#dev 2025-01-05
2025-01-05 UTC
angelo joined the channel
# 
aaronpk i'm still very confused about how this error is happening https://media.aaronpk.com/2025/01/04170457-7310.png
[snarfed] joined the channel
# 
[snarfed] looking forward to recommending https://worksinprogress.co/issue/the-maintenance-race/ (full book still in progress) to everyone here 😆 😢
[tw2113] joined the channel
# 
vikanezrimaya e CSP header.
# vikanezrimaya Thought: CSP prevents injecting arbitrary things into the website (e.g. a rogue Webmention injecting an inline script or style into the page), but at the same time prevents the post author from injecting arbitrary things into e-content (like a custom style for a one-off post), unless special care is taken to inject nonces into script/style tags inside e-content, or, alternatively, hash their contents and send the hashes as part of th
# vikanezrimaya There are trade-offs here. But the second option is far more secure.
# vikanezrimaya Less thought is needed about sanitizing content in Webmentions if the content security policy disallows running non-nonced inline scripts.
# vikanezrimaya Nonces in this case may be more secure than hashes, because a webmention could try a hash collision or to inject a "good" script in a "bad" place somehow.
# vikanezrimaya Whereas placing a nonce allows running a certain script in a certain place and that place only.
grufwub joined the channel
# carrvo[d] I would question why you expect webmentions to inject scripts in the first place. I would expect to only inject safe microformats2 text from the source and a link back to the source. That keeps the destination (of the webmention) secure.
# carrvo[d] Aka display other site's data in your format. Don't try to inject the external site format...
# carrvo[d] aaronpk I love how the expected value, seen value, and help value are the same. Those are always the most frustrating issues 😔
# immibis Thought: don't send malicious scripts to the client and rely on the client to catch it with a security policy
# immibis CSP is solely for defense in depth
# immibis CSP tries to catch the horse once it already escaped from the barn
scattershot joined the channel
# carrvo[d] In your case, I believe, the CSP is the browser catching malicious scripts that your webmention handler allowed to be injected into your site. But if you don't allow your webmention handler to inject foreign HTML, then you would be more secure. That is, when your webmention handler is retrieving content from the foreign site, extract non-HTML text that you embed into your own HTML, to then inject. Including striping away foreign scripts (aka,
# carrvo[d] I know I haven't used or implemented a webmention yet, but I am confident in what I am saying (for reasons that you would have to know me for). Please feel free to wait for more proper experts...
# carrvo[d] Um, I think so (CSP in headers)? Truthfully my confidence in CSP is because it came up recently in this chat and gRegor affirmed my understanding.
gRegor and gRegorLove_ joined the channel
# carrvo[d] Hey! I can link to messages! https://discord.com/channels/866577279223595018/866577430886350869/1322052791690199080
# carrvo[d] What is content security policy?
# 
Loqi Content-Security-Policy (abbreviated CSP) is an HTTP directive that a site can use to restrict what external resources are retrieved by a browser, to mitigate some XSS and injection attacks https://indieweb.org/Content-Security-Policy
[KevinMarks] joined the channel
# 
[KevinMarks] the thing I find most annoying is when libraries do maintenance work just to drop support for older language versions.
# carrvo[d] Uh... mental twist. You were three different people... and I accidentally thought of all of you as the same person, sorry.
# catgirlin.space carrvo[d]: should note that discord message links stay as discord message links on irc unfortunately :( i believe the preferred way of linking messages is find their permalink on chat.indieweb.org? so https://chat.indieweb.org/dev/2024-12-27/1735272348502700 for that message :3
# catgirlin.space [edit] carrvo[d]: should note that discord message links stay as discord message links on irc unfortunately :( i believe the preferred way of linking messages is find their permalink on chat.indieweb.org? so https://chat.indieweb.org/dev/2024-12-27/1735272348502700 for that message :3
nemonical joined the channel
# aaronpk ok i finally recreated this, but I had to change some of the logic in order to trigger this, so I'm still not sure how this is actually happening for real https://media.aaronpk.com/2025/01/05080124-5198.png
# [snarfed] I got this bug report, and I don't know where to start, and honestly I'm surprised that app developers have to do much to handle this at all, instead of browsers themselves, https://github.com/snarfed/bridgy-fed/issues/1666
# aaronpk oops, version with proper exact string match https://media.aaronpk.com/2025/01/05080216-3632.png
ttybitnik joined the channel
# 
[tantek] linking to the BridgyFed fix for context https://github.com/snarfed/bridgy-fed/commit/fe6da84fc303f6b0470d2d649e62d2717af46ac5
nemonical, GuestZero, gRegorLove_ and sebbu2 joined the channel
# [KevinMarks] I remember experimenting with this when we were trying internationalization for SocialWG. I think we got twitter to reverse text
# carrvo[d] catgirlinspace++ will try to remember for next time.
# aaronpk capjamesg: you'd probably like this post about email link + passkey login https://rmondello.com/2025/01/02/magic-links-and-passkeys/
# 
capjamesg[d] This is a fascinating point: "Something that I’ve learned by working on the user experience around website and app authentication is that, if you need to educate a person to go against what the inline flow naturally leads them to do, that cognitive friction will frustrate or stymie a significant number of people."
# capjamesg[d] aaronpk I thought about the UX of prompting for a passkey but I preferred the idea of a more explicit "Sign in with a passkey" button.
fluffy, ben and sivoais joined the channel