Thinking about building “#Fedify Studio” (tentative name)—a web-based #ActivityPub debugging & development toolkit, like a supercharged version of ActivityPub
Technical Discussion
6
Post
3
Autori
4
Visualizzazioni
-
Thinking about building “#Fedify Studio” (tentative name)—a web-based #ActivityPub debugging & development toolkit, like a supercharged version of ActivityPub.Academy and
fedify inboxcommand. Imagine having a proper UI for testing activities, inspecting actors, debugging federation issues… Would this be useful for other ActivityPub developers out there?#fedidev #fediverse
-
「Fedify Studio」（仮称）というウェブベースのActivityPubデバッグ・開発ツールを作ろうかと考えています。
fedify inboxコマンドやActivityPub.Academyの強化版みたいなもので、アクティビティのテスト、アクターの検査、フェデレーションの問題調査などがちゃんとしたUIでできるイメージです。ActivityPub開発者の皆さんにとって需要ありそうでしょうか？ -
假稱 「Fedify Studio」라는 웹 基盤의 ActivityPub 디버깅 및 開發 道具를 만들어 볼까 생각 中입니다.
fedify inbox커맨드나 ActivityPub.Academy의 強化版 같은 것으로, 액티비티 테스트, 액터 인스펙터, 聯合 이슈 디버거 等을 제대로 된 UI로 提供하는 느낌인데요. ActivityPub 開發者 분들께 需要가 좀 있으려나요? -
@hongminhee for sure. Check browser.pub also if it's compatible with what you're thinking.
-
@hongminhee for sure. Check browser.pub also if it's compatible with what you're thinking.
@mariusor@metalhead.club Yeah, I'm aware of browser.pub, and Fedify Studio should have a similar component!
-
@hongminhee good!
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@silverpill do you mean that the "malicious" attachment is not a facsimile of an actual note produced by that actor, but a forgery?
In these cases, I'll agree with
@grishka that some validation based on the ID should be necessary.For embedded object attachments on the other hand (like mastodon produces), probably the validation needs to check that attributedTo corresponds to the one of the parent object or missing.
Interesting corner case.
-
> and it's wildly impractical to use anyway.
@grishka shush, you! 🤫
-
@grishka I am developing a client application where this is a real concern.
But I agree that in general, originating servers are responsible for verification of client data. This part of FEP-fe34 will likely be revised in the future.
-
Web Annotations has a neat solution here which is prefers representation, which allows the requestor to ask for minimal or full representation (i.e., just the IDs or the full representations)
You'd still likely want to gate that on authorization
-
@grishka @silverpill @julian @technical-discussion true but we are talking about mistakes. like taking the origin of the keyId on the http sig instead of following the link to the owner/controller. such assumptions might be true for monoliths, but not everything is a monolith
-
@trwnh @silverpill @julian @technical-discussion but even if, the actor object is still the ultimate source of truth as it's the one which contains the key ID
-
@trwnh @silverpill @julian @technical-discussion it can in theory but no software currently in existence supports that
-
@grishka @silverpill @julian @technical-discussion the key can be on a different keyserver
