The service itself isn’t, but it’s built entirely on top of open standards like RSS, JSON Feed, Webmention, Microformats 2, Micropub, and other #IndieWeb tech. It’s the open web as it’s meant to be!
WeChat ID
aaronpk_tv
-
Shoutout to @indiewebcamp #indieweb from @jeckman. Smaller communities like this pushing for an open web. They need help bridging the gap w/ non-technical users. #wcpub
-
Khor
https://twitter.com/neth_6
•
Aug 8
The link you shared is for Implicit? Implicit does not use client secret. Does this mean IndieAuth is more similar to Implicit than Auth Code but is more secure as the client id has to be redirect uri?
Regular OAuth 2.0 also supports the Authorization Code flow with no secret. In fact, many companies recommend Auth Code w/no secret instead of Implicit.
IndieAuth is like taking Auth Code w/no secret and adding back some layers of security because of the client ID being a URL. -
Khor
https://twitter.com/neth_6
•
Aug 8
Got a #IndieAuth question. Since there is no client pre-registration, there is no client secret. Thus during code/access token exchange no client secret is used. Less secure than Authorization Code and more like Implicit perhaps?
But, most importantly, the fact that IndieAuth uses a URL for the client ID means that you *do* authenticate the client in the initial Auth Code request, since the redirect URL has to match the domain or be registered. That's an improvement over OAuth with no secret.
-
Khor
https://twitter.com/neth_6
•
Aug 8
Got a #IndieAuth question. Since there is no client pre-registration, there is no client secret. Thus during code/access token exchange no client secret is used. Less secure than Authorization Code and more like Implicit perhaps?
Without the secret, there is no authentication of the client. PKCE solves this by using essentially an on-the-fly secret safe for use by mobile apps. IndieAuth *could* adopt the PKCE extension as well, tho afaik noone has done that yet.
-
Khor
https://twitter.com/neth_6
•
Aug 8
Got a #IndieAuth question. Since there is no client pre-registration, there is no client secret. Thus during code/access token exchange no client secret is used. Less secure than Authorization Code and more like Implicit perhaps?
Good question! The OAuth Authorization Code flow doesn't require a secret either. For example mobile apps can't use a secret, but still use the Auth Code flow. There are many benefits to the Auth Code flow over Implicit, I wrote some about that here https://developer.okta.com/blog/2018/05/24/what-is-the-oauth2-implicit-grant-type#when-to-use-the-implicit-grant-type
-
Portland, Oregon • Tue, August 7, 2018 1:03pm -
at XLBPortland, Oregon • Mon, August 6, 2018 7:19pm
-
Ricky Munroe
https://twitter.com/rimunroe
•
Aug 6
xantham gum is pretty much indispensable for folks with celiac disease. There’s nothing wrong with using it
-
Portland, Oregon • Mon, August 6, 2018 10:00am -
I actually used xanthan gum in a recipe I made today
-
It’s hot sauce season again! Time to turn the amazing amount of tomatoes and carrots we get from the CSA into delicious hot sauce!
We’re still working through last year’s supply, and it’s already time to start making new batches again!
Tomatoes, habaneros, carrots, onion, garlic, vinegar and xanthan gum all combine into a delicious hot sauce with a slow heat that grows on you.
Swipe for progress pics and the recipe!
#CSA #communitysupportedagriculture #hotsauce #habanero #cooking #pdxvegans
-
at FERN KitchenPortland, Oregon • Sun, August 5, 2018 12:45pm
-
ᛚᛖᛁᚠ Warner
http://leifwarner.net
•
Aug 4
There was already RDFa and microformats, but that wasn't enough, so Google put out microdata to go with http://schema.org... I fear open data and the web in general seems to be going downhill, these days. Just corporate silos, some of which have their proprietary APIs.
You'd probably get a kick out of this https://aaronparecki.com/2016/12/17/8/owning-my-reviews -
noooo I just use Windows for QuickBooks, but that is all about to change cause I'm switching to QuickBooks Online because this is nonsense
