#dev 2026-04-29
2026-04-29 UTC
# 
[Kupietz] Ah. To make things even more fun, something between the Syndicate Links plugin and Bridgy Fed is not syndicating my custom post types until the next time I syndicate a normal Post, then everything suddenly goes out at once.
# 
simpleauthority Huh, this is so weird. gRegor provided me mintoken earlier to take a look at, but in reading its code it too does the same thing as tokens.indieauth.com (GET request for validating a token), and it returns a response that does not match what the spec declares. So this leads me to believe that this is a prior version of the indieauth spec - I'm just
# simpleauthority not sure which version. I might need to write a new token endpoint for the new spec, not totally sure. Or maybe just try to find what the old spec version is that supported this and build for that.
# simpleauthority Ah, OK - found it. 2 versions ago: https://indieauth.spec.indieweb.org/20201126/#access-token-verification-request - I think I should be able to build something that falls back from newer to older spec versions (within reason hehe)
# [Kupietz] [gRegorLove], yeah. Three syndicated posts of two different types (one regular post, two custom post types), with "Indieweb" in the body text also, syndicated to Mastodon and showed up in https://indieweb.org/mastodon-tag-feed/index.php but didn't show up in #indieweb-stream. A subsequent direct post on Maston does appear in #indieweb-stream.
# [Kupietz] [aaronpk] Appreciate it either way, man.
# [Kupietz] Aaronpk++
grufwub, TwinAdam, NaomiAmethyst, hedy, eb and [angelique] joined the channel
# [Kupietz] Oh, wow. Look at this. This is evil. Someone is trying to see if I have a backup of my wordpress config file they can read.
# [Kupietz] Fortunately that's in my "blocked IPs" log, this person tripped my security immediately.
# [Kupietz] This is why I like having a WordPress/Cloudflare integration that immediately blocks offending IPs at the cloudflare level. Go directly to jail, do not pass go, do not collect $200.
# [Kupietz] Glad I looked at my intrusion logs. I'm finding all sorts of neat stuff. I use a nonstandard URL format for my login page, just a little bit of added "security by obscurity"... never written my actual login URL down, never told to anybody, never used on any computer but my own... and just discovered for at least the past month someone's been hammering at the hidden URL. Fun fun fun. Changed it already and set it to immediately
# [Kupietz] block any IP that tries to access the previous login URL. Go to jail, MFers. Also just turned off Firefox sync of my history... that's the only possible way I can think of that the login URL might have leaked.
Hi joined the channel
# 
[tantek] The thing about Firefox sync of history is that *no one* else can see that, only your local devices that you setup with Firefox sync because sync data is end-to-end encrypted. Even Mozilla physically can't see it, and this is by design: https://support.mozilla.org/en-US/kb/sync#w_is-it-secure
# [Kupietz] I do seriously doubt sync is at fault, but TBH, I was so stumped I asked Claude for suggestions and that was what it insisted was the most likely answer... well, the most realistic-sounding one, second only to "Honestly though, I'd seriously investigate whether the parameter was just guessed" and "if you use Cloudflare, your URL is sitting in their logs". Typical stochastic parrot nonsense, but I figured, I couldn't think of any
# [Kupietz] other way myself, and I don't need FF sync for my history anyway, so, no harm turning it off. Good to know it's secure though.
# [Kupietz] I haven't worked on a public network in a very long time at this point, probably years, and the fact that I only have to log in once every few weeks makes the odds of having logged into my site over one even more infinitessimal. Usually I'm working on the site at home. And the bookmark I have saved to access the login page uses https.
# [Kupietz] I suppose it's possible that some extension is phoning home. That's an unpleasant prospect... I don't have any extension running that has a valid reason to report my visited URLs anywhere.
# [Kupietz] I'm happy to chalk it up to a mystery for now. I'm just going to watch the logs and see if it happens again. And even if it does, I have 2FA, it's not really that big a worry.
# [Kupietz] Viscerally repulsive idea, but, can't rule it out. 😕
# [Kupietz] LOL, reminds me of back when AOL released "anonymized" user web searches. I found a friend of mine's immediately.... because he ego-surfed his own name, using terms only he would use... immediately before searching all his favorite porn searches. Learned more about him that day than I ever wanted to know...
# [Kupietz] Long ago, maybe 15 or 20 years ago, yeah. AOL publicly released a bunch of user search histories.
# [Kupietz] Ah, here it is. https://en.wikipedia.org/wiki/AOL_search_log_release
# [Kupietz] It was really an amazing and horrifying breach of trust.
barnaby joined the channel
# [Kupietz] If there's any silver lining to it, it was a good object lesson for the rest of us, at least. Never again did anyone seriously think what they typed into a browser alone at home late at night was private.
# [Kupietz] I believe so, yeah.
k3can joined the channel
# [Kupietz] So it should have, by any reasonable expectation, stayed private.
# [Kupietz] If wishes were horses…
barnaby, kishy, shoesNsocks, Maxpm5, deathcomestotime, [jeremycherfas], GuestZero_, ax562, superkuh, [artlung], blacklight, [Al_Abut] and KE0VVT joined the channel
# 
[capjamesg] I got IndieAuth added to https://github.com/joshbuchea/HEAD
gRegor and thegreekgeek_ joined the channel
# [capjamesg] Oh I could probably get that in too. The maintainer is really kind.
# [capjamesg] I’ll file a PR.
barnaby and [benatwork] joined the channel
# [Kupietz] [gRegorLove] Yes, I did.
# 
gRegor Which one? The "Another syndication test..." post is the only one I see, doesn't have "indieweb" in the `content_html`. Original is gone now: https://fed.brid.gy/r/https://michaelkupietz.com?p=33668
# [Kupietz] Yeah, I deleted all of them after I was done testing. Here's the Bksky posts of two examples, since Mastodon doesn't include post body in syndicated posts, but these went to mastodon too: https://bsky.app/profile/michaelkupietz.com.web.brid.gy/post/3mkls3c6ra732 and https://bsky.app/profile/michaelkupietz.com.web.brid.gy/post/3mkls3ep6mue2
# [Kupietz] On mastodon those are https://fed.brid.gy/r/https://michaelkupietz.com?p=33658 and https://fed.brid.gy/r/https://michaelkupietz.com?p=33656
# gRegor Though I don't see either "hast thou" or "xyz testing" in https://indieweb.org/mastodon-tag-feed/index.php. Maybe they get removed when the original is deleted?
[snarfed] joined the channel
# [Kupietz] OK.Test post at https://michaelkupietz.com/this-is-a-test-indieweb/ , syndicated to https://mastodon.social/@michaelkupietz.com@michaelkupietz.com/116489829228443582 via bridgy fed.
# [Kupietz] Ah! That turned up in stream! So it has to have the word "indieweb" in the title.
# [Kupietz] Lemme try an identical post, just without that.
JadedBlueEyes joined the channel
# [Kupietz] That's weird, #indieweb-stream posted mine differently from everyone else's though. No [bracketed name], and includes the image thumbnail.
barnaby, Maker and cotsuka joined the channel
# gRegor Yeah, in Aperture you subscribe to feeds and put them in a channel. Each channel can have filters like "exclude reposts" or "only reposts", then there's also word filters. So I think that's what's happening, there's a bunch of our blog feeds in that channel, which it makes sense to filter for indieweb related keywords. But there's also the Mastodon aggregate feed in there, so if "indieweb" isn't in the content_html, they
ax562 joined the channel
# gRegor New section with screenshot: https://indieweb.org/Aperture#Channels_and_filtering
cotsuka joined the channel
# [Kupietz] So, it seems so far, my posts with category "Indieweb" and "Indieweb" also in the title appear in #indieweb-stream. Include "Indieweb" in the body also, in addition to the title and category, causes a thumbnail to appear, too.
cotsuka, lanodan and blacklight joined the channel