sknebelI dont think it fits into how relmeauth works, because its very much part of the design/point of that webauthn is tied to the site, which relmeauth explicitly doesnt do/require
sknebelI think (without rereading specs) in theory you could do a stateless indielogin-type service, but it would basically be that service outsourcing its internal storage to you
recognitium[snarfed]: Hi everybody, I am in the process of indiewebizing my site . When trying to setup snarfed bridgy with bluesky ( I have setup a self-hosted pds), after getting and app password , I get "HTTP Error 401: {"error":"AuthenticationRequired","message":"Invalid identifier or password"}" . Has anybody had and worked around a similar issue ? I tried searching on the web and also in bridgy's github issues, to no avail. Thanks for
[tantek]there are times where 2019 still feels like last year 😬 — wondering if anyone has incorporated this (or other pandemic time compression/dilation effects) into their personal site archive UI
[tantek]hot take on "private" (misnamed) or actually limited audience posts. how to implement: (1) implement IndieAuth/RelMeAuth consumption, (2) implement "simple" password consuming/cookie setting, (3) implement per-post explicit audience allow-lists of domains and optionally one or more passwords. cc: capjamesg[d]
aaronpki've been slowly putting the pieces together to be able to do that on my site. I think I finally got over the biggest hurdle of it, which is the ability to have posts be public/protected/private, and the pages with lists of posts respect that visibility
aaronpkprivate means only me, protected means there's a possibilty someone else could see it (if they could log in, or with a password, or with a token obtained through webmention verification)
aaronpki also have a 4th setting "unlisted" which is exactly what it sounds like, it is only visible at the post's URL, it wont show up in tag pages or anything
[tantek]that largely aligns with my understanding. one nit about "private" that I'm increasingly wanting to solve (for myself) is splitting it into "private private" (as in no one else can ever access) and "private delegatable" (as in just for me however I could delegate access to another person (set?) in order to act "as me")
[aciccarello]I've thought a few times about how to implement limited-audience posts on my static site. Always ends up feeling like I'd be jumping through too many hoops.
[tantek][snarfed] my point about passwords for resources is it's a proven and understood UX people are used to (using daily!) with Zoom, PDFs, and even Flickr
Loqi[preview] [[snarfed]] hey [aaronpk] any chance you know of an OAuth 2 Python lib that supports pushed authorization request? I haven't found one yet 😕
sebbuoh, i thought of the stuff like with google (authenticator), steam, battle, adobe, twillio authy, duo mobile, microsoft, etc... where you connect on a new browser/device, and you get a notification on (all) the old ones that someone (you) tried to log in, and you can accept or refuse (or choose another 2FA)
[Joe_Crawford]_" warning: GH010: Your push referenced at least 20000 Git LFS objects, but we only validated a random sample of 10000. It is very likely that the remaining files have been uploaded successfully too."_
[Joe_Crawford]The pain of this makes me glad a) I never tried to bring videos into my site as-is. and b) I never embarked on my "let's import all of my flickr photos into my site" project. Every prior version of me was rightly frightened to do that.
[Joe_Crawford]Yeah, I was kind of all in on git-lfs but having it all in one place means I can do bulk operations more rationally. It also let's me automate more parts of it, optimize thumbs, use new image technologies (uploaded my first avif yesterday). It'll also allow me to normalize the ad hoc weird WordPress code, random PHP classes, and make all the code quality better with PHPCode Sniffer and Unit tests too.
carrvo You can do it with IndieAuth...but I haven't dug into RelMeAuth...
doesnm doesn't fully support selfhosted pds-es <- https://bsky.app/profile/juli.ee/post/3lgsz52w6oc2g
[tantek] hot take on "private" (misnamed) or actually limited audience posts. how to implement: (1) implement IndieAuth/RelMeAuth consumption, (2) implement "simple" password consuming/cookie setting, (3) implement per-post explicit audience allow-lists of domains and optionally one or more passwords. cc: capjamesg[d]
[aciccarello] I've thought a few times about how to implement limited-audience posts on my static site. Always ends up feeling like I'd be jumping through too many hoops.
[schmarty] artlung++ montecarlo++