#dev 2024-05-20

2024-05-20 UTC
geoffo joined the channel
#
aaronpk reillypascal: I just pushed a change to webmention.io that might be causing this
#
aaronpk log in and look at the "sites" page, make sure you have a site created there
#
aaronpk it no longer accepts webmentions for arbitrary domains on your account anymore, you have to add a domain specifically now
#
reillypascal Ok good to know!
#
reillypascal OK it's working now for the receiver test!
#
reillypascal Thanks, I appreciate the help!
#
aaronpk yay glad it's working now
#
Loqi giggles
[snarfed] joined the channel
#
[snarfed] 😢 👍 https://github.com/aaronpk/webmention.io/issues/182
#
reillypascal Just to clarify, do I have to explicitly add the individual blog posts, or can I just add my home url?
#
aaronpk no just the domain
geoffo, gerben, Renfield, box464, WhatDidYouExpect, jeremycherfas, [Joschi_Kuphal] and [KevinMarks] joined the channel
#
[KevinMarks] [snarfed] mention.tech does that - it stores webmentions for any target domain but also passes them through if a webmention endpoint is found.
#
capjamesg morganwebdev++
#
Loqi morganwebdev has 2 karma in this channel over the last year (3 in all channels)
#
capjamesg I appreciate the background on your project!
Guest6 and GuestZero joined the channel
#
[snarfed] [KevinMarks]++ awesome!
#
Loqi [KevinMarks] has 17 karma in this channel over the last year (31 in all channels)
[Jo] joined the channel
#
[Jo] I'd like to get MicroPub on my site, is there any server for it that's easy to just slap on top of a static site?
#
aaronpk what is micropub servers?
#
Loqi Micropub servers are existing endpoint implementations of Micropub https://indieweb.org/Micropub/Servers
#
aaronpk depends on the static site generator but there are some options there ^^
GuestZero, [byJP], [Paul_Robert_Ll] and Guest6_ joined the channel
#
pcarrier Mhmm are there features I can build in a static site hosting service to enable the indie web?
#
aaronpk A big one would be a service that accepts webmentions and provides some JS people can use to show the comments
#
aaronpk if they're already logging in to your service you have a perfect place to show a feed of recent comments to them
#
pcarrier aaronpk[d] do you get any value from having that be provided by your host rather than a third-party?
#
sebbu wonder if some service like discourse could be compatible webmention
#
aaronpk A better user experience
#
aaronpk this is actually kind of what micro.blog is, since it's also a static site hosting platform under the hood
#
sebbu https://webmention.io/ exists
#
aaronpk It leaves a lot to be desired, and also having more than one option for people would be better
[schmarty] joined the channel
#
[schmarty] oh wow i missed some good passkeys and indieauth talk. glad y'all are figuring out the passkeys-for-indieauth implementations instead of me. my eyes absolutely rolled back in my head trying to load all that in.
#
[schmarty] aaronpk re https://github.com/indieweb/indieauth/issues/133 it feels somewhat cursed to me to have the `client_id` point directly to a document about that client but i also kind of get it, since we're assuming most indieauth systems will need to take that `client_id` value and do some lookups about it. so, i guess i'm for it?
#
[schmarty] i guess i should write that on the issue 😂
#
[tantek] capjamesg++ for https://jamesg.blog/2024/03/14/spring-cleaning/
#
Loqi capjamesg has 41 karma in this channel over the last year (191 in all channels)
#
[tantek] appreciate the thought put into trimming of services to maintain, recognizing ongoing admintax etc.
#
[Joe_Crawford] learning to live within a budget is not just money, it's time, it's effort, and it's a very good practice capjamesg++
#
Loqi capjamesg has 42 karma in this channel over the last year (192 in all channels)
Guest6 joined the channel
#
aaronpk i need to do some of that spring cleaning myself heh
#
aaronpk [schmarty]: "cursed"?? hahaha
#
Loqi hahaha
#
[schmarty] _cursed!_
#
[schmarty] coming from the current IndieAuth spec, where "client_id" is a URL for which I expect human-readable stuff, it feels cursed to say "client_id just for computers now"
#
aaronpk yeah,it's a difference, but i think it's the least bad compromise that could lead to a lot more adoption
#
aaronpk (one of the more-bad options being client_id is the human-readable URL and the AS fetches the client metadata from a .well-known path)
barnaby joined the channel
#
[schmarty] totally agree about avoiding a new .well-known, the lawful evil option. maybe its presence is making me feel weirder about the client_id change which, honestly, is probably only a little weird.
#
aaronpk i was hoping to get the email client community on board with this, but they have an even stronger aversion to hosting web services entirely, and opted for dynamic client registration instead
#
aaronpk the irony being that mastodon already went down the dynamic client registration path and it made kind of a mess of things, and switching to this client_id URL option simplifies a lot
#
[schmarty] as someone who maintains a pile of messy indieauth clients and a messy indieauth provider, the transition concerns me a bit.
#
[schmarty] if i flip all my clients before providers are updated, users will see "some-url-to-a-json-file wants you to log in!!!"
#
aaronpk true, i guess the good news is there aren't _that_ many indieauth providers at the moment 😂
#
[schmarty] and providers probably need to support 🕯 the old ways :rock: as a fallback if the client_id isn't a JSON document. a write-up of that algorithm would be appreciated!
#
[schmarty] that we know of! i mean... selfauth is out there in the wild!
#
aaronpk i would probably recommend the fallback behavior of showing the domain name of the client_id, whether that's because it's an old client or because there's an error fetching the metadata document
#
aaronpk or an error with the contents of the metadata document even
#
[schmarty] interestingly we don't appear to have fallback advice in the current spec https://indieauth.spec.indieweb.org/#client-information-discovery
#
aaronpk oh hm it's kind of implied in the first sentence
#
aaronpk "it will often want to display some additional information about the client beyond just the client_id URL"
#
[schmarty] right, but that specifies the full client_id URL, not just the domain name.
#
aaronpk not sure if we used to have something more specific than that, i feel like we did?
#
[schmarty] i'm thinking of attacks where two clients are hosted on the same domain
#
aaronpk yeah, but in that case your browser would already be sharing cookies with the two clients because they're on the same domain
#
[schmarty] "fails enough existing security practices that no one should be doing this"
#
aaronpk pretty much
#
aaronpk or at least shouldn't be thinking of them as separate clients from a security boundary perspective
#
[schmarty] still feels a bit like hiding potentially meaningful information from the user in the name of conveniently hiding meant-for-computers information from the user.
#
aaronpk well it _should_ provide meaningful information to the user
Zegnat joined the channel
#
[schmarty] sorry, yes, i'm still talking about a case where we have something like http://example.com/good_client/info.json and http://example.com/bad_client/info.json and if the bad client JSON info is broken or missing our advice to indieauth providers would be "just show http://example.com"
sknebel and oenone joined the channel
#
[schmarty] yes people shouldn't do this, cookies, etc., but someone will and a user won't be able to differentiate them.
#
aaronpk the other way to look at it is that those two clients aren't *actually* different clients because they're on the same domain
#
aaronpk so it's actually more helpful to tell the user they are about to authorize the domain name of the client because their data isn't actually limited to just one of those clients
#
[schmarty] i feel that model requires keeping too narrow of a perspective on cookies / local storage sharing.
#
aaronpk another piece of advice could be to recommend clients use as short of a path as possible for the times where servers might display the full URL, so recommend "https://example.com/client" rather than "https://example.com/the_client_name/info.json"
#
[schmarty] i don't have my head around the complexity of that, but it feels better!
#
[schmarty] i just want it to be easier to make micropub clients lol
#
aaronpk FedCM actually makes it quite a bit easier since it removes the indieauth server discovery step from what the client has to do
#
[schmarty] yeah i _think_ i'm excited about that work. my daily drivers are Firefox and mobile Safari and they're all Nos on FedCM currently 😓
#
aaronpk safari is officially "supportive"
#
aaronpk it'll get there
#
[schmarty] aaronpk++ thanks for all the efforts to make this stuff indieweb friendly
#
Loqi aaronpk has 44 karma in this channel over the last year (128 in all channels)
[keithjgrant], Saphire, [aciccarello], [qubyte], barnaby and jeremycherfas joined the channel
#
[KevinMarks] Bridgy fed as spam vector https://conspirator0.substack.com/p/federation-and-political-spam
#
aaronpk oh dear
#
[Joe_Crawford] > _"Learn about Nostr: A simple, open protocol that enables a truly censorship-resistant and global social network."_
sadome joined the channel
#
[Joe_Crawford] it seems Nostr hasn't totally sorted out their complaint about social media being _"overrun with spam and bots"_
#
[Joe_Crawford] https://nostr.com
#
Saphire [Joe_Crawford]: The entire point of Nostr is to not have moderation, or at least the entire appeal of Jack Dorsey
#
Saphire *for JD
[Joe_Crawford] joined the channel
#
[Joe_Crawford] 😕 yes.
#
[Joe_Crawford] In an actual dev question vein: I was looking at what I might do for testing for blogofthe.day I was looking at adding unit tests or integration tests or both. Any recommendations on best practices for testing 11ty-based sites? I don't see unit tests on the http://11ty.dev site but maybe I'm not looking for the right thing.
#
[Joe_Crawford] I mean, the continuous deployment is de-facto validation of fitness but I do like a belt and suspenders.
#
Saphire What is 11ty?
#
Loqi Eleventy is a JavaScript based static site generator that allows the user to select their own preferred template engine and theme, which in practice can and does enable use of microformats2 https://indieweb.org/11ty
#
Saphire Okay it's not another acronym like k8s or i18n, yay. Not yay that I thought it was one x'D
barnaby, [pfefferle] and [tantek] joined the channel
#
[tantek] or a11y or s12y. thus 11ty should really be 6ty 😉
Inc and geoffo joined the channel
#
[schmarty] ok aaronpk! i tried to capture my concerns on the GH issue https://github.com/indieweb/indieauth/issues/133#issuecomment-2121389944
#
Loqi [preview] [martymcguire] After some discussion [in the #indieweb-dev chat today](https://chat.indieweb.org/dev/2024-05-20#t1716220750926700) between aaronpk and myself, some things I'm considering are: Avoiding a new `.well-known` feels like a good goal. Changing the m...
#
aaronpk [schmarty]++
#
Loqi [schmarty] has 12 karma in this channel over the last year (25 in all channels)
#
[tantek] well-known--
#
Loqi well-known has -7 karma in this channel over the last year (-10 in all channels)