ActivityPub client development is coming along!

[silverpill@mitra.social]

@django Have you tried Oni? https://git.sr.ht/~mariusor/oni

It supports ActivityPub client API and is actively developed

[django@social.coop]

@silverpill I did try back in september, I need to try it again! thx

[silverpill@mitra.social]

@django

cc @mariusor

[phnt@fluffytail.org]

@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years.

[phnt@fluffytail.org]

@django Apparently AndStatus is still developed, so it is still used by something. That said the c2s interface in Pleroma was to be turned off by default I think due to lack of maintenance and recent security issues discovered in it.

[django@social.coop]

@phnt I saw the issue. Do you know if it has been confirmed? (The timing is unfortunate)

[phnt@fluffytail.org]

@django There has been some talk about it around the 2.9.1 release months ago iirc, but nothing since. One of the Akkoma maintainers also disclosed recently some information disclosure issues that might affect c2s, so the subject might come up again. But if someone is willing to maintain it and fix issues, it will probably likely stay.

Not sure if Akkoma still has support for it enabled since they have a habit of removing features and options from BE.

[django@social.coop]

@phnt I asked about C2S support in their issue queue, and they said they had more or less ripped everything C2S out of the codebase. The vulnerability was reported to Pleroma a few days later 🫤

[julian@activitypub.space]

phnt@fluffytail.org fwiw some of us AP devs have identified that end user applications may not be the ideal (or even the only) use case for C2S.

A more interesting approach would be to pair it with OAuth2 authentication and use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.

A more traditional API (e.g. Mastodon API) would be used to communicate with end user apps/sessions etc.

cc django@social.coop

[mayel@sunbeam.city]

@julian

Yeah a few of us had a good chat about that approach at the last #fediforum and we're now prototyping that in Bonfire at the moment, as a way to easily add federation capability to non-federated webapps (eg. for an events/calendar app to publish events by just POSTing a JSON with the event info via C2S to a bonfire server).

@phnt@fluffytail.org @django