4 ms·

Last summer I tried untangling the OStatus/pump.io/ActivityPub/ActivityStreams nest hoping to piece together a big picture mental image based mostly on what Wik

Last summer I tried untangling the OStatus/pump.io/ActivityPub/ActivityStreams nest hoping to piece together a big picture mental image based mostly on what Wikipedia has to say, and found it mostly frustrating. For anyone who's similarly curious or confused, LWN published a pretty great overview last month—their "Federation in social networks" article: https://lwn.net/Articles/741218/ https://lwn.net/Articles/741218/

coldacid 9y ago
Thanks for this. I was grinding my wheels much the same way, so hopefully this LWN article will clear things up for me.
Xeoncross 9y ago
Thanks! After reading that article I'm curious where public key cryptography fits into this.
- rogerbraun 9y ago
  In AP, messages are signed with http signatures (https://tools.ietf.org/html/draft-cavage-http-signatures-09 https://tools.ietf.org/html/draft-cavage-http-signatures-09). OStatus has a similar mechanism called salmons, which are signed XML payloads.
  - Xeoncross 9y ago
    server-to-server signatures are a good start, but what about encrypting messages end-to-end? I assume the servers already talk over HTTPS.
    - rogerbraun 9y ago
      it's really not worth it. If people want to exchange encrypted messages, they should use a proper tool for that.
      - Xeoncross 9y ago
        Please don't say that. We already had such pain from HTTP, FTP, and SMTP not starting with it. If building the next version of internet discussion and sharing, we really need first-class support for encryption.
        rogerbraun 9y ago
        no, we really don't. Not every tool needs to be equipped for private discussions. ActivityPub and OStatus are used for Twitter-style communication. Those aren't high security communication services.
        CodeMage 9y ago
        I might be wrong, but I would think that end-to-end public crypto can be used for more than just ensuring privacy.
        recursive 9y ago
        HTTPS ensures more than just privacy. For instance, authenticity.
        freshhawk 9y ago
        They turn into security problems in aggregate. For example, the threat to me from actors slurping up social media data to nudge/manipulate people at a large scale is much larger than the threat to me than someone reading my group chats to my friends or a lot of other personal info that is generally considered more private and more in need of high security. If my personal twitter-style communication got out it would be worse to me than my more private messages, but it is worse to me personally if all the twitter style communication gets out than only my more private messages. You have to account for manipulative big data risks in your analysis, thinking only about your personal data is an outdated approach.
        PaulRobinson 9y ago
        Start with the safe and secure option, figure out how to dial it down and open it up. Doing it the other way around? We literally have 50 years of experience of that being a terrible, terrible idea.
    - paroneayea 9y ago
      Hello! Co-editor of ActivityPub here. I wrote a paper for Rebooting Web of Trust on how this could be done: https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/final-documents/activitypub-decentralized-distributed.md https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust...
      - Xeoncross 9y ago
        Thank you! Important part starts half-way down: https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/final-documents/activitypub-decentralized-distributed.md#end-to-end-encryption https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust... The ideas about using DID's (https://w3c-ccg.github.io/did-spec/ https://w3c-ccg.github.io/did-spec/) and moving off a common transport like HTTP was also interesting.
jcrawfordor 9y ago
I'm the author of the LWN article, so glad to hear the positive feedback. I wrote it because I run a Mastodon instance and have been getting pretty confused about how these fit together. ActivityPub is a very exciting direction and I'm hoping to see Mastodon implement it completely (right now their support is only partial). OStatus comes with a lot of historical baggage - down to the name itself - and that's bumping up poorly against modern expectations like privacy.

coldacid 9y ago

Thanks for this. I was grinding my wheels much the same way, so hopefully this LWN article will clear things up for me.

Xeoncross 9y ago

Thanks! After reading that article I'm curious where public key cryptography fits into this.

rogerbraun 9y ago
In AP, messages are signed with http signatures (https://tools.ietf.org/html/draft-cavage-http-signatures-09 https://tools.ietf.org/html/draft-cavage-http-signatures-09). OStatus has a similar mechanism called salmons, which are signed XML payloads.
- Xeoncross 9y ago
  server-to-server signatures are a good start, but what about encrypting messages end-to-end? I assume the servers already talk over HTTPS.
  - rogerbraun 9y ago
    it's really not worth it. If people want to exchange encrypted messages, they should use a proper tool for that.
    - Xeoncross 9y ago
      Please don't say that. We already had such pain from HTTP, FTP, and SMTP not starting with it. If building the next version of internet discussion and sharing, we really need first-class support for encryption.
      - rogerbraun 9y ago
        no, we really don't. Not every tool needs to be equipped for private discussions. ActivityPub and OStatus are used for Twitter-style communication. Those aren't high security communication services.
        CodeMage 9y ago
        I might be wrong, but I would think that end-to-end public crypto can be used for more than just ensuring privacy.
        recursive 9y ago
        HTTPS ensures more than just privacy. For instance, authenticity.
        freshhawk 9y ago
        They turn into security problems in aggregate. For example, the threat to me from actors slurping up social media data to nudge/manipulate people at a large scale is much larger than the threat to me than someone reading my group chats to my friends or a lot of other personal info that is generally considered more private and more in need of high security. If my personal twitter-style communication got out it would be worse to me than my more private messages, but it is worse to me personally if all the twitter style communication gets out than only my more private messages. You have to account for manipulative big data risks in your analysis, thinking only about your personal data is an outdated approach.
        PaulRobinson 9y ago
        Start with the safe and secure option, figure out how to dial it down and open it up. Doing it the other way around? We literally have 50 years of experience of that being a terrible, terrible idea.
  - paroneayea 9y ago
    Hello! Co-editor of ActivityPub here. I wrote a paper for Rebooting Web of Trust on how this could be done: https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/final-documents/activitypub-decentralized-distributed.md https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust...
    - Xeoncross 9y ago
      Thank you! Important part starts half-way down: https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/final-documents/activitypub-decentralized-distributed.md#end-to-end-encryption https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust... The ideas about using DID's (https://w3c-ccg.github.io/did-spec/ https://w3c-ccg.github.io/did-spec/) and moving off a common transport like HTTP was also interesting.

jcrawfordor 9y ago

I'm the author of the LWN article, so glad to hear the positive feedback. I wrote it because I run a Mastodon instance and have been getting pretty confused about how these fit together. ActivityPub is a very exciting direction and I'm hoping to see Mastodon implement it completely (right now their support is only partial). OStatus comes with a lot of historical baggage - down to the name itself - and that's bumping up poorly against modern expectations like privacy.