#dev 2026-09-13
2026-09-13 UTC
cotsuka joined the channel
# 
[Morgan_M] A new one for me, finding out I had accidentally continued to publish some statically generated webpages I had removed because I had never bothered to check if the static site generator build over-wrote the public folder completely or just incrementally overwrote.
# [Morgan_M] Nothing of any concern, but my site overall is much lighter and 2-3 janky semi broken pages arent there anymore
cotsuka, grufwub, solonovamax, arthur, dustinm`, hypha_, lavandula and lavandula_ joined the channel
# 
[capjamesg] What is alt text?
# 
Loqi alt is a required attribute of the <img> element and should be provided in any use of images on indieweb pages from photo posts to featured and other images in articles https://indieweb.org/alt_text
lavandula, lavandula_, hypha_, cotsuka, doesnm, ax562, mort8088, guilhem1, Cassia, ec_Cass, ZodiacalComet, mahboubine, [social], [aciccarello], [KevinMarks], [KevinMarks]1, Cinnamon, jjuran, cobbland and [snarfed] joined the channel
# 
[Mike] [tantek] continuing from #indieweb-meta re: serving alternate content by refer… that’s a good idea. I can only see practical difficulty: I get strong protection by doing the blocking right on cloudflare, not at the web server level. I’m not sure how we would get alternate content served without some visible artifacts: either a redirect (307?) to a slightly different URL, or appending an URL parameter. You would probably need the worker t
# [Mike] serve the content itself to make it transparent. Which mine actually does… It serves a notice that the user isn’t permitted to access the site… But if you were trying to fool them into thinking they were viewing the real site, that would be a lot of content. A worker could probably serve it, but I don’t know enough about workers to know if they’re really robust enough to serve up much content.
cotsuka and jjuran joined the channel
# [capjamesg] Following on from #indieweb-meta. I use nginx and wonder if there is something already for this.
# tdrayson Something like this [capjamesg] https://serverfault.com/questions/1109277/how-do-i-redirect-my-sites-based-on-different-referers
# [capjamesg] Ah sorry for the confusion! I brought up another topic: “One thing I do want is to ban IPs trying to scan for files like *.php, *.env, etc.”
cotsuka joined the channel
# tdrayson why do you need to ban IPs, instead of just blocking direct access to those files
barnaby joined the channel
# [capjamesg] There are bots that automatically scrape all those paths trying to look for something to exploit. I would prefer to ban them so my server doesn’t have to handle the traffic.
# [capjamesg] Cloudflare might do this for me (I haven’t checked) but ideally I’d like to know how to do this stuff on the server where I have more control.
# [capjamesg] Wow, in the last few days I have had ~7058 requests to *.env files across my sites.
daemonspudguy joined the channel
# tdrayson you could set up fail2ban — it tails the nginx logs and pushes offenders into nftables
# IWDiscord <tdrayson>
# tdrayson worth knowing banning in nginx itself doesn't save you much though, the handshake and TLS have already happened by the time nginx checks a blocklist. fail2ban at least drops them in the kernel on the next hit
# [Mike] [capjamesg] Cloudflare is a reverse proxy, it sits in front of your website and direct traffic to your server. Yes, you can set up security rules. I have a number of security rules that specifically deny requests containing path names that WordPress vulnerability scans often include, such as “xmlrpc.php”. You’re welcome to try visiting an URL on my site like https://m9z.org/test/xmlrpc.php to see what it does. It won’t blacklist you, i
# [Mike] One other bit of technical detail is that by default cloudflare simply forwards requests to your site, and other people can access your site by its direct IP address and never even be seen by cloudflare. There’s a solution to that, too… You set up a local darmon called “cloudflared” on your server that connects to cloudflare via an encrypted tunnel, and turn off all direct external HTTP/S access to your server. It only sees what comes
# [Mike] Uh, James, it looks like you’re already behind cloud flare… https://builtwith.com/jamesg.blog You just need to set up some security rules. I can help you with that if it’s daunting, but it shouldn’t be hard to figure out.
cotsuka and JadedBlueEyes14 joined the channel
# solonovamax I'm looking to implement a websub hub for my website, as there's a couple of feeds I'm serving. reading through the websub spec, it says that "Each subsequent request to a hub to subscribe or unsubscribe MUST override the previous subscription state [...]" (§5.1), which kind of implies that the hub should continue storing a subscription which has been unsubscribed from in the database. I'd prefer to just remove the row from the database when
# solonovamax is sent, but I'm just not entirely sure what's intended by that passage
# solonovamax also, it seems to me that the spec was kind of written with the intent that a single hub server, that is separate to the application server with the feed, is used. because I'm writing the hub to only handle the feeds from my site, I'd ideally like to avoid parsing the topic url to determine which feed was requested. something I could do to avoid that is for each feed to have its own hub route. but, from how the spec was written, it kinda feel
# solonovamax necessarily the intended use, so I'm unsure if I should take this approach or not
bterry and cotsuka joined the channel