2013-08-01 UTC
melvster, josephboyle, bnvk and shaners joined the channel
# 01:14 shaners aaronpk: i've got question about / maybe a feature request for indieauth.com. # 01:16 shaners if i ran my own oauth2 provider at iamshane.com, could indieauth.com somehow detect that and delegate back to me for signing into indiewebcamp.com, instead of requiring a silo? # 01:31 aaronpk we'd need dynamic client registration so I can get a client_id + secret from you # 01:31 aaronpk that's one of those things that got bumped from the spec because nobody could agree # 01:32 shaners for the sake of proofing-of-concept, we could manually add iamshane.com to your list strategies # 01:32 shaners manually register indieauth with my (purely hypothetical) iamshane.com provider # 01:32 aaronpk so if we leave off the "automatic" bit, here's what would need to happen # 01:33 aaronpk then I'd need to "register" an app (you could just send me a client_id and secret) # 01:34 aaronpk and I'd add it to the indieauth DB and it should "just work" # 01:36 aaronpk cool. making the omniauth gem would let me pretty much just drop it in. # 01:36 shaners i was curious if there was any reason to even try before diving in. # 01:37 aaronpk I'll noodle on it for a while though, because I'm curious about the implications of this # 01:38 aaronpk like chances are, not everyone would set up a provider on their domain, more likely a group of people would end up using a shared provider, like a tribe # 01:38 shaners and you could only show iamshane.com as auth provider to me, or people who try to login as iamshane.com, right? # 01:38 aaronpk well it would only show up if they have a profile link at iamshane.com # 01:40 aaronpk but for the small group use case you'd end up with a profile like groupx.com/veganstraightedge and could choose to auth with that one # 01:41 aaronpk in my case my family would be using parecki.com/aaron etc # 01:41 aaronpk the main question is how do I know I can trust the OAuth provider? # 01:42 aaronpk I can trust twitter, github, google, etc because there are only a few of them and they're big enough that security problems are pointed out and corrected quickly # 01:43 aaronpk but how do I trust that your oauth provider isn't compromised, letting someone else log in as you? # 01:54 aaronpk I think it's the same question for openid as well pfenwick joined the channel
# 01:55 aaronpk openid connect seems to have done the work of defining the discovery protocol f-a joined the channel
# 02:00 shaners she's at my house/office today for work. she's gonna be helping on some HS things. # 02:00 shaners we just chatted about this. and she said she'll take a look at it this weekend. # 02:00 shaners i'll do an email intro to remind you two of each other # 02:01 aaronpk yea have her look at the openid connect stuff, it may be what we need. not sure if it's overly complicated but iirc they've trimmed it down from the original openid # 02:02 shaners security: if iamshane.com gets pwned, does that affect me or all of indiewebcamp.com? # 02:02 aaronpk I think just you. because someone would have to put a link to iamshane.com on their site in order to let it be a provider in the first place # 02:05 shaners so. Jane puts a link to iamshane.com on her site. she tries to log in as "iamshane.com" on indiewebcamp. indiewebcamp => indieauth => iamshane.com # 02:05 shaners she'd still need to be able to log in to iamshane.com, right? # 02:06 shaners she'd have to also make a user/pw at iamshane for that to work # 02:06 aaronpk yea, indieauth would redirect to iamshane.com asking her to log in. the response from that would have to indicate that she is "jane" in order for indieauth to confirm the login # 02:07 aaronpk so if an attacker can log in as you (either by knowing your password or by hacking the system) then they can log in as iamshane.com to anything that uses indieauth # 02:07 Loqi aaronpk meant to say: so if an attacker can log in as you (either by knowing your password or by hacking iamshane.com) then they can log in as iamshane.com to anything that uses indieauth # 02:09 shaners aaronpk: how does indieauth.com know that Jane is trying to login as iamshane.com and not me as iamshane.com? # 02:12 aaronpk in the case of a root domain like that, there would only ever be one account at iamshane.com, and the "username" returned by the "who am i" query would have to be "iamshane.com" # 02:37 shaners aaronpk: (when you get back) i'm gonna have jls build this as a little stand alone rails app + oauth2 provider on its own domain (for initial testing). # 02:38 shaners so we don't have to deal with trying to integrate with my monkey mess of a codebase :D scor joined the channel
earplugs and shaners joined the channel
# 03:10 shaners i just switched IRC clients. will someone mention my name, so I can see what the notification looks like? Please. # 03:12 f-a which client are you using # 03:13 f-a I don't know them, will search # 03:13 f-a no, on a linux laptop # 03:18 shaners f-a : have we met? are you one of the european folks in the channel? # 03:19 f-a I am european but I never partecipated to one of the camps! # 03:19 f-a So we haven't met *yet*! # 03:19 shaners what are you working on / interested in working on? # 03:23 f-a well, I get to know indiewebcamp from gnu consensus # 03:24 f-a being a non technical guy, I was planning to write a few articles on how to regain your data and live a social life without silos, in a frugal way # 03:24 shaners are you technical enough to write html on your site? # 03:24 f-a I came here and found some very interesting ideas, starting with mfs, so I an staying here # 03:25 f-a yes shaners , the whole site is written via a quasi markdown language I wrote in haskell # 03:25 shaners would you like a few suggestions of easy things to get started with #indiewebbing your site? # 03:26 f-a let me see: adding rel="me" on my contact link? # 03:26 f-a (yes, please do tell!) # 03:27 shaners rel-me links to your external accounts: twitter, github, facebook # 03:28 f-a problem with rel="me" stuff is: I don't have an account on any of those sites yet. I will soon contribute (or plan to contribute) to pump.io, so github seems the way to go. # 03:28 f-a I will check on the wiki the format! # 03:29 f-a what is your website? # 03:29 shaners start with github.com. it's a great site / community. # 03:30 f-a well Shane, I am currently vegetarian, pondering about going vegan xtof joined the channel
# 03:40 bret there are a few wacky default settings, but I like better than any other IRC client I have tried # 03:40 bret Textual looks nice, but I have been burned by other comercial IRC clients in the past, so, Im reluctant # 03:41 bret the znc stuff looks kinda interesting in textual # 03:42 bret linkunus was the regretful purchace. I never understood how an IRC client could drain a laptop battery so fast # 03:42 shaners so if textual dies, at least i got my $5 worth in the meantime # 03:42 bret what is this ZNC stuff they talk about? how does it tie in more than any other client? # 03:45 shaners bret no idea what the znc stufff there talking about is # 03:45 shaners aaronpk that's what i was using until a few minutes ago. trying textual. # 03:46 aaronpk bret: you can run a znc on a server somewhere and then you'll always be signed in to IRC and when you re-connect to the ZNC thing it'll do tihngs like show you who's mentioned you while you were offline # 03:51 aaronpk i'm going to make a new one for the authorization screen josephboyle joined the channel
# 03:55 aaronpk so hey..this is actually a great excuse for me to do some real-world testing on my book # 04:00 aaronpk I like this checklist approach, I should put that into a sort of "cheat sheet" for the book # 04:33 shaners aaronpk: what's your email that you use on heroku? gjones and xtof joined the channel
cweiske joined the channel
xtof, benwerd, andreypopp, smcgregor and Jihaisse joined the channel
andreypopp joined the channel
earplugs, seyz, eschnou, bnvk, adactio, andreypopp, friedcell, fmarier, melvster, xtof, josephboyle, scor, f-a and hober joined the channel
# 14:42 Loqi the #indieweb movement seem to be giving blogging technologies a reboot # 14:43 Loqi the #indieweb movement seem to be giving blogging technologies a reboot tantek, barnabywalters, andreypopp, f-a, melvster, tilgovi, ozten, josephboyle, spinnerin, eschnou, jihaisse_, benwerd, pfenwick, scor and shaners joined the channel
# 20:30 Loqi the #indieweb movement seem to be giving blogging technologies a reboot josephboyle joined the channel
tantek and benwerd joined the channel
# 21:11 shaners Instagram is apparently deleting photos uploaded by means other than their official app # 21:14 neuro` shaners: that was predictable. They could not let photos uploaded by the famous unofficial API # 21:14 f-a *unofficial* meaning that worm? # 21:14 neuro` f-a: I'd rather say that the worm was using the unofficial API # 21:15 shaners sure. but they're also deleting photos uploaded by unofficial apps by windows phone users # 21:15 neuro` I understand their reaction. If I had millions users I'd probably frak out that thing would go out of control # 21:16 neuro` That does't change the main issue: IG being a walled garden owned by another walled garden # 21:16 shaners if i had millions of users, i'd make a more open documented public api and let it grow and be wild and free # 21:16 neuro` shaners: agree, please read my last statement :) # 21:19 shaners Homesteading. NewBase60 (ruby gem). Microformats 2 (ruby gem). # 21:20 neuro` I needed both of them and was about to reinvent the wheel # 21:43 shaners neuro`: if you find any bugs or want to fix outstanding issues, feel free to send pull requests ;) tantek joined the channel
# 21:47 shaners tantek: did aaronpk talk to you about the rel-canonical problem we ran into at our mini-meetup in pdx? gjones joined the channel
# 22:10 tantek shaners - did you or aaronpk document the rel-canonical problem you ran into on the wiki? # 22:10 shaners it was right at the end of our hangout. i don't think either of us did. # 22:11 shaners can i give you the short version to see if it's been considered already? # 22:12 shaners rel-canonical should only be used once on a page, right? # 22:12 shaners so, on a blog post permalink, not on a feed, for example. # 22:14 tantek so all you can do is link from a page to the canonical URL for that page # 22:15 shaners when linking from a post syndicated to wp.com back to my site's original post, I'd use a[rel=canonical][href=sbb.me/bXYZ1] # 22:16 shaners but i can't NOT show a rel-canonical on the wp.com feed view. it's the same unchangeable markup for permalink and feed. # 22:16 shaners so, aaronpk and i think we need a .u-canonical in places where you can't control the markup # 22:16 shaners i mean, where you can't conditionally control the markup # 22:17 tantek "same unchangeable markup" - sounds like a platform limitations # 22:18 aaronpk it means he can't use rel-canonical on wordpress.com # 22:19 tantek we already have the equivalent to rel-canonical but for pretty much any microformat with u-uid # 22:19 tantek but there's no need for a u-canonical because that would be redundant (a second name for the same thing) # 22:20 tantek ("uid" comes from vCard/iCalendar and predates rel-canonical by many many years) # 22:21 aaronpk question: on my tag page I have other peoples' posts, the permalinks to their domains are marked up as u-url, is that correct? # 22:21 tantek ironic that @schofeld is linking to winer, then mentioning #indieweb - whereas winer seems to be stuck on RSS, while the #indieweb has leapfrogged far past RSS (which is just legacy XML at this point) # 22:22 tantek aaronpk - it's always been wrong ;) rel-canonical has always been page-level # 22:23 tantek aaronpk - see above about u-canonical being redundant # 22:23 tantek using u-uid is optional and if you're already using u-url and only linking to the original via that - then that's fine # 22:24 shaners tantek: it's absolutely a limitation of wordpress.com. but nonetheless it's a context that users (including me) will have to deal with. # 22:24 tantek u-uid (and rel-canonical) are only really useful / interesting if you're actually disambiguating # 22:24 tantek if you're only linking to one URL via u-url, then you don't really need to specify u-uid as well # 22:25 tantek shaners - ironic about the winer post you reference, he says "choose to invest in user freedom" - but he isn't really. he's explicitly investing (or asking others to invest) in "RSS" and making RSS competitive - but RSS is already so much legacy XML that is has nothing to do with "user freedom" any more. # 22:26 shaners tantek: i agree. the intent is in the right place. even if he's totally lost/invested in RSS land. # 22:26 tantek if all you're looking for is wistful posts about user freedom (without any actual action to back it up), the W3C Federated Social Web mailing list is good for that too. # 22:27 tantek anyway, I guess I just got tired of such noise without action about 2+ years ago # 22:27 tantek just checking with you to make sure I wasn't missing something # 22:32 aaronpk so the real answer is to not use rel-canonical on wordpress # 22:33 shaners i'm not. because i don't have any control over the markup in a feed vs permalink page. barnabywalters joined the channel
# 22:34 tantek yes, sounds like a good limitation to document about POSSEing to wordpress.com hober and andreypopp joined the channel
josephboyle and scor joined the channel
# 23:06 tantek aaronpk - when do you get into town next week? andreypopp, benwerd and fmarier joined the channel
aaronpk you'd need to write an omniauth strategy for talking to your iamshane.com provider https://github.com/intridea/omniauth/wiki/List-of-Strategies
shaners aaronpk: does this look like a sane overview of the work to get a test case working? https://github.com/homesteading/homesteading-oauth/issues
f-a shaners, hello
@vivi_tatyana RT @t: No @instagram clients that upload photos … except a worm.
@veganstraightedge RT @edsu: @rdhyee fwiw, the demise of google reader, snowden &
@schofeld I'm with @davewiner on interop: http://dave.smallpict.com/2013/08/01/seasonForInterop #indieweb FTW
tantek sounds worth documenting as a limitation of wordpress.com on : http://indiewebcamp.com/WordPress#WordPress_hosting_service