Replied to OAuth for the Open Web by Aaron PareckiAaron Parecki (Aaron Parecki)

OAuth has become the de facto standard for authorization and authentication on the web. Nearly every company with an API used by third party developers has implemented OAuth to enable people to build apps on top of it.
While OAuth is a great framework for this, the way it has ended up being used is …

IndieAuth, the extension to OAuth 2.0, was developed by Aaron Parecki and implemented by multiple people  in the IndieWeb community, including myself.

The problem has been that people conflated it with the service Aaron created as a reference implementation, which implemented IndieAuth for people who didn’t have it by using the OAuth services of sites like Twitter and Github to bootstrap the service.

Aaron succeeds here in finally conveying a point it took me a long time to understand, and partially only by reading and implementing one of these.

Was pleased to see the founder of Home Assistant, a product I use, tweeting that he would adopt this in that product. Looking forward to seeing what people come up with.

Brainstorming on Implementing Vouch, Following and Blogrolls

Vouch is an extension to the webmention protocol. Webmentions usually have two parameters…source and target. Target is the URL on your website  that the Source URL is linking to.

The vouch parameter is a third URL to help the target determine whether or not they should accept the webmention. This should block automated spam and aid in moderation.

Several people have implemented receiving vouches. It is relatively easy  to look at a vouch URL and see if it links to a third-party who you have approved of in the past.  While there are more advanced things you can do, that is the basic summary of the protocol.

The harder part, and less implemented by others is sending of vouches. Where do you find people who have been approved by people you have approved of? It would really help if we had some more discussion on this.

So, at the Indieweb Summit, we talked about this a bit, after which I implemented a primitive Vouch receiver. My solution was to use a manually curated domain whitelist that I’d previously built as my source for acceptable domains.

There are some suggestions on where to get this list. Several people generate a list from referrers. This sent me down the road of looking as to whether I’d want to implement refbacks to add more mentions to my website…except there is a lot of noise. Refbacks are basically the same as webmentions, except the source is gleaned from the  referrer header that sites send when a page is accessed.

Even if I  have a list of sites that I approve of, I would have to crawl them to find links from them to other sites. So, I think we should all help each other out on this.

That means we need to post our list of approved domains somewhere on our site. That used to be quite popular. It was called a Blogroll. It was sites you read, followed, or recommended. There are other terms for it. But, this is a perfect place to get a nice list, and if we publish them, then we can help the Vouch cause.

But the problem is, how do you tell a Vouch receiver where your list is. There are some brainstorming items about blogrolls and following/follower lists

  • Follower lists marked up with rel=”follower” or rel=”following”
  • Contact lists marked up with rel=”contact”
  • Follow Posts marked up with u-follow-of

Follow posts would create an h-feed of follow posts that could be used to generate a list. You can have a specific page on your website, but there isn’t a way to indicate this to someone looking for it.

There is rel-directory, which is the reverse direction. It indicates that the link is to a directory in which the current page is listed. What we seem to be missing is a property that says that a page is a feed of followers that can be placed inside an h-card or on a home page.

u-follow-of is a proposed property that indicates that an h-entry is considered a follow post, which is a post indicating you have followed someone, then a feed of follow posts could be parsed and read by a reader. If you add in the XFN relationships to that, you can build even more detail.

The reverse relationship would, in theory, be u-follow, which would be a URL to the follow post of the current URL(the thing being followed).

Feeds are identicated by rel=”feed” to link from your homepage to those feeds. But there is a lack of indicating what type of feed it is, such as rel=”blogroll” or rel=”following”.  I’m not sure, and need more discussion about what to use for this.

But, this has the ability to solve a lot of problems. Imagine I…

  • Post Follow posts when I follow someone
  • Use this to generate a blogroll/followers list
  • Send webmentions when I follow someone so they can build relationships
  • Use that list as a vouch list. Use other people’s blogrolls/followers lists as a means to generate vouch lists…which reduces the implementation cost of Vouch.

Needs work, but suddenly I want to do Follow posts.

Episode 7: The Reverse Salmention


In this last episode before Chris Aldrich and I head to the Indieweb Summit in Portland, Oregon, he and I discuss my continual messing up of people’s Indieweb experience, little things I’ve hidden in plugins, web-signin vs IndieAuth, etc.

We’re both looking forward to seeing those of you who can join us in Portland.

I’ve decided I’m leaving Facebook…sort of. It starts with how I interface this site to Facebook…a site called Bridgy. It provides the ability to publish to Facebook and backfeed your comments back to my site.

Ryan Barrett, the man behind Bridgy and someone I probably pester entirely too often, announced on Thursday that he was shuttering Bridgy for Facebook entirely, as recent Facebook API changes had made it impossible for the service to work.

So now, if I want to post to Facebook, I would have to do so myself. I’m not sure I always want to do that, so you might see even less of me there. Sometimes, I likely will. And I won’t be able to save the interactions unless I manually save them.

Oh, well. Guess there is always Twitter.

Episode 6: WordPress and Types of Posts

In this episode, Chris and I discuss how Post Kinds mapped Indieweb types of posts to the WordPress system and why, the defined as opposed to implied types set up, and avatars.

While this is very WordPress centric, there are a lot of discussions here relevant to a broader Indieweb audience about adding new types of posts to your site, trying to design things flexibly(although a developer’s guide is probably needed), etc.

Episode 5: Indieweb Summit and More

With the Indieweb Summit coming up, we should discuss what the Summit is like, community and how to participate, etc.

 

Links

  • Do I know anyone interested in building #indieweb tech or federated services? I’m having trouble conceptualizing some things without having people to bounce ideas off of. https://twitter.com/davidlaietta/status/995485455675162626 That’s what this is all about! I have always been an outsider to that community and want to find good ways to enter and get involved, but I am also trying to find ways to make ActivityPub based projects more accessible to the average web user.