[HN Gopher] Webmention (2017)
___________________________________________________________________
Webmention (2017)
Author : tosh
Score : 57 points
Date : 2022-12-11 09:38 UTC (13 hours ago)
(HTM) web link (www.w3.org)
(TXT) w3m dump (www.w3.org)
| stoicjumbotron wrote:
| Probably the only implementation which I've seen in the wild is
| that of swyx's[0]. Example blog post: https://www.swyx.io/js-
| third-age
|
| Scroll down to the bottom and you'll see it
|
| [0] https://www.swyx.io
| qubyte wrote:
| My personal static site has a custom implementation of dispatch
| and receipt of Webmentions using netlify functions. I'm sure
| there are many more folk quietly coming up with their own ways
| to do it as well.
| mananaysiempre wrote:
| I don't know if one-off custom implementations count, but the
| blog of Xe Iaso (Christine Dodrill) speaks WebMention as
| well[1].
|
| [1] https://xeiaso.net/blog/webmention-support-2020-12-02
| arboles wrote:
| A blog I read also uses Webmentions. This article is swimming
| in them: https://seirdy.one/posts/2020/11/23/website-best-
| practices/#...
| input_sh wrote:
| A lot of examples here:
| https://indieweb.org/Webmention#IndieWeb_Examples
| BaseballPhysics wrote:
| There's plenty more besides. My own static blog supports
| webmentions thanks to webmention.io, which is used by numerous
| other blogs. Brid.gy also uses it to trucker syndication and
| backfeed of comments from various silos.
| [deleted]
| hadrien01 wrote:
| (2017)
| nathias wrote:
| I find it weird that webmentions are on hn very often, and noone
| is implementing it.
| ptcrash wrote:
| I'd argue it's because the risk is not worth the reward.
| Pingback and Trackback is used to send a monsoon of spam and
| I'd wager site maintainers are not too keen on enabling the new
| version of an old problem.
| soapdog wrote:
| I am using it on my website. It is great and makes it so much
| more fun to blog. I really recommend implementing it.
| jwilk wrote:
| What do you mean by "using"?
| azangru wrote:
| He probably means this (bottom of the page):
| https://andregarzia.com/2022/05/On-rants-about-laptops-
| for-d...
| soapdog wrote:
| Exactly that. I use WebMentions to gather information about
| people sharing each blog post and also for comments. If you
| want to comment on the site you can simply send a
| WebMention. For example, sites such as Lobste.rs do that so
| every time a post ends up there, the comments on the thread
| appear on the site. The same happens on Twitter and
| Mastodon. It is very neat.
| epeus wrote:
| More useful information at https://indieweb.org/Webmention-faq
| ptcrash wrote:
| I've read through the spec along with the FAQ that epeus so
| graciously shared here. The idea of mentioning beyond the scope
| of one website's walled garden seems like a very natural
| progression of ActivityPub and the new-found hype surrounding
| Mastodon. My concern is that I haven't seen much thought into the
| security implications.
|
| The spec makes it clear that they're trying to simplify pingbacks
| but they don't address the fundamental security problems with
| pingbacks in the first place. And anyone who's maintained a
| Wordpress site will tell you, the first thing you do is turn off
| the Trackback and Pingback features [1] because not only does it
| attract the scummiest deluge of spam [2] but they've also been
| useful for disclosing internal network info and [3] leveraged to
| target other websites in DDoS attacks. [4]
|
| The only thought given to preventing abuse is as follows from
| Section 4.1:
|
| >The verification process SHOULD be queued and processed
| asynchronously to prevent DoS attacks per section 3.2.
|
| >Receivers MUST verify Webmentions per section 3.2.2.
|
| The first directive isn't a guarantee a DoS attack won't block
| all IO, it just means don't make it trivial to bring a site down
| with webmentions. The second directive sounds nice but if you
| read through section 3.2.2 of the recommendation, it just
| mandates that you should validate the application data that's
| submitted. [5] There's no mechanism to authenticate messages,
| validate the sender, nor limit mentions to a set of trusted
| parties.
|
| Am I missing something or is this recommendation just splitting
| the pingback feature from the XML-RPC protocol? In my opinion,
| that's not providing a lot of value because the feature is still
| so very easy to abuse.
|
| [1] https://www.wpbeginner.com/beginners-guide/what-why-and-
| how-...
|
| [2] https://blog.hubspot.com/website/trackback-spam
|
| [3] https://www.acunetix.com/vulnerabilities/web/wordpress-
| pingb...
|
| [4] https://www.trustwave.com/en-
| us/resources/blogs/spiderlabs-b...
|
| [5] https://www.w3.org/TR/webmention/#h-webmention-verification
| CharlesW wrote:
| > _My concern is that I haven 't seen much thought into the
| security implications._
|
| You may find this interesting: https://indieweb.org/Vouch
| giantrobot wrote:
| That doesn't do anything to prevent the DDoS problem of
| pingbacks/trackbacks, if anything it makes it worse because
| checking the third party vouch address causes an
| amplification attack. As with most things on the Internet
| spammers and assholes have ruined *back systems.
| z3t4 wrote:
| I guess it's not popular enough to attract spammers, but if there
| is an automatic way to put a link on someone else's page it will
| be abused.
|
| There's however Vouch (https://indieweb.org/Vouch)
___________________________________________________________________
(page generated 2022-12-11 23:02 UTC)