#dev 2025-11-13
2025-11-13 UTC
cotsuka joined the channel
# 
[morganm] I really should know this by now, but what is it exactly that allows me to log in with my domain name to events http://indieweb.org ? Whats stopping someone else from logging in with my domain?
# [morganm] I put the `rel` on my website, and linked it with my Github, is it because Github is authing it?
gRegor, troojg, cotsuka and CrimeWave joined the channel
# 
trwnh [tantek] re: convo yesterday about "why use mastodon/fedi in addition to or instead of federating your website with bridgyfed/wordpress", it's not strictly that it's easier but rather that you get more/different out of it. namely you get to follow people and have timelines served with mastodon api therefore letting you use "nicer" apps on your phone. also private posts. also if you run something like pleroma/akkoma you can use mrf (message
NaomiAmethyst, [lazcorp]1, [jeremycherfas]1, [morganm]2, geoffo_, [KevinMarks]1, [Roy]1, gRegorLove_, bret_, cotsuka, barnaby, jak2k, Xe_, sp1ff, vidak, grufwub, doesnm, CrimeWave, Maxpm, DanQ, gRegor, bret and [fluffy] joined the channel
Guest6_, NaomiAmethyst, [artlung]2, [aciccarello]1, grufwub, Dryusdan, gRegor, doesnm and vidak joined the channel
cotsuka and thegreekgeek joined the channel
# .pi.r2. [Jo] Tried a little, seemed to work well. They compared favorably to hetzner except can't go nearly as small, so elected to stay on hetzner for the time being.
cotsuka, seaglade, [Roy]2, [Jo]2, [morganm], [KevinMarks]2, [fluffy]1, [social]1, geoffo, bret_, seaglade-dev, claudine, sebsel_, shoesNsocks, vidak, [schmarty], [Trevor_Morris] and gRegor joined the channel
# autumnlilybug I had an idea for an alternative way of sending and handling webmentions, and given that I don't see anyone else doing it I'm fairly sure it's not a *good* one, but I would love some critique on what I've got so far
cotsuka joined the channel
# autumnlilybug Ok so, I've outlined it in my post on my own webmention implementation (https://seaglade.dev/blog/webmention-implementation) but to summarize:
willnorris_ joined the channel
# autumnlilybug Webmention relies on HTTP POSTs which are non-trivial to automate without using a CMS. I decided to implement a GET handler on my webmention endpoint that uses the search parameters `s`, `t`, and `v` in place of the formdata fields `source`, `target` and `vouch`. If you were to link to, say, `example.com/page1` with a normal webmention, you would use a normal `href` to that URL and then send a POST. With passive webmention
# autumnlilybug sorry I know that was long T-T
# autumnlilybug thoughts?
opencircuit joined the channel
# autumnlilybug ah, so long that IRC didn't like it, whoops
# autumnlilybug sigh
# autumnlilybug anyways, the advantage is that you don't have to mess with curl or any other low-level tooling, and you also don't need a CMS to handle sending the webmention, you can just click that link (or type it into your browser and leave a normal hyperlink in your page)
# autumnlilybug also, if you *do* have a CMS or some existing automation, you can still send passive webmentions because the GET request is just as automation-friendly as a POST. So in practice there's no real downside that I can think of.
# autumnlilybug but, like I said before, I haven't seen anyone else doing anything like this for their webmentions, and as such I suspect there's some huge issue that I'm missing here
# autumnlilybug that's a good idea
# autumnlilybug yeah, part of my goal with it is for passive webmention to be as compatible with existing webmention tooling as possible
# [Trevor_Morris] The foundation of HTTP and the web is verbs, eg GET and POST. GET is for retrieving data that remains unchanged, and POST is used to create or update (could use PUT for that, but native browser support isn't as good as POST) data. This is why a webmention should be using POST. I'm not sure what benefit you get from using a query string vs a form. HTML forms are pretty easy to build and send the correct data in the POST format. General
# [Trevor_Morris] URLs could also be crawled or pre-fetched, which would trigger that data creation when it wouldn't be desired.
# autumnlilybug That does make sense I suppose. The benefit that I had in mind is that an HTTP get can be sent by simply typing an address into a web browser, and one could even link to the passive webmention endpoint in their own post such that the first time the link is used the webmention is sent implicitly (which is why I called it "passive" - nothing has to happen in the sender's publishing software nor does any manual work need to be
# autumnlilybug This was meant more for replies that are themselves articles rather than for comment-style notes.
# autumnlilybug admittedly I was not considering the semantics of HTTP request types when I developed my API
# [Trevor_Morris] Not sure what "comment-style" notes are, but for articles, I have built something within my publishing, which enumerates each external link and tries to send a webmention (well, I manually trigger them).
# [Trevor_Morris] You webmention might never get sent, until someone clicks the link in the article. The receiving website would then have to check the webmention isn't stored every time the link (with the query params) are visited.
# autumnlilybug by comment-style notes I mean notes (entries without p-names) that are meaningless without the context of the original post (like comments on silos like youtube, or replies on twitter) as opposed to entire articles (with p-names) that simply reference another article.
# [Trevor_Morris] Ah. Gotchya.
# autumnlilybug and your point about the link needing to be clicked for the webmention to be sent is correct, though there's nothing stopping someone from either manually typing the passive webmention into their browser (which is arguably less work than using curl to send a POST for many people) or simply clicking the link in their own post after publishing
# autumnlilybug that said those do negate the benefits of not requiring manual effort
# autumnlilybug gRegor: this too, and it can be as simple as using "ON CONFLICT IGNORE" or an equivalent in whatever part of the code records the webmention having been received and validated
# autumnlilybug but the reliance on the link being clicked is certainly a downside
# 
gRegor Hmm, quick question, is this actually linking to your webmention endpoint, or to the post permalink with the query parameters? I'm not sure that's a great recommendation for publishers in either case, since the query parameters could grow stale over time. I.e. your permalinks change, so the `source` is wrong
# [Trevor_Morris] Fair point on de-duplicating. My concern is more that a link with the query params could be shared far and wide, while "manually" sending a webmention is a lot more purposeful.
# [Trevor_Morris] I would assume it is target.example?source=http://mywebsite.com but then I don't see why there is a need for a `target` param.
# autumnlilybug gRegor: the endpoint, although one could certainly implement it on the permalink instead. I chose the prior because that way the endpoint is a dedicated handler, and the post template page can be entirely static rather than needing a dynamic check before serving the content (I use Astro)
# autumnlilybug And it does redirect to `target` once the synchronous step (are both params present, are they valid URLs, is S not on my domain, is T on my domain) is completed, assuming all checks pass. Otherwise it redirects to a 404 to prevent, for example, `target` being set to an arbitrary URL and thus the endpoint becoming vulnerable to use as a link obfuscator.
# autumnlilybug so, with my own endpoint, it would look like `[https://]seaglade.dev/api/webmention?source=[https://]mysite.com/blog/post&target=[https://]seaglade.dev/blog/webmention-implementation`
cotsuka joined the channel
# autumnlilybug Hm, perhaps? But in order to be coached they would have to be requested at least once, no? Caching further requests would actually be a benefit I think
# autumnlilybug Oh interesting, I'll have to look into that
# [snarfed] also autumnlilybug I assume you've seen https://indieweb.org/static_site#Receiving_Webmentions ?
# autumnlilybug [snarfed]: I have seen that but I wanted a system that integrates into my existing website rather than relying on an external service. My website isn't *strictly* static, I'll spare the details but essentially a given route is static unless explicitly configured otherwise (so my webmention endpoint has a backend that is called at runtime but my blog posts are static pages generated at build time).
# autumnlilybug I just looked up the webmention updates spec, it looks like it's intended to be used to notify a receiver of changed content yes?
# autumnlilybug In that case that actually does not matter to my site because I don't store webmention content, only the source, target, and timestamp of first receipt.
# autumnlilybug My comment section is streamed from the backend which parses content out of webmention sources on the fly (with a 48hr cache so as not to hammer sites during high traffic)
# autumnlilybug I'll need to update it to handle deletes though
# autumnlilybug Looks like a delete is notified by sending a webmention and then returning a 410 Gone when the receiver checks the source during the asynchronous step
# autumnlilybug So that won't be difficult to implement. Currently any comment that produces an error when fetched is simply not rendered.
# autumnlilybug I'll just add a specific handler for 410 that deletes the entry in my database
# [snarfed] apart from caching and updates/delete, the biggest challenge with GET-based webmentions will probably be adoption. you can't do it yourself, you need to get *other people* who send webmentions to switch to GETs, or send them in addition to POSTs, and since it's non-standard, that will be an uphill battle
# autumnlilybug Would it be better to delete *all* mentions from a certain source when that source is detected to be gone, or just the one to the page that attempted to load it and discovered that it had been removed? I'm assuming the prior.
# autumnlilybug [snarfed]: Adoption is 100% the biggest issue. I will probably release a reference implementation for Astro and I'll have to do a more formal write up of the protocol for other implementations.
# autumnlilybug I've considered whether or not the HTTP Referer header might be better than a source query parameter, but I think the latter is better because it allows an author to specify the link to their post that should be explored by the receiver if that differs from the URL the post is being displayed at.
# autumnlilybug [snarfed]: Of course - as of right now my implementation is simply a reimplementation of standard webmention but in the GET handler and reading query parameters instead of form data.
barnaby, cotsuka, CrimeWave, oodani, NaomiAmethyst9 and to2ds joined the channel
# [artlung]2 I complained about documentation on a github project and the project made changes. Pretty happy with that, https://github.com/php-feed-io/feed-io/issues/28
cotsuka and DanQ joined the channel
# carrvo Autumn: you might be interested to note that there is a tool out there for sending Webmentions manually (type source and target) and it has an api for automating it. So that could be a very quick way to support POST without much automation on your part. Not sure how it relates to your "passive" Webmentions, sorry...
# carrvo My implementation is pretty special: it injects the content into source control to keep the page pretty static.
# carrvo What is SVNmentions?
# 
Loqi It looks like we don't have a page for "SVNmentions" yet. Would you like to create it? (Or just say "SVNmentions is ____", a sentence describing the term)
# carrvo SVNmentions is This is an endpoint to compliment mod_dav_svn by adding a webmentions receiver that can update an HTML document within SVN.
# carrvo SVNmentions >> https://github.com/carrvo/SVNmentions
# carrvo Oops
# carrvo SVNmentions << https://github.com/carrvo/SVNmentions
# Loqi ok, I added "https://github.com/carrvo/SVNmentions" to a brand new "See Also" section of /SVNmentions https://indieweb.org/wiki/index.php?diff=105907&oldid=105906
# carrvo On a different note I am super happy to say I have updated the navbar on my website! It now lets you logout!