Webmentions are one of the most interesting and powerful technologies floating around the IndieWeb. At their most basic, they sites on the web to interact by sending a notification when a page on one site links to a page on another. When combined with machine-readable metadata like microformats2, they enable really neat social interactions between sites, feeding back likes, comments, bookmarks, shares, event RSVPs, and plenty more.

Receiving Webmentions

A site doesn't have to do all its own Webmention handling, and there are a few services that will handle them for you. I set up my website with the service back in August 2016 (so long ago!) and it's been accepting mentions from other sites since then. And, while there aren't a lot of websites that send Webmentions natively, there are services like Bridgy which uses Webmentions to backfeed social interactions to my site from sites like Facebook and Twitter. Pretty neat!

Sending Webmentions

When I publish a post with a link to a site that support Webmentions, I still need to actually send that notification. I haven't yet built a tool that does that for my own website, but I have been able to make use of Aaron Parecki's Telegraph, which will take in a link to one of my posts and parse it for outgoing links, find out of the targets of those links support Webmentions, and allow me to send them with the press of a button. It's ridiculously easy to use and has the added benefit of letting me pick-and-choose which links go out as Webmentions.

Displaying Webmentions has been collecting mentions for my site for something like 6 months, but they don't just magically show up on my site! provides an API for fetching the mention data for individual pages, or all mentions for my domain.

My site is built on Jekyll, a static site generator, and I like that so far it doesn't rely on JavaScript for folks to read it. I didn't want to require JavaScript for displaying mentions, so I needed a way to "bake in" my mentions for each post. I was inspired by Aaron Gustafson's jekyll-webmention_io, but found that I didn't like some of the choices in markup or the way that it stored the mention data, so I went ahead and wrote my own. It's still heavily a work-in-progress, but I do hope to release it for other folks to use once it's more stable.

What works? Let's see!

Here's an example post with some Likes and RSVPs (both "yes"es and "maybe"s):

And an example post with some replies backfed from Facebook:

All of these are being displayed with the data that provides with its API, and there are some types of post that I would like to handle differently such as the ❤️ above (which was a Facebook "heart" reaction), and I'd like to include a JavaScript enhancement that will show any new mentions, so they aren't sitting in "limbo" until I make a new post.

Overall, I'm really excited to finally be showing these on my site! I think Webmention is a pretty critical part of bringing the "social web" into the IndieWeb and back out of the silos. I am grateful to all the folks that have made this possible with their work on standards and tools!

in reply to

Even though I only owned an X200 for 3 years, the laptop from 2009 was becoming aged, no matter how many things I replaced on it, so sadly, it was time to look for an alternative.

“The F key are not F, but multimedia by default” you can change that in firmware settings, or temporarily by using the Fn Lock.

The smaller {[ etc. keys — that’s only on the ISO layout! My ANSI X240 has these keys normal sized.

Opening the bottom plastic latches is easy with a plastic card, I’ve opened my X240 several times, never left any opening marks :)

in reply to

Two weeks ago I wrote that I hacked my own site. I think it’s important to share how I did it, to make people more aware of possible vulnerabilities, so they can find them too. If others didn’t write about their findings, I wouldn’t have found this one.

I did my best to reach out to people using the same code. If you are using the Kirby Webmentions plugin or my fork of it, please make sure to update!


As some of you may know, my site supports webmentions. In short, this enables me to show replies underneath my posts, that are written by people on their own site. If you write a reply, link to me, mark it up with Microformats and send a webmention, my site fetches your post and shows it as a reply. I use a service called Bridgy to also receive comments from Twitter and Instagram. All of this is automated and very cool.

However, while very cool, it is also potentially dangerous to show external content on your site. The vulnerability I found is an example of what can go wrong.

If you look around on my site, you see I do not only show the content of the reply, but also a picture of the author, if provided. This is especially nice when showing likes:

This nice overview of likes comes from the Kirby Webmentions plugin by Bastian Allgeier, which I modified a bit.

My server takes the fall

In order to protect visitors of my site from other security issues, the plugin downloads the images and shows those downloaded ones. This way my visitors only deal with my server, and not with the servers of everyone who liked my post. It’s a nice service, but it also means that I move the problem: I now have to handle those images with care on my side. My server takes the fall for my visitors.

The problem is: my server just downloads whatever image you give it. In most cases, this will be a nice avatar I can display for my friendly visitors. But one can think of a case where a not-so-friendly visitor feeds my site something else than an image. The plugin of course checks if it’s an image and rejects files that are not a image, but it’s still worth a try.

So, what did you feed it?

Since my server runs on PHP, the nicest thing for an attacker to feed my server is a PHP-file. That way, you can run whatever code you want on my server, doing all kinds of evil things. However, just straight off feeding my site a PHP-file did not work. The plugin is not crazy. It checked wether the MIME of the file was an image of type jpeg, png or gif. It rejected an image.php file like this:

echo "hi!";

Using image.jpg as filename would fail too: the plugin saw that the file had no MIME of an image, so it did not download it. This was the point where I went to bed with a feeling of security: my site was safe and I could not get a php-script in.

The next day, however, I had second thoughts. I needed a real image for my new plan, so I took a screenshot of a smiley. I then opened it in notepad and added the following to the bottom of the file:

<?php mail(‘’, ‘Seb’, ‘hi’);

I then renamed the file to image.php, because you need the PHP-extension in your file to let the server run your code. The last step was disabling PHP on my test-server, to prevent the test-server from executing the code and send mail me. The code just appeared at the end of the image.

I then made a test-post with a u-like-of set to the URL of a post on my blog, and a p-author h-card with an <img src="/photo.php">. It was a like, with an author and an my bad image.

And it worked.

The server sees the image and checks for the MIME, which was image/jpeg, because it was an image. It then downloaded it, including the un-executed PHP string in the bottom of it. It changed the name of the image into the SHA1-hash of the original image-url, but then it appended the extension of the original file, which was .php!

My server then had a file called a266d629bb26d74752080bb1b95bbd0a488bea53.php, which was linked as an image in my post. Every time I refreshed the page, the snippet of code in the bottom of the file got executed, so it sent an e-mail to me.

In this example, I sent an e-mail, but it could’ve been anything.

How to solve?

First off: check your input! And then check it again. A crucial thing for PHP-files is that they get executed if they have the .php extension, so you should not rely on user input for that. Change the filename and change the extension.

Bastian updated the plugin, so now it does not only check for MIME, but also only accepts files with the extensions jpg, jpeg, png and gif. Only if it has a correct extension, it downloads the file, and it checks MIME twice, both before and after the download. I think it’s locked down pretty well, although it still feels a bit scary.

Aaron Parecki, who did this way of showing likes first, uses an external service for his webmention images, and that’s not a bad idea either. If someone manages to get in something bad, it’s not on your the same server as your site. It could also be a good idea to turn off PHP for your upload folder, if you have that kind of access to your server.

Final words

I really like this webmention plugin! It’s thanks to this plugin that I know IndieWeb and all the wonderful things it brings.

But while the plugin and IndieWeb are nice, it’s also good to keep and eye on security. At this moment, webmention is relatively safe because not many people know about it or use it. Although it can be a lot of fun to have a post of a friend automatically show up beneath your post, we have to be aware of the risks of showing content of external parties.

So, be warned, and have fun.

Yeah, this is the one of the big problems with PHP, and Apache mod_php specifically. You can implement various mitigations (drop an .htaccess into the uploads directory that turns off any script execution?) but the fact that you have to is kinda ridiculous. Pretty much all other web development environments are not based around just running scripts from the same directories where static files are. Heck, Apache’s CGI implementation was better, it only ran code from the /cgi-bin/ subdirectory!

in reply to

Last week, Barry Frost released Micropublish, a Micropub client written in Ruby. It's a very slick interface for posting a few kinds of posts. I noticed that his "category" field looked really nice, and discovered that he was using a Bootstrap plugin called "Token Field". Today I added this plugin to Quill, so now everywhere that you previously had to enter tags as comma-separated values, it's now using this "token field" UI.

I also added a new field to the editor to set the published date of posts. 

All this does is include the date you enter as the published date in the Micropub request. It's up to your site to decide what to do with that. For example if you enter a date in the future, your site can decide to not show future-dated posts in feeds, so you can use this for scheduling posts. Of course if you enter a date in the past you can backdate posts such as when importing posts from an old blog.

Released last week? Oh. I guess I’ve been using the “unreleased” version. Now it has edit/delete/undelete functionality! That’s very nice.

in reply to

Of course things like software quality, bad UX (e.g. still none of the hands-off/continuity features work) are a reason for me: why would I pay the „Apple tax“ if „it simply works“ is no longer true?

Another reason is the hardware, and that's a complex one. On one hand Apple hardware is really good, e.g. the touchpads are the best I know. But on the other hand they do stupid things like soldering the SSD and RAM onto the board or gluing the battery. At least the SSD should not be soldered, as I use my hard disks heavily (due to big databases) it is likely that it breaks before the computer is broken.

Also software freedom is a reason. I like the ideals behind the GNU project and think this is the right way.

But my absolutely main reason is performance. Linux performs so much better... I have a script touching and inserting about 2 million rows, one at a time. My Linux finishes the job within two hours, while my macbook needs six(!!) hours to complete the task. The overall performance is so much better, and disk I/O is in its own league.

Yeah, the “soldered SSD” thing is extremely ridiculous. Like, they’re doing everything to make the laptops thinner, even the “Pro” line. Adding M.2 and SODIMM slots wouldn’t even add that much thickness! And M.2 allows the same performance (NVMe) as soldering the SSD.

By the way, Apple trackpads aren’t that special (until 3d touch, at least). They’re literally just Synaptics, same as in a lot of laptops.


I learned a very subtle Ruby trick today.

The Ruby parser will create local variables for every variable that might be set in your code before any of it is run.

irb(main):001:0> if false; x = 1; end
=> nil
irb(main):002:0> x.inspect
=> "nil"

Compare with just checking for x:

irb(main):001:0> x
NameError: undefined local variable or method `x' for main:Object
from (irb):1
from /Users/aaronpk/.rubies/ruby-2.1.3/bin/irb:11:in `<main>'

Just to confirm what's happening:

irb(main):001:0> local_variables
=> [:_]
irb(main):002:0> if false; x = 1; end
=> nil
irb(main):003:0> local_variables
=> [:x, :_]
irb(main):004:0> x.inspect
=> "nil"

This may not seem particularly unusual at first, but has some surprising results when combined with, for example, Sinatra. Imagine you have this code that attempts to accept both a form-encoded and JSON post body.

post '/example' do
  if request.content_type.start_with? "application/json"
      params = JSON.parse(request.env["rack.input"].read)
      return {error: "Error parsing JSON."}.to_json

  # etc etc
  # but params is always nil, even for form-encoded requests!

What's wrong with this picture? Well, the Ruby interpreter sees params = in the code and allocates a local variable. At that point, the hash that Sinatra sets isn't accessible from inside your block, so params will be nil when you try to use it!

The trick is to avoid setting params in the first place.

get '/example/:id' do
  if request.content_type == "application/json"
      payload = JSON.parse(request.env["rack.input"].read)
      return {error: "Error parsing JSON."}.to_json
    payload = params

  # etc etc
  # now you can use `payload` instead of params

Thanks @donpdonp for the hint!

in reply to

In this interesting article Wesley Moore writes about switching away from macOS. He writes about his motivation and reasons:

  • Access to regularly updated, pro hardware.
  • Not restricted to Apple hardware that makes choices that I don’t value, such as:
    • Removing the Esc key.
    • Removing all legacy ports necessitating the use of dongles for everything.
    • Prioritising thinness and weight over everything else.
  • Access to hardware that Apple doesn’t make, such as 2-in-1 laptops.
  • Getting comfortable with an alternative before I’m forced to.
  • The ability to inspect and contribute to the OS I use.
  • Using an OS where developers are first-class citizens.

I can understand his reasons: I for myself have similar problems with Apple nowadays (besides the moral issues). Interestingly he also favors elementary OS:

Elementary is stunning and definitely my favourite. It won’t appeal to everyone but their philosophies and direction really resonate with me.

I'm trying out elementary as well (using it for a week now, I am pretty happy with it), so it was nice to read that somebody else likes it as well - especially since loads of Linux users I know think that this not the way Linux is supposed to be.

I think some people didn’t like how Elementary is asking for money (pay what you want type thing) on the download page for some reason…

Honestly, I recommend not being tied to a particular OS and just, like, using all of them. I have Windows on my desktop, FreeBSD on my laptop, RPi and servers, Arch Linux in a VM… no (actively used) Macs anymore though :D


Our third visit to Wales was in autumn, and though I've not yet been there during winter, I can safely state it's always beautiful.

Beddgelert is a small community; the name of the place originates from a sad story of a heroic dog. It can offer you magnificent views of the local mountains and hills so don't miss it if you're close.

Our third visit to Wales was in autumn, and though I&#39;ve not yet been there during winter, I can safely state it&#39;s always beautiful. 

Beddgelert is a small community; the name of the place originates from a sad story of a heroic dog. It can offer you magnificent views of the local mountains and hills so don&#39;t miss it if you&#39;re close.