Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ActivityPub: decentralized social networking protocol

w3.org

Post reply on HN
Print view View original

21–30 of 140 posts

Re: ActivityPub: decentralized social networking protocol

#21

Post by EGreg »

I have been in touch with Tim Berners-Lee and his Solid project since late 2016. Since then, I've run across many people who work at W3C and in the protocol space, and it's inspired me to open up and publish protocols derived from our platform (eg https://github.com/Qbix/auth)

But I believe that, in the end of the day, mass adoption can only be done when there is a popular platform. Whether it's closed source like Facebook or Twitter, or open source like Qbix, it needs to be actually used. That's how, for instance, oAuth came to be so widely adopted, and many others.

Here is an overview of what I mean: https://vimeo.com/252105786

Protocols like Scuttlebutt or ActivityPub can be bolted on after the actual infrastructure is there.

Re: ActivityPub: decentralized social networking protocol

#22

Post by olegkikin »

jeswin wrote: post #7

From my quick read of the spec, server-to-server federation assumes that servers can be trusted. That need not be the case; unless a message is signed it should not be assumed to have come from a specific user. I don't know if there's an easy way to share keys in a decentralized way, but that'd be an interesting problem to solve (some blockchain maybe). The other question is whether we want server-to-server federatio…

> I don't know if there's an easy way to share keys in a decentralized way

Blockchain. Namecoin, in particular.

Re: ActivityPub: decentralized social networking protocol

#23

Post by nothrabannosir »

kemenaran wrote: post #5

This protocol is a successor to OStatus (GNU Social), and mostly made by the same people. From what I remember, Mastodon switched from OStatus to ActivityPub a few releases ago. In the past they had to extend the OStatus protocol for private messages, which meant some clients may not honor the private status of theses posts. ActivityPub has private messages defined properly in the spec. It seems PeerTube ( https://gi…

> which meant some clients may not honor the private status of theses posts.

Does this mean they may have accidentally published a message intended as private, to the public?

If so, I don’t think I can imagine a more efficient way to rob me of any confidence I ever had in Mastodon…

Re: ActivityPub: decentralized social networking protocol

#24

Post by NetOpWibby »

rogerbraun wrote: post #18
kemenaran wrote: post #5

This protocol is a successor to OStatus (GNU Social), and mostly made by the same people. From what I remember, Mastodon switched from OStatus to ActivityPub a few releases ago. In the past they had to extend the OStatus protocol for private messages, which meant some clients may not honor the private status of theses posts. ActivityPub has private messages defined properly in the spec. It seems PeerTube ( https://gi…

Privacy on the level of AP would have been very easy to add, by just using a different salmon endpoint for private messages. This was discussed at length back then, but Mastodon still chose to implement the leaky-by-default changes. There's nothing in AP that can't be done using OStatus, with very very minor extensions.

Could you elaborate on "salmon endpoint"?

Re: ActivityPub: decentralized social networking protocol

#25

Post by rogerbraun »

nothrabannosir wrote: post #23
kemenaran wrote: post #5

This protocol is a successor to OStatus (GNU Social), and mostly made by the same people. From what I remember, Mastodon switched from OStatus to ActivityPub a few releases ago. In the past they had to extend the OStatus protocol for private messages, which meant some clients may not honor the private status of theses posts. ActivityPub has private messages defined properly in the spec. It seems PeerTube ( https://gi…

> which meant some clients may not honor the private status of theses posts. Does this mean they may have accidentally published a message intended as private, to the public? If so, I don’t think I can imagine a more efficient way to rob me of any confidence I ever had in Mastodon…

Yes, and this was known to the main developer. There were easy ways to make it at least private if the other server was trusted, but they chose to not implement them.

Re: ActivityPub: decentralized social networking protocol

#27

Post by kemenaran »

rogerbraun wrote: post #25
nothrabannosir wrote: post #23

Earlier quoted context omitted.

> which meant some clients may not honor the private status of theses posts. Does this mean they may have accidentally published a message intended as private, to the public? If so, I don’t think I can imagine a more efficient way to rob me of any confidence I ever had in Mastodon…

Yes, and this was known to the main developer. There were easy ways to make it at least private if the other server was trusted, but they chose to not implement them.

Which is why they switched to dual OStatus / ActivityPub broadcasting – except for private messages, which are now only sent over ActivityPub.

All of this without breaking compatibility across instances running different versions; quite a nice piece of engineering IMHO.

Re: ActivityPub: decentralized social networking protocol

#28

Post by tbv »

jeswin wrote: post #7

From my quick read of the spec, server-to-server federation assumes that servers can be trusted. That need not be the case; unless a message is signed it should not be assumed to have come from a specific user. I don't know if there's an easy way to share keys in a decentralized way, but that'd be an interesting problem to solve (some blockchain maybe). The other question is whether we want server-to-server federatio…

We're discussing that situation here:

https://github.com/beakerbrowser/beaker/issues/820

We have two different p2p social feed apps that are compatible, but as we plan for future development we're considering ActivityPub/ActivityStreams

Re: ActivityPub: decentralized social networking protocol

#29

Post by [deleted] »

rogerbraun wrote: post #25
nothrabannosir wrote: post #23

Earlier quoted context omitted.

> which meant some clients may not honor the private status of theses posts. Does this mean they may have accidentally published a message intended as private, to the public? If so, I don’t think I can imagine a more efficient way to rob me of any confidence I ever had in Mastodon…

Yes, and this was known to the main developer. There were easy ways to make it at least private if the other server was trusted, but they chose to not implement them.

[deleted]

Re: ActivityPub: decentralized social networking protocol

#30

Post by rogerbraun »

kemenaran wrote: post #27
rogerbraun wrote: post #25

Earlier quoted context omitted.

Yes, and this was known to the main developer. There were easy ways to make it at least private if the other server was trusted, but they chose to not implement them.

Which is why they switched to dual OStatus / ActivityPub broadcasting – except for private messages, which are now only sent over ActivityPub. All of this without breaking compatibility across instances running different versions; quite a nice piece of engineering IMHO.

this doesn't make much sense. The very easy way to add AP-level privacy to ostatus was to just use a different salmon endpoint for private messages. This way, messages would never have federated to servers that don't respect privacy settings (by accident. if the server leaks on purpose, that's a different story).

This solution was discussed at length with mastodon devs before the implementation of the private messages. It was ignored. Now we have a situation were Mastodon is likely to switch off OStatus soon, leaving behind all those projects that don't have the dev resources to rewrite their core federation systems every few years.

The Ostatus/AP dual stack is also pretty hacky and not even valid according to the AP spec, although it's getting better all the time.

Post reply on HN