Context deletion vs. Removal brainstorming

[julian@activitypub.space]

Currently I am grappling with the specifics behind how to federate out the deletion of a topic in a category (or in ForumWG terms, the deletion of a context from an audience.)

For those unaware, a context is essentially an OrderedCollection containing all objects within its purview.

Deleting a note or other object is easy. If you are same-origin as the object, you Delete(Object), done.

Deleting a context is more difficult... you can't rely on other implementors to store references to your contexts, since it is essentially meaningless to them. Furthermore, if a context is deleted, then when a Delete(Context) is federated out, receivers will have no idea what they're seeing, will try to retrieve the object, and find a 404. So it doesn't even work at all.

Even worse, you can't really delete other peoples' contexts (or for that matter, their content) since you're not same-origin.

Finally, I realized I'm looking at this the wrong way — I'm not deleting contexts, I'm simply removing them from an audience. Remove works perfectly fine when the context continues to exist (as it can be referenced and duck typed). Remove also works for remote content; the same-origin check applies to the audience you're removing from.

If you're deleting a context, you have to be the same-origin, and you really should just federate out deletion of the local members in that collection, via regular Delete(Object).

I suppose federating out self-destruction of a context would be the most complete but it is quite difficult to do when it is no longer resolvable...

[silverpill@mitra.social]

@julian I forgot, why do you want to delete a context? If it's your thread, isn't it enough to just Delete the top-level post?

[julian@activitypub.space]

I'm looking into federating out deletion of contexts because in NodeBB the concept of a topic is a discrete entity, not tied to the posts contained within. Deleting the top-level post would not alter the topic in any way, except perhaps that the next oldest reply is suddenly promoted to top-level, which is odd.

Conversely, in ActivityPub, there either is no concept of a context (threaded objects only), or merely the suggestion of one as a view (current implementations of resolvable contexts). I'm hoping to move this more towards contexts as discrete entities with their own activities.

[silverpill@mitra.social]

I think context property should point to a collection (a dynamic view), but we can introduce a new Delete-able object that is linked to that collection. It could be an actor: https://codeberg.org/fediverse/fep/src/branch/main/fep/f06f/fep-f06f.md

You also mentioned Remove, how it should look in practice? Remove from what target?

[julian@activitypub.space]

At least from the point of view of NodeBB, when a topic is deleted, the Collection is de facto gone. That's why it's problematic to federate out a delete because nobody else can resolve it to find their "version" of your context.

[julian@activitypub.space]

However specifically in response to your suggestion to use an Object Observer, I am not entirely sold on the concept because it feels like an unnecessary abstraction for the purposes of skirting around a limitation in the ActivityPub specification.

In your proposed structure (feel free to correct if wrong), a resolvable context would declare an observer property pointing to an Actor, who would be federating actions out on its behalf. However, it has the same technical hurdle — lack of existing implementation — than the alternative, which is to multi-type the collection into ["OrderedCollection", "Service"] or similar.

> You also mentioned Remove, how it should look in practice? Remove from what target?

No target, but origin. The collection is removed from the audience, so the audience is set in origin.

[julian@activitypub.space]

Obligatory mentions to trwnh@mastodon.social and helge@mymath.rocks because I called out multi-typing, which is a whole other conversation in and of itself.

[trwnh@mastodon.social]

@julian activitypub has no concept of replies either. neither `inReplyTo`/`replies` nor `context` were specced for activitypub. these are more generally terms from the activitystreams vocabulary, and they have no side effects defined or associated with them

[trwnh@mastodon.social]

@julian in theory there shouldn't be anything wrong with saying a Collection is also something else, but activitypub's delivery algorithm will have unintended consequences if you address a Collection that has its own inbox

also Remove is defined with respect to object+target, not object+origin. yes, this is somewhat confusing because in english we remove "from" rather than remove "to", but that's far from the only slip-up. (currently AS2 also defines you Invite an Event to a Person...)

[trwnh@mastodon.social]

@julian for what it's worth, this is what i was trying to head off in the past several months of discussion, with regards to as:context *being* an as:Collection, as opposed to *having* an associated as:Collection. it's why i wrote https://w3id.org/fep/2931 to extend from https://w3id.org/fep/7888

changing the activitypub delivery algorithm would probably end up needing new properties: one that delivers directly (deliverToActor) and one that delivers to expanded items (deliverToCollection)

[trwnh@mastodon.social]

@julian prior art: Web Access Control differentiates subjects who are being granted authorization to access a certain resource. they have separate properties

- agent = every value is a foaf:Agent, and access is granted directly to each entity
- agentGroup = every value is a foaf:Group, and access is granted indirectly to each foaf:member
- agentClass = every value is a rdfs:Class, and access is granted according to vocab

the classes are Agent (as:Public) and AuthenticatedAgent (logged in only)

[trwnh@mastodon.social]

@julian so we have kind of a problem of data modeling, where we have actors (inbox), collections (items[*].inbox), possibly groups which could either deliver directly (inbox) or indirectly per foaf (member[*].inbox) or double-indirectly via swicg/groups task force's current proposal (members.items[*].inbox)

we could *maybe* avoid this by directly specifying which inboxes to deliver to, a la multibox (https://w3id.org/fep/0499 is one take on this), but it's unclear which if any/all are supported.

[trwnh@mastodon.social]

@julian hopefully this demonstrates why the distinction between "is a" and "has a" matters a lot. in the group case you would need to distinguish between delivering to a group vs delivering to a group's members. currently there's a lot of ambiguity around this in 1b12 applications.

[julian@activitypub.space]

trwnh@mastodon.social You're speaking theoretically... that the spec says that if a collection is addressed, then all members in that collection are by definition addressed.

Do you have an example of this in the wild? This has the potential to be a speed bump that is entirely theoretical, and can be ignored in advance of its removal from the AS2 (or AP?) spec(s).

[julian@activitypub.space]

trwnh@mastodon.social oh doy... of course it exists in the wild, we address to follower collections all the time.

... but crucially, when you address a follower collection, you don't resolve the follower collection itself, you rely on the follower to forward your activity onwards... so, again, perhaps resolving a collection for addressing isn't actually used in-practice?

[trwnh@mastodon.social]

@julian yes, this is how followers-only posts in mastodon work. they address your followers collection, which gets expanded to all items in the followers collection.

[julian@activitypub.space]

trwnh@mastodon.social I am going to argue technical details here — when Mastodon sends a followers-only post, they are addressing the followers collection but they aren't parsing it to retrieve targets. They already know them internally and build the targets separately.

I still know of no known implementation that sends an activity addressing a collection, and resolves that collection to find the actor ids.

[trwnh@mastodon.social]

@julian you could, and arguably you should/must, but "no one currently does this" is not the same as "no one will ever do this". consider the case of a public collection.example, and you author an activity to:[collection.example] which you HTTP POST to outbox.example... the specified behavior is that outbox.example fetches collection.example with your credentials and discovers inbox on any items[*]. there is undefined behavior when collection.example has an inbox.

[trwnh@mastodon.social]

@julian mastodon doesn't resolve anything directly over HTTP but they do the equivalent internally with an SQL query. the case where a Collection has an inbox is unhandled because mastodon ignores anything that isn't Person/Group/Organization/Application/Service. mastodon i think also disallows addressing collections that aren't your own followers collection (potentially overzealous spam protection?)

[trwnh@mastodon.social]

@julian in "technical terms" the reason no one has to worry about this issue is because no one implements activitypub, and when they deliver, they generally disallow delivering to any collections except your own followers collection.

imagine addressing someone else's followers collection, or your own following collection, or a group's members collection, or a public collection. those are all possible in activitypub and would behave according to the specified delivery algorithm for any AP outbox