2014/Cambridge/vouch

This article is a stub. You can help the IndieWeb wiki by expanding it with relevant information.

Vouch extension to webmention was a session at IndieWebCamp Cambridge 2014.

Watch: ▶️ 01:03:07s

Notes

This section is a stub. You can help the IndieWeb wiki by expanding it.

The etherpad for this session was https://etherpad.mozilla.org/indiewebcamp-vouch, but unfortunately the notes were not archived before that site died.

Actions to expand:

If you participated and have any archived notes, please add them to this section!
If you watch the video, please add a summary of Participants (by visual or voice cues)

Summary

This summary was generated by Gemini from the transcript of the video

This session focuses on Vouch, a proposed anti-spam extension for the Webmention protocol. The conversation outlines how Vouch can create a decentralized, social-network-based filter to protect websites from automated spam attacks without relying on centralized blacklists.

The Core Problem

Like its predecessor Pingback, Webmention is vulnerable to spam. While standard Webmention verification ensures that a source page links to a target page, spammers can easily automate the creation of pages that fulfill this requirement. This forces site owners to implement coarse filters, such as rigid whitelists or hidden heuristics, which often block legitimate comments from new or unknown creators.

The Vouch Protocol

Vouch introduces a distributed approval mechanism that leverages existing social connections across independent websites.

The Flow

Initial Webmention: Sender (A) sends a standard Webmention to Receiver (B).

The Challenge: If B does not recognize or pre-approve A through their own internal "approval algorithm" (e.g., an internal list of sites B has previously linked to), B rejects the request with an HTTP 449 Retry With status code, indicating that a vouch is required.

The Retried Webmention: A searches for a mutual connection—a third-party site (C) that B trusts and that also links to A. A sends the Webmention again, this time appending a vouch parameter containing the URL of C.

Verification: B performs two rapid, low-cost checks:

Does B approve of the vouching domain (C)?
Does the page at C actually link to A's domain?

Acceptance: If both conditions pass, the Webmention is accepted. Once a relationship is established, A is added to B's local whitelist, meaning subsequent webmentions do not require a vouch.

Criteria for a Valid Vouch

For a vouching URL (C) to pass verification, it must meet specific conditions:

Domain-level verification: The vouching page must link directly to the sender’s domain.

No "nofollow" attributes: The link from C to A must not contain rel="nofollow". If a site explicitly uses nofollow, it signifies that it does not afford trust to that link, disqualifying it as a vouch.

Design Philosophy and Asymmetry

A core feature of the Vouch protocol is its deliberate asymmetry of cost.

Easy for Receivers: Checking a vouch requires very little computing power or network traffic, allowing the receiver to easily mitigate spam onslaughts.

Hard for Senders: Shifting the burden of proof to the sender makes automated spam economically and technically non-viable. Senders must crawl or index links to find mutual paths of trust.

While finding a vouch presents user interface challenges for senders, participants noted this creates an opportunity for IndieWeb feed readers, CMS tools, or specialized social search crawlers (such as the "Shrewdness" service) to index recent outbound links and automatically suggest valid vouches during the comment drafting process.

Edge Cases & Reputation Management

Silos and Nofollow

Participants raised concerns about large platforms (silos) like Twitter, GitHub, or Wikipedia being exploited as "vouch holes" where spammers could generate fake accounts or spam user profiles to gain a vouch. However, the group concluded that:

Platforms like Twitter apply rel="nofollow" to outbound links by default, natively neutralizing them.

High-traffic ecosystems like Wikipedia or GitHub have active abuse-reporting mechanisms and communities that swiftly delete spam accounts, making them unreliable vectors for automated bot nets.

Receivers can explicitly blacklist specific large domains from acting as valid vouches if they prove problematic.

Trust Expiration and Social Hops

To avoid permanent vulnerability if a previously trusted site gets compromised, several trust-management heuristics were discussed:

Time-Bound Trust: Receivers could query their database to see if they have interacted with or linked to the vouching site recently (e.g., within the last week or month) rather than trusting them indefinitely.

Social Hops: Site owners could track trust proximity by recording "hops" (e.g., accepting a vouch from someone up to 3 degrees away) to dynamically map out a close-knit web of trust.

Implementation & Next Steps

The group agreed that a basic implementation of the receiver-side approval box can be executed immediately without complex coding—such as using a simple server-side grep command to scan a directory of flat files for outbound links.

The session concluded with a plan to manually demonstrate the protocol during the next day's project demos using curl to send the modified Webmention parameters.

Transcript

This section is a stub. You can help the IndieWeb wiki by expanding it.

This transcript was copy/pasted from the YouTube auto-generated captions. You can help improve this page by cleaning this up and/or updating the notes section above.

Maybe they're just figuring we'll, um, we'll figure it out, and then we'll just tell them they'll just implement whatever we figure out so they don't need to actually be here to figure it out. Well, I think the idea is they just get it, wait for it to get to know. Right, the guy was over there.Right. They, yeah, they're in this, um, there is something left. Yeah, I guess I should go closer. So on the video, I think we're live now, by theway, wave to one side. No, it's the whiteboard. Oh, yeah, is that. Hey!That was good. Though, there the ones in front of me, the rest of them got dealt. All right, let's go and get started. I'm going to live code while you describe the, okay, so summary. I'll start with, uh, it's good that we have an Aaron and a Ben. Yeah, she’s not the right ones. No, no, that's okay. Um, sorry, I'm on your name yet. D… d, okay. So, basic web mention. Aaron writes a reply to Ben's, to Ben's A blog post sends a web mention to Ben.

Server Ben checks to make sure that his blog post actually links to him. So the source links the target. Right, it goes and retrieves that part for microformats. It goes, "Okay, looks cool." It returns a result saying, "Okay, I got it," like 200 okay or you have synced sync stuff out. So that's the basic functionality.

One of the reasons I like this is like, this is basically like a web mention turned on its side. Look at the protocol. The logo, if you look at the logo, basically illustrates the process of web mention working. You just turn it sideways. I mean, over there, web mentioning b, boom, boom, boom.

It was not really, yeah. Okay, but that's literally all the number traffic that happens in the course. So that's one of the nice aspects. How does mention work? Look, the logo decodes it. Okay, so Vouch adds one more parameter to that. Okay, this basic source-target protocol is the same as pingback.

The difference in the semantics there is, in fact, exactly identical semantics. The only thing we change is dropping X RPC, so pingback has been spammed; we all know this, and so people don't even bother keeping pingback things open because apparently, spammers are okay with setting up sites that actually do link back to you. So you do your link verification, and the link verification passes. The problem with that is that people tried to address that in lots of ways, like WordPress, kism, and things, and none of this really worked out very well.

Okay, it's only a matter of time before we get spammed. So there's webmention plus valves. The idea is that we're living in this future world where our plain webmentions are getting spammed just like pingbacks get found. Because of that, if you do operate a blog that receives webmentions like Ben does, you have at least done some degree of, say, filtering, or maybe blacklist blocking. Or some heuristic, let's just saythat if Ben starts getting spammed with random anonymous spam, Idon't want to get web mentions from everybody.

My own secret sauce algorithm says I've got a white list of people that I trust, or the people that I like getting comments from. The really easy one is, um, I've got this cache of everyone I've ever linked to my blog. The assumption is, if I've linked to you, it's totally cool if you want tosend a comment my way. But you don't need to tell anyone that that's your trick, whatever it is. Ben has created a black box that is like the, um, uh, like let's just call it your approval box or whatever.

So, the approval algorithm is like a little diamond inside to make it work. And so, Ben is still getting web mentions; some of them are getting through, others are not. No one knows why, except that. And that's fine, but that's a very coarse solution, right? Because only people that he thinks would match that, you know, are able to get through. He also wants to receive comments from people he doesn’t know but are reasonable people that leave comments like I have today. So that’s where we mention Plus.

Vouch comes in, so the assumption is you've already tried to build some sort of simple box, whether it's like here are my top 10 friends, or here's everyone linked to, or whatever jurisdiction that's up to you. Um, that's important because web mention. Vouch actually uses the existence of that as a building block. The way web mention vouch works isum, at the end of this process, you send this. This is I to look at.

So I basically dumped this into IRC, sure. Come recreate if I can't find it. Was HTTP. Yeah, it is an HTTP. Okay, we had an AM conversation with someone. Um, I don't think it was 418, because that's I'm a teapot. Which one's preconditioned? Uh, 412. Okay, sorry, that's the one. Ah, okay, so uh, the way it works is when you, when Ben gets the web mention, the planned web mention source target checks it with hisapproval.

Algorithm rejects it if he supports web mention instead of returning what's the normal area for rejecting of web mention. 400. He returns a 404.

Okay, we got that, that's where we start. So then, if A supports sending a web mention plus vouch with vouch, then A starts this process and hegoes, “Okay, that's cool. You don't know me, but I still have something cool to say to your site, say your blog post. I'm going to send you this time a web mention, not just with the source, um, but also, um, plus the vouch to you. Okay, so now Ben's endpoint was, “Oh, I've got a web mention plus vouch.” Interesting, okay, I'm going to go check this.

Vouch checking a vouch from the receiver consists of two steps. So the first step, uh, a vouch is it—well, let me just say what a vouch is. A vouch is a URL, so Vouch is a URL, let's call it from C, okay? Such that C has a link to A's site. The source, okay? The source's site is correct, like directly, if you load C, you Find a link to a site the same way that when you receive a web mention, when you load the source, you find a link to the target, but matching just the domain.

Correct. Okay, the other thing, the other thing—so that's the trivial check. That's the first thing you check: does this vouch actually link to the source that's claiming to vouch for the second piece? Does Bapproved?

See, so this is a deliberately unspecified, and this is where I'm sayingyou use this box, this black box you came up with. First, in your first little attempt to filter off or fight off spam, it can be super simple. Thereason is that by leaving this undefined, it actually makes it harder to forge these vouches. But the simplest thing that someone sending out could do is basically say, "Hey, I know Ben has linked to—uh, what's a good example? Charlie. I know Bill Ben has linked to Charlie, um, in the past, and Charlie has Linked to me or Charlie is like to Aon. Right, Charlie is like toon.

So Aon goes and finds a URL, a blog post on Charlie's side, see that links directly to Aaron. Like, oh yeah, here's the blog post where Charlie linked to Aon. Okay, great! I'm and then sends that as the vouch. The assumption is that because, uh, Ben has say linked to C or mentioned C or somehow they're friends, like you just know that throughwhatever SL channel that A thinks, okay, if this comment were coming from C, Ben would probably approve it, or he has approved the comments in the past, and then sends that as the Val. Now, Ben tests both these conditions. Again, this isn't public, so he just applies whateveralgorithm he's got. If it's accepted, then it's accepted, then the web mention is accepted.

So one test: C links to a site domain, and two approve. Now you can do these in either order; it doesn't matter. So if you got like a really simple approval algorithm, maybe you do this first. Maybe you go, oh, you know, what, I don't trust that.

Vouch. So, whatever I don't like that — vouch; you know trust doesn’t even have to come into it. Um, but both need to pass, and then the flowcontinues. Um, if you know you’ve already received a mention from that source, that target, you don’t need to do this stuff again, right? So, you can sort of cash Web mention attempts. There’s some assumptionthat you do, that it’s efficient. Uh, and then you just send the response back to whether you approved it or not, and that uses the same result codes as what I mentioned.

Now, the point of this is, this is should be super easy for the receiver totest. So, this is designed for easy implementation for the receiver of avouch, and that’s very deliberate. It puts the cost of finding a vouch and sending a vouch on the sender, and that’s also deliberate. It also makes it ambiguous, which does two things. It makes it really hard to automate. And it makes it really hard to automate. That’s a design feature that SMTP failed at, and pingback failed at, and trackback failed at. All of those The failed approach is that they made it far too easy forsenders and not for the receivers.

Vouch does the opposite. We say we're going to make it easier for the receivers to check, but harder for the senders. How do I find a vouch if I'm someone sending a web mention? Uh, that’s a great opportunity for a reader UI or an IndieWeb-like search engine to say, "Hey, I want to send a comment!" Is there someone to comment to Ben’s blog? What are the links that I’ve linked to? What are the friends that we have in common? Right? That kind of social search kind of thing is almost taken for granted in places like Facebook. So there’s a lot of opportunity for that. I think it's like crawling and indexing links from blogs. Reading, oh, is he? I think so, so he can, like, he can in his reader say, "Hey, show me all the domains." That, um, that Ben has linked

to, he's built software you can do that and in that list you'd be like, "Oh, I know that guy; that guy has linked to me. Okay, great, I'll use that as my vouch URL." So there's some UI challenges for sure to be, uh, addressed here, but I do think that that's an area that we can work on, and based on those kind of social features, um, actually use plus. Once you accept a comment from someone the very first time, now you'redirectly linking to them. So once Ben accepts a comment from Aon, uh, the theory is he's now gone into Ben's approval algorithm and no longer needs to send aage, so it's a one-time challenge to establish a relationship like that. And after that, it should just work. And, like I said, from the receiver end, that should be something you can automate if you keep a cache of every outgoing link from your site, including links in your comments. So links to comments on your posts, thosepermalinks.

One more test; when I said, when I said there's only two tests when youCheck this link, and in fact, we should check this link. You might want to consider checking this on Webmention in general; that this link itself, it must not have a rail of no problem.

And there's a very good reason for this. Let's say Ben writes a blog postand it's like you got to look out for this. It's a good uh, you say, "Spam or Sam," there’s one what's one of cryptography? Well, actually, I don’t want to use for spam. Let’s say you say "spammer." Um, you got to look out for it. It's um it's Eve. Eve, that’s not what we're doing with here. It’s not Eve, it’s usually the villain, but this is, this is a different situation. This is not Eve; this not man. The middle is not drawing. All right, I’m going to either I’m blog post that’s like, "Hey, look out for this spammer, Sam." Or you, Ben, blog post: "Look out for Sam,

spammer. Oh, by the way, also look out for um, Tommy Troll. Uh, Tommy Troll. But now the problem is if you’ve done that, let’s say yourAn automatic food algorithm caches all your upbound links. Then you would be cashing these links — all these people you would approve as vouches potentially. So someone else is like, "Oh yeah, Tom Troll is linked to me! I'm a total awesome critical, you know, kind of poster. Ican just use that vouch." Right? It then forces Ben, when he’s doing those links, to actually add real “no follow” to those links in his post, sothat they cannot act as vouches. Someone can use potentially anydomain as a vouch, right?

Twitter, yeah. So the reason that works, or that doesn’t work, is that Twitter puts real "no follow" on all their upbound links. So you will not find any Twitter links that can vouch for a site; there are none that don’t put “what’s that?” on that. I believe not. And get this: You can have links and comments by anybody on yours, yeah. Is that a problem potentially? You can block them.

Right? I don’t think so. You modify algorithms to say anything at GitHub, on your GitHub.

I’m sure you can block others, but you may not want to. You may still want to have the, you know, the thread in your or something. Is it a problem that, right? So, I guess you just would have to blacklist it, basically, or when you link to GitHub, you link to GitHub with a rel="nofollow," thus indicating you’re not actually affording any trust to them in any fashion.

With a nofollow, I may want the fact that I want to get my GitHub to befollowed. So I think you turn around on the alit side, right, and say, you know, since it’s a public-facing repo and I want the comments from end users, but I don’t necessarily trust that all those folks aren’t necessarily spammers, then GitHub is not going to be a domain that I trust as an adoption domain.

It’s not adopted. Yeah, so then what you would do is you would put GitHub as a blacklist here, but there’s, you know, a number of those, and you may not know them all. So how do you maintain those? So there are two pieces that maybe end of those, but when you’re talking about silos, silos.

All have their own blocking UI. The assumption is a good silo, a decent silo will have a way to block people. It's not about blocking because I actually want comments on when it goes from literally it actually has nothing to do with blocking, because as long as they have any URL anywhere in my domain, because you have to domain, they could not be in my G. Right, that’s true. Right, so it’s more of when you link to places that you know to be silos. You have to be careful to know exactly what you’re linking to. Yeah, so it’s not, and it’s only the places you link to.

Right, if assuming your approval, although some, so that, but that’s a little scary. Because I link to a lot of things with, you know, relativelylittle thought to it because I’m sure I’m just posing all the time, and most of those places are not going to link to spammers. That’s why this works; most of those places kick off spammers very quickly, so spammers are never able to actually use those places of vouch. So that’s a good Wikipedia; let’s use that one as an example. I like good luck is aspammer getting the vouch for.

If you put a spam link up there, it's going to be deleted. Even though it's a totally open thing, if someone uses Wikipedia as a vouch, it seems kind of like, "Oh, it could be anyone." But in reality, um, the goal here is to stop these automated spam attacks. Those automated spammers have no chance against communities like Wikipedia. They just getcleaned up like that. I would argue that the same is true for GitHub, forTwitter, for anyone else where someone can say, "Report abuse. This is a spam account." It usually gets deleted pretty quickly. So there's always like a time delay, though, between like Wikipedia; it’s relatively short. With something else, it may be longer, like Instagram, for example. I think most, when you get into that one, you know, in a short period of time, actually get a comment on your site. If you are automatically saying, "Oh, well, somebody got an approved comment," now they go into my approval opera. Then you’re just open to—yeah, so how do you—I would, yeah, say instead of just storing that, "Oh, I’ve approved thisperson," you store what you approved and actually check that the link is still There, right? Um, you know, or what? Yeah, probably that's a lot of maintenance, or you could say it's

information per, and like still, it like the next day. The other assumption is you've already, like, the comments that get through. I know you have this, you have a mention speed of all your comments. Anyone's comments on anything, as soon as you see like a sketchy comment. I mean, I do this tech on my Instagram. As soon as I see a bad comment, I just go and delete it. If I delete it, that thing is not only, like, not in my approval area; I'm probably adding it to my blocklist, my personalblocklist. If it's there, it doesn't matter, vouch or no vouch, nothing'sgetting through. So that's another simple solution. When you delete acomment, um, like the UI on Instagram is a perfect example. It says delete or delete and block. And if you hit delete and block, that user— the other part of that is you don't have to. Like, once you add something to your approval list, you don't have to add them forever because you could very Easily add them for a week, and then after a week, make you go vouch again. You could, and that way, you don't have to periodically refresh through all of your old posts to check things. You can just force people to vouch for your approval.

You could say, "Have I linked to this person in the last week?" For example, yeah, and that way you just do that query. You don’t need toremove them from any data. That’s just your query: "Have I linked thisperson last week or last month?" Or, Brett in the chat just said, uh, as far as Wikipedia, you can always spam user pages, and those aren't monitored. Do those get followed? I’m pretty sure I do not. It’s a trivialcheck. I wonder if, like, without complicating things, because I guessthis could probably be a part of the approval algorithm. But, at the riskof centralizing something, I could see an opportunity for some area for... so I get to see back uh saying that, you know, ceiling to it.

And maybe then I do a check to see what the reputation of C is against a crowdsourced list of you know so that as people start recording things up or down, you know, and I can set in my system, you know, II'll trust anybody. Like if I get a comment back from C or I get a vouch back that says C did it, I'll do it. But maybe I say, uh, n equals five. Like I need that person to at least have been verified by five other people as, "Yeah, no problem that um, you know." Now obviously that starts totalk about some sort of centralized

blacklist that, so Giz tried that. Yeah, and it didn't, it hasn't worked. Like WordPress is still talking about turning off HBS. I like the idea of just like having, I probably post my own blacklist and have it only friends can view it. Yeah, you can share your block list. Yeah, shareyour block list. You can do that too, but if you just have a private block list, be like, "This person is just being abusive. I don't want to see comments from them." Then they don't even pass any of this, right? Or you can add things.

There are vouch holes where it turns out someone opens up a domainwhere someone's able to comment anything on GitHub or something, and you say, "You know what, GitHub's a vouch. I'm just not going to include that in my block list, and keep in mind I'm talking about theblacklist idea as after the vouch has happened. That's right, so this isn't in replacement of the vouch method; it's after the vouch has happened, what's the reputation of the person that's vouching for the comment? So the goal here is that people will likely use Indie Web domains because they're posting like Indie to Indie, and there's this almostsocial aspect of like, uh, I base vouch on the social construct of someone throwing a house party and just telling their friends that they're invited. Like, they just send out one message to their friends, like a dozen friends or so, and you're like, "All right, you guys are all invited." You can also, um, invite your friends; you don't have to see who they know. You just let them know they can invite their friends. Now, the party comes along, um, you know, some of your friends show up and then random A person shows up and you're like, "Who are you?" So that's basically the preconditioned requirement: "Who are you?" How do I know you? And they're like, "Oh, I'm friends with so-and-so that you

invited." That's a vouch, and then you're like, "Oh, I know so- and so." Pass this test: "Hey, so-and-so, your friend A is here." "Oh yeah, that's my friend A from whatever, whatever, whatever." This test has passed. So based on that, but you know, if you're like, if you tell them that andthey don't— they don't tell you how you know them, or they're like, "I'mfriends with so-and-so." And you're like, "I have no idea who that is," you're like, "I'm sorry, I don't know you," and they don't know you, goodbye. Or if they say, "I know you from, uh, Wikipedia," or I know you from the JavaScript meetup, and you're like, "I don't really remember you from the JavaScript meetup. That's kind of like the vouch, theGitHub kind of scenario, where you're like, "That's not a person, that's a— you know, it's a community kind of thing." But I think part of the point that Aon was getting at is, um, Sometimes it's not enough to just know another. Like, oh, I know that person; that's great! How do you know? And you say, "Oh God, we got into this huge argument." Like, we were going back and forth on a post, and a total jackass in this system, they're approved because you see, there was a relationship there, but it may not necessarily be just by virtue of simply knowing someone.

It doesn't necessarily mean that person would vouch for linking to them, right? So that's my point: if you're linking to someone particularly disagreeable, you probably should be looking—yeah, any general practice; general practice, and this is how you basically—yeah, this essentially opens the floodgates for like, yeah, if you're linking to someone, you're kind of saying it's okay for them to comment. That's thebasic assertion I'm placing. And not only that, you're just saying it's okay for them to comment on the people that trust you. I kind of like the idea; I might actually do that, as, um, like keep a record of how many hops away they start pass. Like, okay, I'm friends with Aaron,and you know Brett; that's two hops away, and I'll record him in myWeight list, but say, "Yeah, I know him only through other people." Sure, you know, and you know, maybe five hops away. No, no more.

You know, so you can kind of keep it to a close, say, most people, you know, or even would comment on your blog post only at most three hops.

I think that’s partially what's going to happen here. What's going on, and the spammers are going to be like in hops away. So, um, this is so this is a lot of discussion about the verification, or the creation, or finding the URL, or like the approval method that you use. What is the simplest thing that I can do to verify vouch sheets right now? This box, so like what do I need to do to do that before besides the fact that it requires somebody else to go and create an option.

I just want to do something quick to verify that. That's something I can do without anybody else to do anything. So, the simplest implementation of this box is if you have a way in your CMS to say, "Have I ever linked to this person?" That full stop, okay? So, so, I can make a I can go and post final outbound links, right? If you have that already. Well, if you don’t have that already, then Another simple example is that most people don’t, most people have storage, you know, storage of their posts with the links in it in some form, one database for you. It’s like one database, right? Uh, it’s not going to be a database; it's in a database, and I don’t have a database in my content. I have files.

Okay, I can actually grab my files right far. Um, actually, I totally do that. That would not going to be fast, I think. Brainstorming for, you know, different ways of quickly having approval algorithms is good, or you could even do something really simple, like check your homepage. I know that’s kind of minimal, but you link to a lot of people on your homepage if you have a lot of blog posts, your recent posts, your recentnotes. Um, I don’t show my blog post my where I think that’s where the caching comes in, right? Like the first time that webmention may not be immediate, and that’s okay for it to be queued up until that query has completed. Uh, but then once that query is completed...

Good to go, it's in its own tail, you know. That's you're not having to route through your entire site to find links. You have a white list of people that you're like, "Well, that person was approved." And if you need to ever go back in for some reason, if something got in that you didn't mean to, you know, your CS would take that link out of it. Um And resolve the ISS.

But okay, so let's say, let's say I do some really simple approval algorithm, probably using GR, since I can do that today without writing any code. Okay, that's the idea: what can you do today without writing any code? Write that framing down. That's a good algorithm. What can youdo today without writing any more code? Um, that's a good first step. So yeah, I can write a GR command that will find in the main in all my lists. Um, then what do I have to do?

So then, you should immediately start applying that. The idea is that you apply that to every web mention that comes in. Every web mention that comes in checks, "Have I linked their? If so, approve; if not, reject."So sorry, I came late, but is the A precondition for this is the same sort of approval; you know, proving that you were connected to yourself. That one had to do to register for this conference because obviously, I can just, you know, when I’m spamming, I can list my domain as anything.

Some spammers do that; like, there has to be somebody who links to it. That’s the hard thing. All right, no, but I mean, I could claim that I’m coming from, you know, Microsoft, or I could claim I’m coming from,you know, Indie Web.

The test—okay, you don’t even get there because that post doesn’t evenlink to it. The target doesn’t even get past the first web mention test. Plain web mentions today, no. But do I have to prove I have any kind of control over the thing I’m claiming to be linking from? That’s what you actually don’t have control. Yeah, the vouch, no. So we went over web mention first. Do you know how that works?

Um, yeah, I think so. I mean, all right, so this—okay, so this is preventing spam in the web mentions as well as for comments. Okay, well, web mentions do comments already.

Works today, the idea here is that it's going to get spam. We know that that's coming, and so inevitably everyone's going to end up building a really simple quick and dirty approval algorithm to at least let some links through. It's not perfect. Vouch is a call that builds on that, and it lets you use sort of the social aspect of the web and people linking to each other as a distributed filter, as it were, or distributed sort ofapproval mechanism. Okay, so step one is sending HB port or not. Yeah, step one is you make an approval algorithm, even if it's just like is your URL one of these 10? Sure, yeah, we can just white-list everybody in this room right now. That's right, whatever that is in that box. Step

two is to add that to your webmention code as one of the tests. Not just that Source links the target, but Source passes your approval algorithm. And if it doesn't pass the approval algorithm, you return 412. That 412, how much you guys like familiar with HTP details? So, I picked that because the air conditioning is um A precondition is required, or a precondition is missing. The missing precondition is the vouch parameter. You're basically saying, "Hey, from you, I will not accept a web mention; that target, I will accept web mention that has a source plus vouch. Does anything in the body indicate this is a vouch that's required? That's good, or is just mention enough to indicate?

I think that's enough. I'm going to say that; yeah, and if something else comes along, we can add something to the body or whatever. So we have an acceptance. So step three is then, when it comes in with avouch, then you do two checks. But the assumption is either you have this check already cached, so you've already done the source targetcheck. If you've done the source target check, you don't need to do it. Let's assume you haven't, because adding caching is okay. So then you check it again, or you do these checks first. So it's also possible to do the source target check last. Always, right? That's still the way of doing it. It doesn't matter what order you do it in, because it has the same effect. So basically, check web Engine, like normal, then verify the operation. So, what is the verification of the two steps?

I think what 412 means is, what are the preconditions of the clientspecified for the server to respond to? This or a precondition is missing, posed by the client. The precondition given one field needs to respond to the current expectation. So, it's meant for the client to use the Accept header, if it matches any but, except, or yeah, if it matches caching things. Right? Oh, yeah.

Um, that might be better to expect failure. Um, that would actually be good, though, because then the sender of the web mention can say, "Hey, I can send the vouch" too, and then the receiver says, "Okay, now send me a vouch." Basically, I like going with the 418. I’m is an April Fool’s joke.

Yeah, there isn’t one that the server can use to have the client retry thechanges. Well, precondition failure is that but it requires the precondition to have been imposed by the client.

The client says, "Sorry, client, you asked for this, accept; I can't do that. The client can try again without that. That’s the closest one.” The closest one—well, it's not quite. Yeah, it's not quite 41 because that’s the closest I got. Closest.

Prec, I’m just on Wikipedia. Oh, I should probably state that the server requires the request to be conditional, intended to prevent requests. Should you try after? Form Action 49.

No, that’s actually exactly it. I think Microsoft— that’s hilarious! It’s in the spec. It’s in the—yeah, seems that does seem legit.

That does sound better. Let’s put it that way. I mean, it is exactly what it’s for, and it even says, “Retry with valid parameters.” Right, so we could say we try with valid parameter vouch in the response. I think it’s like not to—yeah, but I’m guessing basic unordered.

The problem is, yeah, that's why we it's not even us, because it requires, also, HTV says you must reply with the request. Don't hey, I like 449, that's a good find. You say how vouch is sent along with webmention as a header or a new to the G. Yes, another parameter. I think it might be good to have something in the response set because of the I want a PCH. So this sends the, I mean, this h449 actually has like sample text. Yeah, and yeah, where you finding the sample text that in theWikipedia 449? I mean, list of HTP codes. Oh yeah, re with, so where's the where's an example response that's itot the AV Go website? Not parameters, one that's all part of the yeah, it's retry with do just away, which kind of seems weird. Um, that seems fun to me. We try with vouch. Great, really. All I check isod, yeah, most things don't pair up the text of H code response. I think people Have a hard time; the applications may choose to learn or not.

Yeah, so let's embrace and extend Microsoft's extension. It's a good extension, I think, that should be there. That's the first time that's ever been another Embrace Microsoft; that's Embrace Microsoft. Oh hey, 499 is which one? 499 token required and 498 token expired. There are two 499; there are two 499. Oh yeah, X does that? All right, so getting back to yeah, so 449; so the response, what does the response actually look like? HTTP 1.1, 499 retry, 449. 449 retrying. But we can’t put any data there because no libraries are going to let us press that out. So where is the um, it comes through PHP. Talk about in the cro. Yeah.Yeah, I mean, like I actually have to press that for, there's HTTP code last reive HTTP code.

Full string. Okay, you know what? Not just the number — that's somewhere. I think I return that string whenever it returns something. Now, the examples in here are that it's returning. Yeah, you can get an integer, but I thought you could get str in, if not in the header, like theHTTP header, which makes me nervous because I don’t think anything's to that. Out there, no problem putting it in both; anyway, yeah, there’s no problem. Um, would it be a? I honestly don’t think we need to add anything more to that. The simplest answer is to just say, if you send a web mention, someone returns a 449, you need to send a vouch. Like, I hope we don’t have to do this protocol anymore at all.

Right, by the way, you may never even get this first one. They may just send you a sourceable touch, yeah, in the first place, because they may be like, "Well, Aron doesn’t really know me." Yeah, like if you’re sending a web to somebody you know you’ve never linked to or they’veNever allow you to like they have no idea.

You're actually better off sending that. Yep, and your client could suggest that. Your client or your UI, where you're posting your comment in your CMS on your site, could be like, um, you know, this guy's never linked to you. Let's say your client is smart and he's been keeping track of everyone's linked to you. You may want to just send a vouch.

By the way, here's a good one. Here are the sites that have linked to you that he does link to. So, if you have the CMS that's been catching all that information. Yeah, because your CMS could literally, while you're typing up your reply or comment.

There is that feeling. It's like going to reply to this URL. Has it ever linked to you? No? Okay. It can go answer that, like in the background.Then it could also figure out, like, okay, let's go check that guy's recent feed. See who was linked to in the past, like, a couple of days or a couple of months.

His archives index those links. Do any of those links match any of thesites that have already linked to you? Oh, they have. Here we go. I'll auto-fill Vou. So it’s possible to potentially completely automate that piece of the process, um, as like an IndieWeb type connection in a way that’s not feasible for like random site to random site. So, which is okay, and this is actually something that I would love to see set up as a service, because I don’t want to write that much crawling code. Sure, for suggesting, but like you could ask; you could ask Shrewdness. Yeah,exactly. So, Shrewdness, you’ve seen a ton of posts. Yeah, that’s a great thing to have, a Shrewdness where um, yeah, it’s just crawling away and if I trust this, then I can just be like, oh, hey, give me some suggestions, else to you, to this site. Yeah.

So then, did you get these two tests? Probably not. So you’ve been sent the Webmention with Vouch? You’ve got the Vouch parameter that leads you down a different verification path. So, so I’m accepting it.

Okay, it may be—I mean, I had to verify—going to verify thetion. How do I verify the so you can decide what's easier for you? Do you want to verify that you like the vouch, or do you want to verify that the vouch actually links to the source? Your choice! What's the advantage of each? Well, you're going to do both. It's just whichever order—no, yeah, you're going to do both. Do both. Okay, so but you can reject after either onefails—that's the point. One requires a network of traffic; one does not. So potentially, yeah, so the idea is if your little approval algorithm box is short and fast, maybe check this first: Do you approve the vouch at all? The vouching— I approve the vouching domain.

Yeah, it doesn’t have to pass by water the store. Yes, because you have to somehow trust; that’s why it’s about. Oh, yeah, I trust that. B for thisguy. Keep the word trust. I should, yeah. I’m okay with—I have to check if I trust. If you’re okay if you approve, let’s call it a check if I approve it.

Because I'm assuming that the sender picked something that I already approved or they think you would approve. Like, maybe they know socially. Yeah, oh yeah, you've never looked to this guy, but you know this guy. Okay, so that's just running. Correct? So that's a black box.

The second one is, I have to then retrieve the vouch VCH vouch URL, yeah, verify that it actually does link to the source's domain. Not without, well nofollow, so you need to find. So if you want me to, like, in aprogrammatic sense, you retrieve C, you GP it or filter it or parts it orwhatever for all links to a site. One of those links must have no real nofollow.

So you then go through that list. If that list is not empty, and you check, is this link without nofollow? Yes, okay, test passed. I'm done. If you reach the end of the list of such links and they all are around nofollow, the test fails.

Is anyone typing this into IRC? Yes? Okay, thank you. It's in a session called "How to do this." Today, not just any camp vouch.

That's the end for this section, okay. What's a grapple? Chart gra is thethat—that's for bread. Okay, time is up; we did it. We solved it; we fixed spam. So, implement yes or no? Um, verification. Yes, I can do it.Approval, yeah, the whole, the whole verification of Ofu. Yeah, okay, so the protocol is implementable. Yeah, I have no idea how I'm going to find the V. Ur, that one is not yeah, yeah. I don't think about pick someone here that’s never linked to you. Um, you probably have not. What's your website? Let’s see, I have mcn.com. That nothing has gone up to in like four years. I broke it, and then I have a gar.com, which is posted too rarely. Um, which one did you sign up with?

And I— to sign up, you signed up for the—yeah, I had to fight my way in by getting Twitter to talk to the new mlm. CNN.com, I think, is how. Okay, so you use your—yeah, I would know. So that’s probably Everything else, if I wanted to send you a comment, I need to find something that we have in common. Now, remember that you already know what post you’re replying to, so there’s a specific post he’s written that you’recommenting on. So I’ll check out the Firefox thing right now.

Okay, so, I guess I should pick a post. Here’s one that says you're coming to that’s relevant, like, “Hey, see you there.” So, I’m looking at thispost, and the first thing I see is a link to the “We.” Okay, you could potentially use any webcam. Try using anywebcam.com.

Vouch, because that definitely links to you. So you could be like, “Oh, by the way, I’m here’s my com PK. This links to my site.” Right? Is the IND a reasonable thing to you? Why not? For them, I should have added a link to their site. They have to have signed it to the wiki with Andes, which is definitely going to stop.

Any spam you write now, so therefore, it becomes this really good source of vouch. Actually, the other question was, if well, it's Wickmedia. But, um, I know they and the nice thing is this whole community of people who are going to be like, if we see any spammer do anything on the new camp, we're deleting them like that. Like they're gone; they're history. User page or not, no matter what they do.

As soon as they try to create an account out of there. So, I don't know how I— so, right there. Okay, so you just solved the problem. How do I find I click my reply button in my browser? I've got a browser reply button. I'm looking at my posting UI that has the reply to URL, so what Ineed now is I need to be able to add a parameter in my posting UI, a u field. I need the ACH field in my posting UI for the store at the minimum, assuming that I don't make my software do it automatically. That's right. Well, you start manual. I don't even know how I would aut— or maybe your software finds a weak vouch.

Like, I know that this guy who's a stronger vouch; it's more personal. The vouch is, uh, it's not a whole domain; it's going to be this specificmention, because otherwise it's the responsibility of the sender, just like Spider. Hold main, so that's not cool. That's actual page; actual is an actual page links to a site. This link can be to the whole domain, butpresumably your approval. So I actually have to find. So I see you link to the Wiki. I actually find a page on the wiki that links back to you, for the no, to you. Oh,

to me, because you're the—yeah, you're trying to find someone; you're trying to get the Wiki to vouch for you. So I know the Wi links to me. Bingo! On my user page, you just go there and use it. But you, as ahuman, know that that's much harder for a robot to do, to automate, right? You as a human can—like, a huge percentage of our brains are, like, evolved to handle this kind of second-degree social logic. So if thesame page doesn't link to both of us, do you need— No, no, it's one-directional.

Doing the work, you link to the wiki. The wiki links to him. It's all one directional: you link to the wiki, the wiki links to him, and he sendsyou a mention, but includes that link on the wiki saying, "Hey, you link to the wiki. It links to me." But I'm linking to the wiki page that he's mentioned on. No, no, no. It's a domain-level approval circle.

This is the point: assuming you've already done everything. Here, this is one send and receive, so that turns into a "v." Yes, okay. That also works. Yeah, I thought that that's when the vouch is. Is there any? No, I mean, I think that that's up to like there's nothing stopping you fromretrying. That's a good point. What is the response if you reject a Dodge? 400, not 412.

[Music] No, it fails. It fails, so return. Yeah, but at that point, like that'salmost like a UI thing. The failure comes back to your reply UI, which just says, "Hey, your comment wasn't Accepted, um, you know, for whatever reason, and then you, as a human, can decide, "Oh, my comment was rejected; you know, what do I do? Well, maybe the vouch wasn’t good enough. Maybe I used GitHub and I should have used something else. All right, I’ll try again with a different URL. So then you, as a user, action say, "Okay, P, you pick a different URL, post, or update, because you’ve already posted on your site. Um, send the web mention.

Maybe it works that time; it doesn’t. But the point is the retry is not automatic.

The retry—there should be a human; that’s the intent here. And that way it should happen at human time, not like automated bot time. So, yeah, if you’re seeing retries on a vouch that appear automated, then that’s that’s like a bad true. And ideally, you’d want to see um, people accepting web mentions that included. It should start so that when youretried, when you came back and go, "Oh, I used GI, I should have used something else." You can just go ahead and, like, it doesn’t have to be the back and forth all over again. Does that make any sense? Because I could very easily see you know, somebody say, like, "All right, Most of my stuff happening right now is on, so I’m going to add that to my whitelist of vouches that I want to try before you let me know.

Like, I need to do a little digging. Um, you know, in terms of automating it for a regular user. Okay, I think this is cool. I want to go do thisnow. I mean, you haven’t CED tomorrow? Tomorrow. Okay, I’ll have a plan, but that means if we’re all verifying, we’re not going to demotomorrow. At least one of us needs to send. Well, I’ll do sending with a curl. I can demonstrate sending; that’s how I send my pings. Now, I will make, that’s the thing, like I man to start my web. Like, one more parameter? No, big. Okay, but since you guys already linked to me, I mean, you have to like cool.

Okay, who’s for discussion? Um, I think me, awesome. Yes, you. [Applause] Then I will sit down, and you want a computer that’s not your act you use for.

Typo correction, sure. Let me go restart the VL and your view, SC. You good? All right.