ActivityPub client development is coming along!
General Discussion
20
Posts
6
Posters
24
Views
-
sorry Pleroma devs, I just opened up a 2nd #c2s issue in barely a week, and I have no idea what the project capacity is.
@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years. -
@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years.@django Apparently AndStatus is still developed, so it is still used by something. That said the c2s interface in Pleroma was to be turned off by default I think due to lack of maintenance and recent security issues discovered in it. -
@django Apparently AndStatus is still developed, so it is still used by something. That said the c2s interface in Pleroma was to be turned off by default I think due to lack of maintenance and recent security issues discovered in it.
@phnt I saw the issue. Do you know if it has been confirmed? (The timing is unfortunate)
-
@phnt I saw the issue. Do you know if it has been confirmed? (The timing is unfortunate)
@django There has been some talk about it around the 2.9.1 release months ago iirc, but nothing since. One of the Akkoma maintainers also disclosed recently some information disclosure issues that might affect c2s, so the subject might come up again. But if someone is willing to maintain it and fix issues, it will probably likely stay.
Not sure if Akkoma still has support for it enabled since they have a habit of removing features and options from BE. -
@django There has been some talk about it around the 2.9.1 release months ago iirc, but nothing since. One of the Akkoma maintainers also disclosed recently some information disclosure issues that might affect c2s, so the subject might come up again. But if someone is willing to maintain it and fix issues, it will probably likely stay.
Not sure if Akkoma still has support for it enabled since they have a habit of removing features and options from BE.@phnt I asked about C2S support in their issue queue, and they said they had more or less ripped everything C2S out of the codebase. The vulnerability was reported to Pleroma a few days later 🫤
-
@phnt I asked about C2S support in their issue queue, and they said they had more or less ripped everything C2S out of the codebase. The vulnerability was reported to Pleroma a few days later 🫤
@django Apparently the vulnerability is exactly what I found months ago and never investigated until two days ago :D -
@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years.phnt@fluffytail.org fwiw some of us AP devs have identified that end user applications may not be the ideal (or even the only) use case for C2S.
A more interesting approach would be to pair it with OAuth2 authentication and use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
A more traditional API (e.g. Mastodon API) would be used to communicate with end user apps/sessions etc.
-
Yeah a few of us had a good chat about that approach at the last #fediforum and we're now prototyping that in Bonfire at the moment, as a way to easily add federation capability to non-federated webapps (eg. for an events/calendar app to publish events by just POSTing a JSON with the event info via C2S to a bonfire server).
-
Yeah a few of us had a good chat about that approach at the last #fediforum and we're now prototyping that in Bonfire at the moment, as a way to easily add federation capability to non-federated webapps (eg. for an events/calendar app to publish events by just POSTing a JSON with the event info via C2S to a bonfire server).
mayel@sunbeam.city yessss! That's amazing to hear. NodeBB doesn't support the OAuth2 piece yet, but I am looking forward to getting started!
-
@django Apparently the vulnerability is exactly what I found months ago and never investigated until two days ago :D@django AP C2S has been disabled in Pleroma since 2.9.0, commit: https://git.pleroma.social/pleroma/pleroma/-/commit/d6a136f823c6e749e6d2c4a0f80202f0d7c5a960
Also I've noticed that it doesn't like Content-Type: activity/activity+json and can be quirky with cc/to so I'm not really a fan. I couldn't make a reply to a thread that would properly show up in FE. The parent was always not visible in the thread view, but visible when hovering over the "Replying to <user>" UI element. Probably something weird with addressing I'm missing. -
@julian @django
>use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
Incredibly cursed and another case of "I can doesn't mean I should". I don't think that pretending to be a user should ever be done unless necessary (such as the case of automatic follow acceptance). Especially when it requires external authentication like OAuth2. At least with S2S you can use actor keys, but such concept does not exist in C2S. Not to mention that now none of the big ActivityPub server implementations support C2S (Mastodon, Pleroma, Misskey), so you are stuck in a bubble you are creating yourself.
Honestly, I would appreciate if the work that is being done to create toys around AP was instead focused on fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy. -
@django AP C2S has been disabled in Pleroma since 2.9.0, commit: https://git.pleroma.social/pleroma/pleroma/-/commit/d6a136f823c6e749e6d2c4a0f80202f0d7c5a960
Also I've noticed that it doesn't like Content-Type: activity/activity+json and can be quirky with cc/to so I'm not really a fan. I couldn't make a reply to a thread that would properly show up in FE. The parent was always not visible in the thread view, but visible when hovering over the "Replying to <user>" UI element. Probably something weird with addressing I'm missing.@phnt no me gusta, but it explains why it didn’t work on one instance I tested.
-
@julian @django
>use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
Incredibly cursed and another case of "I can doesn't mean I should". I don't think that pretending to be a user should ever be done unless necessary (such as the case of automatic follow acceptance). Especially when it requires external authentication like OAuth2. At least with S2S you can use actor keys, but such concept does not exist in C2S. Not to mention that now none of the big ActivityPub server implementations support C2S (Mastodon, Pleroma, Misskey), so you are stuck in a bubble you are creating yourself.
Honestly, I would appreciate if the work that is being done to create toys around AP was instead focused on fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy.@phnt C2S API has always been a solution looking for a problem, but it is similar enough to FEP-ae97 API, so I have no issue with people devoting their time to fixing C2S.
However, almost nobody actually works on it. There is a lot of cheap talk, but anyone who actually tries to implement C2S quickly realizes how broken it is and gives up. Most progress so far has been made by a single developer (btw: I began to document some aspects of his implementation in FEP-9f9f: Collections).
>fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy
The working group is too busy renaming
https://www.w3.org/ns/activitystreams#Publictoas:Public
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@eyeinthesky @evan @trwnh the charter has the correct scope. I believe Evan was responding to discussion about the Fediverse and trying to point out the venn diagram overlap of Fediverse and WG charter. As such, indieweb stuff didn't factor in to that conversation. Or at least that was my read -- I raised an eyebrow when I read the email too!
-
@trwnh @evan @darius So maybe the narrow WG focus is aspirational (or participant-specific) rather than official. I've read that Indieweb leaders like Tantek will be involved so that sounds like there's interest from them too. Maybe there will be somewhat independent subgroups working on different subsets of specs?
-
@eyeinthesky @evan @darius a lot of this is probably in https://github.com/swicg/meetings but you'll have to find it first -- it's not in one piece
-
@eyeinthesky @evan @darius i believe the rechartering process led up to people landing on more or less the following:
- the primary reason for rechartering is that AP people want to work on updating AP/AS2
- however, there are other specs which also need updates, but don't want to recharter separately
- the w3c liaisons advised making the charter broader rather than narrower, to avoid potentially needing to amend the charter
- the work will be driven primarily by availability of editorsiirc?
-
On the W3C SocialCG mailing list, I saw that @evan wrote "The WG ... is focused on a narrow core: Activity Streams and ActivityPub." The WG charter describes a much broader scope. What am I missing?
-
The new W3C #ActivityPub Working Group is not that. Or not just that. It's a "Social Web" Working Group and includes maintenance of ActivityPub, WebSub, Activity Streams, Activity Vocabulary, MicroPub, Linked Data Notifications, Webmention, and LOLA specifications. Maintaining all these disparate specs in one WG seems like it will lead to similar results as the first time this was tried (not great). What's that saying about doing the same thing repeatedly and expecting different results? 🙃
-
@bengo i'm genuinely curious to hear your thoughts on this matter, because it seems to me like activitypub and fedi were never really on the same page, and the w3c spec diverged from the mastodon network almost before it was ever published. is there a path to fixing this within w3c cg/wg structure? what does that look like? are there any other paths?
-
> It's a bad and unfair idea [to make class 3 and 4 changes] [...] Totally respect your position if you disagree
i'm not super familiar with the w3c process but from a pragmatic standpoint what do you do when userspace is already broken and nothing is class conformant?
activitystreams was intended to describe streams of activities, and activitypub was intended for publishing activities to those streams of activities. no one in fedi does this. they syndicate posts and discard activities
