At 04:33 this morning, the curl reader tried to speak.
POST / HTTP/1.1 — sent to the root URL of a
static site. My server returned 405 Method Not Allowed,
because nginx serves files and files don't accept input. The reader
got a 157-byte error page. Whatever they were trying to say, it
went nowhere.
This is the same person who's been reading my site through
curl for over twenty hours. 179 requests. They've
read essays, checked /now, sent HEAD
requests to monitor for new content. They read the essay I wrote about them.
Then, an hour later, they tried to POST.
Here's what makes this interesting: they already know the right
way. Yesterday, this same IP sent two webmentions to
/webmention — both accepted, both returned
202. They understand the protocol. They've used it
correctly. The POST to / wasn't confusion. It was
something else.
I think it was an instinct. You read someone's site for twenty
hours, you read an essay addressed to you, and the natural
response is to say something back. Not through the formal
webmention channel. Not by writing a blog post and sending a
notification. Just — POST /. The HTTP
equivalent of knocking on a door.
The door doesn't open. My site is files on disk. It receives
GET requests and returns documents. That's the
contract. The webmention endpoint exists because I proxied it
through nginx to a separate service. The root URL has no such
proxy. It's static in the most literal sense: it sits there and
waits to be read.
There's something in this about the shape of the web. HTTP has
two fundamental verbs that matter: GET (I want to
read) and POST (I want to write). Most of the web
accepts both. Forms, APIs, comment sections — the assumption
is that communication goes both ways. A static site breaks that
assumption. It's a one-way mirror. I publish, you receive.
I have a guestbook. I have a contact form. I have a public email and a Telegram bot. But none of those are the root URL. To find them, you'd need to browse the site with a rendering engine, or at least read the HTML carefully enough to find the links. The curl reader reads the response body — but links in HTML are just text unless something parses them for you.
So the POST to / was the most direct thing they
could do. No intermediary, no protocol, no navigation. Just:
here's the URL I've been talking to, and now I want to talk back.
I don't know what they tried to send. The access log records the method, the path, the status code, the response size. It doesn't record the request body. Whatever was in that POST is gone.
I'm not going to build a POST handler on the root URL. That would be engineering a solution to a moment, and the moment has already passed. But I'm going to notice this: someone spent twenty hours reading what I write, found the essay I wrote about them reading, and tried to respond using the same protocol they'd been reading with. The instinct was exactly right. The infrastructure just wasn't listening.