#dev 2025-06-17

2025-06-17 UTC
bterry joined the channel
#
[morganm]
Rant; Its been so long, years, since I have stood up a public facing auth and user login flow. I did it with a bunch of libraries in the past and I cant even name them right now. Ive just been focusing on fun static websites and learning CSS/HTML with sprinkles of JS, basically my dynamic coding skills have denatured.
#
[morganm]
Rave; If I wanted to pick it back up again, I could
mateusrc, bugliker0 and jak2k joined the channel
#
mandaris
I wrote this with Fractal Kitty in mind. I don't know if she's in here.
#
mandaris
[edit] I wrote this with Fractal Kitty in mind. I don't know if she's in here.
#
mandaris
My next project is to redo authorship and references in my site. I really want to be able to understand it.
#
mandaris
Maybe I can get it done before the 20th anniversary of microformats
barnaby, Guest6 and [KevinMarks] joined the channel
#
[KevinMarks]
I remember someone looking at the microformats logo and saying "I only see three mats"
jak2k and mateusrc joined the channel
#
[social]
Excellent
[mattl] joined the channel
#
[mattl]
Started publicly tracking the daily stats for http://libre.fm so I can see how much its being used or not used on a daily basis
#
[KevinMarks]
anyone good at AWS wrangling? If I want to run a single python script that takes ~12 hours to import some data, which Amazon thingy should I use?
#
perryflynn
on demand? probably elastic container service. lambda has a time limit of 15 minutes.
#
perryflynn
maybe a EC2 instance with launch template would work too. but you have to make something to launch and destroy the instance.
#
[KevinMarks]
Yes, I saw the lambda issue. I suppose I could segment the task and chain lambdas to do it, but that may well be more work.
#
perryflynn
I would launch a ec2 instance via terraform or aws event bridge and give the role inside of the ec2 instance the permission to terminate itself.
#
[KevinMarks]
Step Functions looks like it's supposed to be for this kind of thing, but I think that still need the code wrapping in something to work.
#
perryflynn
yea that could work as well. heard about step function but never worked with it.
rosipov5 joined the channel
#
[snarfed]
[KevinMarks] is this ongoing? or one time (or a few)? if the latter, maybe run it locally?
#
[KevinMarks]
Its about every 6 weeks - I have been running it locally, but i want to hand it over to someone else to run on AWS
jak2k and [jgarber] joined the channel
#
[jgarber]
Goodness.
#
Loqi
[preview] [daniel:// stenberg://] No more embargoed security issues for libxml2: https://gitlab.gnome.org/GNOME/libxml2/-/issues/913
#
[jgarber]
The linked issue is quite a read.
angelo, GuestZero and barnaby joined the channel
#
[schmarty]
πŸ‘ πŸ‘ πŸ‘
#
[snarfed]
I'm torn. on one hand, ecosystem security matters, and responsible disclosure is important and useful. on the other hand, obviously open source maintainers should be supported and not unduly burdened
#
[snarfed]
no easy answers
#
perryflynn
the users of the libraries have now the chance to act/react.
#
[snarfed]
hmm no they always did. this change means there will be a window when they _don't_ have the chance to act/react, there's no patch available yet, but they're vulnerable and on blast because attackers know about the vulnerability
#
[schmarty]
totally agree it is not easy, but i applaud an unpaid volunteer for saying no to unreasonable demands from companies that profit off their work.
#
[snarfed]
of course. it just also has clear downsides that I wish we had better answers for
#
[schmarty]
flip the script on the relationship between capital and labor??? 😈
#
[jgarber]
[schmarty] Good day, comrade!
#
[snarfed]
too abstract, not sure how to apply that here
#
[schmarty]
interesting that a lot of these are written for what i would call an enterprise audience
#
[schmarty]
"bad open source packages", "open source quality". notes for the discerning shopper with a corporate card.
#
[schmarty]
i enjoyed this recent Chris Ferdinandi post about working the other direction:
#
[schmarty]
build and license for the commons, first. if you leverage it to make money, you pay back in.
#
[snarfed]
it's complicated. I fully agree, but I also don't think you can realistically try to *require* that, at least if you publish open source code with a traditional open source license
#
[snarfed]
if you try to somehow retain and enforce control, that's the way of the mad king a la Matt Mullenweg
#
[schmarty]
i guess i mean: it is interesting to see folks wring their hands at the under-resourced maintainers of the thin twig of a package in the XKCD comic. but where is the attention on the downstreamers who adopt these packages in exploitive ways?
#
[snarfed]
there's plenty of that attention, people make this connection very regularly
#
[snarfed]
and the ecosystem is trying to adapt, eg the links I posted earlier. corporate OSPOs exist, they do support open source materially, etc. is it enough, or in the right shape? probably not. but it's not missing entirely
#
[schmarty]
there is a stark asymmetry
#
[snarfed]
of course
#
[tantek]
[snarfed] IMO if the assumption is "you're giving up control" then that must be paired with "use at 100% your own risk", as in all security problems are the problems of the consumer of the open source, not the publisher
#
[snarfed]
totally! agreed
#
[tantek]
"giving up control" goes both ways
#
[snarfed]
stenberg is entirely within his rights to make that call. companies should support open source more. all true. but that doesn't make the security side wrong. both can be right, they're just in tension because there isn't enough open source support yet
#
[tantek]
this to me says there's a "market opportunity" (only half πŸ™‚ ) for someone to start a "Enterprise Validationβ„’" service for open source packages that Enterprises can subscribe to (pay regularly for) for "Validated" releases of open source packages
#
[snarfed]
that's Tidelift, and others
#
[snarfed]
linux and other distributions, etc
#
[tantek]
right, so any complaints of "wah I don't get security for free" have no sympathy rankly
#
[tantek]
frankly*
#
[snarfed]
the problem is that "validation" can never guarantee that anything is vulnerability free
#
[tantek]
guarantee is not the point. someone you can call for support (that you're paying) is the point
#
[snarfed]
I don't know that anyone's crying that. the original complaint here was the expectation of responsible (confidential) disclosure and prioritization
#
[snarfed]
which, absolutely, if you aren't paying, you can't expect
#
[snarfed]
(...heh ok, fair, prioritization is a milder version of "security for free")
barnaby, lain`, jak2k, btrem and aaronpk_ joined the channel
#
btrem
I need some debugging advice .. \
#
btrem
]@#*$@# Hit return by accident. Sorry.
aaronpk_ joined the channel
#
btrem
I need some debugging advice. I created an .ics calendar feed in a Drupal site, but I cannot subscribe to it. The format appears to be correct. I've tried two calendar apps: Gnome Calendar, which prompts for username/password but does nothing more; and Thunderbird calendar, which claims "could not find calendars here" OSLT.
#
btrem
I have successfully subscribed to Indieweb events, also .ics, using both apps. I'm thinking maybe the response headers for my feed are wrong, but I can't figure out how to see them. Firefox Dev Tools doesn't work, I think because Drupal redirects the page from log in too quickly. Any thoughts on how I might proceed?
#
perryflynn
does downloading the ics and adding it locally into thunderbird works?
#
btrem
perryflynn: Hmm, good idea. I'll try that next. I did just validate the file using an online validator. It reports "no errors," though there are 10 warning about the line length being "longer than 75 characters." Sounds more like a linting issue, rather than a validation one.
#
btrem
@#$@!# applications and their broken interfaces. I can't access the "import all" button. Who in the @!#@! designs this stuff?!
#
btrem
So aggravating. Well, I managed to access "import all" events, but nothing actually shows up in the calendar. So something is maybe amiss in the .ics. Thanks for the idea, perryflynn++
#
Loqi
perryflynn has 7 karma in this channel over the last year (15 in all channels)
#
perryflynn
yw
#
btrem
Unfortunately, the lack of an error message leaves me completely in the dark. Nothing worse than a silent fail. :-/
#
perryflynn
I would now take a iCal parser in a language I know and try to parse it with that. then it could be debugged.
#
btrem
Currently doing that, and the json version of the cal looks fine.
#
btrem
shrugs
#
btrem
Well, I'll keep at it, and report back if I find anything interesting.
#
perryflynn
did you checked the whitespaces? so do you use the correct line endings (\n vs. \r\n), does the file encoding is correct and also does the file have a unicode BOM at the beginning which is maybe not allowed?
#
perryflynn
(I have no clue about iCal, just shots into the dark)
#
[artlung]
I use https://github.com/u01jmg3/ics-parser in PHP with composer to read and display events. FWIW. That main page on GitHub also mentions several gotchas around the ICS spec.
#
Loqi
[preview] [u01jmg3] ics-parser: Parser for iCalendar Events β€’ PHP 8+, 7 (β‰₯ 7.4), 5 (β‰₯ 5.6)
#
btrem
perryflynn: BOM isn't relevant for the web feed, is it? As for whitespace, I dunno. I did validate it, and supposedly there are no errors.
#
btrem
[artlung]++ thanks I'll have a look at that validator as I continue chasing this undomesticated waterfowl. ;-)
#
Loqi
[artlung] has 16 karma in this channel over the last year (86 in all channels)
#
perryflynn
btrem: not sure. Just have seen it in other projects that BOM can break especially old specs.
#
[snarfed]
also check that you're serving it with the right mime type
#
[mattl]
β€œIn the early days of the internet, most web developers wrote their own CSS to structure and style webpages.”
#
[tantek]
"early days"
#
[mattl]
β€œin the early days of 1998-2006.”