53°F

Aaron Parecki

  • Articles
  • Notes
  • Photos
  • Zegnat https://github.com/Zegnat   •   Apr 25

    This totally slipped me by, so here we go. I do like the idea of logging things, and syslog() is probably the best solution unless we want to pull in something like PSR-3. More thoughts:

    1. I would not turn any logging on by default. I do think logging IPs with authentication requests makes sense, and I would simply never want to log any IPs by default. Especially when people running this on shared hosts might be feeding it into logs they themselves cannot clear.
    2. LOG_FAILED_PASSWORDS sounds like a nice-to-have that needs massive disclaimers around it. We can’t work on the assumption that everyone is using a password manager. This means people are typing their passwords, and typos happen. This option sounds good, but if you over time fill logs with deviations of your real password, you better be making sure you are purging those logs real good. (Of course again with the problem that syslog() may be out of reach to the user who unwittingly turned this on.)

    I can almost see us strategically dropping these into the source code, but commented. Anyone who understands syslog() and wants to use it to trip up other alarm bells on a server, will probably be OK uncommenting a couple of functions. Even if they aren’t well versed with PHP. This will at least keep it out of the hands of users who cannot see the possible side-effects.

    Like the idea, just not sure how to execute it without giving users some flags in the config with huge warning disclaimers. And I don’t like warning disclaimers in what is supposed to be a simple single-purpose thing.

    Aaron Parecki
    I like the idea of making logging opt-in by uncommenting the code. I'm struggling to think of a case where logging failed passwords is ever a good idea. It seems others would agree with this assessment as well. https://security.stackexchange.com/questions/16824/is-it-common-practice-to-log-rejected-passwords
    Portland, Oregon • 83°F
    Wed, Apr 25, 2018 3:23pm -07:00
  • Apr 25

    I love programming.

    Aaron Parecki
    I love programming*

    *when programming a product that I also designed myself
    Portland, Oregon • 82°F
    Wed, Apr 25, 2018 3:15pm -07:00
  • Eddie Hinkle https://eddiehinkle.com/   •   permalink

    I definitely agree! It was a huge improvement when they switched to subscription!

    Aaron Parecki
    Everyone seemed super upset about the change, but honestly I prefer the new model. I am happy to support them yearly rather than pay once and expect them to continue improving the software for free. I want to be seen as a customer rather than a drain on their resources.
    Portland, Oregon • 82°F
    Wed, Apr 25, 2018 2:16pm -07:00
  • singpolyma https://github.com/singpolyma   •   Apr 25

    #5 RAM DOS

    Aaron Parecki
    In practice this is enforced by the PHP process itself. PHP has a setting for a maximum memory limit, at which point the process will be killed. I'm not really interested in trying to solve this for real using some sort of stream solution, since the vast majority of content this is used for is relatively small pages.
    Portland, Oregon • 65°F
    Wed, Apr 25, 2018 9:33am -07:00
  • Marty McGuire https://martymcgui.re/   •   Apr 25

    📍 Checked in at Au Bonheur Des Chats, Lyon, Rhône-Alpes. Lunch with cats

    Aaron Parecki
    omg is that a cat cafe? 😻
    Portland, Oregon • 54°F
    1 reply
    Wed, Apr 25, 2018 6:47am -07:00
  • nickvance https://micro.blog/nickvance   •   Apr 24

    @aaronpk I'm a big fan of plan 'ol RSS but this is neat. Seems weird that it shows up under a GoDaddy URL though?

    Aaron Parecki
    Plain old RSS is fine for what it does -- one-way consumption of blog posts and podcasts -- but the web moved on from that kind of interaction ages ago. GoDaddy has been a big indieweb supporter for a while now too! https://indieweb.org/GoDaddy
    Portland, Oregon • 78°F
    Tue, Apr 24, 2018 2:29pm -07:00
  • Apr 24

    Announcement: “Those of you sitting in window seats probably got a good look at the Southwest jet that flew over us. They’re at 36,000 ft., we are at 35,000 ft.” A) Is this common? B) Is it a good idea to announce this? 😳🤔

    Aaron Parecki
    wow pretty cool! It looks like 1000ft is normal though: https://aviation.stackexchange.com/a/2813
    Portland, Oregon • 77°F
    Tue, Apr 24, 2018 2:19pm -07:00
  • Adam Lewis https://twitter.com/lewiada   •   Apr 24
    and what about for storing the access token in the browser?
    Aaron Parecki
    Sadly there isn't a satisfying answer to that. Anything that your JS can use to store any token is vulnerable to XSS. The only secure option is cookies, but that won't work with OAuth. https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage
    Portland, Oregon • 75°F
    1 like 3 replies
    Tue, Apr 24, 2018 12:07pm -07:00
  • Aaron Parecki https://aaronparecki.com/   •   Apr 24
    BCP for public UA clients:

    • use the authorization code flow
    • omit client secret
    • strict redirect URI validation

    Some citations and more info: https://aaronparecki.com/oauth-2-simplified/#single-page-apps
    Aaron Parecki
    I agree it would be nice to see this written up properly though. In the mean time, I'm adding a section to my book about this.
    Portland, Oregon • 72°F
    2 likes 1 repost
    Tue, Apr 24, 2018 11:05am -07:00
  • Adam Lewis https://twitter.com/lewiada   •   Apr 24
    We do implement native apps per RFC8252 including code flow, custom tabs and PKCE, and we use OIDC for authentication to web apps. But doing ua-based-apps / SPAs right is ambiguous at best and I keep hoping for the @oauth_2 WG to begin work on an ua-based client BCP.
    Aaron Parecki
    BCP for public UA clients:

    • use the authorization code flow
    • omit client secret
    • strict redirect URI validation

    Some citations and more info: https://aaronparecki.com/oauth-2-simplified/#single-page-apps
    Portland, Oregon • 71°F
    3 likes 1 repost 6 replies
    Tue, Apr 24, 2018 10:57am -07:00 #oauth2
  • jagtalon https://micro.blog/jagtalon   •   Apr 23

    @aaronpk Hi! I just started using OwnYourGram and it's so cool! I'm glad that I get to archive my stuff from there and onto my own domain. I have a question though: is it possible for it to fetch more than 20 IG posts? Would be cool if I could back those up as well.

    Thank you!

    Aaron Parecki
    Thanks! Unfortunately it doesn't handle importing past photos right now, it's meant to just import photos going forward.
    Portland, Oregon • 46°F
    Mon, Apr 23, 2018 8:04am -07:00
  • macgenie https://micro.blog/macgenie   •   Apr 21

    @aaronpk Your list of life tools is the one that pushed me over the edge. I got the KitchenAid, as recommended, and I hope you are enjoying your $0.26 of affiliate income. 😂. (I actually don't know what the affiliate percentage is anymore.)

    Aaron Parecki
    Haha that's great! It was probably actually more like $1 too!
    Portland, Oregon • 57°F
    Sat, Apr 21, 2018 1:08pm -07:00
  • Marty McGuire https://martymcgui.re/   •   Apr 21

    This Week in the IndieWeb Audio Edition • April 14th - 20th, 2018

    Aaron Parecki
    it's pronounced "awk-tuh"! 😇
    Portland, Oregon • 48°F
    1 reply
    Sat, Apr 21, 2018 7:38am -07:00
  • Apr 20

    Finished butternut squash soup with coconut milk. I don’t know why it took me so long to get an immersion blender. cc: @Burk

    c9a096ad0d.jpgbe94078d9b.jpg

    Aaron Parecki
    I had the same thought after I got an immersion blender!
    Portland, Oregon • 48°F
    Sat, Apr 21, 2018 7:29am -07:00
  • smokey https://micro.blog/smokey   •   Apr 21

    @cleverdevil Perhaps there wasn’t enough of a market before now for WordPress et al. to invest resources into a migration tool/service (there was obviously a desire, because all those tools you strung together), but in the current climate, it does seem like there’s a greater need. Maybe someone is frantically building one right now?

    I’d seen several people asking here about getting their photos out of Instagram, so it’s a shame that InstaLooter isn’t non-tech-friendly (or that someone hasn’t deployed it behind a web service on a server somewhere)….

    And I like the idea of the “on this day” stuff that you and @colinwalker have built for yourselves. The more pieces of the siloed experience that we can easily replicate on the open web, the better :-)

    Aaron Parecki
    a few years ago I made a service "Flickstagram" which would migrate all your Instagram photos to your Flickr. I'm tempted to do something similar again, except it imports everything to your micro.blog or Wordpress or other Micropub website
    San Francisco, California • 60°F
    Fri, Apr 20, 2018 5:45pm -07:00
  • ablaze https://micro.blog/ablaze   •   Apr 20

    @aaronpk I can't even fathom how I could add that just by putting some markup in the site header or whatever, but I look forward to finding out.

    Aaron Parecki
    Here it is! https://www.godaddy.com/garage/an-indieweb-reader-my-new-home-on-the-internet/
    San Francisco, California • 66°F
    Fri, Apr 20, 2018 12:46pm -07:00
  • https://2018.indieweb.org/
    Aaron Parecki
    Looking forward to seeing everyone there! 🎉
    Portland, Oregon • 39°F
    Fri, Apr 20, 2018 6:10am -07:00
  • Eddie Hinkle https://eddiehinkle.com/   •   permalink

    Yeah, he definitely wants to add it. The main challenge he has currently is where are the photos hosted for people who reply using the micro.blog app? For people who host their replies like us, it’s fine. But unless micro.blog posts the replies to the hosted accounts/Wordpress accounts, then micro.blog the service would have to have photo hosting. So until he decides which way to go he’s held off on allow photo replies. If we can do it but others can’t then that would open up even more questions.

    Aaron Parecki
    oh interesting, I guess that makes sense. Tho I kind of like the sound of photo replies as a gateway drug to the indieweb.
    Portland, Oregon • 39°F
    1 reply
    Fri, Apr 20, 2018 5:22am -07:00
  • Eddie Hinkle https://eddiehinkle.com/   •   permalink

    micro.blog doesn’t support photos in replies, only initial posts. That’s what happened :)

    Aaron Parecki
    Feature request! 📷
    Portland, Oregon • 58°F
    1 reply
    Thu, Apr 19, 2018 8:51pm -07:00
  • ablaze https://micro.blog/ablaze   •   Apr 20

    @aaronpk I can't even fathom how I could add that just by putting some markup in the site header or whatever, but I look forward to finding out.

    Aaron Parecki
    That's the power of the IndieWeb!
    Portland, Oregon • 69°F
    Thu, Apr 19, 2018 6:15pm -07:00
older

Hi, I'm Aaron Parecki, Director of Identity Standards at Okta, and co-founder of IndieWebCamp. I maintain oauth.net, write and consult about OAuth, and participate in the OAuth Working Group at the IETF. I also help people learn about video production and livestreaming. (detailed bio)

I've been tracking my location since 2008 and I wrote 100 songs in 100 days. I've spoken at conferences around the world about owning your data, OAuth, quantified self, and explained why R is a vowel. Read more.

  • Director of Identity Standards at Okta
  • IndieWebCamp Founder
  • OAuth WG Editor
  • OpenID Board Member

  • 🎥 YouTube Tutorials and Reviews
  • 🏠 We're building a triplex!
  • ⭐️ Life Stack
  • ⚙️ Home Automation
  • All
  • Articles
  • Bookmarks
  • Notes
  • Photos
  • Replies
  • Reviews
  • Trips
  • Videos
  • Contact
© 1999-2025 by Aaron Parecki. Powered by p3k. This site supports Webmention.
Except where otherwise noted, text content on this site is licensed under a Creative Commons Attribution 3.0 License.
IndieWebCamp Microformats Webmention W3C HTML5 Creative Commons
WeChat ID
aaronpk_tv