Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grow the IndieWeb with Webmentions

amberwilson.co.uk

Post reply on HN
Print view View original

21–30 of 57 posts

Re: Grow the IndieWeb with Webmentions

#21

Post by mjgs »

I like the idea of aggregating mentions from around the web on my personal static site. Ideally I would want to always have the most recent data, and not expose my site in a way that could be hacked.

These are the implementations that come to mind:

- re-render entire site on receipt of new mention (live data, but dangerous)

- re-render site on a schedule (less dangerous, nearly live data)

- fetch mentions client-side (live data, safe, but requires javascript enabled in the browser)

[UPDATED] - use cloud edge worker to insert the live data as the page is being returned to client (live data, safe, works with JS disabled in browser)

Are there some implementations that I’m missing?

Re: Grow the IndieWeb with Webmentions

#22

Post by 90minuteAPI »

mjgs wrote: post #21

I like the idea of aggregating mentions from around the web on my personal static site. Ideally I would want to always have the most recent data, and not expose my site in a way that could be hacked. These are the implementations that come to mind: - re-render entire site on receipt of new mention (live data, but dangerous) - re-render site on a schedule (less dangerous, nearly live data) - fetch mentions client-side…

Live-but-throttled is a decent compromise between the first two. Maybe something that submits a notification directly to you, as chance to approve/deny/respond, moderate what gets published, and be generally aware of what you’re publishing for that matter.

Re: Grow the IndieWeb with Webmentions

#23

Post by mjgs »

90minuteAPI wrote: post #22
mjgs wrote: post #21

I like the idea of aggregating mentions from around the web on my personal static site. Ideally I would want to always have the most recent data, and not expose my site in a way that could be hacked. These are the implementations that come to mind: - re-render entire site on receipt of new mention (live data, but dangerous) - re-render site on a schedule (less dangerous, nearly live data) - fetch mentions client-side…

Live-but-throttled is a decent compromise between the first two. Maybe something that submits a notification directly to you, as chance to approve/deny/respond, moderate what gets published, and be generally aware of what you’re publishing for that matter.

Oh yeah I hadn’t considered the need for a review & approve step. That’s pretty important. So actually implementing web mentions is kind of non-trivial.

Re: Grow the IndieWeb with Webmentions

#24

Post by mjgs »

90minuteAPI wrote: post #22
mjgs wrote: post #21

I like the idea of aggregating mentions from around the web on my personal static site. Ideally I would want to always have the most recent data, and not expose my site in a way that could be hacked. These are the implementations that come to mind: - re-render entire site on receipt of new mention (live data, but dangerous) - re-render site on a schedule (less dangerous, nearly live data) - fetch mentions client-side…

Live-but-throttled is a decent compromise between the first two. Maybe something that submits a notification directly to you, as chance to approve/deny/respond, moderate what gets published, and be generally aware of what you’re publishing for that matter.

An option that just occurred to me:

- use edge workers to fetch and insert data as the page is being returned to the client

That would work in browsers with JS disabled.

You could also have client-side code to update with live data as it comes in.

The downside is that it’s not very portable code, but that’s the same for most serverless stuff, and it’s probably not that difficult to re-implement on another platform.

Re: Grow the IndieWeb with Webmentions

#28

Post by southerntofu »

tarkin2 wrote: post #26

The only third party js I have is disqus. Is this a good alternative? I guess it doesn’t allow comments unless you mention it from your site?

> I guess it doesn’t allow comments unless you mention it from your site?

That is the principle yes. However with or without webmention, you can build a public commenting system on your website. All it takes is form-processing on a server-side endpoint (to receive comments and filter out spam) and retrieving/formatting comments either on the server site (querying the endpoint whether per-request for dynamic sites, or as part of your build pipeline for static sites).

Webmention is a technology that enables websites to federate using semantic HTML. Comments are an order of magnitude simpler and never ever required any JavaScript or third party service. I never understood why people use Disqus, and i certainly will never enable JavaScript to comment on a website.

Re: Grow the IndieWeb with Webmentions

#29

Post by southerntofu »

Vinnl wrote: post #27

This page describes receiving WebMentions. If you're looking at sending them, a while back I implemented that in a small npm library as part of a grant. In case it's useful to anyone: https://www.npmjs.com/package/webmen

In case people are wondering, it's as simple as parsing your own HTML pages for links, fetching those links, parsing the remote HTML for a webmention endpoint, and if this exists, send a request over to it with headers indicating the URL of your own page, and the URL you linked to.

The nature of the interaction is not contained within the webmention, but rather the site on the other site will fetch and parse your page to figure that out. That information is within the HTML itself, such as `Commenting on this article` to express a commenting/reply relationship.

Re: Grow the IndieWeb with Webmentions

#30

Post by southerntofu »

luord wrote: post #14

Last weekend I decided to remove all third party services/javascript from my website, replacing them with external links (for the share button or the contact form), nothing (for google analytics[1]) or with web mentions (for disqus). Not sure how viable it is since it was actually more work than I thought it'd be, but at least I feel better now about my site not loading external stuff and setting unnecessary cookies.…

> remove all third party services/javascript from my website

Congratulations on that! I personally believe it should be the foundation for any website, but well...

> how vulnerable to spam it is, I suppose

This depends on how you implement it. You may implement simple rate-limiting/quotas, manual verification, or go the fancy way and implement signatures and/or vetting (not widely implemented yet in the ecosystem).

> I'm using cloudflare

Please consider not doing that. It's even worse than having 3rd party JS on your website. At least with 3rd party JS, i can disable JS in my browser or use an adblocker. When you use Cloudflare, you ask a private company to strip & search every person who'd like to access your website, and many persons are stuck in the process.

Cloudflare does have an option to let users from Tor access your website. But if you don't tick it, the default setting will leave all privacy-sensitive people at your doorstep, with a bad experience of your site. If JS is enabled, the CAPTCHA will loop forever driving us insane. If JS is disabled, the CAPTCHA won't even load.

Cloudflare is one of the worst things that can happen to Internet freedom, by centralizing all communications (especially as part of a free tier that encourages many non-profits to move over) and terminating TLS connections on there. If you enjoy free-software, privacy and computing ethics, please never use any Cloudflare product or equivalent. If you have problems with DDOS, many hosting providers have very good solutions that do not infringe on your or your readers' privacy.

Post reply on HN