New post: Can we have a more “social” media?
-
New post: Can we have a more “social” media?
https://profpatsch.de/essays/a-more-social-media
On advertising, the Fediverse, and what a more human social web could look like.
Special mentions: @smallcircles, @phnt, @happy-programming
-
Sistema ha pubblicato questa discussione anche su Fediverso il
-
New post: Can we have a more “social” media?
https://profpatsch.de/essays/a-more-social-media
On advertising, the Fediverse, and what a more human social web could look like.
Special mentions: @smallcircles, @phnt, @happy-programming
@Profpatsch oh cool what did you build @happy-programming with?
-
@Profpatsch oh cool what did you build @happy-programming with?
@liaizon Right now it’s two golang files that do a half-assed job at implementing activitypub
-
@liaizon Right now it’s two golang files that do a half-assed job at implementing activitypub
@Profpatsch ah very cool its custom! have you published the code? I would add it to a list of implementations I help manage at https://delightful.club
-
@Profpatsch ah very cool its custom! have you published the code? I would add it to a list of implementations I help manage at https://delightful.club
@liaizon yeah, it’s published, but currently I’d not feel comfortable being listed anywhere, the code is really rough and I haven’t really made sure it’s free of security issues
-
New post: Can we have a more “social” media?
https://profpatsch.de/essays/a-more-social-media
On advertising, the Fediverse, and what a more human social web could look like.
Special mentions: @smallcircles, @phnt, @happy-programming
ADVERTISERS ARE NOT OUR MASTERS
SCALING IS NOT OUR DOGMA -
@liaizon yeah, it’s published, but currently I’d not feel comfortable being listed anywhere, the code is really rough and I haven’t really made sure it’s free of security issues
@Profpatsch honestly seeing it running live and followable I would say you are better off then half the things listed on these lists
-
@Profpatsch honestly seeing it running live and followable I would say you are better off then half the things listed on these lists
@liaizon Haha, that might be true. I did link it in the post, right now it lives at https://codeberg.org/Profpatsch/Profpatsch/src/branch/canon/users/Profpatsch/booster-bot and https://codeberg.org/Profpatsch/Profpatsch/src/branch/canon/users/Profpatsch/activitypub-go
-
New post: Can we have a more “social” media?
https://profpatsch.de/essays/a-more-social-media
On advertising, the Fediverse, and what a more human social web could look like.
Special mentions: @smallcircles, @phnt, @happy-programming
@Profpatsch @smallcircles I think what you described, and implemented with @happy-programming, is something similar to how I would want the infamous "Groups" feature of GNU/Social to work on ActivityPub. An account (Actor of type "Group") that announces certain posts mentioning it with the ability to curate content by its administrators/owners. There have been some small developments on something like that (private groups), but the implementations of it aren't fully compatible with each other.
A group could then Announce all posts mentioning it automatically (like gup.pe) did, could automatically Announce posts only from certain users/instances, or be completely manual approval.
I've described a technical-ish way of achieving that here: https://fluffytail.org/notice/B3kqzWyRLBzINkG3IO -
@Profpatsch @smallcircles I think what you described, and implemented with @happy-programming, is something similar to how I would want the infamous "Groups" feature of GNU/Social to work on ActivityPub. An account (Actor of type "Group") that announces certain posts mentioning it with the ability to curate content by its administrators/owners. There have been some small developments on something like that (private groups), but the implementations of it aren't fully compatible with each other.
A group could then Announce all posts mentioning it automatically (like gup.pe) did, could automatically Announce posts only from certain users/instances, or be completely manual approval.
I've described a technical-ish way of achieving that here: https://fluffytail.org/notice/B3kqzWyRLBzINkG3IO@phnt @happy-programming @Profpatsch
What was also interesting re: #GNUSocial is the unfortunately retracted #ActivityPub #FEP on Unbound Groups i.e. groups (or organizations) that are not bound to a single instance.
See #FEP2100 at https://codeberg.org/fediverse/fep/src/branch/main/fep/2100/fep-2100.md
-
@phnt @happy-programming @Profpatsch
What was also interesting re: #GNUSocial is the unfortunately retracted #ActivityPub #FEP on Unbound Groups i.e. groups (or organizations) that are not bound to a single instance.
See #FEP2100 at https://codeberg.org/fediverse/fep/src/branch/main/fep/2100/fep-2100.md
@smallcircles @phnt @happy-programming I am skeptical of that, because of the mess that is the matrix protocol
-
@liaizon Haha, that might be true. I did link it in the post, right now it lives at https://codeberg.org/Profpatsch/Profpatsch/src/branch/canon/users/Profpatsch/booster-bot and https://codeberg.org/Profpatsch/Profpatsch/src/branch/canon/users/Profpatsch/activitypub-go
@liaizon fwiw I made & deployed some security improvements, the current security mechanisms are documented in https://codeberg.org/Profpatsch/Profpatsch/src/commit/249aa389a2023814b328af8fc795750fd28d995d/users/Profpatsch/activitypub-go/security.md
maybe @silverpill wants to take a look at whether this all sounds sensible?
-
@liaizon fwiw I made & deployed some security improvements, the current security mechanisms are documented in https://codeberg.org/Profpatsch/Profpatsch/src/commit/249aa389a2023814b328af8fc795750fd28d995d/users/Profpatsch/activitypub-go/security.md
maybe @silverpill wants to take a look at whether this all sounds sensible?
@liaizon @silverpill I want to write a blog post on this at one point, but I don’t know if I missed anything or misunderstand things.
-
@liaizon @silverpill I want to write a blog post on this at one point, but I don’t know if I missed anything or misunderstand things.
2. Activity-Level Origin Checks
Same-origin is checked rather than exact equality so that servers with multiple actors can sign on behalf of any of their actors — a common legitimate pattern.For incoming activities, consider checking exact equality. See FEP-fe34, section "Signatures":
In order to minimize damage in the event of a key compromise or insufficient validation, consumers MUST verify that the signing key has the same owner as the signed object. Consumers MUST also confirm the ownership of the key by verifying a reciprocal claim.
This is not strictly necessary, but would help if the origin server does poor job at validating user input.
3. Embedded Object Origin Checks
Owner origin: the object's owner (actor for Activity subtypes, attributedTo for Notes/Objects) must be same-origin as the signing actor. Anonymous objects (no owner field) are accepted.In this case I also recommend checking owner ID equality, as a rule of thumb. Because origin servers implementing C2S API may fail to validate all embedded objects (which can be deeply nested).
Response body size limits
You may also need to limit the number of redirects and set a timeout. Some HTTP libraries have bad defaults.
By the way, I collect such recommendations in this guide: https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md#network. Contributions are welcome!
-
New post: Can we have a more “social” media?
https://profpatsch.de/essays/a-more-social-media
On advertising, the Fediverse, and what a more human social web could look like.
Special mentions: @smallcircles, @phnt, @happy-programming
@Profpatsch @smallcircles @phnt
What hasn’t been considered is the ability of multiple people to speak with “one voice” yet.
Imageboards?
There was one that federated using ActivityPub: https://github.com/FChannel0/FChannel-Server
-
@Profpatsch @smallcircles @phnt
What hasn’t been considered is the ability of multiple people to speak with “one voice” yet.
Imageboards?
There was one that federated using ActivityPub: https://github.com/FChannel0/FChannel-Server
@silverpill @Profpatsch @smallcircles @phnt theres also https://oeee.cafe
-
@Profpatsch @smallcircles @phnt
What hasn’t been considered is the ability of multiple people to speak with “one voice” yet.
Imageboards?
There was one that federated using ActivityPub: https://github.com/FChannel0/FChannel-Server
@silverpill @smallcircles @phnt uh, I want to stay away from image boards as far as possible, they are the opposite of healthy communities. I have no clue how my post made you think “probably image boards” lol, did I not use the word “human” enough
-
2. Activity-Level Origin Checks
Same-origin is checked rather than exact equality so that servers with multiple actors can sign on behalf of any of their actors — a common legitimate pattern.For incoming activities, consider checking exact equality. See FEP-fe34, section "Signatures":
In order to minimize damage in the event of a key compromise or insufficient validation, consumers MUST verify that the signing key has the same owner as the signed object. Consumers MUST also confirm the ownership of the key by verifying a reciprocal claim.
This is not strictly necessary, but would help if the origin server does poor job at validating user input.
3. Embedded Object Origin Checks
Owner origin: the object's owner (actor for Activity subtypes, attributedTo for Notes/Objects) must be same-origin as the signing actor. Anonymous objects (no owner field) are accepted.In this case I also recommend checking owner ID equality, as a rule of thumb. Because origin servers implementing C2S API may fail to validate all embedded objects (which can be deeply nested).
Response body size limits
You may also need to limit the number of redirects and set a timeout. Some HTTP libraries have bad defaults.
By the way, I collect such recommendations in this guide: https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md#network. Contributions are welcome!
@silverpill @liaizon I’d say we should rewrite these standards to have a “here’s how an ideal world would look like” and then “here’s what you might want to do for compatibility with existing implementations” approach, instead of that horrible MUST/MAY/SHOULD trainwreck.
e.g. ideal world: “host and scheme should be lower case”, compat work: “you can lowercase them before comparison, but do it like this: <instructions>”
-
@silverpill @liaizon I’d say we should rewrite these standards to have a “here’s how an ideal world would look like” and then “here’s what you might want to do for compatibility with existing implementations” approach, instead of that horrible MUST/MAY/SHOULD trainwreck.
e.g. ideal world: “host and scheme should be lower case”, compat work: “you can lowercase them before comparison, but do it like this: <instructions>”
@silverpill @liaizon not dunking on your work ofc, but I think the “best practices” around writing standards are just not very good unfortunately
-
@silverpill @liaizon not dunking on your work ofc, but I think the “best practices” around writing standards are just not very good unfortunately
@silverpill @liaizon Like, even just using urlparse() from different languages exposes us to implementation difference issues, so a simple split("#")[0] equality is *way* better than urlparse & field comparison for security reasons.
which means lowercasing is a bad-bad!
Ciao! Sembra che tu sia interessato a questa conversazione, ma non hai ancora un account.
Stanco di dover scorrere gli stessi post a ogni visita? Quando registri un account, tornerai sempre esattamente dove eri rimasto e potrai scegliere di essere avvisato delle nuove risposte (tramite email o notifica push). Potrai anche salvare segnalibri e votare i post per mostrare il tuo apprezzamento agli altri membri della comunità.
Con il tuo contributo, questo post potrebbe essere ancora migliore 💗
Registrati Accedi