#social 2015-07-24

2015-07-24 UTC
bblfish, jasnell, tessierashpool_, ElijahLynn, tilgovi and the_frey joined the channel
#
Loqi Akuckart made 2 edits to [[Socialwg/2015-07-28]] https://www.w3.org/wiki/index.php?diff=85179&oldid=85155
jaywink joined the channel
#
Loqi Akuckart made 1 edit to [[Socialwg/2015-07-28]] https://www.w3.org/wiki/index.php?diff=85180&oldid=85179
the_frey_, the_frey and melvster joined the channel
#
melvster work in progress: http://gitpay.org/linkeddata/SoLiD
the_frey, dwhly, bblfish, the_frey_, the_fre__, jasnell, shepazu and tilgovi joined the channel
#
melvster so I worked out a good rule of thumb about URIs
#
melvster question: should it have an ETag?
#
melvster Yes: it's an HTTP Document
#
melvster No: it's PART of a document (use a fragment)
#
melvster so blog can also be a doc
#
melvster (web log)
#
melvster but a person cant
#
melvster (logically)
#
melvster use that ^^ and you'll be fine
otharwa, tilgovi, bblfish, jasnell, jasnell_, KevinMarks and the_frey joined the channel
#
melvster aaronpk / raucao : do you have technology to verify irc accounts as authentic ...
#
aaronpk that's normally done at the IRC server level or by a privileged bot like NickServ
#
melvster aaronpk: yes I like NickServe, but I'd like to also be able to do a two way link between irc and gitpay ... like you do with rel me auth ... is it possible?
#
aaronpk not unless NickServ enforces nicks
#
melvster aaronpk: let's assume it does ...
#
melvster you can register nicks and hold them a long time
#
aaronpk on Freenode it does, so you can be reasonably sure that if someone is connected as "aaronpk" then it really is that person
#
melvster im more interested in the two way link because they you can transfer funds between irc and gitpay
#
raucao there was a grace period last time i checked
#
aaronpk oh you might be right
#
raucao so you can be a different nick for a few seconds
#
aaronpk gives your client a couple seconds to send the password
#
raucao which means it's not to be trusted with money
#
raucao in fact, there's no other way to do it really
#
aaronpk i was thinking about adding a sort of "login session" to IRC nicks via indieauth
#
melvster damn
#
aaronpk you could do a login dance where a bot PMs you a code and stuff, and you'd be authenticated as long as you don't disconnect or change your nick
#
melvster oh yeah
#
melvster that works
#
aaronpk but even then it's not 100% because if there's a netsplit, someone can come in on one of the split servers and pretend to be you
#
raucao i have a feeling it's going to be more complex and less reliable than just making someone click on a link and do auth outside of irc
#
melvster aaronpk: still doesnt answer my question on how to to do reciprocal linking, i can link FROM gitpay to irc, but how to link BACK?
#
aaronpk raucao: yeah that's what i was thinking basically
#
aaronpk it'd pm you a link which would verify you in a browser, and then you'd be authenticated as that nick until you disconnected/changed nicks
#
melvster oic
#
melvster so run a bot
#
melvster that's smart
#
melvster yes i can do that
#
melvster BUT
#
melvster can i prove it for audit?
#
aaronpk probably not, since you can netmask yourself on IRC to hide your IP address
#
melvster but if the channel is logged independently?
#
melvster link this one ...
#
melvster then the bot and the logger would have to collude
#
melvster so if you trust 1 of 2
#
melvster you are ok?
#
aaronpk if the messages were sent in a public channel? hmm maybe?
#
melvster aaronpk: yes that works, so what would the message need to look like, do you think?
#
ben_thatmustbeme irc actually reports if your nick is authed or not, but its highly dependant on your client / library as to if it reports it
#
aaronpk ben_thatmustbeme: that's server-dependent
#
melvster btw ... when you have a web of trust security problems tend to go away
#
ben_thatmustbeme yes that too
#
aaronpk IRC servers are all basically their own silos, so you're gonna have to do silo-specific stuff with each one
#
melvster gah
#
aaronpk e.g. freenode has a very strict NickServ, but w3c IRC does not
#
melvster yeah but no one's gonna log on the w3c irc to steal money!
#
ben_thatmustbeme and i don't mean nickserve, i'm pretty sure the base IRC has some flag on every message saying its an authed name or not, if we are already assuming in the same that there is a nickserv, and you can have extremely long auth times
#
aaronpk what i'm saying is you should be talking about freenode specifically, not IRC generically
#
ben_thatmustbeme i think freenode does it as well
#
ben_thatmustbeme again, almost nothing reports it though
#
aaronpk ben_thatmustbeme: i think that's only if the user is authed at the server level, which is usually resreved for only the special bots like nickserv and chanserv
#
aaronpk afaik the freenode irc protocol doesn't know about authentication at all
#
ben_thatmustbeme i'm pretty sure it does. it comes in with every single message as i recall when writing my bot a while back
#
ben_thatmustbeme its just a boolean
#
aaronpk hmm
#
aaronpk digs up IRC protocol docs :/
#
ben_thatmustbeme might be non-standard, not sure
#
raucao auth is not part of irc iirc
#
ben_thatmustbeme its not
#
raucao hah, that's a good acronym combo
#
ben_thatmustbeme hah
#
aaronpk so freenode added their own flag to the protocol?
#
raucao hmm, 3.1+ specs contain some account stuff, making it seem like there's a concept of accounts before 3.1 http://ircv3.net/irc/
#
ben_thatmustbeme as i remember i saw something like that
#
ben_thatmustbeme it may have been a different status, like ops, voiced, authed, none
#
ben_thatmustbeme not sure
#
ben_thatmustbeme i remember looking it to it as i wanted to be sure logs were actuall by the people they cliamed to be
#
ben_thatmustbeme but i ended up working out that it was a lot of trouble
#
ben_thatmustbeme i wonder if you can query nickserv
#
melvster im more interested in adoption than bullet proof security
#
melvster probably not the most popular thing ever said by a programmer!
#
aaronpk i think you can ask nickserv
#
melvster yes
#
melvster by the sounds of it the security is too big a barrier
#
melvster for me at least
#
aaronpk /msg NickServ INFO tantek
#
aaronpk Last seen : Jul 24 18:22:47 2015 (3h 0m 29s ago)
#
ben_thatmustbeme /msg NickServ INFO melvster
#
ben_thatmustbeme weird
#
raucao i don't see any response when doing the same. ben_thatmustbeme you need to remove the leading space
#
ben_thatmustbeme that should have actually run the command, even without nickserv
#
ben_thatmustbeme didn't think i had one
#
ben_thatmustbeme weird
#
melvster most payments on the web are not actually secure at all
#
aaronpk i typed a space so that it would show up here
#
ben_thatmustbeme weird that when i hit up to pull back the command there was no space
#
ben_thatmustbeme i didn't copy-pasta from you, i had typed it
#
ben_thatmustbeme meh