Social Web Incubator Community Group Teleconference

05 Jul 2017

Attendees

Present: cwebber, tsyesika, ben_thatmustbeme, aaronpk, cwebber2
Regrets Chair: cwebber2
Scribe: tsyesika

aaronpk: I mentioned in the github thread. We've experimented in the indeweb wiki and we use a button which requires one click but setting it up requires a lot.
... I also implemented the mastodon follow button where you type in your own site, it's an interesting approach but obviously not as good as the silos
... I'm pretty sure the only way to do this is have it part of the browser otherwise you're granting too much permission from the site your visiting. I don't think there is a way to do it securely other than using the browser or a user-agent doing the following(?)

cwebber2: my gut feeling is the browser has to be involved somehow. I'm worried about XSS attacks. For example if you had a like button, could you also make that handle a delete action too if you had granted the site both permissions. Does anyone have any thoughts on cross site trickery (more broad then just XSS)

<Zakim> cwebber, you wanted to ask about xss attacks

sandro: I agree with what's been. Getting browsers to implement this stuff is going to be difficult. I think it'll be possible to do a polyfill.

sandro: polyfill looks as if it's in the browser but it's actually not. The site using it has to load a bit of JS that does some magic from a specific site

<ben_thatmustbeme> https://www.subtome.com

aaronpk: joulian has actually done this from subto.me. I don't know how it exactly works but it's essencially a polyfill tied to a domain

<aaronpk> https://www.subtome.com/#/

aaronpk: when people put a subtome button on their site ... (something) it looks like a regular follow button. One solution around the browser is to get a reader support as it can add all the buttons at once and it also knows what you're doing (favouriting a post, etc.)

<Zakim> cwebber, you wanted to ask about js interactions

cwebber2: if we had a like-style button on the page. They'll probably be added by JS anyway (mastodon is react.js), we'll have to assume things like this will have to be robust enough for JS to add buttons like this and we have to think about JS being able to click buttons like this. Like google's click fraud

sandro: How I imagine polyfills it would use iframes. When I put a static facebook like button on my page it allows a user to like something without leaving the page and display how many friends have liked the page. It's bidirectional.
... the page can't mess with the double iframes. The browser treats them as separate origins, the iframe security is quite good.
... I implemented this double iframe thing. Is there interest in moving forward, we could rebrand Julian's code.
... someway we could get this functionality deployed across social websites

aaronpk: I think we need to do some more exploring and experimentation. Our current set of options aren't ideal right now.

sandro: I'm glad you're saying that, the UX is too messy and there is no guarantee that it'd work on microsoft products or mobile and that's a large fraction of the web.

<nightpool> have people mentioned multiple accounts yet? that's a usecase that protocol handlers can't provide, as far as I understand existing tech

cwebber2: There might be some theming miss match between sites

sandro: You could provide some theming but as a user I like the idea of seeing a tiny window into my own site so it should be themed like my site

aaronpk: I agree. As a user I need to be able to trust that button to do something on my site so it should look like my site. The problem with button in someone's site it'll have problems with designers and such and it'll look wrong. It's why i prefer browser or reader support

<cwebber2> nightpool, good question, I'll raise it

sandro: how do you invasive it'll look like in the browser/reader?

aaronpk: I have a bookmarklet that i can click and it lets me follow someone. It's integrated into the browser outside the thing i'm viewing

sandro: If it's styled in the polyfil, if it's put in the top and styled like my browser

aaronpk: if it's intentionally taken outside the flow of the website. I could see myself using that. It'd also not conflict with the style of the website too

cwebber2: Would you be able to click the like or share or whatever on multiple things on a page with a drop down or would it only be one thing per page

<Zakim> cwebber, you wanted to raise nightpool's question about multiple accounts

aaronpk: there is a micropub chrome extension (?) and it looks thorugh the href's on the page and shows things in yellow that you can do it on but one of the reasons i think readers are better because it can do things like that

cwebber2: nightpool was asking about multiple accounts

sandro: My answer is there will be a button for my currently chosen account and a drop down menu to switch to another account or add an account

<ben_thatmustbeme> "Not you? click here"

sandro: I'm not sure it'd work with the titlebar aaronpk was talking about

aaronpk: that's how it works with facebook, you can choose a little dropdown

<nightpool> sandro: I'm not sure that's compatible with registerProtocolHandlers, is my point

<cwebber2> |[[[1]|https://foosite.example/post/123/]]] [stop][reload]|

sandro: it seems to me facebook and disqus <something> style.

<cwebber2> |--------------------------------------------------|

<cwebber2> |[V [email protected] ]| [* Like] [* Reply] |

cwebber2: something like this ^ (ascci art). You have your address bar and then something on the left with the available actions to the left

sandro: I pictured the drop down all the way to the right

cwebber2: I don't think it's the critical design issue, it could be either way. I don't care

sandro: I don't picture your name there

cwebber2: Yeah it could display the users picture or whatever

<nightpool> i'm more concerned about the technical problems

sandro: coming back to next steps. I wasn't sure anyone was interested but I'm glad aaronpk is interested

<cwebber2> nightpool, could you elaborate?

cwebber2: I'm very interested too. It's one of the things we looked at in mediagoblin when we first looked into federation

<nightpool> cwebber2: you can only have one protocol handler for a given protocol, right?

sandro: If we're going to do IRC we probably should just go back to typing
... though I do like jessica being this voice to text machine here ;)

P

<nightpool> if we're using the <iframe src"whatever"> format

sandro: do you have in mind the next experiment or a thing you wanna try

err

that was sandro

<nightpool> so if I want to use accounts on cybre.space and glitch.social, no page can know about both

aaronpk: I'm not sure what the next step to try. I don't have a easy way to read people regardless if there is a one click button to follow

sandro: what do you mean by read

aaronpk: follow people, I don't have a place for that to go right now

<cwebber2> nightpool, I'm not totally sure I follow... I'm guessing you mean that you couldn't do both activitypub and webmention in the same thing, or?

sandro: Just thinking in a world which is just hfeed (?) and websub

<nightpool> one sec, let me open mumble.

sandro: what I'm thinking is on your page you put the follow button (with double iframes) and when i click on that (the button is displayed on my site).
... I need to get something from your site to know if I'm already following or...

aaronpk: I don't have a good experience for seeing content once I follow you so I don't have an incentive to follow folks

nightpool: I was trying to say in IRC: One of the thing that happens on mastodon is that people have multiple accounts on multiple instances. I have two accounts on two different instances
... Looking at the protocol handler approach doesn't work well because you can only have just one of the instances buttons loaded

sandro: This could be another reason for the trusted domain iframe method so you can have the drop down talked about
... you could have one site which proxies other sites, doesn't need to be a 3rd party

nightpool: I think it gets into the concern people from matrix or other federated networks. Matrix has a separate identity from your home server. It lets you have one identity but multiple servers but it's more complicated from a users point of view

cwebber2: is there anything more to discuss on this or do folks feel we've wrapped it up

sandro: I'm excited to implement something but I want to implement something wants to use but I don't know where to go

nightpool: mastodon is willing to accept PRs. following might be difficult because we have that and we don't want to loose compatibility

sandro: So maybe a share so when you click it posts to your mastodon with a URL to the toot

nightpool: what I was talking about is being able to like someones toots without having to have a mastodon account

<Zakim> cwebber, you wanted to review the ups/downs of the two options

cwebber2: I wanted to review as we have several proposals
... option 1) Use iframes to embed individual buttons (maybe browser support in the future)
... upsides: easy to look and reply to individual posts. downsides: theme mismatch (maybe a upside), it's more difficult to select specific users

nightpool: are we talking about register protocol handler or or at a higher level then that??

cwebber2: higher level than that, more about the UX of how to embed this

sandro: It seems it's between iframes and register protocol handler
... option 2) the ascii art I put earlier (reposting)

<cwebber2> <cwebber2> |[[[2]|https://foosite.example/post/123/]]] [stop][reload]|

<cwebber2> <cwebber2> |--------------------------------------------------|

<cwebber2> <cwebber2> |[V [email protected] ]| [* Like] [* Reply] |

<sandro> [* Like | v]

sandro: this is a bar that would appear on the top of the page, separate from the content. The advantages: it's separate from the content. disadvantages: it's harder to act on individual things on the page (multiple likes on a page or something)=
... We probably need both of these. We probably want to act on specific things on the page and the page as a whole. I think if we get one to work, the other probably will come too

nightpool: when you mentioned option 1, we mentioned the difficulties of multiple accounts. I don't think that's a UX limitation, it could show a dropdown or a confirmation

<aaronpk> here's the micropub chrome extsension i mentioned earlier: http://omnibear.com/

<aaronpk> and screenshot of the in-page partial content interaction https://lh3.googleusercontent.com/Jv1otQxCPcgZiuAAWCDeZzGnS_KKRuVf2Ww6GOEIwHDNFYDSSMyBIapYacz_g57OBrq-v9t2=s640-h400-e365-rw

nightpool: I think sandro is right, the main UX difference is acting on the whole page or a specific element and i think both are good

aaronpk: I'm sharing some links, you can see it highlights the elements

sandro: what's a web-p image

<aaronpk> https://chrome.google.com/webstore/detail/omnibear/cjieakdeocmiimmphkfhdfbihhncoocn

<ben_thatmustbeme> nor did mine

aaronpk: It's supported in chrome but not firefox

sandro: so the dropped menu is a normal right click menu?

<ben_thatmustbeme> http://caniuse.com/#feat=webp

<aaronpk> https://lh3.googleusercontent.com/H1ASXNCZ-XciT7GlB7ZJS_fYo_iwyx5P2h_5s9JZNWIawkDt79NKrQAXS424Vslv51u4z58eg7g=s640-h400-e365-rw

aaronpk: yes it's a normal right click menu and when it highlights the thing you want to act on(?)

<aaronpk> https://lh3.googleusercontent.com/KqTOcSgOfdBH4KnLu_jRJZMw-DJ3b5Go-Ato0rauVl1Jj03Bcd_Cq9qY6UIPkD9SBfqh4nvDKms=s640-h400-e365-rw

sandro: that's very nice, so when you click reply to entry how does that work?

aaronpk: it opens a micropub client and makes a micropub reply to your site

sandro: <missed your reply>

cwebber2: I saw a demo at <somewhere> doing federated payments or something where you could one site and click pay and I wasn't sure how it worked but it was very impressive
... unless there is anything else lets break 10 minutes early

sandro: are we meeting next week?
... if folks on summer wanna have a break we can i think or if folks wanna continue we can

<nightpool> 0

cwebber2: I am happy to continue on our current schedule but if folks wanna move to biweekly that's okay. Do we want to do a poll on IRC

<cwebber2> don't care

I don't care :)

<sandro> dont care

<sandro> :-)

<nightpool> don't care either

<sandro> conflicting preferences

<ben_thatmustbeme> don't care

cwebber2: dont' care does not mean you don't care about the group, just you have no preference :)

<ben_thatmustbeme> so basically, the general response is, apathy

cwebber2: lets keep the status quo. Weekly it is

<sandro> +1 stick with weekly

<sandro> thanks cwebber2

<nightpool> this might have been a bad week to ask this on :P

<cwebber2> tsyesika++

<Loqi> tsyesika has 18 karma in this channel (20 overall)

<nightpool> tsyesika++

<Loqi> tsyesika has 19 karma in this channel (21 overall)

sorry I missed so must stuff, I'm rusty when it comes to scribing it seems

<nightpool> tsyesika: you did a really great job summarizing my rambling :)

)

<nightpool> sandro: I should go get lunch soon, but let me know if you want to talk about specific implementation stuff

<nightpool> I'll ping gargron on what his thoughts are on the trusted domain stuff

<ben_thatmustbeme> tsyesika++

<Loqi> tsyesika has 20 karma in this channel (22 overall)

<nightpool> in theory I like aaronpk's registerProtocolHandler -> intermediate domain -> rest of your accounts but it seems pretty hard to make it really work from a UX perspective.

<ben_thatmustbeme> cwebber2: care to end meeting officially

<nightpool> the meeting is over, everyone has left mumble

<ben_thatmustbeme> trackbot, end meeting

Summary of Action Items

Summary of Resolutions

[End of minutes]

SocialCG/2017-07-05/minutes

Social Web Incubator Community Group Teleconference

05 Jul 2017

Attendees

Contents

Summary of Action Items

Summary of Resolutions