Bookmark

This is an interesting post, and is an important one to think about. We need to remember that although now we've got lax data privacy / retention laws, it's only going to get more user-focused and protect everyone more (which is universally a good thing!) but that we need to make sure we're architecting things in the right way to handle this.

Also, while you're thinking about this - have a read through some production logs and wonder "what could a bad actor do with these? Could they phish a customer? Could they steal their identity? Or are these so useless that we may as well not be logging anything at all?"

 Reply

Regarding our conversation yesterday for OAuth and API aggregation, I mentioned that while working on PSD2/Open Banking we've been doing similar, for instance with a third party who would register on behalf of a fourth party.

I've tracked down https://bitbucket.org/openid/obuk/src/6b4300bdc872dd55573f3ce9c65b66ada640efaf/uk-openbanking-registration-profile.md as the definition for the way this works with the use of new fields in the Signed Software Assertions (for use with https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1078034771/Dynamic+Client+Registration+-+v3.1).

It may be worth reaching out to OpenID/Open Banking to see if they've got this officially specified about this, or whether this is the latest source of truth you can use

Hope this helps with your hope to standardise this into an OAuth spec!

 Note

It's been an awesome day at IndieWebCamp Amsterdam!

The afternoon was chatting about licenses and ownership, then looking at how to migrate folks from silos to IndieWeb with a long term strategy, then some discussions about events, RSVPs and calendars, and finally all things syndication.

Got some great discussions, and lots of interesting things to play with tomorrow at the hack day!

 Note

Interesting start to the morning at IndieWebCamp Amsterdam - we've spoken about accessibility of the Web and IndieWeb, and about how private posts and privacy should work

 Note

I'm really enjoying the intros at IndieWebCamp Amsterdam. Its nice to see the range of websites, the technology usages, and that some folks are posting while they're talking while others haven't touched their sites in years.

It's an exciting chance to get reinvigorated!

 Note

En route to my first IndieWebCamp (Amsterdam) after a great couple of days at DevOpsDays London.

I'm really looking forward to meeting some folks and talking about owning more of my little corner of the Web, and meeting the faces behind the websites I frequent!