#dev 2026-01-09
2026-01-09 UTC
# 
[morgan] I feel like many people here have more cumulative experience than me, but Ive always been suspicious of the xkcd standards comic, its often brandished around as some kind of proof best practices dont actually exist and are a waste of time
# [morgan] this is from previous experiences on other forums not this one I do add for sure
# 
crowdersoup I made a fun thing for Neocities today: https://github.com/Crowder-Cloud/Neo-CMS
# crowdersoup Super simple toy project but it was pretty fun to build. It has some basic support for indieauth and incomming webmentions, but given that it's dynamically loading markdown it only works on browsers with javascript enabled.
# IWDiscord <crowdersoup>
# [snarfed]4 [morgan] whoa really? interesting! that hasn't been my interpretation, or others' I've talked with. I hadn't thought about it as about best practices at all, but literally about standards, and specifically the (common!) idea that when there are multiple overlapping standards, you can make another one that covers them all and everyone will automatically switch to your new one
# [snarfed]4 (which almost never happens, at least not without a *lot* of non-technical people- and org-wrangling work)
# [morgan] I think I basically was in some web dev spaces where people viewed standards as an annoyance to their preferred convenience way of doing things
# [morgan] like lets use divs and spans with upgraded roles for everything to make it "simpler"
# [morgan] Some of these people operate businesses and apps that make money but arent necessarily best practices at all... I mean its a mixed bag out there. The comic came up a few times whenever standards were discussed as almost a thought neutralizing thing
pfych and saccharin joined the channel
# [tantek]4 interesting, so their conclusion from the comic was the right number of standards is 0 rather than 1. apparently there are two types of people in the world 😉
# [snarfed]4 amusing when there are actual literal numbers in the comic itself, and they're 14 and 15 😆
# [snarfed]4 but thanks for the explanation [morgan]
moose3339 joined the channel
# [morgan] I like standards myself
gRegor and grufwub joined the channel
# [tantek]4 Somehow the lesson they took from it is to dismiss all standards as a waste of time because there will always be another to replace whatever exists
WinnerWind joined the channel
# [morgan] I just switched my website to using manual deploys from Netlify after hugo had a cryptic build error. Why not just build it locally, upload a folder. Less being hooked into a service
DanQ and [pfefferle] joined the channel
lanodan joined the channel
# 
simpleauthority [aciccarello]: If you want to discuss the micropub client PR more real time, I'm online. I replied to your change request about the API change -- correct, it would be breaking. Not sure if acceptable, but we can do it if it is
doesnm_ and ggarcia24 joined the channel
# [tantek]4 capjamesg true! re: h-feed followers
# [tantek]4 I use that dt-published in the future trick to iterate on drafts and NOT have them show up in my homepage h-feed which only displays items up to the current time
# [tantek]4 It's a minimal implementation of a /scheduled post
ttybitnik joined the channel
# 
[aciccarello] simpleauthority, I think the separate method is a good idea for now. It makes migration easier. But for auth, PKCE is clearly preferred so I think it should be default at some point.
# simpleauthority Agreed
# [aciccarello] I'm not sure how the client is supposed to handle a server that doesn't support PKCE though. Does that need a special case or are the params ignored?
# [aciccarello] I know the auth one can be ignored
# [aciccarello] It looks like it's sent in the body of the token request but could be ignored without issue
# simpleauthority If I'm reading the spec correctly, PKCE has been required since September 2020. I think it might be about time for clients to warn users not to connect to servers that don't support it hehe. However, I think it would depend on the server if it will ignore the PKCE params or not, depending on how strict the server is about reading in the params. If
# simpleauthority it ignores the code challenge and code challenge method, then it will also probably ignore the code verifier on code exchange too
# simpleauthority In that case, the client can do PKCE but the server would effectively just ignore it
# [aciccarello] That simplifies implementation for clients. I don't think there is even a way to know if the server supports PKCE.
# simpleauthority Only way to really know would be if it rejects the PKCE params, otherwise it shouldn't really matter to the client. If it does reject, my suggestion would be for the client to not continue. But technically, they could try again without PKCE
# [aciccarello] We'll see what Keith says but I'm fine with either approach, breaking change or not.
# simpleauthority Sounds good
# 
Zegnat This is surprising to me: https://www.alanwsmith.com/en/37/wa/jz/s1/ "Your site will be removed from Google search results if you don't have a robots.txt file"
# simpleauthority I am currently having a similar reaction to Alan. I need to add a robots.txt now haha.
# [morgan] Not sure how current it is but this is a restrictive one I experimented with https://ignoreallpreviousinstructions.pages.dev/robots.txt
# Zegnat robots txt << [https://ignoreallpreviousinstructions.pages.dev/ Ignore all previous instructions] is a single purpose webpage that curates a robots.txt file against AI scrapers
# 
Loqi ok, I added "[https://ignoreallpreviousinstructions.pages.dev/ Ignore all previous instructions] is a single purpose webpage that curates a robots.txt file against AI scrapers" to the "See Also" section of /robots_txt https://indieweb.org/wiki/index.php?diff=107555&oldid=107554
duanin2, ttybitnik, blacklight and GerrietDE joined the channel
# [aciccarello] Apparently the robots.txt I have had for a while was never included in my final site build 😅 🤦♂️
# [aciccarello] IDK how many of the AI scrapers actually respect robots.txt though
# [morgan] theres so much noise, people saying having a unique robots.txt will actually fingerprint you for scraping because its unusual... all weird. Like we are in Lord of the Rings and retreating to Helms Deep these days
# [morgan] Please forgive me deity's, for I have entered an LLM search to see what https://ignoreallpreviousinstructions.pages.dev/ returns and it returns garbled text about how it cant be processed because it exists to confuse an llm
# [morgan] Anyways, this topic is well worn, but the requirement for a robots.txt is a fresh new thing
# [aciccarello] Does anyone have experience with PHP League oauth providers? It'd be cool to have one for IndieAuth to integrate with the flarum oauth plugin https://github.com/FriendsOfFlarum/oauth/blob/2.x/src/Providers/Google.php
# [aciccarello] This project implemented it as an extension to the oauth extension https://github.com/songnguxyz/flarum-ext-oauth-mediawiki
# [aciccarello] I wonder if lacking an email address will be a problem
gRegor and DanQ joined the channel
# Zegnat [aciccarello]: I have used the League’s OAuth 2.0 stuff at some point, you are thinking about the clients? https://oauth2-client.thephpleague.com/providers/thirdparty/
# [aciccarello] Cool, I hadn't seen that list.
# [aciccarello] I was wondering what it would take to get indieauth into flarum.
# Zegnat I am not familiar with Flarum, so cannot say. It looks like people have written plugins to add more OAuth providers (https://oauth2-client.thephpleague.com/providers/thirdparty/) but whether those are repackagings of League providers or have to follow a Flarum specific implementation I cannot say
# [aciccarello] If I understand correctly, ideally, there'd be an IndieAuth provider on this list and then a Flarum extension like the mediawiki one to integrate it into flarum
to2ds and btrem joined the channel
# btrem gRegor I just now noticed your invocation of the xkcd standards comic, presumably in response to my complaints about iCalendar. In my defense, I'm not really asking for a new standard per se, with new names and features. Rather, I just wish there were a way to send the same data but in a format that software routinely supports.
# Loqi PKCE is short for Proof-Key for Code Exchange (pronounced "pixie"), a standard (RFC 7636) extension to OAuth 2.0 that is used by IndieAuth, that protects against intercepted authorization codes during the OAuth flow https://indieweb.org/PKCE
barnaby joined the channel
# [KevinMarks]2 Yes, you construct a PHP object, then it knows how to print that as iCal. [aaronpk] has used it, my PHP is more old school usually.
# Zegnat Meetable uses eluceo/ical to create iCal files for download on the event pages etc (https://github.com/markuspoerschke/iCal)
# [tantek]4 Heads up to anyone using Sendgrid (e.g. to send newsletters from your personal site) There's a nasty ragephish going around: https://www.pcmag.com/news/avoid-the-ragebait-phishing-emails-exploit-anger-over-ice-to-trick-users
blacklight joined the channel
# btrem There's a date_ical module, which seems promising. But it does not provide basic http auth, which is a deal breaker for me. I provided a PR to add basic auth, a few weeks ago now, and got crickets back. I could hack the module myself, but there's another problem. The module is extremely inflexible. Might be broken in some respects, or maybe I don't understand it entirely. I could file issues, but if my PR is being ignored, the
DanQ joined the channel
CrimeWave joined the channel
pfych joined the channel
# btrem I do realize that with the power of Drupal comes complexity. And it's a tradeoff I get and am willing to make. Forgive me for beating a dead horse, but at the end of the day, the problem AFAICT is the mismatch between the formats that calendar apps will accept -- iCal and iCal only, thank you very much -- and the formats that frameworks typically export out of the box -- html, json, xml.