#dev 2026-09-17

2026-09-17 UTC
cotsuka, Xlongdivision, grufwub and sp1ff joined the channel
#
[social] I’ve hit what may be a bug and can’t login to http://webmentions.io and using my http://vanderwal.net nor my http://personalinfocloud.com
angelo joined the channel
#
[social] The error I am getting is a 403 error.
#
[social] I’ve cleared cookies and tired different browsers and devices.
lavandula_, lavandula, rubenwardy, cotsuka, ruecharli, vikanezrimaya, doesnm, [pcarrier_com], barnabywalters, [burgeonlab], [snarfed], ax562, [jeremycherfas], ZodiacalComet, GuestZero, lockywolf_ and strugee joined the channel; shoesNsocks left the channel
#
aaronpk one of the last things that makes indieauth not compatible with OAuth is the text about exchanging the authorization code at the authorization endpoint when no access token is expected https://indieauth.spec.indieweb.org/#profile-url-response I would like to remove that behavior and switch to the normal OAuth behavior of exchanging it at the token endpoint. I can't find a github issue about
#
aaronpk this but I swear we've talked about it before
cotsuka, lavandula, Zac, alex2, lavandula_, [Braden_gingers] and Xlongdivision joined the channel
#
gRegor yeah, rings a bell. maybe it was only in a session or chat.
#
gRegor aaronpk: for the indieauth test S407 checking for expires_in, is it supposed to be trying multiple refresh_tokens? Looks like 4 refresh token requests.
#
gRegor also unsure if/how the introspection endpoint is supposed to work, since it requires authz. I implemented Client Authentication for it as a proof of concept, but there's no client secrets in the IndieAuth flow. Is that test just to ensure the 401 response?
#
aaronpk Oh it's based on the current spec that says auth is required for token introspection. My new IndieAuth server has a way to register resource servers and give them credentials, but I don't think anyone else does that yet
#
aaronpk Not sure on 407, will have to check a bit later
[manton] joined the channel
#
[manton] I think that would be a good change (using the token endpoint, so it’s the same even with profile scopes).
#
gRegor +1
#
[manton] It’s a little confusing right now. I had to refresh my memory how it works.
#
[manton] If that changed, would it be weird if the token endpoint returned a blank (or missing) access_token field?
#
[manton] Or I guess it could return an access token that just didn’t have access to anything.
#
gRegor good question. I also wonder what response the authorization endpoint should give if clients try exchanging there.
#
gRegor I guess keep it working as backcompat for a while
#
[manton] Yeah, makes sense to keep the old way working.
#
GWG I don't have a way to do auth on the introspection endpoint yet
cotsuka, jjuran, mahboubine and [Tabitha] joined the channel
#
aaronpk yeah technically the oauth token response requires returning an access token. one way to handle it is to return an access token that can retrieve profile information from the userinfo endpoint
cotsuka, Xlongdivision, Drew1, Drew2, vriska, lanodan, barnaby, ax562 and WinnerWind joined the channel
#
aaronpk ok: for an indieauth.com replacement service, what's the better name: Keyhole or IndieKey?
#
aaronpk and yes i am getting close to being able to launch this
[schmarty] joined the channel
#
[schmarty] IndieKey >>>>>> Keyhole 😂
#
aaronpk that much?
#
aaronpk i do like that it mirrors IndieLogin
#
[schmarty] i think keeping "hole" out of project names is a good idea. at a minimum it reminds me of "it goes in the square hole"
#
tdrayson I guess indiehole is not a good fit….😅
#
tdrayson Might be miss interpreted when pronounced
[schmarty] joined the channel
#
aaronpk omg
#
aaronpk ok next question: .org or .net or .id? (.com is $3000 so that is out)
#
[schmarty] .org sounds more like a community resource. .id is interesting but i think that's also an expensive TLD? .net is dot-neutral for me. :}
#
aaronpk .id is mid, showing $22/yr right now
#
[schmarty] that's not bad! i expected extortionate pricing.
#
aaronpk me too
cotsuka joined the channel
#
aaronpk "indie key dot I D" might be a bit too much rhyming for me tho 😂
#
[schmarty] i like it! a rhyme is a good mnemonic.
GuestZero joined the channel
#
[snarfed] interesting! I thought indielogin was the indieauth replacement. is that one out now?
#
aaronpk see that's the thing
#
aaronpk indieauth.com did *two* things
#
aaronpk indielogin.com is half of the replacement, and I've never built the other half yet
#
[snarfed] oh I guess I thought that part was staying on indieauth
#
[snarfed] but ok, makes sense
#
aaronpk yea there's a bunch of things I want to do differently for that half, and indieauth.com is a dead code base at this point
cotsuka and jjuran joined the channel
#
[Mike] Parenthetical aside: [tantek] Point of information, following up with your DoH comment the other day... I use the NordVPN plugin in FF, and turning on the custom DoH setting prevents the VPN from connecting unless you also set the custom DNS server to NordVPN's DNS, `https://dns1.nordvpn.com/dns-query` or `https://dns2.nordvpn.com/dns-query` . Just a little trivia to throw into the ol' memory pot.
#
[Mike] I looked in the wiki to see if we have anything about DoH, but there isn't, so, didn't add this anywhere, but thought it was worth filing away. Nord's own documentation doesn't make it clear that this is an issue until you trip over it.
#
[tantek] yes since they both deal with routing / DNS that makes sense
#
[tantek] does NordVPN host a DoH resolver?
#
[Mike] Seems that way to me. I set the DoH custom DNS to one of those URLs in FF, and it worked. In fact I found a page that says since it's in the FF settings it'll still use their DoH even when you're not signed in to the vpn
#
[Mike] Which, I mean, makes sense.
#
gRegor +1 for indiekey dot id
#
[aciccarello] Same indiekey dot id sounds memorable
#
[Mike] I like indiekey dot id as well.
#
aaronpk it will be done
#
aaronpk thanks
#
gRegor wait wait indiekey dot biz
#
[aciccarello] Gregor wants his domain to not be alone in the TLD
#
[aciccarello] 😆
#
gRegor XD
#
aaronpk haha
cotsuka joined the channel