#dev 2026-11-06

2026-11-06 UTC
[pcarrier_com] joined the channel
#
[pcarrier_com] Also solved by disabling password-based authentication which is a great idea with all your SSH setups, affected or not.
Xlongdivision, CrimeWave, grufwub, hypha_ and troojg joined the channel
#
Zegnat [pcarrier_com] yeah it still catches me by surprise when SSH does not default to keys.
#
WinnerWind to be fair key setup is a bit more involved than just password auth which Just Works
#
Zegnat Maybe. I think Hetzner will still default to a root password. But they give you the option to upload your public key before the server is created. Which is so much safer, but not enforced.
win0err joined the channel
#
[pcarrier_com] typing it twice into the `passwd` command.
#
[pcarrier_com] The learning curve is everything, and SSH key management workflows are basically non-existent (IIRC it’s ubuntu, maybe also debian, offering to import your public ssh keys from http://github.com at install time?). But all in all, it’s one command to generate a key the first time, then putting eg https://github.com/pcarrier.keys into ~/.ssh/authorized_keys is arguably less involved than generating a strong new password the
JoshuaMorris, jjuran, petermolnar, barnaby, grufwub, win0err, paultibbetts and troojg joined the channel
#
mcepl aaronpk: Any chance you can pick up https://codeberg.org/forgejo/forgejo/issues/1692 ? I really now nothing about it, and given the love of Forgejo community with AI (none), I cannot even vibe code anything for it.
ax562, [Sophia], [aciccarello], [artlung] and barnaby joined the channel
#
gRegor indieauth-client-php question, if you start discovery with an `http` URL that redirects to https, should we keep track of that in the client and use the final URL for comparison? I think I'm running into an issue with this if I try to sign in with just "gregorlove.com" because it gets normalized to http, then the issuer comparison fails, because the issuer is (correctly) an https URL
#
gRegor Looking through the code now and I don't think it handles it, but maybe I'm missing something
#
gRegor this is from indiebookclub btw. I guess I could normalize those domain-only submissions to https, hm
#
gRegor oh, and it's the client itself doing that http normalizing: https://github.com/indieweb/indieauth-client-php/blob/main/src/IndieAuth/Client.php#L561
#
aaronpk i thought there was pretty thorough redirect handling in the library already
#
gRegor I'm getting an invalid_issuer error
#
gRegor It's handling the redirects OK, I just think the resulting URL isn't getting back into the client code when it compares against the normalized $me
#
aaronpk hmm
#
gRegor I think it's in the p3k/http response, so maybe could extract it in the _fetchBody/_fetchHead methods. I guess with comparison check that the hostname didn't change? https://github.com/indieweb/indieauth-client-php/blob/main/src/IndieAuth/Client.php#L329
#
gRegor hostname check may not be necessary since it already does the authn endpoint verifications
[Al_Abut] joined the channel
#
gRegor hm, let me look closer, I might be doing something wrong. I don't get the error if I enter http://aaronparecki.com but do if I enter http://gregorlove.com.
#
gRegor aha, I think I've got it. I link to my metadata endpoint as a relative URL but yours is absolute. `extractEndpointFromHTML` uses the entered URL to normalize, so it's returning an http URL for my metadata endpoint, even though the p3k/http response correctly followed the redirect.
#
gRegor I can file an issue describing it
#
gRegor https://github.com/indieweb/indieauth-client-php/issues/34
#
Loqi [preview] [gRegorLove] #34 Improve handling of redirected URLs
#
gRegor I can work on a PR too, though would like confirmation if we need to be strict on checking the hostname after redirect
#
Zegnat I do not think it needs any extra validation rules, upon a first read. The real bug is simply "it's using the original http URL to resolve the URL." If it is resolving relative URLs, those should be resolved against whatever the resource is that was retrieved. And that resource is post-redirects.
#
Zegnat Now I am wondering if I am handling that right in my own code
#
gRegor sounds good, I was thinking that was the case too, just want to be sure.
#
Zegnat I do not have an indieauth client lib, but I just checked my webmention lib, and that one does seem to handle it. As should every other webmention lib that tests against https://webmention.rocks/ because it seems to have an explicit test for it in Discovery Test #23! So if you want a test for it, something like that :D
#
gRegor nice! oh yeah maybe indieauth.rocks has a test for this now
#
Zegnat My probably only partly correct code to fix this: https://github.com/Zegnat/php-webmention-endpoint-discovery/blob/bbec3c520537dac0b0040516f50ad6badeb8771e/src/EndpointDiscovery.php#L50-L55
#
Zegnat Keep requesting and rewriting the value of $url until the response code is no longer a redirect code.
#
gRegor hah, nice. p3k/http has the final URL so should be easy to extract
#
gRegor Will work on a PR over the weekend. For now trying to wrap up an indiebookclub release! 👀
#
Zegnat Sounds to me like https://indieauth.rocks/tests/C106 should be failing with indieauth-client-php. Not at a machine where I can test that right now though.
#
[capjamesg] Is there a way in RSS to indicate a resource has an alternative available that contains a translation?
#
Zegnat [capjamesg]: I only know of a way in Atom, not in RSS. But maybe there is some sort of extension / xml-namespace just like how people do for podcasts and the likes?
#
[capjamesg] I’m looking at Atom now. Yeah, it looks like you can do a link rel= in Atom, so presumably you could say link rel=alternate or something.
#
Zegnat <link rel="alternate" hreflang="nl" href="dutch-translation.html"/>
#
Zegnat hreflang is specifically speced for that: https://datatracker.ietf.org/doc/html/rfc4287#section-4.2.7.4
#
[capjamesg] This is good to know. My use case is I’d love my web reader to be able to announce when a translation is available for a post, and in what languages.
#
[capjamesg] I don’t know how many people are publishing this markup, but I can always add it anyway and write about the process.
#
Zegnat Interesting, there is some documentation on embedding link within RSS using an atom: namespace. https://www.rssboard.org/rss-profile#namespace-elements-atom-link
luca joined the channel
#
gRegor [aciccarello]: new indiebookclub launched, interested to see if micropub works for you after that indiekit update. If it still errors out, you should see more details on the IBC error page now at least 🫰
#
[aciccarello] I was wondering when that would be released. I think it should be fixed in my indiekit instance. I’ll try it out soon.
#
gRegor I just noticed there's different crossed fingers emojis 🤞 lol
#
[aciccarello] lol, now I need to know what the other one means 🤔
#
gRegor windows said the first one is "crossed finger and thumb" other is just "crossed fingers" hm
#
[aciccarello] Oh, it’s either the finger heart, snapping, or money gesture
#
[tantek] yeah I’ve seen it used for finger heart in practice. there’s no action marks so it lacks the implied noise of a snap.
ax562 joined the channel
#
mcepl https://github.com/aaronpk/IndieAuth.com/pull/245 ehm
#
Loqi [preview] [mcepl] #245 Fix session cookie domain for OpenID callbacks
wwind joined the channel
#
GWG I think tonight I'm going to start writing up my thoughts on Compass.
#
aaronpk mcepl: see who needs AI to make stupid mistakes when you can just do it all on your own
#
GWG Good line.