#dev 2025-10-11

2025-10-11 UTC
#
gRegor [snarfed], I forget, is there a way to de-duplicate bridged bsky accounts in BF? I noticed https://bsky.app/profile/gregorlove.com.web.brid.gy, would be nice if I could somehow redirect it to my actual account https://bsky.app/profile/gregorlove.com
posixlycorrect and bagaag joined the channel
#
[snarfed] gRegor by de-dupe, you mean attach to a native account? no, but I can disable the bridged one if you want
NaomiAmethyst joined the channel
#
gRegor [snarfed], yeah, realize there probably isn't a way to, but if it could be like "the account you're actually looking for is over here." I thought you had disable the bridged one before, but maybe it restarts if someone follows it?
#
gRegor It's not a big deal either way
#
gRegor just interesting thinking if someone replies to the bridge, I don't think it would come back to me (?)
#
gRegor Strike that last one, I did get a webmention for it! Nice
#
[snarfed] I can definitely disable it so that it stays disabled. looks like I've never done that before, but I can if you want!
barnaby, grufwub, rhiaro, gRegor, srazkvt, sarna, ttybitnik, failxontour and shoesNso_ joined the channel
#
aaronpk i *thini* i have bluesky/atproto login working in indielogin.com now. i'm about to deploy it
#
aaronpk guess i need to write docs first
#
[snarfed] awesome! which oauth lib did you use?
#
[snarfed] tried to test but it always uses my site's own IndieAuth provider 🤷
#
aaronpk oauth lib lol
#
aaronpk i used a JWT library to create the DPoP JWT, but everything else is from scratch
#
[snarfed] sounds about right for atproto oauth 😭
#
aaronpk DPoP really isn't that bad tho
#
aaronpk so this supports two modes, either entering a bluesky handle directly, or entering a web page that has a rel=me to a bluesky handle
#
aaronpk if you enter a bluesky handle that is also advertising an indieauth server, it prioritizes the indieauth server. I think that's the right behavior but not 100% sure
girlonthemoon joined the channel
#
[snarfed] is it deployed?
#
aaronpk not yet
#
aaronpk docs first
#
[snarfed] 👍
#
[tantek] IndieAuth > site-specific OAuth so yes
#
[tantek] Prioritize the more open / least site specific pathway first to shift things in that direction
#
[tantek] [snarfed] I imagine you have a purely test-purposes bsky handle right?
#
[snarfed] hah many yes
#
aaronpk this bluesky oauth is roughly analogous to indieauth tho, it's not actually tied to a silo the way twitter/github/codeberg/gitlab is
#
aaronpk in other words, if someone gets a new domain and puts up a static website, then adds rel=indieauth-metadata to an indieauth server, that is roughly equivalent to adding the DNS entry to use their domain as a bluesky handle and using the bluesky oauth server
#
aaronpk this is a real mouthful of an OAuth scope `rpc:app.bsky.actor.getProfile?aud=did:web:api.bsky.app%23bsky_appview`
#
[snarfed] lol. yeah they went from way to coarse to maybe way too granular
#
aaronpk oh, fun edge case i just encountered while testing...
#
[snarfed] per-host-per-RPC scopes are like...yeah that's a permission...but not really a semantic, meaningful, user-legible permission 😆
#
aaronpk if your have a custom domain bluesky handle but _don't_ have a website hosted there, it errors out
#
[snarfed] ah. that's relatively common
#
aaronpk or if you have a domain that is a very slow mastodon instance it will time out
#
[snarfed] lol reminds me of the Mastodon issue where when it receives a remote post with a link via AP, and tries to generate a link preview, and the link fetch times out, it just silently drops the post 🤦‍♂️
#
aaronpk great
#
[snarfed] this is the one [tantek] hit pretty regularly when he'd link to https http://kevinmarks.com, which hangs
#
aaronpk oh funny, unintended side effect is entering a *.bsky.social handle doesn't work because there is no DNS entry for it
#
aaronpk i guess i'm ok with that
proofreed joined the channel
#
aaronpk oh, but it also doesn't work with linking to a bsky.social profile from a website, which is less good
#
aaronpk hm, hacky workaround for that but i guess it will work
#
aaronpk good think i did some more tests
#
[snarfed] huh I thought the *.bsky.social subdomains served http
#
[snarfed] they do. but yeah you'd have to do HTTPS handle resolution, not DNS. https://atproto.com/specs/handle#https-well-known-method
#
aaronpk they do but i'm checking for the _atproto DNS record on the domain
#
aaronpk oh i didn't know about the well-known
#
aaronpk [snarfed]++ that is better than my other hack
#
Loqi [snarfed] has 40 karma in this channel over the last year (66 in all channels)
#
aaronpk alright it's live! who wants to be the first to test
NaomiAmethyst joined the channel
#
[tantek] reads the updated https://indielogin.com/setup
#
Loqi [preview] How to Set Up Your Website for IndieLogin.com
#
[tantek] aaronpk if I use authn, then do the "me atproto" links have to also be upgraded to "me authn atproto" ? I think they should
#
[tantek] ... if I use rel="me authn"* that is
#
[snarfed] worked great!
#
[snarfed] [aaronpk] just fyi though, when I decline, the callback on http://indielogin.com then says "Received invalid response from ATProto server"
#
aaronpk oh ha i never test the decline button, i just figure people will close the tab
#
[tantek] what is rel-authn
#
Loqi rel-authn is a link relation that can be added to your rel-me links to indicate you want to use them as an authentication option in RelMeAuth https://indieweb.org/rel-authn
#
[tantek] nice
#
[tantek] what is rel-atproto
#
Loqi It looks like we don't have a page for "rel-atproto" yet. Would you like to create it? (Or just say "rel-atproto is ____", a sentence describing the term)
#
aaronpk hm, i didn't do anything with rel=authn with this
#
aaronpk [snarfed]++ just added error handling for that
#
aaronpk ok fixed up some handling of rel=authn
#
[tantek] aaronpk, please review (freshly written how to consume authn docs from my understanding) https://indieweb.org/rel-authn#How_to_consume
#
aaronpk i think that is right
#
aaronpk tho in code, it's easier to think of it as "if there are any rel=authn links, use the intersection of the rel=me and rel=authn links"
#
aaronpk since the mf2 parser returns both as separate arrays
#
[tantek] I figured it made for shorter instructions as a patch for a rel-me implementation
#
[tantek] aaronpk can you draft a brief /rel-atproto page and add an entry for "atproto" in the rel registry? https://microformats.org/wiki/existing-rel-values#HTML5_link_type_extensions
#
[tantek] I took care of adding an entry there for "authn" if you want to use that as a template
#
aaronpk what is atproto?
#
Loqi AT Protocol or Authenticated Transfer Protocol, previously known as Authenticated Data Experiment (ADX), is a federated social network protocol, designed and first implemented by the Bluesky project, subsequently supported by IndieWeb-friendly service micro.blog and libraries https://indieweb.org/atproto
#
aaronpk what is rel=atproto
#
Loqi rel-atproto is a link relation that can be added to your rel-me links to indicate that this link is an ATProto account handle and an authentication option in RelMeAuth https://indieweb.org/rel-atproto
#
aaronpk done
#
[tantek] nice
#
aaronpk i think my next spec might be an OpenID Connect extension that returns `sub` from the token endpoint, which is what BlueSky does today, and analogous to IndieAuth returning `me`
#
aaronpk at that point IndieAuth will be made up almost entirely of IETF/OpenID specs
CrimeWave joined the channel
#
[tantek] why "sub" instead of "me"? what does "sub" mean in that context?
#
aaronpk subject
#
aaronpk It's baked pretty deep into a bunch of OAuth and OpenID specs at this point
#
[tantek] oof
#
[tantek] "sub" is a term that extractive cable/sat-tv companies use to refer to "subscribers" instead of. you know, "users" or even "customers"
#
[tantek] not good framing 🫠
#
aaronpk It's because tokens don't always represent users, so it means the "subject" of the token
#
[tantek] also brings to mind "test subject" like in a lab
#
[tantek] sure, that's why AS1 chose "actor" I believe
#
[tantek] "sub" is deliberately decentering
#
[tantek] (also overloaded in CS terms, PubSub, Microsub, etc. etc.)
#
aaronpk It's not a fight I am interested in having, I am more interested in the capability itself than the name of the field
#
[tantek] so I'd avoid calling anything "sub" in IndieAuth
#
aaronpk If it means IndieAuth is actually just a specific way to do OpenID Connect and doesn't invent anything itself I consider that a win even with the somewhat unfortunate name of one field
#
[tantek] yeah that's a reasonable conclusion
#
[tantek] because you were able to get the other building blocks into OpenID Connect extensions or something?
#
aaronpk The client id metadata doc that bluesky is using was one of the major building blocks
#
aaronpk And it's a real OAuth draft now
barnaby, doesnm, gRegor, gRegorLove_ and rrix joined the channel
#
gRegor Hm. I added `<link rel="me atproto authn" href="https://bsky.app/profile/gregorlove.com">` and when I try indielogin with that profile link, I'm taken to a bsky sign-in prompt with identifier field = "bsky.app" (readonly field). After entering my password I get "Wrong identifier or password
#
gRegor ". Signed out and in of my bsky account to make sure I have the right password.
#
gRegor If I try to sign in with gregorlove.com, it uses my IndieAuth server (expected)
ludovicchabant joined the channel
#
aaronpk yeah `https://bsky.app/profile/gregorlove.com` is not an atproto profile url
#
gRegor How do I find that? I have no idea what that is, haha
#
aaronpk yours is `gregorlove.com`
#
aaronpk this isn't really for people who already have an indieauth server at their domain
#
gRegor Ahh ok
#
gRegor very cool though! aaronpk++
#
Loqi aaronpk has 44 karma in this channel over the last year (125 in all channels)
[Sophia_wood], rrix and Saige_Leah joined the channel
#
carrvo aaronpk, it is nice to hear. I found the "sub" (subject) important to have side-by-side with "me" to support an OAuth library I use.
#
aaronpk oh cool, what library?
#
carrvo I find it very interesting because I was looking at whether the IndieAuth could be used with an OpenID Connect library. JWKS stopped me cold, if I recall.
#
carrvo The Apache ones.
#
aaronpk theoretically openid connect can be used without jwks as well
#
carrvo I have better documentation on how I made them compatible. Or I can talk about it later.
#
carrvo What is MIndie?
#
Loqi MIndie is a minimal, self-hosted IndieAuth solution for the home, developed and used by carrvo https://indieweb.org/MIndie
#
aaronpk oh so like an apache reverse proxy?
phobos joined the channel
#
carrvo No? I use IndieAuth to feed mod_oauth2 in front of SVN.
thegr8whoopdini[ joined the channel
#
carrvo Technically mod_oauth2 is incorrectly used and I should have mod_auth_openidc. Maybe I should revisit my experiment.
#
carrvo https://github.com/OpenIDC/mod_auth_openidc and https://github.com/OpenIDC/mod_oauth2 for reference.
#
Loqi [preview] [OpenIDC] mod_auth_openidc: OpenID Certified™ OpenID Connect and FAPI 2 Relying Party module for Apache HTTPd
#
aaronpk ok cool yea that's what i thought
#
aaronpk ok first draft https://drafts.aaronpk.com/openid-simplified-subject-response/draft-openid-simplified-subject-response.html
#
Loqi [preview] Aaron Parecki
#
aaronpk lol wat loqi
#
aaronpk oh there's a vcard in there 😂
thegreekgeek joined the channel
#
carrvo aaronpk++
#
Loqi aaronpk has 45 karma in this channel over the last year (126 in all channels)
#
carrvo Yeah, the module maps the sub claim to the Apache user field. Looking forward to seeing the updates on your draft!
#
[tantek] aaronpk, microformats has friends everywhere 🙂
[morganm]1, hidjy[d]_, moose3336 and rozodru joined the channel
#
aaronpk well that was not what i expected to be doing today when i woke up but glad to have it done!