Notices by ☭⚑ Comrade Angles ⚑☭ (angle@anticapitalist.party), page 44

@Gargron @kaniini @cwebber Hmm. Maybe it's labelling it wrong? Is starts with "authorization: 'Signature", so maybe it's seeing it as an authorization header and not knowing what to do with it? :/

@Gargron @kaniini @cwebber Nope, just "Request not signed". :/

@Gargron @kaniini @cwebber Huh, I'm not seeing those errors. Maybe I'm just not looking in the right place? Or maybe I have a different problem with the signing. :/

@Gargron @kaniini @cwebber Oh! One thing you could do, though, would be to get it to give more descriptive errors. So it's not just "request not signed", but also "Key not found", "Actor not found", "No webfinger response", etc, etc. Though, yes, I know this takes resources that could be spent on other things. :/

@Gargron @kaniini @cwebber No no, I getcha. I'm gonna need to go ver Agora with a fine toothed comb for security before I put up this latest version. :X

@Gargron @kaniini @cwebber Ahh, gotcha. So I'll need to implement a webfinger endpoint. :/

@Gargron @kaniini @cwebber Hmm, still doesn;t work. I guess I probably need to sign the actor data too, when it requests that, right? :/

@Gargron @kaniini @cwebber Hmm, gotcha. And I don't need to provide any other data for the key anywhere, beyond id, owner, and publicKeyPem?

@Gargron @kaniini @cwebber Ahhh, gotcha. Thats the description of the key that I used to export it, aka "public key encoded in pcks8 scheme as pem string." I take it I need to put "actor.id + "#main-key" there instead? Do I need to do any special routing to make that data available, or will it know to load the Actor json, grab the publicKey, and match against its ID? :/

@hypolite Eh, theres a difference between worrying about them publishing knock offs of your creation and them publishing the exact same thing. Or copying it wholesale, in the case of a book. :/

Aaaaargh. I have to many things I want to do and too little time, energy and focus to do them all. I have Agora to program, video games to make, a creative commons book on morality to write, an rpg wiki on games to write, etc, etc. Not enough time in the world. :/

@kaniini @cwebber @Gargron Huh, do I need to make the actors public key available anywhere besides in their publicKey property? Maybe that's the problem. :/

@kaniini @cwebber @Gargron Hmm. Well, I checked to see what my code was sending, and it looks about right?

"authorization: 'Signature keyId="pkcs8-private-pem",algorithm="rsa-sha256",headers="date",signature="<omitted due to length>"'

Unless I fucked up and it's just sending the clients private key publicly. :/

@Archbeth Maybe? I don't actually know birds very well, sorry. XD

@Archbeth Alright, cowbird then. Same idea. :P

@Archbeth Yeah I think one of those is a cuckoo egg. :P

@kaniini @cwebber @Gargron Eeep. I'm using joyents library (Via npm's request library, via Meteors HTTPS library...) and I have no idea what spec it's compliant with.Though actually, it looks like it might be by the same person, Mark Cavage? I'll dig through and try and figure all that out, I guess. :/

https://github.com/joyent/node-http-signature/blob/master/http_signing.md

@Gargron Which spec? This one? https://tools.ietf.org/html/draft-cavage-http-signatures-10