#dev 2024-08-31
2024-08-31 UTC
# 
ben i found https://modernfontstacks.com/ recently
jonnybarnes joined the channel
# 
[KevinMarks] The Tufte principle you want here is small multiples - stack the 2 charts for different terms instead of overlaying them where the one in front dominates. Consider doing them as bars rather than lines too.
ttybitnik joined the channel
# 
sebbu ben, i prefer https://www.nerdfonts.com/
[qubyte] joined the channel
to2ds joined the channel
# ptramo[d] to2ds[d] not that I know of. And conneg--
# ptramo[d] to2ds[d] you _can_ specify link type= to indicate a mime type
# ptramo[d] ah yup, https://pcarrier.com/conneg totally causes a second request with `Accept: text/css,*/*;q=0.1`
rozenglass joined the channel
# ptramo[d] there was no link.
# ptramo[d] ah! I was considering designing a solution for conneg on xmit.co but if even cloudflare doesn't support it… no thanks
# ptramo[d] not as far as I understand no
# ptramo[d] [edit] cloudflare simply won't take the Accept header into account for the caching of anything but images according to https://simonwillison.net/2023/Nov/20/cloudflare-does-not-consider-vary-values-in-caching-decisions/
# ptramo[d] cloudflare simply won't take the Accept header into account for the caching of anything but images according to https://simonwillison.net/2023/Nov/20/cloudflare-does-not-consider-vary-values-in-caching-decisions/
# ptramo[d] [edit] cloudflare simply won't take the Accept header into account for the caching of anything but images according to https://simonwillison.net/2023/Nov/20/cloudflare-does-not-consider-vary-values-in-caching-decisions/
mattbcool[d] and [Pierre_Carrier] joined the channel
# pcarrier no, rel="alernate" href="…" type="foo/bar" tells the browser to fetch with (in short) Accept: foo/bar
# pcarrier but then cloudflare might have cached the URL with type text/html and decide to serve that regardless of what your server would do
# pcarrier What you really want is to have every payload on its own url, even if they represent the same resource, and everything is dandy
# pcarrier So no conneg--
# pcarrier Almost want to implement the Gemini protocol on xmit but I really can't get over tofu for certificates
# 
Loqi It looks like we don't have a page for "tofu" yet. Would you like to create it? (Or just say "tofu is ____", a sentence describing the term)
reno_ joined the channel
# superkuh TOFU is the way.
# superkuh Way better than CA TLS.
# superkuh For human persons.
# pcarrier Humans don't speak tls, it's all tools
# superkuh Yes, but humans use them. And CA TLS is designed for the needs of corporate persons, not human ones.
# pcarrier What do you do when your private key is compromised?
# superkuh What do you do when the CA enclave secrets are leaked?
# pcarrier superkuh: CA bundle distributors handle those extremely rare occurrences (compared to random server keys being compromised)
# superkuh pcarrier, both are so rare as to not be a significant worry.
# pcarrier I've had to rotate secrets many times in my career
# pcarrier It's a significant worry to me.
# superkuh In a personal context?
# superkuh Or at work?
# pcarrier GitHub ssh keys changing was a huge hassle for a lot of users. It's not harmless.
# superkuh I've never had my home webserver's keys stolen. Well, except that time the FBI stole all my machines in 2011.
# superkuh But what can you do about that... not much.
# pcarrier superkuh: both. I assume zero days are exploited though.
# pcarrier Also I use letsencrypt for everything now. My private keys are rotated every 2 months if I do nothing.
# superkuh My self-signed cert expires in 2050. Different strokes for different folks I guess.
# pcarrier Yeah some people don't really care about security by industry standards.
# superkuh I worry more about the political and social pressures applied to full centralized CAs than getting hacked.
# pcarrier Worst case scenario you have to change provider and your customers stop being impacted. With tofu our customers are screwed unless there's a sensible UI around rotation (which there clearly isn't for ssh, I haven't reviewed Gemini clients)
# superkuh I don't have customers.
# pcarrier I call people I provide a service to customers, whether paying or not
# pcarrier If you build things for nobody but yourself, no offense but your own UX is your own choice, whatever
# superkuh My "customers" (in that sense) would not be screwed or even impacted at all because I do the proper HTTP+HTTPS setup,
# superkuh HTTPS only is so fragile.
# superkuh Only really called for if you're dealing in sensitive information, money, etc.
# superkuh I hope all my visitors have JS whitelist only and disabled by default.
# pcarrier ads can be injected at the HTML level
# superkuh Can, but aren't. For-profit only knows how to js.
# superkuh What value is merely advertising? The value is in the spying and tracking with JS.
# superkuh And with HTTPS only you've basically given control over to a corporation. Every 90 days they either approve you or don't.
# superkuh Unvisitable without their approval.
# superkuh There are no non-corporate CAs.
# superkuh At least not with cert stores in everyone's browser.
# pcarrier you consider https://www.abetterinternet.org/ a corporation?
# superkuh It's the least worst of them. And as LE's value goes up and more and more centralize in LE it becomes more of a target for legal and social pressures.
# superkuh It is definitely a corporation though, technically.
# superkuh Just like .net was/is.
# superkuh Enough value and it'll get corrupted in time.
# superkuh HTTP+HTTPS is a way to mitigate that eventuality.
# superkuh Not for a bank, but for personal websites.
# superkuh And HTTPS TOFU is even better.
# pcarrier I mean honestly, if you're concerned about the pressure that can be applied to vendors, I wouldn't worry about CAs, I'd worry about DNS
# superkuh One can always use an IP address.
# pcarrier so much more effective and so fewer points of pressure
# pcarrier one can. does one?
# superkuh But yeah, I use alternate addressing systems like tor to.
# superkuh pcarrier, I used my IP address for my webserver literally 30 minutes ago.
# superkuh So a friend from IRC could upload a file to me.
# superkuh Anyway, I've once again dragged the chat off-topic onto my pet peeve. Sorry. Just wanted to say I like TOFU.
# pcarrier and I want secrets to rotate. seems irreconcilable.
reno_ left the channel
# superkuh Up to about $50/ipv4 now.
# pcarrier [mattl]: IPv4 maaaybe, so the evidence so far is that we've found a peak (https://ipv4.global/wp-content/uploads/2023/02/pricing1-revised-2.png)
# pcarrier unless they're dedicated to IPv6 in some way, agreed
# pcarrier I wouldn't be shocked if a lot of sites served over CDNs like cloudflare today didn't have IPv4s for their origin
# superkuh The modern AOL.
# pcarrier I'm a bit shocked that only about 15% of my traffic defaults to IPv6, a number that hasn't moved much in years
# pcarrier cloudflare is a global operation
# pcarrier top 5 network operators represent ~31% of traffic of ident.me, looking at a 1-hour slice. I expect it'd be a lot less looking at a 24-hour window
# pcarrier aaronpk: nope. https://github.com/…/….wiki.git right?
# 
[mattl] [aaronpk] looks like they moved the URL to the bottom of the wiki page but I'm still seeing for example https://github.com/openmelody/melody.wiki.git
# [mattl] yup. it was one of http://GitLab.com's things they had over GitHub for a while
# [snarfed] to2ds you may be interested in https://snarfed.org/2023-03-24_49619-2
# Loqi [preview] [Ryan Barrett] Content negotiation considered harmful https://snarfed.org/matilda-used-car-salesman-harry-wormwood.jpg
AramZS joined the channel
# [morganm] Im currently working on a demo about web components, its going to be a small portion of a talk about that topic. https://bc-web-component.netlify.app/ . Ive added a few features Im going to use to describe the features of web components, its very hacky right now, anyone have any great ideas or suggestions?
# [morganm] mattl++
benatkin and rrix joined the channel
# [morganm] ✂️ is the season at my household
# Loqi OwnYourGram.com is a service which streams your Instagram photos to your own site in real-time https://indieweb.org/OwnYourGram
[schmarty] joined the channel
# 
[schmarty] Well that's fun!!
JadedBlueEyes joined the channel
# 
aaronpk well this explains why there are so many active podcast feeds in my websub hub https://github.com/ad-aures/castopod/blob/53232d3b616877e0db87c7f01e2f199f03a0c357/modules/WebSub/Config/WebSub.php#L21
# aaronpk hey cool https://websubhub.com/