[angelique]Some random & dev crossover: If your repo's README includes images, do you place them in a directory and, if so, what do you name it? Just keeping them in the root feels weird, especially when there's more than the one. 🤷♀️
jak2kIndielogin.com can't log me in because it uses a user agent that is also used by LLM crawlers. (There is an open issue.) Even with a correct user agent, I would have to trust the header. Maybe we could specify a way to say "Hey, I'm a bot for <URL>" so it can be verified. Basically an IndieAuth for computers.
[tantek]Really? I'd be surprised if IndieLogin didn't have a unique user agent and even more surprised that any LLMbot would bother with pretending to be IndieLogin
[tantek]Been wondering if IndieAuth / RelMeAuth / Web Signin should suggest a user agent, and similarly for Webmention retrieval requests. That way you could add them to a low frequency allowlist and then it would be obvious if they're legit requests or a dumb bot pounding
jak2kMaybe a service could publish some kind of key it signs a header with? That would be cryptographically verifiable without having to use more complex stuff like client certificates.
deathcomestotime and [pcarrier] joined the channel
aaronpkThere's a clear path to do a possibly simpler version of it by indielogin.com publishing a public key in the client ID metadata document, then adding a private key jwt in a header
[tantek]For this usecase there's no need for 100% verifiable identity plumbing. It just has to be probabilistically true enough for performance reasons
aaronpkYeah, but ultimately it should be doing that anyway when it starts the OAuth flow, so it basically rides along for free at least on the client side
[tantek]Also, my proposal would generalize to any server to server follow-your-nose discovery use-cases so it would be a useful building block for future protocols too
[tantek]We should be lowering the batteries to such usecases to provide ever more practical and robust alternatives to all the .well-known fragile site path specific approaches people leap to because they don't know better
[angelique] Some random & dev crossover: If your repo's README includes images, do you place them in a directory and, if so, what do you name it? Just keeping them in the root feels weird, especially when there's more than the one. 🤷♀️
[capjamesg] I have done that too.
jak2k Indielogin.com can't log me in because it uses a user agent that is also used by LLM crawlers. (There is an open issue.) Even with a correct user agent, I would have to trust the header. Maybe we could specify a way to say "Hey, I'm a bot for <URL>" so it can be verified. Basically an IndieAuth for computers.