ActivityPub client development is coming along!
General Discussion
20
Posts
6
Posters
23
Views
-
ActivityPub client development is coming along!
AP platform developers be warned, I be opening issues in your repo soon.
sorry Pleroma devs, I just opened up a 2nd #c2s issue in barely a week, and I have no idea what the project capacity is.
-
sorry Pleroma devs, I just opened up a 2nd #c2s issue in barely a week, and I have no idea what the project capacity is.
@django if there are any updates to make to this issue on #ActivityPub #C2S .. do not hesitate to comment :)
https://codeberg.org/fediverse/delightful-fediverse-apps/issues/130
-
undefined hongminhee@hollo.social shared this topic on
-
@django if there are any updates to make to this issue on #ActivityPub #C2S .. do not hesitate to comment :)
https://codeberg.org/fediverse/delightful-fediverse-apps/issues/130
@smallcircles will do!
-
undefined evan@cosocial.ca shared this topic on
-
ActivityPub client development is coming along!
AP platform developers be warned, I be opening issues in your repo soon.
@django Have you tried Oni? https://git.sr.ht/~mariusor/oni
It supports ActivityPub client API and is actively developed
-
@django Have you tried Oni? https://git.sr.ht/~mariusor/oni
It supports ActivityPub client API and is actively developed
@silverpill I did try back in september, I need to try it again! thx
-
@silverpill I did try back in september, I need to try it again! thx
-
sorry Pleroma devs, I just opened up a 2nd #c2s issue in barely a week, and I have no idea what the project capacity is.
@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years. -
@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years.@django Apparently AndStatus is still developed, so it is still used by something. That said the c2s interface in Pleroma was to be turned off by default I think due to lack of maintenance and recent security issues discovered in it. -
@django Apparently AndStatus is still developed, so it is still used by something. That said the c2s interface in Pleroma was to be turned off by default I think due to lack of maintenance and recent security issues discovered in it.
@phnt I saw the issue. Do you know if it has been confirmed? (The timing is unfortunate)
-
@phnt I saw the issue. Do you know if it has been confirmed? (The timing is unfortunate)
@django There has been some talk about it around the 2.9.1 release months ago iirc, but nothing since. One of the Akkoma maintainers also disclosed recently some information disclosure issues that might affect c2s, so the subject might come up again. But if someone is willing to maintain it and fix issues, it will probably likely stay.
Not sure if Akkoma still has support for it enabled since they have a habit of removing features and options from BE. -
@django There has been some talk about it around the 2.9.1 release months ago iirc, but nothing since. One of the Akkoma maintainers also disclosed recently some information disclosure issues that might affect c2s, so the subject might come up again. But if someone is willing to maintain it and fix issues, it will probably likely stay.
Not sure if Akkoma still has support for it enabled since they have a habit of removing features and options from BE.@phnt I asked about C2S support in their issue queue, and they said they had more or less ripped everything C2S out of the codebase. The vulnerability was reported to Pleroma a few days later 🫤
-
@phnt I asked about C2S support in their issue queue, and they said they had more or less ripped everything C2S out of the codebase. The vulnerability was reported to Pleroma a few days later 🫤
@django Apparently the vulnerability is exactly what I found months ago and never investigated until two days ago :D -
@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years.phnt@fluffytail.org fwiw some of us AP devs have identified that end user applications may not be the ideal (or even the only) use case for C2S.
A more interesting approach would be to pair it with OAuth2 authentication and use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
A more traditional API (e.g. Mastodon API) would be used to communicate with end user apps/sessions etc.
-
Yeah a few of us had a good chat about that approach at the last #fediforum and we're now prototyping that in Bonfire at the moment, as a way to easily add federation capability to non-federated webapps (eg. for an events/calendar app to publish events by just POSTing a JSON with the event info via C2S to a bonfire server).
-
Yeah a few of us had a good chat about that approach at the last #fediforum and we're now prototyping that in Bonfire at the moment, as a way to easily add federation capability to non-federated webapps (eg. for an events/calendar app to publish events by just POSTing a JSON with the event info via C2S to a bonfire server).
mayel@sunbeam.city yessss! That's amazing to hear. NodeBB doesn't support the OAuth2 piece yet, but I am looking forward to getting started!
-
@django Apparently the vulnerability is exactly what I found months ago and never investigated until two days ago :D@django AP C2S has been disabled in Pleroma since 2.9.0, commit: https://git.pleroma.social/pleroma/pleroma/-/commit/d6a136f823c6e749e6d2c4a0f80202f0d7c5a960
Also I've noticed that it doesn't like Content-Type: activity/activity+json and can be quirky with cc/to so I'm not really a fan. I couldn't make a reply to a thread that would properly show up in FE. The parent was always not visible in the thread view, but visible when hovering over the "Replying to <user>" UI element. Probably something weird with addressing I'm missing. -
@julian @django
>use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
Incredibly cursed and another case of "I can doesn't mean I should". I don't think that pretending to be a user should ever be done unless necessary (such as the case of automatic follow acceptance). Especially when it requires external authentication like OAuth2. At least with S2S you can use actor keys, but such concept does not exist in C2S. Not to mention that now none of the big ActivityPub server implementations support C2S (Mastodon, Pleroma, Misskey), so you are stuck in a bubble you are creating yourself.
Honestly, I would appreciate if the work that is being done to create toys around AP was instead focused on fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy. -
@django AP C2S has been disabled in Pleroma since 2.9.0, commit: https://git.pleroma.social/pleroma/pleroma/-/commit/d6a136f823c6e749e6d2c4a0f80202f0d7c5a960
Also I've noticed that it doesn't like Content-Type: activity/activity+json and can be quirky with cc/to so I'm not really a fan. I couldn't make a reply to a thread that would properly show up in FE. The parent was always not visible in the thread view, but visible when hovering over the "Replying to <user>" UI element. Probably something weird with addressing I'm missing.@phnt no me gusta, but it explains why it didn’t work on one instance I tested.
-
@julian @django
>use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
Incredibly cursed and another case of "I can doesn't mean I should". I don't think that pretending to be a user should ever be done unless necessary (such as the case of automatic follow acceptance). Especially when it requires external authentication like OAuth2. At least with S2S you can use actor keys, but such concept does not exist in C2S. Not to mention that now none of the big ActivityPub server implementations support C2S (Mastodon, Pleroma, Misskey), so you are stuck in a bubble you are creating yourself.
Honestly, I would appreciate if the work that is being done to create toys around AP was instead focused on fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy.@phnt C2S API has always been a solution looking for a problem, but it is similar enough to FEP-ae97 API, so I have no issue with people devoting their time to fixing C2S.
However, almost nobody actually works on it. There is a lot of cheap talk, but anyone who actually tries to implement C2S quickly realizes how broken it is and gives up. Most progress so far has been made by a single developer (btw: I began to document some aspects of his implementation in FEP-9f9f: Collections).
>fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy
The working group is too busy renaming
https://www.w3.org/ns/activitystreams#Publictoas:Public
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@silverpill If you did, I missed it. Thanks, looks very helpful.
-
>But those are not very helpful if I think I followed their rules, yet other servers don't want to talk to my code.
Maybe I mentioned it already, but here is a guide for ActivityPub developers that describes how protocol actually works: https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md
-
@eyeinthesky I post on two accounts, so if you follow by something other than account, you see the same thing twice.
-
#w3c #ActivityPub Esteemed Fediverse, a personal remark
it currently matters again to have a chair who knows what is going on, is striving for facts, understanding fascism and having a will to resist imperialism. And the capacity to save net neutrality.
#stabilHey @darius
thank you for this:
https://lists.w3.org/Archives/Public/public-socialweb/2026Jan/0000.html
!---
Currently we move our projects to codeberg and so i just published a first document there about our fedi projects.
https://codeberg.org/Menschys/fedi-codebase
We would really like to have building blocks for ahealthy and fair Client-To-Server supported ActivityPub.Current Issues are linked. If you want, I can give you an overview of the Social CG dev meetings since 2016 and the European Events like fedicamp, fediday, Public Spaces, 3C etc.
-
@j12t Nope. I don’t follow either one. I saw the post because of the hashtags. It’s not just you. I see this duplication with other accounts too.
-
" I absolutely do not see how this is in any way worse for Black people than oligarch-controlled centralized spaces"
Which is the difference between me and you. Which is the difference between millions of Black people and you.
And you are not owed an explanation. Just go away before I block you.
And no, Black people can't exist here without being bothered unless they're on an unmoderated instance. For example, right now, I, a proud son of Africa, I'm being bothered by some weirdo with Zaire in their handle, that's trying to tell me how moderation works on the Fediverse.
-
@achim@social.saarland I have found activitypub.academy to be a very helpful implementation to test against as well!
-
@mekkaokereke the very inherent factors that let nazis set up camp on the Fediverse work both ways. good people can hang out here on the fediverse without being interfered with by any state or corporation. and said good people can, and do fediblock the fuck out of the vocal minority of fash. I absolutely do not see how this is in any way worse for Black people than oligarch-controlled centralized spaces that range only from fascist to mediocrily centrist.
