Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automatically sending Webmentions from a static website

jamesmead.org

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Automatically sending Webmentions from a static website

#21

Post by epeus »

simonw wrote: post #11
necrotic_comp wrote: post #8

Earlier quoted context omitted.

I would think that because most of the sites are static, they are going to be doing some moderation before re-rendering and posting the linkbacks. The README says that one of the steps is verification [ https://github.com/converspace/webmention/blob/master/README... ], but it's a little disappointing that it's essentially an "exercise left for the reader".

"The receiver SHOULD perform a HTTP GET request on source to confirm that it actually links to target" We did that in pingback too. It turned out to be trivial for spammers to circumvent.

I've had them on my sites for a few years now, and even with bridgy passing tweet replies through the spam hasn't been too bad, but certainly adding an allow-list makes sense too. Having built Technorati that effectively did this at scale, I do appreciate the spam problem, but decentralising implementations has so far worked out OK.

Re: Automatically sending Webmentions from a static website

#22

Post by epeus »

epeus wrote: post #21
simonw wrote: post #11

Earlier quoted context omitted.

"The receiver SHOULD perform a HTTP GET request on source to confirm that it actually links to target" We did that in pingback too. It turned out to be trivial for spammers to circumvent.

I've had them on my sites for a few years now, and even with bridgy passing tweet replies through the spam hasn't been too bad, but certainly adding an allow-list makes sense too. Having built Technorati that effectively did this at scale, I do appreciate the spam problem, but decentralising implementations has so far worked out OK.

Marty writes up some of the variety of implementations here https://martymcgui.re/2020/07/15/what-we-talk-about-when-wer... (which I saw because he webmentioned my in it).

Re: Automatically sending Webmentions from a static website

#23

Post by epeus »

simonw wrote: post #5
leephillips wrote: post #4

I like the idea, but I wonder if I should bother: in other words, are people actually using this? Is this the new pingback, because that seemed like a good idea, too, but it never got off the ground.

I helped create pingback [ https://simonwillison.net/tags/pingback/ ], which eventually made it into WordPress and hence achieved pretty widespread distribution. My concern here is spam. With hindsight both Pingback and Trackbacks (which Pingback was a response to) essentially became APIs fit spammers to add junk to your site. Can webmention avoid the sane fate?

BTW, there's a pretty good discussion of pingback compared to webmention here, including how to bridge between them and some of the spam problems too https://indieweb.org/pingback

Re: Automatically sending Webmentions from a static website

#24

Post by toomim »

superkuh wrote: post #10

I implemented webmentions for my static site back around the end of 2019. My solution for receiving on my static site was to just log POSTs and review them with my eyes. Then if someone has actually sent a webmention (as opposed to pingback spam) I just use curl to respond. There's no need to have anything automated at all. ref: "A static, manual system for receiving webmentions (and pingback) with nginx" http://supe…

That's what OP originally did as well.

Re: Automatically sending Webmentions from a static website

#25

Post by dane-pgp »

dane-pgp wrote: post #2

It still amazes me that people have managed to create a viable system of decentralized comments across independent, statically-generated websites. Perhaps I should heed the (humorous) warning by Ben Werdmuller here, though: https://aaronparecki.com/2013/05/21/4/xkcd#mentions

The page I linked to was mostly intended as a nice example of Webmentions being used in the wild, but I also thought it made a nice point about the risks of centralized systems versus decentralized ones.

Examples of the latter would be spam (as mentioned elsewhere above), and coordination problems when trying to upgrade the standard in potentially backwards-incompatible ways. Hopefully the continued adoption of Webmention will prove that these risks are manageable.

Re: Automatically sending Webmentions from a static website

#27

Post by kixiQu »

simonw wrote: post #14
necrotic_comp wrote: post #13

Earlier quoted context omitted.

That's a bummer. Did you find out any other more robust ways to filter out spam ?

I gave up and stopped using it (well, I didn't bother reimplementing it on one of my various blog engine rewrites). If I were to implement pingback or webmention today I'd use a moderation queue with the ability to allow-list trusted domains so they get to skip moderation in the future.

https://github.com/zerok/webmentiond has allow list and block lists :) I am very happy using it

Re: Automatically sending Webmentions from a static website

#28

Post by abdullahkhalids »

Vinnl wrote: post #18
abdullahkhalids wrote: post #15

Why do you need an always on service for this? Just send the webmentions whenever you compile your static website - that's the only time content actually changes. On Pelican, you can do it using this plugin https://chezsoi.org/lucas/blog/pelican-pingback-and-webmenti...

Make sure to only do it after you've deployed it - part of the WebMention process is that the mentioned page actually checks the page that sends the mention for the given link. (Also annoying if the link is added client-side.)

To be fair [emphasis mine]

> Upon receipt of a POST request containing the source and target parameters, the receiver SHOULD verify the parameters (see Request Verification below) and then SHOULD queue and process the request asynchronously, to prevent DoS attacks.

https://www.w3.org/TR/2017/REC-webmention-20170112/

Though, probably, this won't happen in practice. So better to be careful.

Re: Automatically sending Webmentions from a static website

#29

Post by ignitionmonkey »

superkuh wrote: post #10

I implemented webmentions for my static site back around the end of 2019. My solution for receiving on my static site was to just log POSTs and review them with my eyes. Then if someone has actually sent a webmention (as opposed to pingback spam) I just use curl to respond. There's no need to have anything automated at all. ref: "A static, manual system for receiving webmentions (and pingback) with nginx" http://supe…

Just to correct your blog post, the Webmentions spec says in this scenario where you're just logging, you "MUST" return a 202 Accepted. I went through a similar phase (logsink with 204) which I corrected recently.

https://www.w3.org/TR/2017/REC-webmention-20170112/#h-receiv...

I was wondering if I should've sent this comment as a webmention instead but I guess old habits die hard.

Re: Automatically sending Webmentions from a static website

#30

Post by Vinnl »

abdullahkhalids wrote: post #28
Vinnl wrote: post #18

Earlier quoted context omitted.

Make sure to only do it after you've deployed it - part of the WebMention process is that the mentioned page actually checks the page that sends the mention for the given link. (Also annoying if the link is added client-side.)

To be fair [emphasis mine] > Upon receipt of a POST request containing the source and target parameters, the receiver SHOULD verify the parameters (see Request Verification below) and then SHOULD queue and process the request asynchronously , to prevent DoS attacks. https://www.w3.org/TR/2017/REC-webmention-20170112/ Though, probably, this won't happen in practice. So better to be careful.

Even if done asynchronously, if the link is not present the moment you send the WebMention, it can still happen between sending it and deploying it. But you're right, if the two are close together and a receiver is actually processing them asynchronously, it'll likely go well.
Post reply on HN