I also found this in your SECURITY.md:

https://codeberg.org/Profpatsch/Profpatsch/src/commit/249aa389a2023814b328af8fc795750fd28d995d/users/Profpatsch/activitypub-go/security.md#response-body-size-limits

@liaizon

do you mean I have to check the new http signature on every 30x response? I don’t believe that can work??

which means lowercasing is a bad-bad!

e.g. ideal world: “host and scheme should be lower case”, compat work: “you can lowercase them before comparison, but do it like this: <instructions>”

What hasn’t been considered is the ability of multiple people to speak with “one voice” yet.

Imageboards?

There was one that federated using ActivityPub: https://github.com/FChannel0/FChannel-Server

2. Activity-Level Origin Checks
Same-origin is checked rather than exact equality so that servers with multiple actors can sign on behalf of any of their actors — a common legitimate pattern.

For incoming activities, consider checking exact equality. See FEP-fe34, section "Signatures":

In order to minimize damage in the event of a key compromise or insufficient validation, consumers MUST verify that the signing key has the same owner as the signed object. Consumers MUST also confirm the ownership of the key by verifying a reciprocal claim.

This is not strictly necessary, but would help if the origin server does poor job at validating user input.

3. Embedded Object Origin Checks
Owner origin: the object's owner (actor for Activity subtypes, attributedTo for Notes/Objects) must be same-origin as the signing actor. Anonymous objects (no owner field) are accepted.

In this case I also recommend checking owner ID equality, as a rule of thumb. Because origin servers implementing C2S API may fail to validate all embedded objects (which can be deeply nested).

Response body size limits

You may also need to limit the number of redirects and set a timeout. Some HTTP libraries have bad defaults.

By the way, I collect such recommendations in this guide: https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md#network. Contributions are welcome!

@liaizon

maybe @silverpill wants to take a look at whether this all sounds sensible?

What was also interesting re: #GNUSocial is the unfortunately retracted #ActivityPub #FEP on Unbound Groups i.e. groups (or organizations) that are not bound to a single instance.

See #FEP2100 at https://codeberg.org/fediverse/fep/src/branch/main/fep/2100/fep-2100.md