63°F

Aaron Parecki

  • Articles
  • Notes
  • Photos
  • manton https://micro.blog/manton   •   May 2

    @aaronpk I've been experimenting with that for the Micro.blog for Mac app. We'll see how it goes. Seems like a better fit than web upload because of the file sizes.

    Aaron Parecki
    Awesome. If you do end up doing that, I would love to see an "Advanced" settings section so that I could put in my own Micropub endpoint details! I still need to import my Instagram photos from before I built OwnYourGram!
    San Francisco, California • 65°F
    Wed, May 2, 2018 10:40am -07:00
  • permalink

    For anyone who downloaded their Instagram archive, how big was the .zip file? Mine was 30 MB, but I stopped posting last year and only had a few videos. Wondering if the average size is too big for anything except as a backup.

    → 2018/05/02 9:45 am
    Aaron Parecki
    There's definitely an opportunity for someone to make an Instagram Archive to Micropub importer desktop app. Point it at your archive, then it'd go make Micropub requests to create posts on your site for all the old photos.
    San Francisco, California • 59°F
    Wed, May 2, 2018 9:30am -07:00
  • David Shanske https://david.shanske.com/   •   Apr 29

    An Indieweb Podcast – Episode 3: Syndication

    Aaron Parecki
    I would love to be able to subscribe to this but something is wrong with the feed!
    Portland, Oregon • 56°F
    Mon, Apr 30, 2018 2:22pm -07:00
  • https://indieweb.org/events/2018-05-02-homebrew-website-club
    http://tantek.com/2018/122/e1/homebrew-website-club-sf
    Aaron Parecki
    I'll be in SF this week! Any special donut requests?
    Portland, Oregon • 46°F
    Mon, Apr 30, 2018 6:48am -07:00 #hwc
  • vishae https://github.com/vishae   •   Apr 28

    Hi @aaronpk

    When I add the first line, this is the error message I get (when attempting to send a previous post to my site - after the verification process):

    HTTP/1.1 100 Continue

    HTTP/1.1 500 Internal Server Error Server: nginx/1.12.2 Date: Sat, 28 Apr 2018 06:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Endurance-Cache-Level: 2

    That is the same error message I get if I remove that line and add the second line you suggested (I'm assuming you didn't want both lines in the .htaccess file).

    Aaron Parecki
    Okay, thanks for giving that a try. We're working on a fix and should hopefully have an update shortly.
    Portland, Oregon • 51°F
    Sat, Apr 28, 2018 9:36am -07:00
  • Zegnat https://github.com/Zegnat   •   Apr 28

    #172 Use stdClass when a microformat has no properties

    Aaron Parecki
    Does this match the behavior as described in the readme? https://github.com/indieweb/php-mf2#generating-output-for-json-serialization-with-json-mode See also this issue which looks like the same thing but for `rels` https://github.com/indieweb/php-mf2/issues/29
    Portland, Oregon • 51°F
    Sat, Apr 28, 2018 9:35am -07:00
  • https://2018.indieweb.org/nuremberg
    Aaron Parecki
    Looking forward to coming back to Nürnberg!
    Portland, Oregon • 65°F
    Fri, Apr 27, 2018 10:17am -07:00 #indiewebcamp
  • Chris Aldrich http://www.boffosocko.com   •   Apr 26

    🔖 camelcamelcamel for Amazon Price tracking

    Aaron Parecki
    I use that all the time! It's very helpful to be able to tell whether a "sale" is actually a good deal.
    Portland, Oregon • 65°F
    Fri, Apr 27, 2018 6:33am -07:00
  • sknebel https://github.com/sknebel   •   Apr 26

    A potential manual way: have a !snooze command that blacklists a string for e.g. 24 hours.

    Aaron Parecki
    !snooze is not a bad idea, that gives people the ability to make the decision about what to filter.

    I do have some code that Loqi uses to kick people out of the IRC room when they spam it that might also work here, but I'd be worried about too much false positive filtering. It looks at a normalized version of the text (lowercase, no whitespace or punctuation, minus URLs) and could reject tweets that match an existing one found in the last 24 hours. That would have stopped a bunch of these from coming through.
    Portland, Oregon • 71°F
    Thu, Apr 26, 2018 6:57am -07:00
  • danielpunkass https://micro.blog/danielpunkass   •   Apr 25

    @aaronpk Enjoy it :)

    Aaron Parecki
    I solved that problem for myself pretty quick 😉
    Portland, Oregon • 84°F
    Wed, Apr 25, 2018 3:43pm -07:00
  • danielpunkass https://micro.blog/danielpunkass   •   Apr 25

    @aaronpk This is a privilege that I enjoy far more than many programmers... thanks for the reminder.

    Aaron Parecki
    Yes, I learned this the hard way two years ago. I was blissfully unaware of this privilege up until that point.
    Portland, Oregon • 84°F
    Wed, Apr 25, 2018 3:37pm -07:00
  • Zegnat https://github.com/Zegnat   •   Apr 25

    This totally slipped me by, so here we go. I do like the idea of logging things, and syslog() is probably the best solution unless we want to pull in something like PSR-3. More thoughts:

    1. I would not turn any logging on by default. I do think logging IPs with authentication requests makes sense, and I would simply never want to log any IPs by default. Especially when people running this on shared hosts might be feeding it into logs they themselves cannot clear.
    2. LOG_FAILED_PASSWORDS sounds like a nice-to-have that needs massive disclaimers around it. We can’t work on the assumption that everyone is using a password manager. This means people are typing their passwords, and typos happen. This option sounds good, but if you over time fill logs with deviations of your real password, you better be making sure you are purging those logs real good. (Of course again with the problem that syslog() may be out of reach to the user who unwittingly turned this on.)

    I can almost see us strategically dropping these into the source code, but commented. Anyone who understands syslog() and wants to use it to trip up other alarm bells on a server, will probably be OK uncommenting a couple of functions. Even if they aren’t well versed with PHP. This will at least keep it out of the hands of users who cannot see the possible side-effects.

    Like the idea, just not sure how to execute it without giving users some flags in the config with huge warning disclaimers. And I don’t like warning disclaimers in what is supposed to be a simple single-purpose thing.

    Aaron Parecki
    I like the idea of making logging opt-in by uncommenting the code. I'm struggling to think of a case where logging failed passwords is ever a good idea. It seems others would agree with this assessment as well. https://security.stackexchange.com/questions/16824/is-it-common-practice-to-log-rejected-passwords
    Portland, Oregon • 83°F
    Wed, Apr 25, 2018 3:23pm -07:00
  • Apr 25

    I love programming.

    Aaron Parecki
    I love programming*

    *when programming a product that I also designed myself
    Portland, Oregon • 82°F
    Wed, Apr 25, 2018 3:15pm -07:00
  • Eddie Hinkle https://eddiehinkle.com/   •   permalink

    I definitely agree! It was a huge improvement when they switched to subscription!

    Aaron Parecki
    Everyone seemed super upset about the change, but honestly I prefer the new model. I am happy to support them yearly rather than pay once and expect them to continue improving the software for free. I want to be seen as a customer rather than a drain on their resources.
    Portland, Oregon • 82°F
    Wed, Apr 25, 2018 2:16pm -07:00
  • singpolyma https://github.com/singpolyma   •   Apr 25

    #5 RAM DOS

    Aaron Parecki
    In practice this is enforced by the PHP process itself. PHP has a setting for a maximum memory limit, at which point the process will be killed. I'm not really interested in trying to solve this for real using some sort of stream solution, since the vast majority of content this is used for is relatively small pages.
    Portland, Oregon • 65°F
    Wed, Apr 25, 2018 9:33am -07:00
  • Marty McGuire https://martymcgui.re/   •   Apr 25

    📍 Checked in at Au Bonheur Des Chats, Lyon, Rhône-Alpes. Lunch with cats

    Aaron Parecki
    omg is that a cat cafe? 😻
    Portland, Oregon • 54°F
    1 reply
    Wed, Apr 25, 2018 6:47am -07:00
  • nickvance https://micro.blog/nickvance   •   Apr 24

    @aaronpk I'm a big fan of plan 'ol RSS but this is neat. Seems weird that it shows up under a GoDaddy URL though?

    Aaron Parecki
    Plain old RSS is fine for what it does -- one-way consumption of blog posts and podcasts -- but the web moved on from that kind of interaction ages ago. GoDaddy has been a big indieweb supporter for a while now too! https://indieweb.org/GoDaddy
    Portland, Oregon • 78°F
    Tue, Apr 24, 2018 2:29pm -07:00
  • Apr 24

    Announcement: “Those of you sitting in window seats probably got a good look at the Southwest jet that flew over us. They’re at 36,000 ft., we are at 35,000 ft.” A) Is this common? B) Is it a good idea to announce this? 😳🤔

    Aaron Parecki
    wow pretty cool! It looks like 1000ft is normal though: https://aviation.stackexchange.com/a/2813
    Portland, Oregon • 77°F
    Tue, Apr 24, 2018 2:19pm -07:00
  • Adam Lewis https://twitter.com/lewiada   •   Apr 24
    and what about for storing the access token in the browser?
    Aaron Parecki
    Sadly there isn't a satisfying answer to that. Anything that your JS can use to store any token is vulnerable to XSS. The only secure option is cookies, but that won't work with OAuth. https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage
    Portland, Oregon • 75°F
    1 like 3 replies
    Tue, Apr 24, 2018 12:07pm -07:00
  • Aaron Parecki https://aaronparecki.com/   •   Apr 24
    BCP for public UA clients:

    • use the authorization code flow
    • omit client secret
    • strict redirect URI validation

    Some citations and more info: https://aaronparecki.com/oauth-2-simplified/#single-page-apps
    Aaron Parecki
    I agree it would be nice to see this written up properly though. In the mean time, I'm adding a section to my book about this.
    Portland, Oregon • 72°F
    2 likes 1 repost
    Tue, Apr 24, 2018 11:05am -07:00
older

Hi, I'm Aaron Parecki, Director of Identity Standards at Okta, and co-founder of IndieWebCamp. I maintain oauth.net, write and consult about OAuth, and participate in the OAuth Working Group at the IETF. I also help people learn about video production and livestreaming. (detailed bio)

I've been tracking my location since 2008 and I wrote 100 songs in 100 days. I've spoken at conferences around the world about owning your data, OAuth, quantified self, and explained why R is a vowel. Read more.

  • Director of Identity Standards at Okta
  • IndieWebCamp Founder
  • OAuth WG Editor
  • OpenID Board Member

  • 🎥 YouTube Tutorials and Reviews
  • 🏠 We're building a triplex!
  • ⭐️ Life Stack
  • ⚙️ Home Automation
  • All
  • Articles
  • Bookmarks
  • Notes
  • Photos
  • Replies
  • Reviews
  • Trips
  • Videos
  • Contact
© 1999-2025 by Aaron Parecki. Powered by p3k. This site supports Webmention.
Except where otherwise noted, text content on this site is licensed under a Creative Commons Attribution 3.0 License.
IndieWebCamp Microformats Webmention W3C HTML5 Creative Commons
WeChat ID
aaronpk_tv