#dev 2026-09-19
2026-09-19 UTC
cotsuka, CRISPR, grufwub and Xlongdivision joined the channel
# 
[tantek] remember what I said about small businesses getting hacked? not just because of old buggy code that LLMs can find, but perhaps now new buggy AI sitebuilder code: https://www.stuff.co.nz/nz-news/361034088/chaos-after-auckland-store-leaves-website-open-public-edit — consider this a warning by example to NOT create a slop-coded indieweb site
kleb60, k3can8 and cotsuka joined the channel
# 
carrvo Been a while since I posted here but I've been working on a new component: https://turner.enemyterritory.org/user/carrvo/website/MIndie-Agent--An-IndieAuth-Bot.html
# carrvo It works with my own setup. Next week I will hopefully have time to try it against someone else's.
cotsuka, lavandula_ and lavandula joined the channel
# 
WinnerWind i saw that indieauth is being replaced with indiekey ._.
lavandula joined the channel
# WinnerWind oh wow, indiekey is much faster than indieauth, i quite like it
# WinnerWind in indieauth i had to log in first by selecting github which redirected me to google where i put my password and passkey which then forwarded that to github and then github finally forwarded that to indieauth
# WinnerWind madness but it worked
lavandula joined the channel
lavandula_, Xlongdivision and [pcarrier_com] joined the channel
# [pcarrier_com] where do I read about that?
# [pcarrier_com] what is indiekey
# 
Loqi It looks like we don't have a page for "indiekey" yet. Would you like to create it? (Or just say "indiekey is ____", a sentence describing the term)
[pcarrier_com]1 joined the channel
# [tantek] indiekey is https://indiekey.id/
lavandula and barnabywalters joined the channel
# WinnerWind my longest auth chain is this: someone's private forgejo <- codeberg <- github <- google <- password & passkey
cotsuka and lavandula joined the channel
lavandula, jjuran, cotsuka, barnaby, lavandula_ and doesnm joined the channel
# 
[KevinMarks] To log into the AWS account for a company I'm contracting for its AWS <- Microsoft <- Github <- Google <- Google Authenticator, and I need to do this once an hour to keep the local port forwarding tunnel so I can access the db from my local machine
cotsuka joined the channel
lavandula, dustinm` and barnaby joined the channel
# WinnerWind aaronpk: unofrtunately IndieKey doesn't work with webmention.io ._. (GH issue already made)
cotsuka, lavandula_, lavandula and chimo joined the channel
# 
[rose] Is indiekey a bit like Authelia? Or... Not exactly cos there is some third party stuff? I use Authelia. I had to use it yesterday after realising my Tailnet DNS don't work on the tablet. It works nicely for the remote access system, which is turned off when not in use anyway. The best security is turning the service off when you don't need it!
# [rose] RE: AI slop websites, [tantek] - I was assessing some companies for a client, IT sector, basically where they should go in a directory and if their proposals make sense enough to justify a new category. Of about 6, 2 were AI-generated. Obvious from the samey designs and CSS errors on responsive screens, and size despite being static. I don't wanna say too much in case people figure it out. But yeah, I am surprised that it happens even when
# [rose] [aaronpk] Oh so it is different. Authelia is like an independent gateway thing that you can put in front of sites on your server. But it doesn't integrate with other things. So I have to use Google to log in to my Immich. It sounds like IndieAuth replaces that - when the service supports it?
# 
aaronpk oh it does OIDC already https://docs.immich.app/administration/oauth/
# Loqi [preview] [kivraid] kivraid: Modern, lightweight identity provider in a single Go binary: OIDC provider, forward auth, LDAP + local users + upstream OIDC federation, TOTP & passkeys, a self-service portal and a polished admin UI — SQLite by default, ~26 MB RAM. A featherweight Authentik alternative.
barnaby joined the channel
# 
doesnm my instance are at https://auth.doesnmlab.xyz/
barnaby and thatoddshade joined the channel
# tdrayson It tends to be the thing AI leans towards by default for a lot of sites, its less common these days but in the early days it was a major flag that something was AI generated, but each model seems to have a "house" style
cotsuka joined the channel
thatoddshade joined the channel
# aaronpk this is a fascinating stat from indieauth.com logins https://media.aaronpk.com/2026/09/19055308-1802.png
barnaby joined the channel
# [KevinMarks] I keep using http to log into monocle because https gets a different set of feeds
# carrvo Oh dear, I wanted at some point to duplicate the auth selection of IndieAuth.com (I looked at the source once and found it hard to read) but IndieKey.id replaces it with Passkeys, which I don't like.
# tdrayson why don't you like passkeys?
cotsuka joined the channel
# WinnerWind considering i dont keep cookies in my browser using passkeys saves me a thousand clicks
ax562, pmjoshi and lavandula_ joined the channel
# carrvo I might be mixing up IndieAuth.com and IndieLogin.com, I can never remember the difference.
# carrvo tdrayson: I don't like Passkeys largely because the most popular way is to share it between devices, which breaks the purpose of them.
# carrvo Then there is the marketing of "passwordless"--you need to still have a password or some other mechanism to register the device's Passkey in the first place (and every new Passkey).
# carrvo A good feature of memorized passwords is that is for finding yourself in a situation of needing to login without any of your devices around. Finally, if I am to remember the password I will have anyway, then I need to regularly use it.
lavandula and barnaby joined the channel
# [social] I set up indiekey.id with passcode. I went to capture the recovery codes and it says I have 8, but haven’t seen them.
lavandula, cotsuka and barnaby joined the channel
lavandula_ joined the channel
# [social] I click the “Generate a new set” and the screen shot is all I see. I am using Safari.
# WinnerWind another day another break in my SSG https://x0.at/Q4QJoslArq.png
# WinnerWind carrvo: Passkeys to me are a convenience feature. I use KeePassXC to store my passkeys so this means that i can use my passkeys anywhere I feel like, that has the database file and a copy of KeePassXC. I don't set up passkeys to be the ONLY 2FA method. I set up passkeys to be an alternative to password + totp
lavandula joined the channel
# WinnerWind so if i need to log into google i can either use my passkey to log in with 3 clicks or i can use my password, then open my TOTP application, then enter my TOTP, and then login
# WinnerWind my rule of thumb is: don't open the keepassxc database on any device that isn't 100% managed by me, so this setup basically means i have a passkey for my phone&laptop
# WinnerWind [social]: yeah that shouldn't be happening, it should be showing you the codes right there
# [social] I’m going to try in Firefox / Zen
# WinnerWind good luck!
# [social] A Saturday building and running runbooks for my data munging services. Adding debugging and testing fits the theme.
# carrvo WinnerWind: I don't like convenience! But it is completely fine for you.
# WinnerWind carrvo: if I kept cookies in my browser, I wouldn't be using passkeys
# [social] The recovery codes work in Firefox, but don’t show in Safari.
# WinnerWind i wrote a small hook in my SSG to minify html and it turned an 10.3kb into an 8.1kb file
# WinnerWind [social]: interesting, might be worth reporting to the developers
# WinnerWind things working in ff/chrome and breaking in safari is shcokingly common
# [social] The developer is here and interacting
# [social] [aaronpk] The recovery codes work in Firefox, but don’t show in Safari. In Safari they don’t appear to begin with.
cotsuka joined the channel
# [social] LLMs just copy me
# tdrayson Oh joy, what a shocker something doesn't work in Safari...
# [social] I am chipped for a direct connection
# tdrayson As much as I like Apple, their browser be a doozy sometimes for developers 🤣
# WinnerWind aaronpk made indiekey? everywhere I go, i see his face
# carrvo I haven't figured out why Chartjs doesn't play nicely with Safari. It is a real bummer for my growth charts. 🙁
# [social] Years back when I was advising Microsoft web app product teams, they would build to work with standards and test first in Safari. If it worked there it would work in nearly everything else. That still holds up. Chromium and Firefox are farther ahead than Safari (for the most part, some things Safari is ahead, like spatial web handling).
# WinnerWind i think i might have ^_^``` i only check ≋1 indieweb channel at a time
# [social] Safari can take a beating that Chrome can’t. I can have around 1,000 tabs open and no issues, but Chrome around 150 tabs and it has issues.
# [social] carrvo have you looked at D3 options? Their charts and dataviz offerings nearly always work well in all browsers. I’ve used them since the around 2008 for many charting and dataviz needs.
# tdrayson seems to be rendering in safari fine for me (from the chartjs demo page)
# tdrayson [social] surely having 1,000 tabs open is abuse 🤣
# [social] I often will have two Safari Windows open with close to 1k tabs. But, then easily do an open tab capture with open tab side bar copy and paste out to structured markdown list and then close the window and start fresh.
# [social] 1,000 tabs is my comfort blanket. 😉
# [social] Opening dev console (just finished sending a support request to stop 403'ing http://Webmention.io and the PHP parser.
# tdrayson my brain couldn't handle having that many things open, i'm currently sat at about 15, but try to close as many as possible every morning back to 0
cotsuka and lavandula_ joined the channel
# carrvo I have a feeling that my Chartjs issue is a config one, not the library itself. In that case I am likely to have an issue regardless of the library.
# carrvo But I haven't had an opportunity to debug since it is my wife's device, not my own.
# carrvo If anyone wants to spend a little time, I have a public demo here: https://turner.enemyterritory.org/user/carrvo/website/growth-charts.html
# [social] [aaronpk] I see the `code-block secret` in the in the source response in the page in the HTML / DOM. Safari doesn’t show anything is blocking it. But, since the page is new one of my site blockers that triggers on sites that are new (likely Stop the Madness).
# [social] I am only at under 200 tabs in one Safari window and around 90 in the other. 48GB of RAM helps.
# [social] I’m not sure if that is what is blocking it.
lavandula joined the channel
# [social] I was seeing the codes in the DOM.
# [social] I denied Stop the Madness access to run on Indiekey.id and the codes showed up properly.
# [social] I’m not sure what I have flagged in Stop the Madness that would have caused this.
# [social] Thanks!
# tdrayson [social] the chartjs is working fine for me in safari
strugee joined the channel
# tdrayson sorry [carvo] lol
strugee_ joined the channel
# WinnerWind just had a thought, i wonder if it would be possible to use webmentions to make a guestbook
# WinnerWind probably not, a guestbook is meant to be written to by ANYONE
# [social] [carvo] I have empty tables and the links to the CSVs are broken
# WinnerWind not just people with a website
# WinnerWind but a guestbook limited to those who can send webmentions would certainly combat a lot of the spam that takes place on atabook based guestbooks
# tdrayson https://indieweb.org/guestbook looks like some people just create a page on their site that accepts webmentions
ARCHI and [tw2113] joined the channel
Xlongdivision joined the channel
# [snarfed] sounds like a job for https://commentpara.de/
cotsuka, pimeille, rrix_ and Bazz joined the channel
Bazz, cotsuka and WinnerWind joined the channel
# [social] gRegor I heard back from my host support and they were blocking old browser versions as “they are often what AI bots claim”. My sites now have the old browser blocking turned off (not exactly what I had hoped for an outcome, as my bot traffic is double real traffic but not bad and now I know why).
cotsuka joined the channel
# [social] This is just one of the layers they have, but it cut the bot traffic not captured by 60% to 70%. Being on shared hosting some people want the capture and others want it all blocked and others are in the middle.
# [social] Looking at my log from the other day (one of 4, which I need to sort out why there are 4 different access logs) there were around 240 different crawlers for search / bots. I’m trying out GoAccess locally.
Xlongdivision joined the channel
# [social] Hmm… http://webmention.io returning `Issuer in metadata endpoint is not valid`
# [social] This was working not that long ago.
cotsuka and Pixi` joined the channel
# carrvo tantek++
# [social] I am entering https://vanderwal.net
Pixi joined the channel
# [social] Great! Thank you!
# [social] [aaronpk]++
cotsuka and SDavidPrince joined the channel