Skip to content

ActivityPub

Focused discussion related to ActivityPub integration in NodeBB

52 Topics 629 Posts

Subcategories


  • Discussion and announcements related to the SWICG Forums and Threaded Discussions Task Force

    14 Topics
    233 Posts
    mikedev@fediversity.siteM
    Third party issues are subtle enough that they're obvious only after you actually have to deal with them. I've been dealing with them for a long time now. Both in private groups and multiple protocol interactions - where we were trying to make something from protocol 'A' visible to somebody using protocol 'B' when we ourselves used protocol 'C'.

    Tokens are one way to do it, but they can be real tricky to secure, and they need to be stripped from conversational objects or inReplyTo's and de-duplication don't work correctly. Or give everybody in the conversation the exact same token - in which case they don't  really provide very good access control. These are things most people don't come to grips with until they try it.

    We've traditionally implemented private groups in other protocols by doing a straight resend/relay of a signed activity by the group actor, and we did this in AP with LD-signatures for a while. I don't think Mastodon supports relaying any more because they're now verifying sender-id (via the HTTP-sig) against actor-id and rejecting mismatches.

    FEP-8b32 along with Collections conveniently gets around all of the related issues. The sender and actor id of the Add activity matches, and the object is a complete signed activity.