2 ms·
The info 'xyz liked this post' is not distributed as far as I know. It's not cryptographically signed or anything. It's just to be believed based on the reputat
by TekMol 8y ago
The info 'xyz liked this post' is not distributed as far as I know. It's not cryptographically signed or anything. It's just to be believed based on the reputation of the site the post is on. Or am I missing something?
- wslh 8y agoTo be distributed it doesn't need to be cryptographically signed.
- NoGravitas 8y agoYeah, you're missing something. 'Like' is a kind of message on ActivityPub, and it can be sent from one instance to another (decentralized like email, not distributed like BitTorrent). All messages are signed by the originating server (using HTTP Signatures [0]), so you can verify that the message is actually being sent by that instance, that it has not been tampered with, and that the user the message is attributed to is a user on that instance. There's also an option in the spec to sign message contents with JSON-LD signatures[1] using a key pair specific to the user. Mastodon and Pleroma don't use these because they're considered unnecessary and may have certain drawbacks. [0]: https://tools.ietf.org/id/draft-cavage-http-signatures-01.html https://tools.ietf.org/id/draft-cavage-http-signatures-01.ht... [1]: https://w3c-dvcg.github.io/ld-signatures/ https://w3c-dvcg.github.io/ld-signatures/