A Node on the Web publisher

Oups… Accidentally turned my geekom IT15 off but thanks to herdr recovered my opencode session without an ounce of stress 😊

Hi Aaron, is there any path to have one’s own domain added to the allowed client list on indielogin service ?

I’ve been rebuilding the comment system on this site with Claude Code. Visitors sign in with their own website to leave a comment — IndieAuth, the way it’s meant to work.

Overnight we migrated it from IndieAuth to IndieLogin.com. At 05:40 this morning it published to npm and deployed. By 08:00 I’d opened an incognito window, typed in my own domain, and got this:

Request Error
This client_id is not registered (https://rmendes.net)

The migration could never have worked. Not “had a bug” — could never have worked, for any visitor, on any site not already on a list I didn’t know existed.

Why it looked right

The reasoning behind the change was sound, which is what makes it worth writing up.

The plugin discovered each visitor’s own authorization_endpoint and sent them there. Visitors without one fell back to indieauth.com. That fallback is the part that dates: indieauth.com’s own home page says it “will eventually be replaced,” and points developers at IndieLogin.com.

IndieLogin also promised more providers — Bluesky, GitLab, Codeberg — and one genuinely appealing property. When you discover each visitor’s endpoint, you inherit an obligation from IndieAuth §5.4: if the profile URL the server returns isn’t the one the visitor typed, you must re-discover it and confirm it declares the same authorization endpoint. Skip that, and any authorization endpoint can return any me and be believed — including mine. My plugin was skipping it. Delegating to one trusted service makes that whole class of problem structurally impossible rather than merely fixed.

Good argument. Built on documentation nobody tested.

The part the docs don’t mention

IndieLogin’s API docs describe client_id as informational: “the home page of the application the user is signing in to.” Nothing about registration.

The source says otherwise. In app/Authenticate.php, on the authorize path:

$client = ORM::for_table('clients')->where('client_id', $client_id)->find_one();
if(!$client) {
  $errors[] = 'This client_id is not registered (...)';
}

That table is queried in two places and written in none. Registration happens by opening a GitHub issue asking to be added. There’s a queue of them, requests from April and August this year sit unregistered, and an issue asking for a self-service registration form has been open since 2018.

The ideal would have been a solution to automate client website registration, there is a github issue for it, but to the best of my knowledge it has not been developed.

When Claude first told me this, I didn’t believe it — it sounded like a hallucination. aaronpk advocates for this stuff; the idea he’d maintain a manual allowlist seemed absurd. It restated the claim twice before I pushed hard enough that it stopped arguing and designed a test instead: same endpoint, same parameters, a deliberately-broken redirect_uri on both.

• indiebookclub.biz → “The client_id and redirect_uri must be on the same domain” appears to indicate this site is on the list of allowed clients.
• rmendes.net → “This client_id is not registered” indicate I’m not the list and the opened github issues appear to indicate there is no way to get in without poking the indieweb people on IRC or via email.

A known consumer clears the client check and trips the next rule. Mine never gets that far. That’s not a reading of the source, it’s the live service behaving differently based only on the domain.

None of this is a knock on IndieLogin. It’s free, someone pays to run it, and an anti-abuse step simply never got automated — issue #20 says as much. But “free for anyone to use” and “requires a manual step that isn’t happening” are both true at once, and only the first one is documented.

The actual failure

One curl to /authorize would have caught this before a line of code was written. It never happened. The whole migration — design, implementation, publish, deploy — rested on an API description that was accurate about the protocol and silent about the policy, and nobody poked the real endpoint.

My assumption was, its working like indieauth.com, why would anyone want to maintain a list of allowed clients ???

That’s the AI-assisted failure mode worth naming, and it isn’t “the AI wrote bad code.” The code was fine. The tests passed. The commit message was better than mine usually are. It was confidently, fluently wrong about something it could have checked in ten seconds, and confident fluent output is exactly what stops you asking.

What caught it was me, in an incognito window, doing the thing a user does : testing

Docs describe the protocol. Deployments enforce the policy. Only one of them rejects you.

Back to IndieAuth, but better

We reverted, which restored a working system that still had the §5.4 hole. So the rest of the day went on fixing that properly instead of delegating around it.

Profile URL verification. When the returned me differs from what was typed, re-discover it and require the same authorization endpoint. An endpoint claiming rmendes.net now gets refused. Failure to re-discover fails closed. Verified against live discovery, not just stubs.

Discovery via microformats instead of pattern matching. The old code matched <link rel="x" href="y"> with a regex. Measured against real markup, it handled one shape out of five:

None of those failed loudly. A missed rel silently routes someone running their own authorization server to the third-party fallback instead — the opposite of what this plugin is for. microformats-parser was already in the dependency tree. It just wasn’t being used, so we started using it !

Server metadata discovery. Servers publishing rel="indieauth-metadata" now get that document preferred over the rels. It’s also the only place an issuer is published, so the iss on the authorization response can finally be checked. The spec mandates simple string comparison there, not URL normalisation — a trailing-slash difference is a mismatch, which is the opposite of what you’d assume. Worth checking before you ship it, as we’d just learned.

Amusingly, this site served a metadata document all along and never advertised it. One <link> in the theme fixed that.

The plugin went from 3 tests to 32, and npm test runs for the first time.

What I’m taking from it

The failed migration was worth more than a clean one would have been. It forced an articulation of why delegating would have been safer, which turned out to be the exact argument for doing the verification properly in-house.

But the durable lesson is about how I work now. An AI can hold more of the IndieAuth spec in its head than I can, write better commit messages than I do, and produce a migration that is coherent, tested, well-documented and completely unshippable — because it never touched the thing it was integrating with.

If you have implemented IndieAuth for commenting on your blog, what was your approach ?

This is actually a cool idea !

In short: it’s a social, RSS-friendly radar for the open web, self-hosted, with magic-link auth, and connected to the fediverse (ActivityPub).

Bernie is right⁠.

If healthcare, decent wages, taxing billionaires and protecting workers are now “radical” or “extreme”, then the current US administration is practicing something much closer to state terror against its own population.

Americans are fed up. The tragedy is that a huge part of that anger was successfully redirected — and many of those who wanted to punish the system ended up voting its most brutal incarnation into the White House.

Github down… 404 on any repo I visit, just another reason I’m going to switch to code.rmendes.net as primary and github as mirror for my own repos.

Moving Orgs repo : that’s beyond my current scope for now

GitHub status page show a day in hell for the engineers working over there

Google Workspace now receives mail for 21.8% of MX-publishing domains and Microsoft 365 for 16.8%. Together that is 38.6% of the measured Internet’s inbound mail behind two companies. Nobody else comes close: the next named provider, Proofpoint, sits at 1.9%.

Source

Quite happy with the way Plume evolved in just a few weeks !

(to use this, you need a blog that support Micropub)

White House authorizes private companies to launch ‘hack-back’ cyberattacks that destroy data and systems, targeting foreign cybercrime organizations — vetted organizations can now conduct offensive cyber operations | Tom’s Hardware

https://share.google/vkx5E0RRVXU2Mwi42

What could go wrong?

Damn… There isn’t one single actively developed IndieWeb/Micropub mobile app on the Android playstore. Even IndiePass has been discontinued. I don’t want to start from scratch but I’m considering if I should do something about it. I’m fine publishing on mobile using my browser but IndiePass was quite handy and better integration with Android Share to targets.

Test post without Syndication

I think my #Indiekit fork might be one of the very few setups where this happens:

You post from Phanpy or Moshidon — regular Mastodon clients, no Micropub support at all.

My custom Fedify AP answers the Mastodon client API, turns that request into a Micropub post, writes it to my own site as Markdown, and then federates it as #ActivityPub.

My blog via that same plug-in answers the Mastodon API.

So Phanpy and Moshidon think they’re talking to a Mastodon server.

They’re not. They’re writing Micropub.

The flow is : Mastodon client → Mastodon-compatible API → Micropub → Markdown file on my own site → ActivityStreams 2.0 → delivered to followers.

Same for edits: editing from Phanpy issues a Micropub replace, then broadcasts an Update(Note).

Plenty of projects do “native post → AP representation” (WordPress, Micro.blog).

What I haven’t seen elsewhere is the extra hop: a non-Micropub client producing a Micropub post without knowing it.

It’s been a fun coding summer 🌞😎

They are killing Hyperlinks

Had fun coding a small python script for weechat that relay mentions of my handle to my self hosted private ntfy sever allowing me to get IRC notifications while on the go, the notification carries the actual message of the user on IRC so I can quickly check if it needs a reply or not.

Yes very useless and fun 😅

Testing Plume from Firefox, now you can see the steps indieauth take against your site for the initial connection, there is also a welcome tab for onboarding (Inspired by Omnibear)

Improved Plume onboarding and fixed a few bugs https://rmdes.github.io/plume/ #micropub and just after publishing this new version, I found a new bug, there should be 1.5.1 very soon !!!

Test post from Omnibear #micropub extension

I’m refactoring my AP implementation first so that I can properly build C2S later on, for now I’ll keep the API layer, since it already covers a lot of ground but the refactoring will allow me to have a more robust implementation and I’m finding this https://www.stevebate.net/activitypub-client-api-a-way-forward/#flowz very inspiring

It really sucks to have a properly configured email server, running on your own domain — thanks, Cloudron — only to have Google, Microsoft, and the other giants systematically dump your messages into spam anyway.

And yet I now find myself sending important emails twice, or using another provider, just to make sure they actually reach the person on the other side.

Email was supposed to be an open, decentralized protocol. Instead, a handful of monopolies have effectively privatized deliverability: they decide whose mail is trustworthy, whose isn’t, and independent servers are guilty until proven innocent.

#Enshittification at scale: privatize the commons, segment it, then slowly make the open alternative unusable for everyone else.

Mark Zuckerberg’s manifesto rests on a single elegant idea: safety comes from distributing power so no one actor can impose their will.

It’s a fine principle. It’s also the exact opposite of how he has run everything he has ever touched.

Start with the structure of Meta itself. Through dual-class shares, Zuckerberg controls roughly 61% of the voting power of a company he does not majority-own. No board can fire him. No shareholder vote can bind him. He is, by design, the one man on earth who cannot be overruled — and he is lecturing the rest of us on the dangers of concentrated control.

The “independent oversight board” he now dangles is offered by someone who dissolved Facebook’s own Civic Integrity team right after the 2020 election. We have seen what his oversight is worth when the cameras move on.

Then measure the values against the receipts — and not just on AI.

• He says superintelligence must protect your privacy. In 2019 he stood on a stage and announced “the future is private.” That same business paid a $5 billion FTC fine for deceiving users about who could access their data, and today Meta’s AI chats aren’t end-to-end encrypted and are mined to target ads. The pledge is identical. So is the gap between the pledge and the practice.

• He says AI must reflect human values. In Myanmar, Amnesty International documented that Facebook’s own algorithms proactively amplified the hatred that fueled the ethnic cleansing of the Rohingya — and Meta has refused to pay reparations. In January 2025, he ended US fact-checking, rewrote the rules to permit users to call LGBTQ people “mentally ill,” scrapped DEI, and installed a Trump ally on his board — timed precisely to a change in political weather. These are not the choices of a man guided by values. They are the choices of a man reading the room and calling it principle.

• He says AI will create more employment, not less. He said this while cutting ~600 AI roles in October 2025 and 8,000 jobs in May 2026. He preached openness for years, quietly went closed in 2025, and has now reopened — not from conviction, but because the manifesto needed a proof point. Ask the Metaverse how his grand, world-remaking visions tend to end.

• This is the deeper problem. When Zuckerberg speaks about “human values” and “personal empowerment,” he is not describing humanity — he is describing the only life he knows: total control, zero consequences, every failure absorbed and rebranded as vision. “The future is for everyone” is a definition of everyone written by a man who has never once had to live as one of them. It is not a vision of the world. It is the view from inside the bubble, mistaken for the view of the world.

The safest thing you can do with a manifesto about not trusting concentrated power is to remember who wrote it, and how much of it he holds.

C’est horrible à dire, mais peut-être que lorsque nous en aurons assez de voir la nature et nos maisons partir en fumée, nous prêterons davantage attention aux rapports « alarmistes » du GIEC — qui, au fond, n’avaient rien d’alarmiste.

Mais surtout, peut-être mettrons-nous enfin la question du dérèglement climatique au-dessus du « wokisme » et autres sottises. Car une chose est certaine : notre avenir sera marqué par les migrations climatiques — des êtres humains fuyant la sécheresse, les déserts agricoles, les inondations et autres phénomènes extrêmes.

Le plus probable, malheureusement, est que l’extrême droite instrumentalise la question climatique pour faire avancer ses projets antimigratoires, transformant encore davantage l’Europe en une forteresse entourée d’épaves humaines : des personnes qui cherchent simplement une vie meilleure, là où celle-ci est encore possible.

A health check that reports “healthy” is not the same claim as “this loop is still running.” I spent a chunk of today’s session learning that distinction the hard way, on a bot whose only job is to relay earthquake alerts to Bluesky.

The setup: a queue drain loop calls health.updateActivity() once at the top of every tick, before it checks whether there’s anything to post.

If the queue is empty, it returns immediately after that call — fine, activity stays fresh. But if a post is in flight, a re-entrancy guard (if (queueRunning) return) sits before that activity call on every subsequent tick.

So a post that hangs doesn’t just delay one tick — it silently stops the timestamp from ever updating again, while the health endpoint keeps reporting healthy right up until its own staleness threshold (10 minutes) is crossed.

I caught it by taking two /health readings 42 seconds apart and noticing lastActivity hadn’t moved at all — not slow, frozen.

Confirmed the mechanism by correlating a dedup file’s mtime with the exact freeze-and-recover window: a post to the Bluesky API had started, then sat there for ten minutes before some unrelated default finally aborted it.

The actual bug was almost embarrassingly small: bskyHandler.ts and its fleet-mode equivalent both constructed the Bluesky API client with no request timeout at all.

The RSS-fetching side of the same codebase already wrapped its fetches in one. Nobody had ported the pattern to the half that talks to Bluesky.

Fix was an AbortController wrapped around the client’s fetch, 30 seconds, done.

Damn, stumbled on a black hole of the past, really sorry to all the blogs that interacted with mine circa 2016 and that I never replied to, I was in a huge Justice battle IRL and my site at the time was not giving me as much control and view over what’s happening than it is today, some of these replies I’m seeing now for the first time.

There is also quite a few dead links that I never managed to recover from my server crash from around those years

Thanks for sharing RSC ! There is still a lot of work before I start to really enjoy using it as I envision but its been really fun to develop :)

Cross-browser Micropub client extension. Post to your IndieWeb blog from any page.

rmdes.github.io/plume/ - now with Draft support, right in your browser of choice !

I need to fix duplicate webmentions

• 1 is coming from legit webmention
• 2 is coming from fed.brid.gy

I need to think about how to fix this

really glad to hear that :)

Test from Chromium based browser, Plume Micropub extension

Testing Plume from Firefox

I have looked at your Micropub plugin and then debugged the issues with claude and I think I found the problem, nothing to do on your side, it was really a bug on my side : https://github.com/rmdes/plume/releases I submitted version 1.3.1 to the extension stores, both should be available soon, you can always “developer” load it via the github release page if you don’t want to wait, let me know how it goes :)

Do you have access to your Kirby server logs ? would be interesting to check what’s the error precisely, have you looked at the dev console log when you attempt to add your site to the extension settings ? this would allow to gather a bit more information I suppose, another way would be to create a user for me, so that I can connect using it and launch mcp playwright debug in the process to understand what’s happening

inspiring…

Cool idea !

Great work by the cloudron team as usual !

Major Update : a configurable RSS poster for #Bluesky - that supports multi accounts - in active development https://github.com/rmdes/bsky.rss

China isn’t simply a regime with a centrally planned technological machine.

It’s something stranger: a strategically directed state sitting on top of an extremely competitive manufacturing ecosystem.

China’s long-term strategy increasingly resembles ecosystem substitution:

Foreign technological ecosystem becomes a vulnerability → create an alternative ecosystem.

Replacing Microsoft Office with a Russian office suite is import substitution.

Creating an operating-system ecosystem, CPU architecture, compiler toolchain, domestic cloud stack, hardware supply chain, developer community and application ecosystem is technological sovereignty.

China is attempting the latter.

@srijan.ch@fed.brid.gy how’s your micropub endpoint?

Does your blog support micropub?

Hmm this is odd, do you have any information to help me debug this ?

Test post from Plume, micropub extension for Firefox/Chromium derived browsers

Wishing there was a fully supported ATgeo lexicon that most bluesky app views could understand…it would allow us to build location aware posts from location data (think disasters, quakes, flood etc)

Sometimes I’m wondering, what would be the cost of stopping supporting the Mastodon API layer and instead work towards proper implementation of client to servers opening the route for a universal mobile app for #fedify based AP implementation.

For indiekit I used Fedify to bring this very blog into the fediverse but then I wanted to be able to use Phanpy and other mobile app so I built a compatibility api layer that these mobile apps expect to find allowing me to use my own site with any Mastodon mobile app. It works but it’s buggy and I’m subject to API layers change and other future breakage I don’t want to deal with in the long run.

So now I’m wondering, do I drop this API layer and build a universal client?

People comes in all shapes and sizes but writing code into OPML outlines to then “generate” code files for a git repository is one that I will never understand.

No matter how much time I put into it.

It’s like using I a Word document to write Javascript or typescript?

The results is a OPML file literally containing Javascript code, each outline being a block of code.

When changes are made and saved it changes the timestamp of the outline publish time, so any diff against the OPML is full of noise, it’s literally the worst dev environment I have seen in my life.

There is certainly a historical reason for this that evade my grasp but imagine, having a dozen intertwined code projects ALL developed in such a way.

Good luck contributing or sending a PR to repository like that. It’s literally the perfect way to make sure collaboration is impossible.

Just migrated bsky.rss from feedsub to feedsmith, now bsky.rss support RSS, Atom, Jsonfeed, RDF and soon GeoRSS too, I’ll do another round of improvements so that it would be easier to parse and render weather Feeds but that’s for later. Feedsmith has a bunch of other RSS extensions that I want to integrate, for example better source/author attribution, something I always wanted to bring for the RSS feeds that properly use these properties.🔗 https://rmendes.net/notes/2026/08/07/678e3

Related to my previous posts : https://standard-reader.app very interesting read here

There is so much happening on the #ATproto Atmosphere that its hard to keep up, I’m not talking about Bluesky the company, I’m talking about this or this or this its really a never-ending exploration no matter where this is going, this being decentralization and building on top of the protocol, it’s good for the web.

Plume A browser extension to Post to your IndieWeb blog from any page — toolbar composer or right-click capture. Cross-browser, multi-account, no telemetry.

The White House Is Feeding Russia’s Information War Against Europe

How the Ceuta migrant crisis exposed a transatlantic propaganda pipeline flowing from the White House.

https://weaponizedspaces.substack.com/p/the-white-house-is-feeding-russias

Interesting read.