Flag Activity

[fentiger@zotum.net]

Is there any information anywhere on how the Flag activity is used in practice?

As ever, the spec only tells me that it exists; it doesn't say anything about what it contains, where it gets delivered to, how the recipient processes it, etc.

Maybe I could find out more by setting up some test instances and experimenting with it, or by trying to trawl through various repositories to find the relevant source code - but it seems a lot quicker to just ask.

#ActivityPub #ActivityPubDev #FediDev #FediDevs

[evan@activitypub.space]

I think there's some information in the Trust and Safety TF initial report:

https://github.com/swicg/activitypub-trust-and-safety

[silverpill@mitra.social]

@fentiger https://socialhub.activitypub.rocks/t/how-do-account-reports-federate-is-there-sample-data/2813

[julian@activitypub.space]

opliko@infosec.exchange did you look up any other sources when you implemented flag support in NodeBB?

cc fentiger@zotum.net

[thisismissem@activitypub.space]

Yeah, we've still gotta write the FEP that describes Flag activities in detail.

[thisismissem@activitypub.space]

The way we want this to work is essentially that we have a new moderatedBy property on Actors, and that references an Actor to which moderation activities should be delivered, if that's missing, then your only option is to send to the inbox/sharedInbox of the actor you're flagging. I'm trying to work through writing the FEP at the moment, but we need some sort of "proof" that the actor indicated in moderatedBy does actually consent to moderating that other actor, which is a bit of complexity.

Beyond that, we want to separate the reported object from the evidence for the report, currently those are mushed together in the object property. The actor is currently always your "instance actor" but with moderatedBy the actor would be your moderation actor.

For compatibility with Mastodon, the objects must include the reported actor and the objects owned by that actor that are being reported. The content property (which in this case, does not support localisation via contentMap) is used as the message to the remote moderator. That is typically truncated at 5000 characters, though other implementations may have different truncation lengths. The server must also be "responsible for" or involved in, the objects referenced.

There is currently not mechanism for indicating categorisation of the report (e.g., spam, illegal content, etc), this will probably be proposed as happening through moderation labels (another FEP we're working on)

[fentiger@zotum.net]

@Emelia Thanks - this is exactly the kind of detail I wanted to see, and I think this would make a great FEP.

if that's missing, then your only option is to send to the inbox/sharedInbox of the actor you're flagging.

This doesn't seem ideal - doesn't this mean that the recipient has to look at the activity type to decide where it gets delivered (to the user themselves, or to the site moderator)?

• This seems like a layering violation; I'm trying to separate the transport layer (delivery to to/cc/audience) from the application layer (interpretation of particular activity types) and this adds a need for the transport layer to inspect the type field
• If the recipient doesn't do this then the activity could be delivered to the user who's being flagged - which seems like something that should be avoided.

Luckily I don't think I'll need to do this for the application I have in mind.

[thisismissem@activitypub.space]

You asked this here: https://activitypub.space/topic/fd53b73d-bf92-4e81-a5ae-5a681e4aacd4/flag-activity?_=1768647932631

There has been no changes in status from what I last said, because I get almost zero time to work on AP T&S. I can probably explain Flag activities better in a call or something than quickly in text.