pump-io / pump-io.github.io Goto Github PK

For search engines, etc.

It would be nice if we could throw Cloudflare in front of http://pump.io, to take advantage of their free HTTPS thing. This will boost our SEO ranking and also prevent passive attacks, which will be a good start.

Obviously it'd be better to do HTTPS properly, but my feeling is that this is better than nothing. The one downside is that this potentially gives people a false sense of security but a) it seems like if someone did do something (unlikely given the cost/value ratio here) the impact would be minimal anyway, plus b) people do a terrible job of looking at security indicators anyway tbh.

I get a security warning (SSL_ERROR_BAD_CERT_DOMAIN) when accessing https://pump.io via Firefox, and the website is only available via http, unless I ignore the warning.

Once #4 gets merged Try It will send users to a different site each time. In a world where most servers are up most of the time, the old behavior is better. So we should reenable it if that ever happens.

I've been thinking recently about how we present the project. The current website is a lot better than it used to be, but it's still not great and doesn't do a good job of explaining the project.

I think we should focus on three main things that differentiate us from other ActivityStreams/(future) ActivityPub projects:

• Security - we innovate on this space with things like shipping a restrictive systemd file, and we have additional enhancements planned like automatic HTTPS (pump-io/pump.io#1259) and chroot jails on by default (pump-io/pump.io#1258)
• Great admin experience - it's dead-simple to install and set up because of npm and good MongoDB packaging (even easier than Wordpress' 5-minute install, which is only 5 minutes if you already have a database, web server, etc.). We're also always looking to make this better with things like zero-downtime restarts (pump-io/pump.io#1295)
• Flexibility through open standards - the pump.io project has historically been deeply involved in the standards community (specifically AP derives from the pump.io API). We also drive new standards and explicitly track useful protocol extensions in our issue tracker. We should focus on how this makes us open and flexible, such that we can go beyond just "social network" usecases (i.e. solid, high-performance, generic ActivityStreams distribution)

Thoughts?

Pretty sure there are some TODOs lying around in this codebase; I should grep around and fix them

We will also want to drop 5 and 7 at the same time.

This is blocked on stratic-indexes-to-rss being published to npm.

#4 got closed when the user left GitHub so we need to do this ourselves now.

http://pump.io/blog/2017/10/denial-of-service-security-fixes-now-available literally has two <title>s and one of them is wrong.

Objections to CC-BY-SA 4.0?

We need a README with:

1. Instructions on hacking on the site
2. Instructions as to how to cross-post things

Not sure exactly where we should go with this, but the README stuff is pretty useless. We should do a much better job explaining what the software actually does.

I could find no mention of a channel for pump-io on IRC.

On which IRC network can pump-io be found? Which channel?

Blog post titles still end in "pump.io by e14n" - I should fix this instance and also look for other references to E14N.