Live data from Hacker News

ActivityPub: decentralized social networking protocol

w3.org

81–90 of 140 posts

Re: ActivityPub: decentralized social networking protocol

#81
post #51

Earlier quoted context omitted.

> which meant some clients may not honor the private status of theses posts. Does this mean they may have accidentally published a message intended as private, to the public? If so, I don’t think I can imagine a more efficient way to rob me of any confidence I ever had in Mastodon…

Socal media is orthogonal to privacy. If you want to keep something private, don't post it on a social media platform -- or at least, encrypt it out of band before you do.

Perhaps "antithetical" to privacy.

Re: ActivityPub: decentralized social networking protocol

#82

This protocol is a successor to OStatus (GNU Social), and mostly made by the same people. From what I remember, Mastodon switched from OStatus to ActivityPub a few releases ago. In the past they had to extend the OStatus protocol for private messages, which meant some clients may not honor the private status of theses posts. ActivityPub has private messages defined properly in the spec. It seems PeerTube ( https://gi…

Last summer I tried untangling the OStatus/pump.io/ActivityPub/ActivityStreams nest hoping to piece together a big picture mental image based mostly on what Wikipedia has to say, and found it mostly frustrating. For anyone who's similarly curious or confused, LWN published a pretty great overview last month—their "Federation in social networks" article: https://lwn.net/Articles/741218/

I'm the author of the LWN article, so glad to hear the positive feedback. I wrote it because I run a Mastodon instance and have been getting pretty confused about how these fit together. ActivityPub is a very exciting direction and I'm hoping to see Mastodon implement it completely (right now their support is only partial). OStatus comes with a lot of historical baggage - down to the name itself - and that's bumping up poorly against modern expectations like privacy.

Re: ActivityPub: decentralized social networking protocol

#83

Earlier quoted context omitted.

Please don't say that. We already had such pain from HTTP, FTP, and SMTP not starting with it. If building the next version of internet discussion and sharing, we really need first-class support for encryption.

no, we really don't. Not every tool needs to be equipped for private discussions. ActivityPub and OStatus are used for Twitter-style communication. Those aren't high security communication services.

I might be wrong, but I would think that end-to-end public crypto can be used for more than just ensuring privacy.

Re: ActivityPub: decentralized social networking protocol

#85
post #11
post #9

Earlier quoted context omitted.

That need not to be the case, but realistically it is the case for Mastodon & co for now. People are looking into various signature schemes, potentially as extensions of the protocol, but it would have moved the entire thing into very untested waters, which is bad for a new standard. Same with federation: It's what you need right now for "normal" users (e.g. compare user numbers of Mastodon etc to purely p2p alternat…

As a counter example, there are millions of non-technical users using the bittorrent protocol. They are running a server on their machines and not aware of the technical complexity that lies underneath. I am not saying it's an easy UX problem to solve, but it can be done.

BitTorrent only works well (i.e in a true peer to peer fashion) if many people are serving up the same files so that some sources are always online. Outside of piracy that is rarely the case.

Re: ActivityPub: decentralized social networking protocol

#86
post #52
post #48

Earlier quoted context omitted.

That's not true. XMPP can do far more than instant messaging, and it's definitely not complicated (well for a decentralized network and for technical audience of course). For the record I'm the main developer of a XMPP based "social network" project (Salut à Toi), and we are able to communicate natively with others XMPP projects (e.g. Movim) for years (we can share comments like in the video, it's the basis of common…

The problem I've always had with XMPP is that any time I try to do something with it, I get lost in an endless sea of RFCs with no idea of which are important for my use-case (most RFC titles seem fairly jargon-heavy to me). Then, when I go to read an actual RFC, because of the fact that each RFC has some interactions with all other RFCs, they're fairly impenetrable. Is there a document somewhere collecting the most…

> I get lost in an endless sea of RFCs with no idea of which are important for my use-case (most RFC titles seem fairly jargon-heavy to me).

Exactly my feeling when I trying to read ActivityPub and other "federated social network" specs

Re: ActivityPub: decentralized social networking protocol

#87
post #51

Earlier quoted context omitted.

> which meant some clients may not honor the private status of theses posts. Does this mean they may have accidentally published a message intended as private, to the public? If so, I don’t think I can imagine a more efficient way to rob me of any confidence I ever had in Mastodon…

Socal media is orthogonal to privacy. If you want to keep something private, don't post it on a social media platform -- or at least, encrypt it out of band before you do.

I disagree with that, though you might want to think strongly on what you mean by "privacy".

For some people, this is strictly limited to the technical capability to prevent (or allow) the flow of information. I'd long subscribed to this point of view, but have found it inadequate, if only because capabilities have been changing so dramatically on this point.

Rather, and this is something of a personal definition, though I'm not certain it's specific or original to me is that privacy is the ability to define and defend limits and boundaries on information sharing.

You might ask "why use that definition?"

My principle answer is that if it isn't possible to share information in a limited context, then there's something immense and profound which is lost. Two people, or twenty, or even several tens of thousands (say: a large company or government bureaucracy) might need to share information without disclosure.

I've been following the ICIJ's multiple projects on various data leaks, which are particularly poignant in revealing both sides of the argument. On the one hand, the ICIJ itself farms out its data to several hundred journalists from numerous organisations, and keeps a lid on the project until an agreed-on release date. (The group has produced a video showing just this process.)

On the other, ICIJ's stock in trade have been leaks of information from other organisations whose privacy has been breached.

The question of "which of these is right?" should very much arise. And it's not an easy question to answer, though I believe there are some guides which can be used.

As such, privacy is not an inviolable right, but it is a crucial element of social organisation.

Re: ActivityPub: decentralized social networking protocol

#88

Earlier quoted context omitted.

server-to-server signatures are a good start, but what about encrypting messages end-to-end? I assume the servers already talk over HTTPS.

Hello! Co-editor of ActivityPub here. I wrote a paper for Rebooting Web of Trust on how this could be done: https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust...

Thank you! Important part starts half-way down: https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust...

The ideas about using DID's (https://w3c-ccg.github.io/did-spec/) and moving off a common transport like HTTP was also interesting.

Re: ActivityPub: decentralized social networking protocol

#89

Earlier quoted context omitted.

Please don't say that. We already had such pain from HTTP, FTP, and SMTP not starting with it. If building the next version of internet discussion and sharing, we really need first-class support for encryption.

no, we really don't. Not every tool needs to be equipped for private discussions. ActivityPub and OStatus are used for Twitter-style communication. Those aren't high security communication services.

HTTPS ensures more than just privacy. For instance, authenticity.
Post reply on HN