#dev 2025-11-27

2025-11-27 UTC
CrimeWave, shoesNsocks, sp1ff, PrehistoricWeeb, gRegor and grufwub joined the channel
#
ulhar4409 working on a micropub server, and the specs I'm reading aren't very clear on this: how qualified must a "url" parameter be for the server to accept it? conversely, how "vague" should a url be to reject it?
#
ulhar4409 all the examples in the spec have a scheme and a host included, so i'm guessing it Must have those, but it irks me a little that it doesn't say for sure
#
[tantek] Pretty sure a URL by default means fully qualified if there are no other details. It's normal in specs to not say defaults like that every time
#
ulhar4409 hmm, ok
#
ulhar4409 i remember reading through HTTP RFCs a while ago, particularly about the Link header, and whenever it made use of syntax defined elsewhere it would helpfully include a sentence like "this document also uses [term] as defined in [other document]" which made my research a lot easier
#
ulhar4409 like, the origin of the particular term would be revealed once, and then the rest of the document doesn't have to worry about defining it
#
[tantek] indeed. use of "URL" should reference the URL standard once and that should be sufficient
gRegor, [aciccarello], opencircuit, DanQ, barnaby, NaomiAmethyst7, rosipov1, [KevinMarks] and ttybitnik joined the channel
#
carrvo Any Apache configuration experts around? I struggled with it last night and, to not make it too long here, my woes can be found https://stackoverflow.com/questions/79831946/explanation-of-apache-2-4-require-directives-ordering
#
[tantek] Oh hey this is on topic, another reason not to use 3rd party analytics providers unless you have a REALLY good reason to: https://www.bleepingcomputer.com/news/security/openai-discloses-api-customer-data-breach-via-mixpanel-vendor-hack/amp/
#
[Al_Abut] Whoa. I like to think I’m immune by using Plausible, since they’re a cookie-less and privacy-first small business in the EU but hey, you never know.
DanQ and [snarfed] joined the channel
#
[snarfed] all code can/does have vulnerabilities 😢
#
[snarfed] values and region may sometimes correlate with security, but only some, and security is never perfect
#
[snarfed] "All code is liability." - Peter Norvig
#
capjamesg An interesting testimony to how predictable URLs may in fact be retrieved I think: https://www.theguardian.com/business/2025/nov/27/obr-budget-leak-cybersecurity-investigate
#
capjamesg “The link was not advertised on the website but the OBR has used the same web address, or URL, for previous budget documents, changing only the date. A Reuters reporter, in preparation for covering the budget, went to the publicly available URL shortly after 1130 GMT on Wednesday”
#
capjamesg All the details are not yet available though.
#
[snarfed] lol yup. hence *unguessable* URLs
#
[tantek] Nah I love guessable URLs 😁
#
[tantek] They've done a lot for radical openness and transparency
NaomiAmethyst, CrimeWave, DanQ, jjuran, [artlung] and rossabaker joined the channel