capjamesg[d]aaronpk Where is a good place to learn about implementing SSO? I have auth logic in my web reader and I'd ideally like for people to be able to sign in to other services I make using the reader login instead of re-implementing things.
GuestZeroas a micro.blog non-user, i fully agree with that reasoning. technology aside, there's a whole toxic callout culture evolved around that 'feature'.
doesnm> For example, Micro.blog does not show follower counts,[21][14] does not have hashtags,[22][23][5][24] public likes[21][14] or trending topics,[23] does not have equivalents of retweeting[21][23][25][14] or quote tweeting, does not algorithmically recommend users and like Mastodon, and does not have full-text search as part of the service[24] or client apps.
[snarfed]"So what is special about Mastodon that requires so much technical infrastructure to support something so simple? ...There is also a culture in Mastodon of treating posts as semi-protected..."
[snarfed]^ captures a tension we've talked about some here. Many of us may have grown up with the 90s and 2000s web, which culturally was much more permissionless - feed readers, mashups, embeds, etc.
[snarfed]technically protocols like AP are still largely that, but culturally they're often not, which is often one direct cause for orgs like Mastodon moving so slow and haltingly
[snarfed]...specifically, the tension that the fediverse has a strong *culture* of consent and opt-in, but the way it actually works, AP federation, is by default opt-out and not consent-based
[manton][snarfed] That sounds right. We often think about this in purely technical terms, like “you know your post is being copied to thousands of Mastodon servers, right?”
trwnhre: [manton] "You don’t need permission to quote something on the web", sometimes you would still do well to ask for explicit consent. "can i copy your text onto my page" is the mechanical aspect, but "can i quote you in this article" might reasonably be answered with "no". it's more of an integrity thing where you can "prove" that someone gave their consent or at least acknowledged it in some way.
[snarfed]yeah, the question of whether you need someone's consent to respond to them, or to talk about them, is kind of complicated. the answer isn't clearly always yes, but it's maybe also not clearly always no
trwnhanother thing that feels like it should be fine is a reply-context, but if someone doesn't consent to having their resource embedded on your page, then this can be seen as a violation of their consent
trwnhi think ultimately consent is about respect, like if you want to talk about a politician without getting their approval first, you could say that the journalistic aspect outweighs any respect you have for that politician. but most people are not public figures, even if they are posting in public
[snarfed]true. but even then, I don't even think the consent-first wing of fediverse thinks you need to ask permission first every time you reply to someone, right?
carrvocapjamesg, if your goal is not re-implementing (and you can live with logging in independently) then an short-term alternative is to pull your auth into a library that you can import into other projects. Then you can loop back and give a "login once" experience in the long-term.
trwnhno, the Create is separate from the Quote -- you are basically notifying someone that you quoted them, and then they can respond with a stamp or otherwise ignore or reject you
trwnhi think the closest thing on the web outside mastodon is basically like how someone might put up a web page that attests some claim. "these are my socials" and then they claim rel-me. or they say "i'm doing a reddit ama and this is my verification"
trwnh[snarfed] well a Reply activity might make sense actually, in the same way as a Quote, you use it to trigger being added to the replies collection
trwnhone thing i was discussing with claire is that conceptually when an Accept "happens", it in effect can be verified by two things: either you have presence in a special collection, or you can grant a stamp. or both!
carrvocapjamesg: fair enough. For my setup that is why I spent so much time coming up with a server-level auth strategy instead of an application-level strategy.
[manton]@trwnh: I remember once years ago I asked a blogger if I could quote something from one of their posts, and their response was something like. “of course, it’s on the web and I want people to quote and link to it”. I’ve never asked anyone since then. I get what you’re saying about consent but if we all asked before quoting another blog post, it would crush what is good and open about the web. Mastodon is more complicated, though, a
[manton]Yep. And like fair use, I usually think about how much of something I’m quoting. So if there is a 5-paragraph blog post, I’m not going to quote more than a couple sentences. Quoting the entire thing would be too much.
[snarfed]yeah in general western freedom of speech and fair use doctrines seemed to match (or drive) a lot of the traditional open web's norms around responding, quoting, etc
btremI'm not really on social media, so I suppose I don't know much about that. At least, not much about fediverse. As for the corporate silos, well, those are corporations, which don't have much accountability to democratic principles, or elected officials, or really anyone but their investors.
btremIn the U.S., at least, there's a distinction between public persons -- politicians, celebrities, etc. -- regarding libel. As in, it's harder for a public person to prove libel than a non-public person.
catgirlin.spacenot a problem for me quite yet, but are there any recommendations when it comes to changing domains? when i have my new website i'm planning to move to saige.ink instead...
Loqimigration in the context of the indieweb refers to the process of moving your indieweb site from any one or more of one CMS / web host / DNS provider / URL design / domain name to another https://indieweb.org/migration
catgirlin.spacebtrem i guess more like, general advice? i didn't know if there was much as far as like, dealing with indieauth and stuff when changing domains (i hope that makes sense somewhat...)
btremThe wiki link that gRegor posted has some info on that. The thing to be mindful of is if you use your domain to log into services (e.g., the wiki, webmention.io, etc.). If your domain changes, you'll have to figure how to migrate your logins.
btremOr if you should migrate them. For webmention.io, probably not. The point of the service is to provide incoming webmentions for a domain. But if you migrate your content, you might very well want your replies, likes, etc., to come with it.
btremIf you want advice on forwarding from one domain to another, we'd need to know what software you use atm. Apache? Nginx? You can also do that via dns records, and in fact that might be preferable. But we'd need a bit more info. Do you have access to dns records? As in, can you change them, add new records, etc.?
catgirlin.spacethe actual http redirects i'm not concerned about--i already have stuff for that. more just stuff you mentioned like wiki and webmentions is what i'm concerned about i think (i have some time since it's not happening anytime soon, my girlfriend and i haven't done much on our little website backend thingy)
catgirlin.spaceit seems like everything on that wiki page is just brainstorming (for domain changes anyways). would i just have to reach out to everywhere i use indieauth and hope they manually update my domain since there doesn't seem to be a standard for that?
gRegorIf you mean the wiki, domain change won't be a big deal. You can sign in with the new domain, you'll get a new blank wiki user page, you can copy the contents of your old wiki user page and redirect it to the new one
gRegorMost indieauth clients probably aren't set up to make the update. I run indiebookclub for example, and haven't run into this yet, so idk how I'd do it.
btremand for webmentions, if that is a concert, you probably want to have accounts for both the old and new domains. And have your site builder/cms/whatever retrieve both accounts so you'll have your old and new webmentions. (gRegor sort of discussed this, but you don't really have to "archive" them. You can just migrate them IYSWIM.
trwnh[manton] i think that we can reduce the uncertainty with people describing ahead of time what their preferences or expectations are... so for example someone might say "this post is 100% public domain i don't care what you do with it" or they might have a policy like "i very specifically do not want matt mullenweg to refer to me in any way" and beyond that point you can make some assumptions to fill in some blanks. but that kind of advisory
trwnhpolicy is separate from what stamps are doing. stamps let you basically ack or attest "this thing is okay". and policies of course can be disrespected
trwnhbut crucially, this is separate from the Quote activity, which is separate from the Accept Quote. they progressively build on each other so that you can at baseline notify someone that they've been quoted, and then you might give them a stamp to let 3rd-party observers know that you're okay with this. those observers don't need to know your exact policy, they just check the stamp
capjamesg[d] aaronpk Where is a good place to learn about implementing SSO? I have auth logic in my web reader and I'd ideally like for people to be able to sign in to other services I make using the reader login instead of re-implementing things.
[Joe_Crawford] Definitely.
[manton] Put some thoughts down about Mastodon quote posts that some folks here might find interesting… Still trying to digest it but writing a post helped me. https://www.manton.org/2025/02/18/mastodon-quote-posts-draft.html
doesnm > For example, Micro.blog does not show follower counts,[21][14] does not have hashtags,[22][23][5][24] public likes[21][14] or trending topics,[23] does not have equivalents of retweeting[21][23][25][14] or quote tweeting, does not algorithmically recommend users and like Mastodon, and does not have full-text search as part of the service[24] or client apps.
trwnh re: [manton] "You don’t need permission to quote something on the web", sometimes you would still do well to ask for explicit consent. "can i copy your text onto my page" is the mechanical aspect, but "can i quote you in this article" might reasonably be answered with "no". it's more of an integrity thing where you can "prove" that someone gave their consent or at least acknowledged it in some way.
aaronpk conneg-- bites again https://github.com/aaronpk/p3k/issues/121
Loqi migration in the context of the indieweb refers to the process of moving your indieweb site from any one or more of one CMS / web host / DNS provider / URL design / domain name to another https://indieweb.org/migration