Menu ⇓
  4. ↪ Dan York: Questions About Known (@withknown) Platform, Webmentions and security / spam

    Webmention spam has already started to become a problem, especially thanks to Brid.gy’s backfeeding of twitter comments. For most of us it hasn’t yet been a big problem, but it inevitably will be in the future. There’s some ideas about potential spam prevention tools on the wiki: indiewebcamp.com/spam

  11. ↪ Kevin Marks: pondering webmentions of people with Aaron - it is tricky without a reader - should saying http://kevinmarks.com ping me?

    @kevinmarks depends if you want it to! I’d say yes, it’s analogous to a non-reply @mention on twitter. And whilst a reader w/ mentions feed+notifications is a good UI for consuming that data, you can have it on your own site too, e.g. aaronparecki.com/mentions, and even poll+post native OS notifications e.g.

    https://www.youtube.com/watch?v=CYyNexN1qPA

  15. ↪ Marcus Povey: Spying on a website using Webmention and MF2

    @mapkyca good point, I hadn’t considered this problem with hotlinking profile photos before. I think some webmention implementors have started doing this, and I intend to do it within Shrewdness.

    It’s worth noting that the attack is not at all limited to profile photos though, rather any photo or otherwise automatically loaded content in the comment e.g. images or audio. Whilst caching profile photos is feasible, caching any media in comments is more difficult, and therefore a good reason for text-only comments.

    Text-only content is not an option in Shrewdness, but perhaps instead images could be cached, and other media loaded upon demand, removing the ability to arbitrarily spy on people.