I think the #ActivityPub client-to-server API is extremely important and underrated.
Fediverso
100
Posts
11
Posters
72
Views
-
@evan @julian@fietkau.social @julian@activitypub.space @smallcircles i think there needs to be a way to get a consistent event log in-order from the canonical/authoritative source. failing that, though, the least you could do is have your activities refer to each other in an obvious way. Undo(Accept(Follow)) lets you reverse-reconstruct what happened because all 3 activities are right there (hopefully fetchable!). so maybe Undo(Add) makes more sense than Remove; perhaps we say that the Remove is the result of the Undo?
@evan @julian@fietkau.social @julian@activitypub.space @smallcircles i guess you could hack it with inReplyTo on the Activity, if you assume responses always come after the thing they are responding to (although i could make a famous joke here about answering a question before it is asked).
-
@evan @julian@fietkau.social @julian@activitypub.space @smallcircles i guess you could hack it with inReplyTo on the Activity, if you assume responses always come after the thing they are responding to (although i could make a famous joke here about answering a question before it is asked).
@evan @julian@fietkau.social @julian@activitypub.space @smallcircles anyway, to address julian (not lam)'s question: what does Accept(Note) even mean? what does it entail? can you always assume it has to do something with a replies collection that may or may not be there?
-
@julian @deadsuperhero @evan POST outbox is the vision of C2S btw -- nodebb is a client in that regard, letting users publish activities of whatever they did on nodebb, to their activity stream.
i recently filed an issue on ap-api for "suggested activities" to improve the security issues with letting others POST to your outbox directly: https://github.com/swicg/activitypub-api/issues/53
-
@julian@activitypub.space @general@activitypub.space @evan@cosocial.ca Again, this is sort of why I'm advocating for supporting timelines as a concept in the ActivityPub API. Instead of repeatedly parsing the inbox, we could do exactly what you're saying with some kind of representation of a timeline. Even if it's just plain old algorithmic time-sort.
@deadsuperhero @general @julian @evan concept: attaching Applications to your inbox, each of which do their own thing. right now we have effectively monolithic apps that have exactly one "internal AP client" attached to the inbox.
-
> it seems a waste of resources to try to track it.
is it? did someone ask to receive updates of every single change? if not, then maybe. the level of detail is an open parameter here...
-
I haven't seen anyone use Add and Remove activities to notify updates to the `outbox`. I don't think it would work; it's too recursive.
I've done it for other feeds, like `replies` or `followers`, and it works pretty well.
> use Add and Remove activities to notify updates to the `outbox`. I don't think it would work; it's too recursive.
i'm tracking inbox items and outbox items as separate from the activity content/payload. no source release yet but the idea is that inboxes receive "notifications" instead of "activities". notifications have their own timestamps so receiving a notification whose activity content claims to be in the future/past won't cause any confusion for readers.
-
#ActivityPub builds on top of #ActivityStreams in the sense that it adopted a number of its 'social primitives' defined in its vocabulary, and Collection being among those. These particular uses become 'protocol space', but other than that AS from the perspective of AP solution development is purely a set of social primitives, granular building blocks that one *may* use in a solution. AS is a utility library of sorts then. Or is that a wrong perception?
A 'feed' is something that lives in solution space, and I would only choose Collection to model it, if it offers a perfect fit in functionality. And aboveall.. does not assign some new app-specific use along the way.
I tooted today that I feel the biggest folly of the fedi is that everyone tries to cram their domain into the AS namespace. The AS primitives should not be Swiss army knives and have only singular well-defined meaning and purpose, yet they have become that along the way.
@smallcircles @evan @julian if only the application domain of activitystreams was activities and streams... ;)
i do think it causes a lot of confusion to stray away from activities as content, instead using them as vehicles for state changes (which will never be consistent, not even eventually consistent).
back when atompub and atom+as1 were a thing, the "feed entry" was atom semantics and the "activity stream" was as1 semantics. they coexisted in the same xml file. it worked well enough.
-
@smallcircles @evan @julian if only the application domain of activitystreams was activities and streams... ;)
i do think it causes a lot of confusion to stray away from activities as content, instead using them as vehicles for state changes (which will never be consistent, not even eventually consistent).
back when atompub and atom+as1 were a thing, the "feed entry" was atom semantics and the "activity stream" was as1 semantics. they coexisted in the same xml file. it worked well enough.
Yes, for the ideation on Protosocial as an #ActivityPub compliant extension (going back to the roots with blank slate W3C specs) I imagined mapping the AS primitives to consistent protocol capabilities and thereby define a set of normative architecture patterns, like "this is how we do CRUD, this is Publish/Subscribe, this is an Event stream and this a Collection", etc.
Then Protosocial library and SDK implementers would need to deal with #ActivityStreams at a low-level plumbing impl detail, while solution developers would have a higher-level API to invoke these patterns. And other than that would not need to touch #ActivityStreams which is now entirely reserved to making AP work on the wire.
A combination of linked data practices and schema-based design would be used for both open-world and closed-world extension modeling. But here too the solution developer should be shield from the nitty gritty internal mechanics.
-
@evan @julian@fietkau.social @julian@activitypub.space @smallcircles anyway, to address julian (not lam)'s question: what does Accept(Note) even mean? what does it entail? can you always assume it has to do something with a replies collection that may or may not be there?
@trwnh That's kinda what I'm getting at, yeah. The goal is to express that the owner of the replied-to object has accepted a reply, i.e. that the reply is added to the post's replies collection and shown under it in the web view. Followers and other observers are made aware this reply is accepted and can be shown similarly in other places that want to honor the poster's reply filters, so observers don't need to iterate over the replies collection all the time.
-
@trwnh That's kinda what I'm getting at, yeah. The goal is to express that the owner of the replied-to object has accepted a reply, i.e. that the reply is added to the post's replies collection and shown under it in the web view. Followers and other observers are made aware this reply is accepted and can be shown similarly in other places that want to honor the poster's reply filters, so observers don't need to iterate over the replies collection all the time.
@trwnh The GTS interaction controls docs mention the replies collection, but only tangentially. For the purpose of conversation backfilling (which GTS doesn't do yet) I'm wanting to emphasize that the replies collection is the source of truth for replies curated by the object owner.
The Accept(Note) is essentially a hack to allow interactions from servers that don't implement GTS's ReplyRequest activity. I'll discuss with them how best to signal reply acceptance.
-
@trwnh The GTS interaction controls docs mention the replies collection, but only tangentially. For the purpose of conversation backfilling (which GTS doesn't do yet) I'm wanting to emphasize that the replies collection is the source of truth for replies curated by the object owner.
The Accept(Note) is essentially a hack to allow interactions from servers that don't implement GTS's ReplyRequest activity. I'll discuss with them how best to signal reply acceptance.
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles
> express that the owner of the replied-to object has accepted a reply, i.e. that the reply is added to the post's replies collection and shown under it in the web view
i get that, but the question is whether you can claim this understanding universally for all peers. as it stands, Accept is very vague wrt this. Accept(Note) meaning "Add to replies collection" might be a thing gts does, but that's their interpretation of Accept, not the definition.
-
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles
> express that the owner of the replied-to object has accepted a reply, i.e. that the reply is added to the post's replies collection and shown under it in the web view
i get that, but the question is whether you can claim this understanding universally for all peers. as it stands, Accept is very vague wrt this. Accept(Note) meaning "Add to replies collection" might be a thing gts does, but that's their interpretation of Accept, not the definition.
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles
> replies collection is the source of truth for replies curated by the object owner.
this is fine i think, but the way to do this usually is HTTP GET. you could notify of changes to the replies collection, or you could reify the Reply and then Accept that?
the Reply has an instrument which is the Note. it has clear side effects to Add the instrument to the object.replies. the side effects can be gated behind Accept/Reject like following currently works.
-
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles
> replies collection is the source of truth for replies curated by the object owner.
this is fine i think, but the way to do this usually is HTTP GET. you could notify of changes to the replies collection, or you could reify the Reply and then Accept that?
the Reply has an instrument which is the Note. it has clear side effects to Add the instrument to the object.replies. the side effects can be gated behind Accept/Reject like following currently works.
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles alternatively add the Reply itself, parallel to likes/shares collections. it depends on whether you think the replies collection should always contain a specific type of object, which i don't think is something you can guarantee because publishers can do anything with it. similar to how some publishers include activities in threads and some include notes.
-
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles alternatively add the Reply itself, parallel to likes/shares collections. it depends on whether you think the replies collection should always contain a specific type of object, which i don't think is something you can guarantee because publishers can do anything with it. similar to how some publishers include activities in threads and some include notes.
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles i think the issue here is that projects are doing things that may or may not get widely adopted, then if the proposals ever change, they have to deal with older software only understanding the old thing they tried. (this is where i would say something about protocol capability negotiation)
-
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles
> express that the owner of the replied-to object has accepted a reply, i.e. that the reply is added to the post's replies collection and shown under it in the web view
i get that, but the question is whether you can claim this understanding universally for all peers. as it stands, Accept is very vague wrt this. Accept(Note) meaning "Add to replies collection" might be a thing gts does, but that's their interpretation of Accept, not the definition.
@trwnh This is in the context of a FEP draft which prescribes a meaning (including desired side effects) for compliant implementations.
Hence my fidgeting with the vocabulary. The effects are the goal, the question is how they should be expressed and broadcasted. (Principle of least surprise, potential compatibility with existing implementations that look at the replies collection, concerns around server traffic...)
-
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles i think the issue here is that projects are doing things that may or may not get widely adopted, then if the proposals ever change, they have to deal with older software only understanding the old thing they tried. (this is where i would say something about protocol capability negotiation)
@trwnh There's also this, yeah. GTS interaction controls have already gone through one breaking schema revision from version 0.19 to 0.21 (with 0.20 trying to manage both), and a core goal of the FEP I'm working on is to not break compatibility again.
Sending out an Add in addition to the Accept(Note) that's already happening should be non-breaking for existing implementations, I'm pretty sure. What's left to decide is whether it's a good idea.
-
@trwnh There's also this, yeah. GTS interaction controls have already gone through one breaking schema revision from version 0.19 to 0.21 (with 0.20 trying to manage both), and a core goal of the FEP I'm working on is to not break compatibility again.
Sending out an Add in addition to the Accept(Note) that's already happening should be non-breaking for existing implementations, I'm pretty sure. What's left to decide is whether it's a good idea.
@julian@fietkau.social @evan @julian@activitypub.space @smallcircles this makes me really wish people didn't overload the AS2 vocab so much, and were less afraid of defining their own extensions. you could swing it so that the same activity is an Add, Accept, and ReplyAck. it sucks that we have to pick one instead of using whatever makes sense. (developers: please support multityping and/or duck typing! composability is the only true path to extensibility, and one size never fits all...)
-
@trwnh There's also this, yeah. GTS interaction controls have already gone through one breaking schema revision from version 0.19 to 0.21 (with 0.20 trying to manage both), and a core goal of the FEP I'm working on is to not break compatibility again.
Sending out an Add in addition to the Accept(Note) that's already happening should be non-breaking for existing implementations, I'm pretty sure. What's left to decide is whether it's a good idea.
@julian@fietkau.social in a parallel conversation not about interaction controls, @rimu@piefed.social made the case for batching events, which I'm going to repurpose as an argument against sending additional activities for backward compatibility (unless absolutely necessary.)
> As a user can do a great number of notable things (posting content, liking content, following others) each minute and there can be thousands of instances to send to, a great many POST requests can be sent in a short amount of time.
>
> For example if 5 people cast 20 votes and there are 500 instances, the instance hosting the community containing the posts being voted on must send 5 * 20 * 500 = 50,000 HTTP POSTs. -
Except when they are called other names instead ;p
A timeline is a different thing than a collection imho. And an AS collection has some very particular functionality, which if I model a timeline in my app may not supported (e.g. reverse ordering).
Collection / 'timeline' is one of those words where sometimes they indicate an app domain, and sometimes a core protocol mechanism. Same is true with 'follow' which is sometimes a user action, sometimes indicates low-level publish/subscribe.
For core capabilities that must be part of the specs, in 'protocol space' it may be better to use terminology that is more common in messaging architectures and all the various architecture patterns that are involved. Perhaps idk we deal with a time-ordered event log or something like that.
@smallcircles @evan An AS2 Collection cannot be a timeline (in general). It’s not even ordered. An AS2 OrderedCollection (a subtype of Collection) might be ordered by time or not, so it’s also not a timeline (in general). When they are ordered by some time value (unspecified in AP) they are often called “streams” in the spec. The Mastodon content timelines are not the same as AP activity streams although a filtered AP stream can be transformed to a content timeline.
-
@smallcircles @evan An AS2 Collection cannot be a timeline (in general). It’s not even ordered. An AS2 OrderedCollection (a subtype of Collection) might be ordered by time or not, so it’s also not a timeline (in general). When they are ordered by some time value (unspecified in AP) they are often called “streams” in the spec. The Mastodon content timelines are not the same as AP activity streams although a filtered AP stream can be transformed to a content timeline.
@steve I think
we need to emphasize that timelines can be built from regular collections, even unordered ones, by using some intermediate representations specific to the type of timeline that a client wants to render.The fact that the specification does not directly support a mapping between a collection and a responsive timeline, *DOES NOT MEAN* one can't be built from it, only that it requires a little more effort on the client side.
My goto example is how rich mail clients allow responsive mailbox representations on top of a much less expressive collection method that IMAP provides compared to ActivityPub.
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@smallcircles @steve @mariusor
I think in particular the terms "publisher" and "consumer" from AS2 and "client" and "server" from AP don't always map cleanly, especially with HTTP POST requests.
When a client delivers an activity to the actor's outbox, the client is the publisher of that activity, and the server is the consumer.
Same when a sending server (publisher) delivers an activity to a receiving server (consumer).
-
-
Yeah, this is how I'd expect it to work (with the possible addition of *also* allowing cookie auth on the client side)
But yeah. Locally authenticated user from my client -> my server, then HTTP signature from my server -> your server
-
Week in Fediverse 2026-02-20
Servers
- snac v2.90
- Castopod v1.15.0
- Ktistec v3.3.0
- tootik v0.21.1
- Badgefed v0.1.1
- Gush! v0.0.30
- Wanderer v0.18.5
- PieFed v1.6.6
- Our technical direction (Mastodon)Clients
- Sengi v1.8.0
- tooi v0.21.2
- Summit v1.77.0
- Aria v1.4.3
- Pixelix v4.3.2Tools and Plugins
- feed2fedi v3.5.0
- PeerTube Browser: A video discovery project for the federated PeerTube networkProtocol
- FEP-34c1: Collection Filtering using TREE Hypermedia Vocabulary
Articles
- Where Does Community Live?
- Why MAEPs? What should they look like?
- how to not regret c2s
- Reimagining Fediverse Advocacy
- FR#154 – Search and Community-----
#WeekInFediverse #Fediverse #ActivityPub
Previous edition: https://mitra.social/objects/019c5906-05c0-87bf-8302-8226a8513c00
-
@mariusor I have implemented it requiring OAuth on one side and using HTTP Signature on the other. I think you need to use the user's authorization for private content or to respect personal blocks. It sucks for caching but ¯\_(ツ)_/¯
-
@smallcircles @steve sure. I am not a fan of the idea that AP is a message-passing system; it's a read-write API.
-
@thisismissem it's not explicitly saying to forward authorization, but to me that's implied from "require authentication":
proxyUrl: Endpoint URI so this actor's clients may access remote ActivityStreams objects which require authentication to access
-
@evan @benpate @steve @mariusor @smallcircles my understanding of proxyUrl is that it's just fetching a remote object, but without forwarding authorization
For many cases you want to forward the request as the authenticated user to the remote server, not doing the request anonymously
