#dev 2023-12-19

2023-12-19 UTC
geoffo, Renfield, gRegor, geoffo_ and [Murray] joined the channel
#
c​apjamesg Who do I need to talk to about merging https://github.com/w3c/webmention/pull/106?
#
c​apjamesg [tantek] aaron ^
#
Loqi [preview] [capjamesg] #106 Submit implementation report
[KevinMarks], AramZS, geoffo and [tantek] joined the channel
#
[tantek] Is the new GitHub slower for anyone else?
marion joined the channel
#
[tantek] Maybe it's a network issue however I was able to update and reload my own homepage quickly (no JS dependencies, no problems)
#
[snarfed] new GitHub?
#
[snarfed] hey gRegor or anyone else, are you familiar with OpenLibrary? sounds like a reading/books silo similar to GoodReads?
#
[snarfed] I'm struggling to understand this request to add OpenLibrary support to Bridgy: https://github.com/snarfed/bridgy/issues/1633
#
[tantek] yeah GitHub recently rewrote a bunch of webcomponents in React I believe, and there's been quite a few complaints about it
#
[snarfed] ah
#
Loqi [preview] [yepstepz] #1633 [Silo Request] openlibrary
#
c​apjamesg aaronpk: https://github.com/aaronpk/Monocle/pull/59
#
Loqi [preview] [capjamesg] #59 Update manifest to allow PWA support
#
aaronpk hmm I vaguely remember doing that early in Monocle dev and it caused more problems than it solved
#
aaronpk Something about how clicking on links in the reader worked
#
aaronpk it's very possible that has all changed now tho, since when i started developing it you couldn't even set alternative default browsers on iOS
[aciccarello] joined the channel
#
[aciccarello] Someone requested a PWA for Indiekit too https://github.com/getindiekit/indiekit/issues/675
[Caleb_Hearth] joined the channel
#
[Caleb_Hearth] Note that while OpenLibrary is technically a silo, it’s run by Internet Archive so they’re buds.
#
Loqi [preview] [sentience] #675 Make Indiekit a Progressive Web App (PWA)
#
[tantek] capjamesg I am unable to merge your implementation report and I'm not sure who is
#
[tantek] I will ask in the W3C slack
#
[tantek] This looks IndieWeb dev-interest related: https://www.mnot.net/blog/2023/12/19/standards-and-centralization
#
c​apjamesg Thank you.
#
[tantek] The actual RFC is longer and I haven't read through it yet: https://www.rfc-editor.org/rfc/rfc9518.html
#
Loqi [preview] Mark Nottingham
#
[snarfed] reminds me of https://snarfed.org/2010-10-08_standards_or_diversity_monoculture_or_fragmentation . but I'm sure this is much broader and deeper
#
[tantek] Wow from 13y ago! 👀
#
[snarfed] (and standards body oriented)
#
aaronpk [tantek]: capjamesg: I merged the webmention PR, I still have admin on the repo
#
c​apjamesg Thank you!
#
c​apjamesg I am going through all my open PRs to try and clean them up.
#
[tantek] aaronpk++ nice! you merged it before I could get the W3C Slack to work (something with the network here is making JS-heavy webpages/apps fail weirdly)
#
Loqi aaronpk has 41 karma in this channel over the last year (107 in all channels)
#
c​apjamesg If you are in a giving mood: https://github.com/aaronpk/Monocle/pull/59 😄
#
Loqi [preview] [capjamesg] #59 Update manifest to allow PWA support
#
c​apjamesg *an _extra_ giving mood 😄
#
c​apjamesg aaronpk++
#
Loqi aaronpk has 42 karma in this channel over the last year (108 in all channels)
#
c​apjamesg for the review + merge.
#
[tantek] capjamesg did you see aaronpk's chat comments re: 59 above?
#
c​apjamesg Oh no...
#
c​apjamesg Link?
#
[tantek] capjamesg, https://chat.indieweb.org/dev/2023-12-19#t1703003028844900
#
Loqi [preview] [aaronpk] hmm I vaguely remember doing that early in Monocle dev and it caused more problems than it solved
#
c​apjamesg Oh.
#
c​apjamesg I see.
#
c​apjamesg It's not a huge deal.
#
[tantek] or maybe worth experimenting with a dev deployment like dev.monocle ?
#
[tantek] aaronpk while in that repo, this seems like an easy one character fix (unsure why GH thinks there are conflicts) https://github.com/w3c/webmention/pull/112
#
Loqi [preview] [pfefferle] #112 WordPress with capital "P"
#
aaronpk Hm can't do it til back on a computer
#
[tantek] I wonder if that's also because of the GitHub React mobile breakage (supposedly they're fixing bugs) https://news.ycombinator.com/item?id=33576722 (second comment there with "this UI really sucks on mobile (at least on iOS)."
#
Loqi [preview] [todsacerdoti] GitHub is replacing Rails front end rendering with React
#
GWG Can anyone weigh in on the difference of interpretation between gRegor and myself? You can take your time, I'm clearly not going anywhere till next week.
#
[tantek] GWG, context or link?
#
GWG [tantek]: https://github.com/indieweb/indieauth/issues/132
#
GWG Among other things
#
GWG So, gRegor was sending me tickets as I was working on my Ticketing endpoint code refresh.
#
GWG He sent them to wpdev.gwg.us with the subject wpdev.gwg.us, but when I redeemed at his token endpoint, the me property was his staging site. I say the me property should be equal to the subject.
#
GWG And to gRegor's point, it isn't explicit.
#
GWG I use the returned me property from any access token response to associate the response with a local account.
#
[KevinMarks] OpenLibrary is great. There's already a book focused ActivityPub implementation in bookwyrm.social
#
[tantek] Anyone here interested in being nominated for consideration of appointment to the W3C TAG, e.g. to help keep IndieWeb principles represented in standards proposals and work? https://www.w3.org/blog/2023/seeking-w3c-community-input-for-tag-appointees/ folks I can think of that might be up for it: [KevinMarks] [snarfed] maybe even [aaronpk]. Other suggestions welcome!
gRegor, Loqi_ and Zegnat joined the channel
#
[tantek] capjamesg, if you felt like co-chairing SocialCG burned you out, I can tell you that participating in the TAG would be even more challenging
#
[tantek] I think your "youthful flare" as you say would be useful yes!
#
gRegor GWG, I'm commenting on that issue to add some more context now that I've thought about it more.
#
GWG gRegor: Great. I have nothing but time to discuss it
bret joined the channel
#
[tantek] capjamesg, re: "(particularly re: social standards, privacy, etc.)", see https://github.com/w3ctag/design-reviews/issues and see if you find issues you think you can provide a new perspective on! That would be a good way to dip your toe in to see if there's enough there of interest to you.
#
capjamesg [tantek]++
#
Loqi [tantek] has 30 karma in this channel over the last year (99 in all channels)
#
gRegor Hm, capjamesg chat "I'm probably not senior enough..." didn't seem to make it to chat logs.
#
capjamesg I think there might be an issue somewhere?
#
capjamesg Loqi has been a bit slow.
#
capjamesg [tantek] I have weighed in on your thread in the W3C Slack.
#
gRegor what is chat archive
#
Loqi It looks like we don't have a page for "chat archive" yet. Would you like to create it? (Or just say "chat archive is ____", a sentence describing the term)
#
gRegor Hm https://github.com/indieweb/indieweb-chat-archive last commit was 5 days ago
#
gRegor -> meta
#
Loqi [preview] [indieweb] indieweb-chat-archive: Full archive of IndieWeb chat log data files
#
gRegor chat archive is [[discuss#Logs]]
#
Loqi ok
#
gRegor GWG, in a multi-user site, how does my token_endpoint identify which user in the `me` response?
#
gRegor I think the only thing I could do in the ticketing flow is use the `subject` I initially sent as the `me` in the access token response
#
GWG The change is that unlike most IndieAuth servers built, except maybe indieauth.com, this time you are issuing tokens for users who aren't in a coupled relationship to that server.
#
GWG So, sending the subject as the me would make sense, because the token endpoint is coupled with the ticket sending mechanism.
#
GWG So, that is who the ticket authorized giving the token to
#
gRegor Duplicating that doesn't make sense to me
#
gRegor Since you have the subject and have verified it before redeeming for an access token, `me` is redundant in that case
#
GWG gRegor: The question was what it represents. What I'm using it for is a different question though
#
gRegor I mean, one informs the other
#
GWG But, I get a POST to my ticket endpoint. It provides subject(who it is for), resource(what it is for), and issuer(the server that issued it). So, I'm saying that if Subject wants access to Resource, then they can get a token via the issuer.
#
GWG Is there a spoofing scenario inherent in any of this?
#
gRegor I don't think so, with the issuer+indieauth-metadata verification
#
gRegor Another q that your proposed `me` response makes me think of: with the dfn of `me` as "the canonical user profile URL for the user this access token corresponds to", how would my token endpoint be able to know that? I might send a ticket to example.com, but the canonical user profile URL might be example.com/author/alice.
#
GWG gRegor: I still am curious to hear other inputs though.
#
gRegor Same
#
GWG gRegor: That is a good question for the specification. But there is an answer, you are sending it to a page, in theory, with an appropriately marked up h-card
#
gRegor I think another way to put how I view the `me` in that response is "the domain that has authority over this token". My domain issued it, can revoke it, etc.
#
GWG gRegor: And for me, that's the issuer.
#
gRegor That's a bit "in theory" for this spec, I think.
hacdias joined the channel
#
gRegor *a big
#
gRegor Good point on issuer, that's right
#
gRegor Time for some lunch
#
GWG The authorization response returns issuer, but the ticket response doesn't.
#
capjamesg hacdias Hello! I loved your Spotify Wrapped blog post.
#
gRegor That's interesting. Maybe both should.
#
hacdias capjamesg hey! Thanks :D
#
hacdias decided to join as i'm trying out irc again 😅 it's been some time
#
GWG gRegor: With everything public, it might be warranted
#
capjamesg Let's move to #indieweb-chat!
#
[jacky] struggling on ideas of silos to support for web sign in
#
[tantek] jacky, GitHub might be it at this point. Possibly Flickr too
#
[jacky] ah yes Flickr
#
[jacky] if Medium had a IdP of sorts (or some api to search for a profile URL)
#
AramZS hacdias Oh, you should link that post here I don't think I read it and I like Spotify Wrapped posts
#
gRegor what is spotify wrapped
#
Loqi Year in Review is a feature on some silos (like Facebook) as well as being a special kind of article on some IndieWeb sites that summarizes important aspects of the past year, sometimes on specific topics like books read https://indieweb.org/Spotify_Wrapped
#
gRegor Can also add yourself to indieweb examples on /year_in_review if you'd like!
#
hacdias AramZS here: https://hacdias.com/2023/11/30/spotify-wrapped/ 😅
#
Loqi [preview] [Henrique Dias] Spotify Wrapped 2023
#
AramZS Cool!
#
gRegor [jacky], Also leans more dev folks, but does Stackoverflow have OAuth?
#
[jacky] good question lemme see
#
gRegor what is dev.to
#
Loqi DEV or dev.to is a silo-based community of software developers that uses their platform for discovery, publishing articles and networked learning about programming and development topics https://indieweb.org/dev.to
#
[jacky] yup https://api.stackexchange.com/docs/authentication
#
gRegor Maybe dev.to
#
[tantek] Maybe http://Wordpress.com?
#
[jacky] Wordpress; I'm leaving out b/c I'm letting them use an IndieAuth plugin (and effectively delegate that itself)
#
gRegor worpdress.com doesn't (easily) allow those plugins afaik, different than self-hosted WP (.org)
#
[jacky] and it doesn't implicitly provide a oauth2 provider
#
gRegor what is wordpress.com
#
Loqi Wordpress.com is a blog hosting service that runs the WordPress open source software https://indieweb.org/WordPress.com
#
[jacky] there is an auth api https://developer.wordpress.com/docs/oauth2/ for the hosted service
#
gRegor Hm Bridgy has Medium on there, wonder what that's using for auth
#
[snarfed] Medium's own API
#
[snarfed] [jacky] http://micro.blog?
#
[jacky] that I'd opt to use http://micro.blog's IndieAuth support as well (unless http://micro.blog doesn't provide that?)
#
[snarfed] Tumblr, Google, Mastodon, Pixelfed?
#
[jacky] lol: yes, nope, yes and yes by #3 via Mastodon's oauth2 flow
#
[jacky] only no to #2 b/c that'd opt to be using e-mail (and I have the e-mail sign in flow down)
#
[jacky] needs to just deploy
#
gRegor deploy++
#
Loqi deploy has 1 karma over the last year
#
[jacky] hmmm well actually
#
[jacky] for google, could I sniff at DNS for site verification and confirm that's active via their API somehow?
#
[jacky] ah ha, you can
#
[jacky] https://developers.google.com/site-verification/v1/getting_started
#
[jacky] and the limitations work perfectly (only being able to see verified sites under one's own name)
#
[jacky] that'd be enough for most silo users tbh
#
[jacky] the baseline requirement I'm going for is if with a URL, can I determine its "provider" using a hueristic and from there, ask that provider if it knows of this URL and if it's possible to get it when authenticated with that resource
#
[jacky] (to implement web sign in)
[0x3b0b] joined the channel
#
[KevinMarks] How about omg.lol
#
[KevinMarks] TAG does sound interesting
#
capjamesg I'm sure you'd be great at it [KevinMarks].
#
gRegor Is it freeze TAG or regular TAG?
#
capjamesg We call "tag" "tig" in Scotland :D
#
[tantek] gRegor, more like you tag someone and you're still "IT"
#
gRegor what is omg.lol
#
Loqi omg.lol is a platform on which you can build a web presence, offering features like hosting a simple landing page, email forwarding, and URL redirection, and a community around the product https://indieweb.org/omg.lol
trwnh joined the channel