2016-04-10 UTC
KartikPrabhu joined the channel
# 00:08 aaronpk for any u-* values, ensure they are either a relative or absolute URL and not something like "javasript:alert()" # 00:18 aaronpk if "javascript:alert('hi')" is considered a valid URL then it's doing what it's supposed to # 00:18 KartikPrabhu mf2py does manke URLs absolute, but that is in the parsing spec, it does not validate them in any way # 00:19 aaronpk i'm not talking about doing anything with e-* classes, only u-* since the parser knows the value is supposed to be a URL in that case # 00:20 KartikPrabhu aaronpk: people might have accidently put a "u-*" when tey meant "p-*". might be better to just expose that to keep thigns visible. COmsuming code can always validate mlncn joined the channel
# 00:26 sknebel (thinking of protocols: is there anything "established" about webmention endpoints being HTTP vs HTTPS?) # 00:28 sknebel (+ it would be interesting if any webmention endpoints accidentially or intentionally work with ftp:// or other source urls as well, there are some nasty issues hidden in that kind of thing) # 00:29 aaronpk well the webmention endpoint itself has to be http/https because the spec requires you make an HTTP request to send the webmention # 00:29 aaronpk but i think it doesn't say anything about the source URL needing to be HTTP # 00:31 aaronpk KartikPrabhu: no i think this *has* to be done at parse time # 00:32 aaronpk because when i'm consuming a property called "url" I have no idea if it came from a u-url class or p-url class # 00:32 KartikPrabhu so if you are going to consume it as a URL (e.g. display it as a link to a comment) then validate it, else don't # 00:33 aaronpk otherwise someone could put javascript in a p-url class # 00:34 KartikPrabhu i don't think there is a fool-proof alternative to validation/sanitisation at comsume time # 00:35 aaronpk i'm gonna add this to XRay tho since everything I do goes through that so at least it'll only have to be done once friedcell joined the channel
snarfed and tantek joined the channel
# 01:55 GWG Is anyone around who I could talk to about Vouch? Namely someone who has feelings about it. # 01:55 GWG Maybe I should watch the video from Cambridge shiflett and yakker joined the channel
# 02:37 GWG I'm worried about implementing a system where I'm rejecting the majority of the internet that doesn't use it # 02:39 aaronpk i need to re-implement in my new site, but what I was doing before was showing "vouched for by ___" if the comment was vouched # 02:42 GWG I was trying to iterate on the implementation. # 02:44 GWG And I know there is some interest in Vouch. [kevinmarks] joined the channel
# 03:15 KartikPrabhu one can always send unvouched webmentions to other spam processors like Akismet/manual approval etc... # 03:19 kylewm Why not exactly? I thought you needed a list of known good domains to verify a vouch # 03:22 GWG I thought vouch generated them. A whitelist suggests someone made one shiflett joined the channel
# 03:22 GWG Although admittedly you have to start with a list # 03:23 KartikPrabhu you can generate one from already existing webmention comments though # 03:30 GWG But if I try to build one that way, I'd build it into the existing moderation system by passing the vouch parameter further down. # 03:30 GWG But it seems, from comments, that accepting webmentions with or without vouch is not uncommon. snarfed joined the channel
# 03:45 kylewm (I think it's probably pretty important that we make use of that money :) mlncn and gRegorLove joined the channel
# 05:47 gRegorLove In the ProcessWire Webmention plugin, it always attempts to send a vouch parameter with a webmention, if possible. There is a checkbox, off by default, for "require webmention with vouch" for incoming wm # 05:48 gRegorLove There's a textarea for "Approved vouch domains", one domain per line. I populated it manually at first, but just recently added an option to enter a URL that the plugin will periodically parse for h-cards and add the URLs it finds to the approved vouch domains. # 05:51 GWG My plan right now is to just make it so the parameter is passed and work on what it does later. tantek joined the channel
# 06:38 Loqi Ok, I'll tell them that when I see them next # 06:39 tantek kylewm, GWGW, there is no requirement to "start with a list" - that's just one possible (common?) way to start with a simple implementation. The spec does not require it. # 06:39 Loqi tantek meant to say: kylewm, GWG, there is no requirement to "start with a list" - that's just one possible (common?) way to start with a simple implementation. The spec does not require it. # 06:43 gRegorLove !tell aaronpk it looks like that test is ambiguous with authorship step 7.3. Step 7.4 would return the http u-url, though. # 06:43 Loqi Ok, I'll tell them that when I see them next friedcell joined the channel
# 07:53 aaronpk !tell gRegorLove interesting point. however the authorship algorithm results in an author h-card, not an author URL, so the xmpp URL in that test case could still be used to match that h-card. # 07:53 Loqi Ok, I'll tell them that when I see them next Pierre-O joined the channel
# 07:59 aaronpk !tell gRegorLove XRay in particular looks for http/https URLs and will ignore anything else, so that's why the test is looking for that URL and not the xmpp one # 07:59 Loqi Ok, I'll tell them that when I see them next Breadbasket_, catsup, nitot, friedcell, KevinMarks and Nissyen1 joined the channel
ben_thatmustbeme, benborges, Lancey, emmak_, tantek, snarfed and snarfed1 joined the channel
# 16:42 GWG Rewriting this code is going to be harder than I thought. I wish someone had commented it more. wolftune joined the channel
# 16:46 GWG Well, I'm trying to turn the code upside down so it works differently. # 16:57 voxpelli Refactoring is tough work, especially when one has no tests, hard to keep a solid ground to build on tantek joined the channel
snarfed joined the channel
# 17:20 GWG And amusingly, snarfed enters right after I say that. # 17:25 GWG I know that I will have to give in someday j12t, jedahan and [kevinmarks] joined the channel
# 17:44 [kevinmarks] Writing tests for code you're about to change is how you prove that you know how the code works # 17:48 GWG I just wish pfefferle was around. I have questions friedcell, j12t, snarfed, Pierre-O, singpolyma, brandonrozek, jedahan, Breadbasket_ and Lancey joined the channel
j12t, snarfed, Breadbasket_, KartikPrabhu and emmak joined the channel
# 22:01 aaronpk anyone want to help me test a tool for testing webmentions? # 22:02 aaronpk i haven't finished the home page yet or written really anything that tells you how this works, but basically the tests here are posts that accept comments, and you can use them to help debug your webmention sending # 22:03 aaronpk i have the main functionality of handling webmentions and parsing the source URL for comment data working for the most part, so i'm adding more helpful debugging tools to it now # 22:04 bear so you want me to add a mention of that test/1 url to my sight and have it send a webmention now? # 22:04 aaronpk yeah, feel free to try to send webmentions to it, and let me know if you see anything weird. # 22:06 aaronpk i'm planning on using this during IWC to help people get spun up on sending webmentions gmacon, gRegorLove and Nissyen joined the channel
# 22:45 bear I just realized that the julian days for april are all 90+ date april 1st == 91... # 22:45 bear (I like it when simple patterns like that emerge) # 22:46 bear oh poo - 2016 is a leap year, i was looking at the wrong table # 23:04 bear sorry it took me so long - just processed a post about test/1 # 23:04 bear it found yours, and got a 201 back immediately # 23:04 bear but the webmention.rocks one it is still chewing on # 23:04 GWG I've been thinking about the 201 and the 202. # 23:05 aaronpk webmention.rocks processes the WM synchronously so that it can return debugging info in the response # 23:05 GWG aaronpk: Then that would be a 200, not a 201 or a 202 # 23:05 bear I may have to local hack some debug prints as it is still processing it # 23:05 aaronpk GWG: it depends on whether it returns a status URL # 23:06 GWG What does that look like again? Example wise? # 23:06 bear I need to add some debug logs to see if it just stuck on myside or what - one sec # 23:07 aaronpk i didn't put an example response showing the 200 response, but it's mentioned at the bottom of that section # 23:09 GWG I meant an example of a status page KartikPrabhu joined the channel
# 23:10 aaronpk I want to write up status URLs as an extension but I haven't yet # 23:14 bear ah - my webmention library is not finding the endpoint # 23:15 bear so this is already becoming a useful tool :) # 23:15 GWG What about Forwarded: over X-Forwarded-For? # 23:15 aaronpk tests 1-6 advertise the endpoint in different ways so you can test all of them # 23:19 GWG aaronpk, was reading the rest of the page. # 23:27 bear the scanners for new sites are amazing fast tantek joined the channel
# 23:37 bear i'm wondering how I can detect that cleanly # 23:39 bear once letsencrypt is up with the discovery endpoint - it's very fast # 23:40 aaronpk i have a catch-all for letsencrypt that makes this super easy # 23:41 bear yea, I think I have one also - nginx config item that redirects it to a dir # 23:47 bear ok, now the https call returns 200 instead of 404 - but i'm still not finding the link # 23:49 bear ah - the header is "Link" and silly bear assumed that they are "link" # 23:55 bear this is where I rage about languages that are case-insensitive for string compares # 23:55 bear yes, I get that - but realize that the browsers are showing "link" in the dev view # 23:56 bear and that most "web" languages are case-insensitive in compares (php, js, etc) # 23:56 aaronpk really? php is pretty explicit about whether you're doing case sensitive or insensitive comparison # 23:56 bear so the python requests lib happily converts the headers into a dictionary with the key being "Link" # 23:57 aaronpk i always have to double check how the HTTP header is going to show up in whatever framework i'm using tho # 23:57 bear I wouldn't know - I remember reading some discussion about this from earlier on stackoverflow and the person implied that php was very happy to compare link to Link in headers # 23:57 aaronpk the $_SERVER variable converts them all to uppercase and prefixes with "HTTP_", other frameworks have methods to retrieve HTTP headers that handles the case insensitive matching internally # 23:58 bear yea, i'm mostly being verbose for anyone reading this to learn - what my webmention library should have done was checked # 23:58 bear yea, that is why I am kinda surprised that python requests gave me "Link" back when I asked for the header keys # 23:59 aaronpk yeah i've seen some libraries that try to be "smart" about it, but then you're never sure if it's going to return "Content-Type" or "Content-type" # 23:59 bear time for me to create a simple map/helper function
KartikPrabhu mf-parsers should not sanitise HTML
[kevinmarks] To make vouch work, you need a white list, right?
kylewm.com edited /2016 (+282) "/* Participating */ Assistance for underrepresented groups" (view diff)
gRegorLove I have feelings about Vouch, GWG
Loqi aaronpk: gRegorLove left you a message 1 hour, 13 minutes ago: For this test https://github.com/aaronpk/XRay/blob/master/tests/AuthorTest.php#L86 what's the reasoning for the assertion being the http u-url instead of the xmpp one? http://indiewebcamp.com/irc/2016-04-09/line/1460270304256
aaronpk so you can try to get a comment to appear here for example http://webmention.rocks/test/1
bear ah - it's failing because I used https://webmention.rocks/test/1