I'm making some huge changes in my site in prep of using it for more of my comms and devs, a bit similar to how https://simonwillison.net/ does it. Right now, I'm going to experiment with implementing local sign-in to my site. It'll probably be incomplete as Sele doesn't support RelMeAuth and I'm very torn on implementing it as an explicit feature (more on that later).


For now, if I can get it to show that I'm signed in, that'll be a great first step. I've added logic to https://indieweb.org/Shock to allow for the redemption of a token for it to use for fetching Micropub information, as well as granting me access to the dashboard. This is exciting as I can also use this to require authorization for posts and feeds soon, and even considering allowing an on-site form for replying if you sign in. All things to consider.

byhttps://jacky.wtf • posted archived copycurrent

Most of this is all toy stuff - so I can understand how these specs work together practically and what it would look like to make things that wouldn't even use any of the terminology or knowledge - just using an app. Right now, it's rough, but this is when I'm more excited.

I'm making some huge changes in my site in prep of using it for more of my comms and devs, a bit similar to how https://simonwillison.net/ does it. Right now, I'm going to experiment with implementing local sign-in to my site. It'll probably be incomplete as Sele doesn't support RelMeAuth and I'm very torn on implementing it as an explicit feature (more on that later).

For now, if I can get it to show that I'm signed in, that'll be a great first step. I've added logic to https://indieweb.org/Shock to allow for the redemption of a token for it to use for fetching Micropub information, as well as granting me access to the dashboard. This is exciting as I can also use this to require authorization for posts and feeds soon, and even considering allowing an on-site form for replying if you sign in. All things to consider.

Just laid off? Nervous about possible layoffs? Here’s what to do.

Suddenly losing a job can be personally destabilizing. But lots of us have been there and gotten through it.
byStack Overflow Blog archived copycurrent

Moving from Mastodon to a new instance or to Micro.blog

Mastodon has a feature to move accounts from one instance to another instance. I spent some time recently exploring how this works so that we could support it in Micro.blog. I used this to consolidate my ActivityPub presence from multiple Mastodon accounts to just @manton@manton.org, powered by my blog and Micro.blog.


From what I can tell, this feature is not well-documented. It does not exist in the ActivityPub spec. The “Move” activity examples in the companion ActivityStreams spec also do not cover moving accounts. So I’ll document some of the technical bits here in the hope that it’ll be helpful to other folks.


To move accounts, 2 things are required:



  • From the new instance, set up an “alias” that links your new and old accounts.

  • From the old instance, initiate a migration to the new instance.


The Mastodon documentation says that aliases should be set up on both sides of the migration, but this does not seem to be required. In my testing, an alias is only needed on the new instance.


Because I wanted to move to Micro.blog, I added an alias in Micro.blog that references one of my old accounts: @manton@mastodon.social. You can find this in Micro.blog under Account → View Mastodon Details → Aliases.


Screenshot of Micro.blog aliases page.

Aliases are added to the ActivityPub profile information in the field alsoKnownAs. Here’s a snippet of my info:


{
"preferredUsername": "manton",
"name": "Manton Reece",
"alsoKnownAs": [
"https://mastodon.social/users/manton"
],

}

For debugging, I often use curl on the command line to poke around at people’s accounts. To see my full ActivityPub JSON, use something like this with the “actor” URL returned from WebFinger:


curl -L -H "Accept: application/activity+json" https://manton.org/activitypub/manton

The next step is to sign into the old Mastodon instance and tell it to move to Micro.blog. Mastodon will take a few actions when this starts:



  • It will verify that there’s an alias on Micro.blog, confirming that both accounts are yours.

  • It will lock your Mastodon account, updating the profile to tell people about the new Mastodon instance. (In my case, actually powered by Micro.blog.)

  • It will send a “Move” activity to all the instances for all your followers, telling them to update their references to point to your new username.


The “Move” activity is sent to each follower’s inbox just like other activities such as “Create”. It includes a field target for the new instance that the user is moving to:


{
"actor": "https://mastodon.social/users/manton",
"target": "https://manton.org/activitypub/manton",

}

Mastodon won’t add alsoKnownAs to your ActivityPub profile on the old instance, but instead it will add a similar field named movedTo with the new actor URL:


{
"preferredUsername": "manton",
"name": "Manton Reece",
"movedTo": "https://manton.org/activitypub/manton",

}

Updating your followers can take quite a while. Likely hours and possibly over a day, if you have hundreds or thousands of followers. It makes sense that this is a very low priority background task. You can watch the progress as Mastodon essentially decrements your follower count on the old instance.


Here’s what Mastodon now looks like for my account, to tell people that I’ve moved:


Screenshot of Mastodon.social with moved account.

This is a fairly new feature in Mastodon, and I expect we’ll need to keep refining our support for it as there is more real-world usage. If you’re using Micro.blog, also remember that Micro.blog is not Mastodon. You can follow and reply to anyone on Mastodon, but you can’t use Mastodon-only clients like the upcoming Ivory from Tapbots.


What about moving in the opposite direction, away from Micro.blog to Mastodon? We’ll be adding that later. ActivityPub is only currently enabled for new Micro.blog users, or if you’ve manually enabled it, so I want to wait until we’ve enabled it for all users. Otherwise there will be no way to move Micro.blog-only followers.










✴️ Also on Micro.blog



byhttps://www.manton.org • posted archived copycurrent

Bridgy Fed updates





All the recent Twitter drama has obviously sparked renewed interest in Mastodon and the fediverse, and that’s even included Bridgy Fed, my little IndieWeb side project that turns personal web sites into full-fledged fediverse accounts.


A month and a half ago, I was all set to take it easy, maybe play a game or two, and poke at a new project. Then, Musk happened. A ridiculous mess, to be sure, but also a huge opportunity for fediverse projects like Bridgy Fed.


Except, it wasn’t ready. It worked, mostly, but it was rough. Very rough. Onboarding was especially bad: the home page was a wall of text, and there was no UI to speak of. If I wanted to capitalize on all the newfound interest, I had work to do.


So, I rolled up my sleeves and got building. I started with my own web site: I’d hooked it up to Bridgy Fed a long time ago, but I wasn’t really using it. I dove in, scratched my own itches, listened to early users and new refugees, and scratched their itches too. I built actual, honest to God UI and an onboarding flow. I added features, tracked down interop issues, and fixed lots of bugs. I watched the dozens of active users turn into hundreds and traffic swell 10x over the course of just a few weeks.





It’s been a hell of a sprint. I’m slowing down now, but at this point I can say I’m using this web site to fully participate in the fediverse, with complete posting, reading, and responding experiences on both desktop and phone. No Mastodon instance needed.


If that sounds interesting, try it out and let me know what you think. Feedback is welcome. Happy federating!

byRyan Barrett • posted archived copycurrent

Filippo Valsorda 🦊:calculator: (@filippo@mastodon.social)

In practice it means that I can't have @filippo@filippo.io as my username, and then delegate it to a masto.host instance I access at, say, filippo.masto.host. I need to put the instance on a domain I control and never change, with all the risks involved in delegating a subdomain.For a network that compares itself to email and preaches "own your identity" it certainly makes it hard, unless you go straight for the true and pure solution of self-hosting everything. Users need graceful on-ramps.
byMastodon archived copycurrent

That doesn't seem to be the case. There's a few people who use things like https://fed.brid.gy/ to sync from their own instance (or Web site, in more layperson terms) to the fediverse. I've personally done the conventional https://indieweb.org/POSSE out of laziness, tbh (just sending out a POST).

I hate MVPs. So do your customers. Make it SLC instead. – @ASmartBear

I hate MVPs. So do your customers. Make it SLC instead.

Product teams have been repeating the MVP (Minimum Viable Product) mantra for a decade now, without re-evaluating whether it’s the right way to maximize learning while pleasing the customer. …
by@ASmartBear archived copycurrent

Dropping the customer-business monikers, I do like this idea of leaning towards making something people can use and wouldn't mind using.

The ethics of syndicating comments using WebMentions

This blog uses WebMention technology. If you write an article on your website and mention one of my blog posts, I get a notification. That notification can then be published as a comment. It usuall…
byTerence Eden’s Blog archived copycurrent

I've been considering adding a form that allows me to process removals in a semi-automated fashion. This is something worth documenting on the IndieWeb wiki and adding a flow for.

Near-term Plans for My Twitter

On the IndieWeb chat, Chris Aldrich prompted a discussion about people migrating away from Twitter. I started to reply, but I realized it would be better to post a note here — partly as a nudge to myself and partly to get back in the habit of writing.



I have a moral objection to the way Elon Musk is running Twitter. This post won’t go into all those details, but the short version is that he is allowing racists, antisemites, and outright Nazis back on the platform under the guise of “free speech.” See also: this succinct note by Ben Werdmuller.



In late 2019, I was pushing myself to get off of Facebook. It was important for me to keep in contact with people from there, so I started setting up a newsletter. I intended to post a farewell notice and let people subscribe to stay in touch. That stalled due to the pandemic, though thankfully I have been successful at not posting on Facebook! With the recent Twitter events, I’m spurred to get this done and quickly.



My near-term plan is to finish up the newsletter subscription system, publish a How to Follow Me page with details of the newsletter, my feeds, and even Mastodon to follow along. Then I will write an announcement post on Twitter and pin it. I will probably change my display name to “Find me at gregorlove.com.” In the following months, I may make my Twitter account private.



I have my Twitter export and intend to archive them all on my site and delete them from Twitter, but that is a longer-term project. Eventually my Twitter profile will just be a pointer to my site.



If you are already on Mastodon and want to follow me now, visit https://fed.brid.gy/user/gregorlove.com and enter your Mastodon username.

bygRegor Morrill • posted archived copycurrent

This is a good nudge for me to figure out what I'll do after working on Sele and Shock for a bit. I do want to give people a way to keep tabs on me if they'd like. I think I might crib some ideas you have here!

mx alex tax1a - 2020 (2) (@atax1a@infosec.exchange)

#rustlang is a programming language from the early 2010s that uses techniques from programming language theory that were discovered sometime after 1970this upsets nerds who think the only way to write a performant operating system is to write it in C, a literally conservative language from 1970 with very little compiler-time protection against memory corruption or type-check mismatches, because it means that they have to learn about something new, that prevents them from doing stupid things, because they think they just want to be able to do whatever they want without any safeguards or even a warningrust stops an entire massive class of memory-corruption bugs by design, so of course fragile cis men who think they need control over every single thing hate it:)
byInfosec Exchange archived copycurrent

Vidar Hokstad / Galaxy Bound (@vidar@galaxybound.com)

@jalcine@todon.eu The "old-school" solution is to user extensions to dynamically select format. E.g. one site I worked on had urls of format /item/somenumber return HTML, but you could add ".xml", ".rss" and a few other extensions to get other formats.The annoying thing about that is that there's no reliable/standard automated way of discovering the alternative formats for arbitrary sites.But at least proxies won't break it.
byGalaxy Bound archived copycurrent

I can see something like https://html.spec.whatwg.org/multipage/links.html#link-type-alternate being used for discerning alternative types, but that'd require parsing HTML (which is oddly deemed as taboo outside a browser nowadays).

Simon Willison (@simon@simonwillison.net)

Unpopular opinion time: I don't like the #HTTP Accept headerAny time I encounter it I find it surprising, and it inevitably makes web APIs both harder to work with and harder to understandPlus it can break things in very subtle and surprising waysDid you know Cloudflare used to ignore "Vary: accept" entirely? And today only respects it for image formats?Which presumably means you can't put a Mastodon instance behind Cloudflare because some Mastodon APIs need "Accept: application/json"
byMastodon archived copycurrent

Could one say that it's Cloudflare not conforming to specs w.r.t HTTP? Obviously, there's smarter people there than me (but I also don't touch their services anymore for ethical reasons) but I could imagine there's some sort of document that they have explaining this.

That said, what would you do in place of the header? Adjusting the URL?