Publ 0.5.8, Authl 0.3.1, and IndieAuth security

So, both Publ and Authl had a pretty naïve issue with the identity verification step of the IndieAuth flow; it simply accepted whatever the authorization endpoint said the user’s identity was. This made it very simple to spoof one’s identity and log in as anyone on any Publ or Authl site.

Authl 0.3.1 fixes the problem with the IndieAuth login flow, and Publ 0.5.8 fixes the problem with the Bearer token flow.

webmention.js security update

So hey, if you’ve been using webmention.js you should probably update it, as there turned out to be an XSS issue found by Checkmention. Better to be safe than sorry etc. etc.

Reblob!

It’s been a while since I’ve worked on IndieWeb stuff, but I finally got around to releasing an extremely preliminary version of reblob, a little commandline thingus to make this stuff easier. Eventually I’ll also have a server-based version here, at least as an example.

Pushl v0.2.4, now with a proper user-agent

While trying to figure out some weird access patterns on the day-job site I had the realization Pushl wasn’t actually specifying a user-agent, so it was just coming through as the generic aiohttp one, which isn’t very friendly.

Now it sends a reasonable user-agent by default, and this can be overridden by the --user-agent flag if you want to for your own analytics or whatever.

Oh, and I had quietly released 0.2.3 a few days ago; there were just some minor internal changes to logging and also declaring Pushl as beta, rather than alpha, software.

Pushl 0.2.2

I’ve done a bunch more work on Pushl to try to get it more stable. In particular, I’ve made it so that it will only recurse into feeds that are on domains that were declared in the initial requests, and I seem to have cleared up some cases which were causing it to hang and also added a global timeout which will, hopefully, prevent it from hanging indefinitely.

I do wish I could figure out what is causing the hangs when they do happen though. Oh well. Some discussion of the issue below the cut.

Pushl v0.2.1 released

I’ve been working on getting Pushl much more stable and reliable, particularly around a persistent “too many open files” error I was having, which turned out to be primarily due to a fd leak in the caching routines. Oops.

Anyway, there’s also seemingly a problem with how aiohttp manages its connection pool, at least on macOS, so I’ve disabled connection keep-alive by default. However, if you still want to use keep-alive, there’s now a --keepalive option to allow you to do that. I’m finding that it doesn’t really improve performance all that much anyway.

This is feeling beta-ready but I’ll give it a few days for other issues to shake out first.

Pushl v0.2.0 released

So, I just released v0.2.0 of Pushl. It was a pretty big change, in that I pretty much rewrote all the networking stuff, and fixed some pretty ridiculous bugs with the caching implementation as well.

The main thing is now it’s using async I/O instead of thread-per-connection, so it’s way more efficient and also times out correctly.

And oh gosh, I had so many tiny but critical errors in the way caching was implemented – no wonder it kept on acting as if there was no cached state. Yeesh.

Anyway, I’ll let this run on my site for a few days and if I like what I see I’ll upgrade it to beta status on PyPI.

An early-alpha Movable Type importer

For those folks who want to import their content from Movable Type over to Publ, I’ve finally gotten around to writing an importer. Currently it only attempts to convert entry content and category metadata, and only using SQLite-formatted database dumps.

See its README.md for the (incredibly rough) usage instructions.

Eventually I want to try to automatically convert templates from MT’s scripting language to Jinja-Publ templates, although there’s a bunch of stuff that’s going to be difficult to port across and a lot of stuff is just plain not feasible to even try, so don’t expect that to become a major thing any time soon.

Pushl v0.1.7

I ended up doing some more work on Pushl and have now released v0.1.7. The major changes:

• Did a bunch of refactoring to make the code a little cleaner and handle configuration more appropriately
• Added a configurable timeout for connections (which now defaults to 15)
• Added a --version option on the command line arguments

Also, some suggested usage ideas below the cut!

Pushl v0.1.6 released

It’s been a while since I’ve updated Pushl but today I released v0.1.6. It includes the following fixes:

• Now it supports Pingback as well as Webmention
• Improved the threading defaults and connection pooling
• Also checks entries for updates even if the feed didn’t change (in case something changed in the more text or page metadata or whatever)

Anyway, it should just be a pip install --upgrade pushl (or pipenv update) away.

Pushl v0.1.5

While I’m fixing random stuff in Publ, I figured I’d finally fix some problems with Pushl too. Nothing major here, just:

• Stability: Fixed a bug where feeds that don’t declare links caused the worker to die before entries got processed
• Performance: Now we use a global connection pool (so connections can be reused)
• Fixed a minor correctness issue with archive feeds (which actually doesn’t make any difference in the real world but whatever)

Embedding webmention.io pings on your site

Are you using webmention.io as your webmention endpoint? Want to get your incoming webmentions displayed on your website?

Well you’re in luck, I wrote a simple-ish script for that. (You’ll probably also want to see the accompanying stylesheet too.) And it doesn’t even require that you use Publ – it should work with any CMS, static or dynamic. The only requirement is that you use either webmention.io or something that has a similar enough retrieval API.

I wrote more about it on my blog, where you can also see it in use. For now, I’m just going to use the sample site repository to manage it (and issues against it).

It’s MIT-licensed, so feel free to use it wherever and however you want and to modify it for your needs. I might improve it down the road but for now it’s mostly just a quick itch-scratching hack that does things the way I want it to.

Pushl v0.1.3, and a FeedOnFeeds update!

I just released Pushl v0.1.3, which adds some minor performance optimizations and a bug fix.

Originally I was hoping to have a major performance optimization, in the form of having rewritten Pushl from thread-per-connection to async operation, but unfortunately I ran into a bunch of problems with it. Mostly that I was running into a “too many open files” error and I couldn’t figure out what was causing a descriptor leak. I have the work-in-progress branch online if anyone wants to take a look at it.

Anyway, the reason I went down this route is because I added WebSub subscriber support to my fork of Feed-On-Feeds, which makes it so that WebSub-enabled RSS and Atom feeds will push their updates to your reader instead of having to wait for a polling interval.

You can read more about some of my other thoughts on a blog entry that quickly devolves into a rant, if you’re so inclined.

Pushl 0.1.0 released

I’ve gotten Pushl to the point that I’m confident in releasing it as a full alpha and having a cron job run it every 15 minutes. Whew.

I’ve also added some h-entry markup to the Publ site templates so that hopefully the notifications appear at least somewhat reasonably elsewhere.

I really need to redo these site templates now that I have a better idea of how they go together. Also the quickstart guide could be a lot better.

Pushl 0.0.1 released

I finally got around to releasing a very rough prototype of Pushl to pypi. It only sends out WebSub notifications for now (does anyone even use those?), but I’ll work on actually implementing WebMention soon.

Also, recently someone pointed out to me fed.brid.gy which makes it easy to turn a static site into an ActivityPub source. At some point I’ll experiment with setting up Publ for this; it looks like it’s just a matter of adding a couple of additional route rules to Publ, so that will probably go into an advanced configuration guide if I ever get around to making such a thing. (Or it could actually be added to Publ directly but there isn’t much of a reason for that, IMO.)