<asheesh>
FWIW simonv3 what I would suggest is that you ask each person to make a personal account for themselves, then you just start using things, no need for anything group-specific.
<asheesh>
oasis.sandstorm.io is one way to host grains; there's a free tier of 5 grains per person.
<asheesh>
You can also self-host if you prefer.
<asheesh>
If you're asking about getting a sweetheart deal on a multi-person membership without paying, then two things to note.
<asheesh>
1. We're not actually billing people yet, and
<asheesh>
2. For such a request, I'm not the person who'd approve it; support@sandstorm.io has the right people for that (Kenton & Jade) though I think it's very possible they'd be amenable.
<asheesh>
Curious for your thoughts!
aaronr has joined #sandstorm
<simonv3>
asheesh: that’s what I figured
<simonv3>
I was mainly curious whether there was - or would be - an organization like option
<simonv3>
I have no idea how you would go about structuring that (architecture wise) but I was thinking of it like, well, an organizational google docs
<asheesh>
There probably will be an organization-like option in the near future (>2 months), where companies/orgs can have something like sandstorm.opensourcedesign.com be a CNAME to oasis.sandstorm.io so it looks like your own Sandstorm for your group but we happen to administer it.
<asheesh>
Of course you can already get this if you self-host (-:
<asheesh>
There's other things to think about, largely about access control, like giving an org owner the ability to modify other people's grains etc.
<asheesh>
Getting that latter set of stuff right is the main reason for there being some delay on this. AKA we have our hands full with the stuff we're working on right now so haven't figured that out yet.
<simonv3>
that is totally fair!
<asheesh>
But basically, I suggest y'all pick one of (run a Sandstorm, use Oasis) and start having fun. (-:
<simonv3>
sounds good
<asheesh>
I will be happy to help either way!
tobald has quit [Ping timeout: 240 seconds]
funwhilelost has joined #sandstorm
tobald has joined #sandstorm
jacksingleton has joined #sandstorm
jacksingleton has quit [Ping timeout: 252 seconds]
<sprin_>
My question: I have noticed that HTTP headers are filtered by the capnp proxy
<sprin_>
Is there any way to get custom headers through? My app depends on CORS, so without CORS headers, it's rather useless
<sprin_>
well, I should say useless for most cases where the comment server is running on a different domain than the HTML where the widget is embedded
<sprin_>
dwrensha: ah, excellent! I will take a look
<dwrensha>
I wonder whether we should allow apps to tighten that down. Like, your app sounds like it only wants to access from one specific origin.
<dwrensha>
(I admit to only having a vague idea about how CORS works.)
<sprin_>
yes, ideally the user can specify one or more origins
<sprin_>
I appreciate the note in the docs regarding implementing comments ;)
<asheesh>
: D
<geofft>
I think there's no good reason to restrict origin for public APIs -- CORS is just simplifying something an app author could do if they felt like running a proxy somewhere
<geofft>
i.e., if example.net doesn't support CORS, I can just set up a server on example.com/proxy/... that fetches example.net/... server-side and returns it
<geofft>
the only reason _not_ to use Access-Control-Allow-Origin: * is if your site is restricted at the network level somehow (checks IP addresses, lives in a private network, etc.)
<geofft>
so maybe you want to support checking origins so that a public website can't XHR+CORS to a Sandstorm server that lives within a LAN, but other named servers on the LAN can? maybe to other grains on the same server?
<asheesh>
Also this Chrome bug is driving me insane and maybe I will try to learn flexbox
<sprin_>
well, in this case, it's a small thing if there is no origin restriction. Having a restriction denies someone else embedding the widget into their own page without permission.
<sprin_>
But denying the API to other domains is not really a security thing, since the API will be open to anyone outside of a browser context, absent having authentication enabled for every API interaction (posting, etc).
<geofft>
right.
<geofft>
if your API needs authentication, hopefully that's with cookies or tokens or something else, not IP addresses / origins
<sprin_>
correct.
<asheesh>
BTW mega-yay sprin_ glad that you're working on this; I'm hopeful that Sandstorm will be a good way for more people to use pg-discuss.
<sprin_>
So it is not much of an issue to allow all domains. Restricting is just a small barrier to another site operator being a small nuisance
<sprin_>
asheesh: Thanks! I have not done any publicity yet, since I want to have a nice set of deployment options on the menu when I do the 1.0 release and publicize.
<asheesh>
(-:
<asheesh>
I used to use something vaguely like this in 2001 for comments on my personal static site and so it's super fun for me to something like this that I can possibly help out.
<asheesh>
(I'm one of the authors of vagrant-spk & live in SF & work for the Sandstorm company, fwiw.)
<asheesh>
I now want to see if I can dig up those CGI scripts...
<sprin_>
And sandstorm is a really good fit for non-sysadmins! pg-discuss has many setup steps that would turn off many casual users
<sprin_>
reverse proxy, wsgi container, python virtualenv, postgres... it's a bit beyond most users of wordpress I think
funwhilelost has quit [Quit: My Mac has gone to sleep. ZZZzzz…]
<asheesh>
I can't seem to find anything by Googling [postgres website comments cgi 2001] sadly.
<asheesh>
sprin_: Glad you appreciate these benefits! (-:
<asheesh>
(BTW are you SF-based perchance? I see you're somewhere in California, says your IP address, I admit.)
<asheesh>
"backward compatibility and working without JavaScript — were actually holding it back" I sympathize & can't disagree.
<asheesh>
This is seemingly "just" the /admin/ which is to say the author-facing UI.
<simonv3>
Yeah, and relying more heavily on an API - I think a couple of people are confusing that
<asheesh>
"confusing that"?
<simonv3>
The feeling I get from how people are talking about this is that “all of wordpress has been rewritten"
<asheesh>
Gotcha.
<simonv3>
but the impression I get from that post (I could be understanding it wrong) is just that what was previously known as wp-admin was/is
funwhilelost has quit [Quit: My Mac has gone to sleep. ZZZzzz…]
NOTevil has quit [Quit: nevermore]
jacksingleton has joined #sandstorm
<zarvox>
okay, some issues with git master:
<zarvox>
I am presented with the "Unlink this identity" button for my last identity. It works. We probably shouldn't allow this.
<dwrensha>
agreed!
<zarvox>
The "Login enabled" button appears to be unstyled, and clicking it does not tell me that this will toggle it.
<zarvox>
As a screenreader user, I'd be very confused by what the button is supposed to be communicating.
<zarvox>
It's a button, but the text doesn't describe the action that will happen if I trigger it.
<zarvox>
When I logged in as Alice Dev Admin under sandstorm-132 and then ran a newer frontend, sandstorm got confused about being unable to read property 'picture' of undefined in profile.js:192
<zarvox>
and I had to manually Meteor.logout() from the console, because something was very unhappy
<zarvox>
is this likely just an issue with dev accounts? even so, we should make it work across upgrade because developer VMs are going to be messed up if dev accounts can't upgrade cleanly
<dwrensha>
like not just a dev accounts issue
<dwrensha>
likely*
<zarvox>
Okay. I'll start filing issues then.
<dwrensha>
or you could just fix the bugs!
<dwrensha>
(quote unquote "just")
<zarvox>
that would assume that I think I understand everything well enough to fix it myself, and that no one else should contribute fixes!
<zarvox>
both of which might be false!
<zarvox>
:D
<asheesh>
zarvox: I'm pretty sure that conversation saved me ~30 minutes, so thank you very much for your help with topbar stuff!
<zarvox>
asheesh: yay, I'm an enabler!
<asheesh>
In the good way, I hope!
<sprin_>
asheesh: Is this an accurate understanding of how exporting HTTP APIs works?
<sprin_>
in the case of the comment widget app, the owner sees the setup page which has the iframe embedded
<sprin_>
in the iframe, a template renders the correct HTML snippet to paste in to their HTML content on another domain
<sprin_>
the snippet contains both API_HOST and API_TOKEN
<jadewang>
apparently the "slack is down" techcrunch article is on the frontpage of hN
rustyrazorblade has quit [Quit: rustyrazorblade]
<sprin_>
when a user loads the comment widget, the JS sends a request to API_HOST with API_TOKEN in a header
<sprin_>
But for the case of a public API, why is there a token involved at all?
<zarvox>
Sandstorm doesn't support sessions that aren't authenticated. You can provide a token that you intend to be used for "public consumption" but you still have to provide the token.
<sprin_>
ah, understood. So there is no way for an owner to expose an API with a one-time authorization, without a token?
<zarvox>
That's correct.
<zarvox>
You can publish things at a random URL that the app gets to know, but can only put static content on.
<sprin_>
a follow on question: Does this expose the entire HTTP API of the app? Can I control which endpoints are exposed?
<zarvox>
Requests to the "API endpoint" can be prefixed with a particular path before the request hits the app. See bridgeConfig.apiPath in your sandstorm-pkgdef.capnp?
<kentonv>
you can't rely on that for security though
<zarvox>
kentonv: ...the docs suggest that you can. if you can't, then what should app authors rely on?
<kentonv>
permissions
rustyrazorblade has joined #sandstorm
<kentonv>
sprin_: you'll need to define a permission and role for "can only access this API", and then create the webkey with that role.
<kentonv>
and the code will need to block other kinds of requests if the necessary permissions aren't present
<kentonv>
we're working on ways to expose endpoints that are considered independent of the app's main UI, which sounds like what you really want here, but for the time being you need to enforce using permissions. apiPath is more of a convenience, it doesn't actually prevent other paths from being accessed, unfortunately.
kecolus has quit [Quit: Leaving]
<sprin_>
kentonv: understood!
<sprin_>
I built this with pluggable authentication in mind, so I will have to actually put that to the test. For a non-sandstorm deploy, admins are authenticated with a traditional username/password login
funwhilelost has joined #sandstorm
<kentonv>
I fixed apiPath's comment to be clearer about security implications.
<zarvox>
thanks for clarifying!
NwS has quit [Quit: See you in Isla de Muerte!]
<maurer>
kentonv: So, before I continue to try to figure out how to get sandstorm (at least the spk generating portion) to build on my dev system, are there any intentions to have a non-ekam build system in the near future?
<maurer>
(if so I should probably just wait rather than burning more hours trying to figure out how to appease ekam)
<zarvox>
maurer: probably not, but I'm curious what you're running up against and if we can find a workaround for you!
<maurer>
zarvox: So, my end goal is that I want to be able to put nix closures (basically a transitive dependency thing from a package manager) along with gotty or a similar program into an spk
<maurer>
zarvox: To do this in any kind of clean way, I need to package at least the spk portion of sandstorm on nixos
<maurer>
zarvox: However, I'm currently stuck on an issue where wh3en I build, a bunch of header files which seem to be in place within the source directory are mysteriously not found
<maurer>
I can provide the exact error message if you like, but I do not suspect it would help, because I think it's that some kind of symlink system to let ekam work isn't going quite right
<maurer>
I'm just shooting for packaging spk for now since packaging anything with meteor in it is going to be trickier
<zarvox>
ahhh, sure.
<zarvox>
So ekam looks under ./src for all source code and build rules. We symlink src/capnp (and others) to the deps/ folder where we expect to find git clones of some other repos.
<maurer>
Yeah, I've placed them in the deps folder, and I can see the deps build
<maurer>
e.g. I watch as a lot of capnp .c++ files build
<kentonv>
is the problem with node.h?
<zarvox>
okay, cool! can you pastebin the failure log?
<maurer>
kentonv: no
<maurer>
zarvox: sure, onesec
<zarvox>
thanks :)
<maurer>
(sorry, it'll take a sec since atm it's still building with the deps/ekam instead of a separately packaged one, so no incremental build)
<zarvox>
what does the ekam invocation you're using look like?
<maurer>
It's being invoked through the makefile
<kentonv>
note that under Ekam, the "first failure" in the list is unfortunately not correlated to the "root cause failure"
<maurer>
kentonv: Yeah, I tried setting parallelism to 0 but that didn't seem to help
<maurer>
(in terms of root causing)
<kentonv>
yeah it doesn't help because when a rule fails, Ekam has no idea what artifacts it might have output which might have made other rules succeed
<kentonv>
so e.g. if you can't build the capnp compiler, then lots of things will fail to include .capnp.h files because the capnp compiler never generated them, but Ekam doesn't really know that. :/
<zarvox>
what's the patch look like?
<kentonv>
however, the errors in your log look really weird to me. Those headers aren't generated.