interactive publish: skip silo auth if there's a bridgy publish backlink

[snarfed]

...since the backlink proves that they intend to publish it with bridgy. requested by @tantek.

[snarfed]

Thinking about this. I like it, and it would help us work around eg #911.

I'm worried about one scenario, though. Say a post includes a Bridgy Publish backlink, but doesn't actually trigger the publish. Someone else (ie not that site's owner) could then use the interactive UI on https://brid.gy/ to publish that post as that silo user at some arbitrary point in the future.

Realistically, I think at least some sites automatically include Bridgy Publish backlinks for some silos on many or all of their posts, eg maybe @jamietanna and @jalcine, among others? So they might be susceptible if they don't also automatically publish all of those posts.

@tantek et al, open to thoughts on the threat model here!

[jalcine]

(heh, this issue number)

I actually disabled automatic syndication until I supported indieweb/micropub-extensions#4 (by way of https://git.jacky.wtf/indieweb/koype-next/issues/11) to do automatic syndication more accurately. That said, if I notice a failure on syndication, it follows an exponential retry flow (and I tend to check the logs often after I post, so I'd be able to debug).

That said, is it more of an idea/request to implicitly authenticate people if they have everything in place to publish posts?

(Originally published at: https://jacky.wtf/2022/6/YDYq)

[snarfed]

That said, is it more of an idea/request to implicitly authenticate people if they have everything in place to publish posts?

Right, this.

[jalcine]

Interesting! I figure some level of user intervention was required for things like Twitter or Tumblr. If not, that would be very nice to have (and would be one less step for people).

(Originally published at: https://jacky.wtf/2022/6/F65c)

[snarfed]

Looked at this a bit. It's not easy right now, due to the way we handle the OAuth check for interactive publish requests. We do the OAuth redirect and dance first, before we fetch the source page. To do this, we'd need to add a new server-side handler before the OAuth dance that fetches the source page and checks for the backlink. Doable! But nontrivial.