pane for Gitea
#
aaronpk
i see regular openid connect there
#
[jacky]
(hopes that the Slack bridge sends over photos)
#
[KevinMarks]
[manton] that's assuming that the admin is working with the migrating user. I can see a way for an admin to eject a user to a dead end instance with this, but I suppose they could just delete them.
#
aaronpk
it does not
#
aaronpk
ok yeah that is openid connect, not openid 2
#
[jacky]
ah okay
#
[manton]
Update: I was wrong. Unless I’m seeing some caching behavior, you do need aliases set in Mastodon both ways.
#
aaronpk
hmm so close
#
aaronpk
i tried putting in my indieauth metadata URL there
#
aaronpk
got redirected back with a 500 server error tho
#
[jacky]
dang okay
#
[jacky]
but if OpenID Connect is a good way to do this with existing OAuth2 apps then I might try this more
#
[jacky]
thought it seems like IAM endpoints should even supplant that too
#
aaronpk
indieauth is pretty close now except the ID token, but OpenID Connect doesn't even require ID tokens
#
aaronpk
the only weird thing is most OIDC consumers expect that you have to use a preregistered client ID/secret, but you can just put in whatever you want for those that your indieauth server will recognize
#
aaronpk
hmm the error in the gitea logs is "UserSignIn: could not find a matching session for this request" which suggests this is a lot closer to working than not
#
aaronpk
oh nvm
#
aaronpk
"PANIC:: interface conversion: interface {} is nil, not string"
#
aaronpk
so it's expecting something in the response that it's not getting, possibly id_token
#
aaronpk
ok yeah they are expecting an id_token in this integration instead of using the access token to look up the user info
#
aaronpk
lol wat they check the ID token then *also* go fetch the user info endpoint
#
aaronpk
they don't request the "profile" scope but they expect profile info in the userinfo endpoint
#
aaronpk
so this integration has some bugs :)
#
aaronpk
anyway [jacky] you're going to have to implement OpenID Connect a specific way to get it to work with Gitea, or file issues to get them to do things differently with OpenID. Or get the library gitea uses to support indieauth, which would be basically ripping out a bunch of code from their openid provider
#
Loqi
[jalcine] #291 Adding support for IndieAuth
#
[manton]
Final update on the Mastodon migration, because I have to keep correcting myself. It was a caching issue. No knownAs is needed on the old account that is moving. There is a movedTo field though.
#
aaronpk
is movedTo required?
#
[tantek]
[KevinMarks] the "knownAs" thing is an injection from the RDF/SW crowd who have long used a `alsoKnownAs` predicate
#
[manton]
[aaronpk] I don’t see how it could be required exactly, unless servers are supposed to verify that movedTo is set when accepting a Move activity.
#
[manton]
“Move” is not in the W3C’s ActivityPub spec. I have no idea where it’s even documented!
#
aaronpk
a lot of mastodon is not in the activitypub spec :)
#
[manton]
Also, I’ve been saying knownAs but it is alsoKnownAs. Thanks [tantek].
[hollie] joined the channel
#
[snarfed]2
parts of AP are specified in AS2
#
[tantek]
^ there is that, *and* there are Mastodon-specific extensions to AP which, AFAIK have not been well documented or integrated using the supposed extension mechanism in place to enable it
#
[tantek]
literally the excuse to make AP use/depend-on JSON-LD was that *allegedly* JSON-LD, @context, all that namespace nonsense had a functioning extensibility story.
#
[tantek]
Some of us pushed back on that claim, e.g. asking, if that's true, can you point to any successful examples of a spec with an @context was later extended by someone else with another @context in any real products. Crickets.
#
[tantek]
We were told to believe JSON-LD/@context extensibility would work effectively "on faith" (AKA "because we said so because we're experts"). We know how well that works out in technology (almost never).
#
[tantek]
this is why namespaces--
#
Loqi
namespaces has -3 karma in this channel over the last year (-4 in all channels)
#
[tantek]
and especially URLnamespaces--
#
Loqi
URLnamespaces has -1 karma over the last year
#
[tantek]
like the ns URL with the OStatus domain which is now squatted by an Indonesian gambling site
#
[schmarty]
haha i just went on a mental spiral of trying to solve the "if this org cares so much about a domain how did they lose it??" problem and :face_with_spiral_eyes:
#
[snarfed]2
one place to start: what's the org
#
[snarfed]2
(hint: arguably there isn't one)
#
[schmarty]
(it was like "i bet it was a single-point-of-responsibility" => "what was the org structure? / how much org structure should one expect?" => "what if there were trusts for DNS management? / what would that control look like?" => "uh oh multi-party agreement / shared passwords / abort abort / bail out bail out"
#
[schmarty]
snarfed: 💯
#
[tantek]
I read that (hint) in "narrator's voice"
#
[snarfed]2
😎
#
gRegor
[snarfed]2, tried searching github but couldn't find an issue: are regular @-mentions supported in BF? I tried linking the @-@ in my post and also just as plain text, but it didn't show up as a notification for [Joe_Crawford]
#
[manton]
[snarfed] That example in ActivityStreams does not actually match what Mastodon sends, though! Also it doesn’t explain anything about how servers should implement it, e.g. do they need to verify a move is valid.
#
[snarfed]2
yeah the example in the spec is for a post, so I image an account move will look different
#
[snarfed]2
but yeah maybe underspecified, given how important a feature migration has turned out to be
#
[snarfed]2
again one reason I like what the Bluesky people did with AT
#
[manton]
Yeah, I’m still very interested in Bluesky.
#
[snarfed]2
gRegor mentions are maybe half supported. I don't parse HTML contents and send separate Mention activities for every link, if that's what you're asking
#
gRegor
Gotcha. I was thinking like with twitter they autolink @example names, but with Mastodon I'm guessing it needs an explicit 'mention' object to link the name
#
gRegor
Which does sound tricky
#
[tantek]
snarfed, indeed, and it makes me wonder if we should write something up more formally about how to use, parse, process, notify IndieWeb @domain identities
#
[tantek]
without going down any crypto/blockchain/whatever ratholes
#
[tantek]
[manton] I'm curious what use-cases are drawing your interest to BlueSky, or if it's more like an interesting science experiment to observe from a (safe) distance
#
IWDiscordRelay
<c​apjamesg#4492> This may be a long shot but has anyone played around with semantic search here? I have been playing around with BERT for information retrieval and I'm impressed. IndieWeb Search hasn't been returning useful results for a while so I thought about a semantic search approach. It's not quite working as expected.
mlncn joined the channel
#
[manton]
[tantek] Mostly a science experiment. I’ve also been wondering if it could be a federated backup plan if ActivityPub doesn’t work out (scaling problems or identity problems).
#
[tantek]
that's a fascinating framing for sure (federated backup plan)
#
[tantek]
I feel a lot of "what is federating/federation" is a language & framing issue.
#
[tantek]
E.g. [manton] I'd be curious what you think of this "How to" section and if that aligns with what you think of as "federated" or "federating", and if not, what's missing and/or what doesn’t match up from your perspective (and in comparison to ActivityPub)
#
[manton]
I worry a little that “federation” as a word is being redefined with the Mastodon interest. To me, it implies more of multi-user sites connecting to each other, vs. the IndieWeb’s focus more on true distribution: individual single-user sites (domains) connecting.
#
[manton]
From my perspective with Micro.blog, my stuff will always be IndieWeb-first. But I like layering on other APIs where I can for compatibility, and that’s how I’ve been viewing ActivityPub.
#
[manton]
And how I’d view Bluesky.
#
[manton]
Maybe for that wiki page, there should be a separate page at /fediverse instead of redirecting. Hmm.
#
[tantek]
Interesting, so the multi-user on a single site aspects of "federation"
#
[tantek]
the reason I ask is that to some extent the term "federation" and even "fediverse" has been coopted, and that's not a good thing
#
[manton]
Yeah, I think that’s right. When I said “redefined” above, I almost typed coopted.
#
[tantek]
Even the Wikipedia page has issues https://en.wikipedia.org/wiki/Federation_(information_technology) though at least it seems to be general enough to not be coopted
#
[tantek]
OpenID as an example there is a bit out of date since OpenID(2) adoption is pretty much dead right?
#
[tantek]
hmm even the OpenID page itself still talks about OpenID1/2 as "current" when it really should be updated to document it as a past thing: https://en.wikipedia.org/wiki/OpenID
#
IWDiscordRelay
<c​apjamesg#4492> [tantek] ^
#
aaronpk
"OpenID Federation" means an entirely different thing now too
#
[tantek]
capjamesg have not seen that article. I know the general concepts
#
[tantek]
aaronpk how can OID federation mean anything meaningful now since there’s no guarantee or even strong encouragement of OIDC “identities” working across systems.
#
aaronpk
it's federation between enterprise systems
#
Loqi
Roland Hedberg (editor)
#
[snarfed]2
entertaining side effect of Bridgy Fed's new monitoring, I can see mastodon.technology suddenly start sending out Delete activities for all of its users since it's shutting down. https://snarfed.org/mastodon-technology.png
#
aaronpk
interesting that they decided to do that and not just pull the plug
#
[KevinMarks]
They gave people notice so they could migrate
#
[jacky]
and the broadcast prob helps with semantically tying up loose ends
#
[manton]
[KevinMarks] I just randomly noticed some mastodon.technology deletes today too… I did not expect they would actually do that. Most Mastodon instances just go away quietly.
#
[manton]
Wonder if that is considered best practice and what if an instance has 1 million users? Would they really send out 1 million deletes? Seems kind of nutty.
#
aaronpk
just another example of why a push-driven spec isn't actually scalable
#
[manton]
Yeah. I think my biggest concern is the potential flakiness when a server is temporarily down… Do you retry sending the activity, and if so, how long, and how often? I expect some things are just lost.
#
[snarfed]2
1M deletes x however many instances those users have interacted with
#
[KevinMarks]
This is why the websub design is actually good.
#
[schmarty]
xeiaso++ definitely some fun mastodon-protocol learning in here! https://xeiaso.net/blog/coso-private-account-bypass
#
Loqi
xeiaso has 2 karma over the last year
#
[schmarty]
(also i lol'd at "Construct an HTTP request with the moral equivalent of this curl command")
#
cambridgeport90[
I'm just curious, though. Who would want to have their Mastodon (or any fediverse account) configured like that? What would be the point... after all, the web is meant for interactions and to be viewed. Having a server run like that... just seems to open the door to more proprietary-ness, so to speak. I can't find a better word. Can anyone explain what I think I'm missing?
[Murray] joined the channel
#
[fluffy]
I definitely feel like polling+websub is the way to go if you want anything to scale. Mastodon has had SO MANY historical issues due to how push retry works, and the lack of any sort of pull-based backfilling.
#
aaronpk
for all the people complaining about how mastodon causes 100s of requests to a URL to fetch the link preview, at least setting up a web server to handle a bunch of GET requests is relatively straightforward
#
aaronpk
caching is a known problem with plenty of different ways to solve it