#dev 2026-09-14
2026-09-14 UTC
cotsuka, bterry1, mahboubine, rrix and [Morgan_M] joined the channel
# 
valerieflynn What is Weird Web October?
# 
Loqi Weird Web October is a 31 day challenge to make a website every day in October according to the theme of the day, inspired by Inktober, and open to anyone to participate by posting about their new sites with the hashtag #weirdweboctober https://indieweb.org/Weird_Web_October
cotsuka, grufwub, lavandula_, bterry1 and lavandula joined the channel
# 
WinnerWind does webmention.io not support relme auth anymore? it says my site has no authorization endpoint
bterry1 joined the channel
# WinnerWind i'll make an issue on GH, seems like someone else also had issues loggin in
# WinnerWind [tantek]: webmention.io doesnt let me go to indielogin, for some reason ^_^``
# WinnerWind i can use indielogin and indieauth just fine, jus tlogged into both places to see if my site was broken
# WinnerWind but webmention.io just says i dont have an authorization endpoint
# WinnerWind ah! it seems im missing rel="authorization_endpoint"
# WinnerWind i don't remember since when that became a requirement ^_^``
lavandula joined the channel
# WinnerWind wohoo! webmentions Finally work now
lavandula joined the channel
# 
[capjamesg] thamara_k I did not receive the Webmention from your most recent blog post.
# thamara_k thanks for letting me know. Back to the drawing board.
# thamara_k Are you using webmention.io to capture them?
lavandula_ joined the channel
# [capjamesg] Yep
# WinnerWind [capjamesg]: quick question, webmention.io is only a webmention RECEIEVR. what do you use to actually send webmentions?
# WinnerWind i saw in the wiki a list of tools but im curious what you actually use
lavandula, lavandula_ and cotsuka joined the channel
# rnkn 55 commits pushed to production yolo!!
# WinnerWind its not a true yolo if 55 commits are not pushed on a friday :P
# WinnerWind my website's prod IS dev, haha
# WinnerWind i do test it locally first but other than that i just push it directly
# rnkn mine's a platform with users, so there's local tests, staging tests, production, then me clicking around making sure everything works
# WinnerWind why not write testbenches?
# rnkn is that different to tests?
# WinnerWind oh, my bad
lavandula joined the channel
# WinnerWind nope, a testbench is just a battery of local tests that needs to pass or fail
# rnkn ah yes, that's what I mean by tests
# [capjamesg] WinnerWind I am not sending them right now, but I have a Python script to do it.
# [capjamesg] https://telegraph.p3k.io can be used to send them manually.
# WinnerWind [capjamesg]: thanks for letting me know!
# WinnerWind im trying a bunch of things and seeing what i like most
[jeremycherfas] joined the channel
# 
[jeremycherfas] Beat me to it [capjamesg] ++
# WinnerWind OOF. made the rookie mistake of using a single equals to sign in place of a double equals to sign
lavandula and lavandula_ joined the channel
# WinnerWind you've heard of em, you've heard of rem, get ready for frem, an actual unit i used in my SSG and i did not even notice
# WinnerWind i dont really have a super rigid toolchain, im kind of working with raw HTML/CSS right now, i just have a really advanced automation to turn my sphagetti into pasta
ZodiacalComet, mort8088 and lavandula joined the channel
# rnkn if you're using a SSG why worry about bots? their crawling won't impact your site
# mort8088 You'd be amazed at the number of people who use an SSG but still have PHP on. "tyranny of the default"
aaronpk_ joined the channel
# rnkn I would recommend against installing PHP in the first place
[Murray] joined the channel
# rnkn negligible if they’re not loading media
# WinnerWind rnkn: because i had a bot crawl 500 GiB in about 3 months
# WinnerWind TLDR: i had one bot make 62% of my web traffic
# WinnerWind although this was from my fileserver, at the time, my fileserver just mirrored the stuff from my static site + a few extra books and articles i liked but couldnt find elsewhere
# WinnerWind so i had 600GiB of bandwidth eaten up by bots asking for HTML pages
oxtyped joined the channel
# rnkn your file server served HTML pages or downloads?
# WinnerWind downloads of html pages
# rnkn I mean binary files
# WinnerWind i mean if you consider it that way every file is a binary file :P
# WinnerWind but nope, i had HTML pages, PDFs and epubs all downloadable
# WinnerWind html pages would be downloaded and not opened in the browser
# 
[Murray] yeah bandwidth hit is not negligible. There are plenty of personal sites that have been taken offline for periods due to the impact of bot traffic. Poorly made scrapers going in loops; bad faith code that just hammers a site with more and more "agents" until its done; thundering herd issues where bots follow bots.
# WinnerWind ive even seen some user agents intentionally/unintentionally make MultiPart requests to a server in the hopes of paralell processing a given endpoint but causes the webserver to send the same thing multiple times over (MultiPart requests are better suited for audio/video and not HTML pages)
# [Murray] Yeah, and unfortunately very few are designed to use the "best practices" that the LLM industry have suggested. E.g. the few people I know that bothered with the whole "alt version of the webpage in machine-parseable formats" find most crawlers still just go to the webpage rather than the bot version
# rnkn I can recommend pf-badhost as a first line of defence
# rnkn I then have a block on IPs with 100 requests over 10 mins
# rnkn or 100 concurrent connections
# rnkn put images on a CDN
# [Murray] /mark/work/ woops 😄
# WinnerWind ive been pretty content with iocaine (https://iocaine.madhouse-project.org/)
# WinnerWind its taken my bandwidth down by a lot, and it even pushes bots to its own URL path so you can see all the bots that got caught and then block them entirely/move them elsewhere
# WinnerWind me and a friend in the indieweb found that redirecting them elsewhere is a really REALLY easy way to do an amplification attack, though
# WinnerWind there seems to be a limited number of crawlers and after redirecting them elsewhere they stop coming to your site, but then the crawlers become someone else's problem
# WinnerWind doesnm: yup, but the bots that get stuck in iocaine go to a special page on the site and you can then use a URL rule to block them entirely, which is what i do
# WinnerWind oom?
# WinnerWind ah
# WinnerWind doesnm: forgejo/gitea has an option to hide expensive page views behind a login
# WinnerWind things like diffs and blames
# WinnerWind set env variable REQUIRE_SIGNIN_VIEW=expensive
# WinnerWind thats oaky
mort8088 joined the channel
# rnkn WinnerWind, doesnm: do you have recommendations if I want to keep false positives to an absolute minimum?
# WinnerWind rnkn: iocaine is really good at not catching modern browsers and even slightly outdated ones while also completely nuking everything else
# WinnerWind that said sometimes it does overshoot so if you're using something line Monocles browser or something that isnt Gecko/Chromium your chances of being caught by iocaine go drastically higher
# rnkn is the cookie challenge still effective at all or don't bother?
cotsuka joined the channel
# rnkn oh I forgot my favourite bot mitigating measure: I continuously scan access logs and block any IP requesting *.php
cotsuka, ax562, [contact898] and lavandula joined the channel
# Loqi test in production is (AKA testing in production) deploying code changes to a web site or service typically visible to the public as part of checking to see if the code changes function as expected, and is practiced by some IndieWeb creators especially with their own projects as a form of eating their own cooking, often before publishing code changes to an open source repository https://indieweb.org/test_in_prod
# WinnerWind [tantek]: LMAO, there really is an indieweb page for everything
cotsuka joined the channel
[schmarty], [Sophia] and [Sophia]1 joined the channel
deathcomestotime and [manton] joined the channel
# [social] GitHub is still Ruby. But, in the last year I’ve seen a handful of boostrapped products that the developers in the past 10 years had gone to Node / JS head to Ruby because of the whack-a-mole nature of security issues with Node. The ease of Ruby and legacy still solid collections of gems allows for quick prototyping and testing. The parts of their services that need optimizing often are getting moved to Rust (much like the Python to Rust i
# [social] the data science community).
sp1ff` joined the channel
Xe joined the channel
cotsuka joined the channel
# rnkn [manton]: what lang is micro.blog?
# [social] GitHub used a little Ruby on Rails, but quickly turned to building their own frontend framework that was less fragile for what they needed than Rails offered. Late 2010s GitHub was shifting to more common frontend frameworks. Many of the GitHub front end devs have been standards and DOM heavy focussed and frameworks needed to have that focus.
ZodiacalComet, mort8088 and cotsuka joined the channel
# 
[Mike] Interestingly, for a long time I've been trying to figure out what to go into next professionally. Every time I looked at it, it came down to Rails or PHP+Laravel, and originally, from a purely technical point of view, Rails seemed to come out on top, but as I learned more—and this is literally less than a week ago—Laravel edged out Rails (the very final straw was, I've already been doing PHP to some extent for years, and, if I want to do
# [Mike] I'm pleased the technical arguments led back to PHP, for a number of reasons, including the obvious nontechnical reasons not to want to get into rails. I was a little surprised, I always worried that PHP was kind of outdated and reliant mostly on the legacy systems built in it, but apparently Laravel is holding pretty strong, possibly even gaining some usage.
# tdrayson As someone who started on WordPress and soon became fascinated by coding and development, I've recently started using Laravel and Vue.js, and it has been a joy. For me, the nicest thing about Laravel is that everything seems well thought out and just works. There are so many handy built-in functions natively that you then don't have to worry about.
# IWDiscord <tdrayson>
# tdrayson I definitely think more people are moving from WordPress to Laravel for the PHP side of things. It's a natural progression, I feel, or at least it was for me. I didn't really want to just leave the PHP world, and I found I was hitting the limitations of what WordPress can and should be doing.
# tdrayson PHP is also used on at least 40% of the entire internet, so I don't think it's going anywhere anytime soon
lavandula, [benji], daemonspudguy, solonovamax, cotsuka and thatoddshade joined the channel
# extralongdivision Not necessarily indie web focused, but I'm sending this from Discord but would like to use IRC more but it doesn't seem to like my VPN. Anyone else have trouble with this?
# IWDiscord <extralongdivision>
# extralongdivision I've setup have SASL setup with liberachat, but IRC doesn't like to connect to a server unless my VPN is disabled.
# 
gRegor Found this, too: https://libera.chat/guides/sasl#sasl-access-only-ip-ranges
barnaby, deathcomestotime, barnabywalters, cotsuka, ZodiacalComet, shoesNsocks, gtsmslp and kishy joined the channel
# [Mike] @tdrayson++ Thanks... that's encouraging to hear. I'm coming from a dual background of WordPress (plus some other very small apps in just ordinary, no-framework PHP, and one project in SMARTY which was really annoying), and designing general database-driven apps. lots of CRUD. Laravel seems to have the high-level database abstraction covered well too, from what I've read so far.
thatoddshade, ZodiacalComet_ and cotsuka joined the channel
# 
[aciccarello] Was there ever a discussion on how sites could publicize what webmention vouches they would accept? That seems preferable to needing to crawl a site for links. Publicizing your allowlist could potentially be misused to make it easier to game the system but I don't know how else a sender would reasonably discover a good vouch.
# [aciccarello] I'm also wondering if there is/should be a rel (like nofollow) that should indicate a link isn't valid for a vouch
# [aciccarello] Oh, "nofollow" was mentioned in 2014 https://indieweb.org/2014/Cambridge/vouch
cotsuka joined the channel
# [aciccarello] Short of building an entire service for this. I wonder if there's a distributed way to do this. Let's say sites had pages listing 1) sites they have approved and a (potentially private) list of mentions they've received. In that scenario if you wanted to send a mention to Alice, you could check Alices approved site, compare it to your own mentions list and look for a match.
# [aciccarello] Again, I'm not sure publishing your allow list is wise but it seems necessary.
# gRegor Have not kept it up to date or linked to it outside indieweb chats, heh: https://gregorlove.com/following/
cotsuka joined the channel
# [aciccarello] The discoverability of the list seems important. While I see the appeal of making it a manual step, I don't think it's reasonable for most interactions.
parnikkapore_x joined the channel