8 ms·
To those of you pushing for ActivityPub: Webber's trashed it (the initial author) and is working on a way to mitigate the problems of it by implementing incomp
by kick 7y ago
To those of you pushing for ActivityPub:
Webber's trashed it (the initial author) and is working on a way to mitigate the problems of it by implementing incompatible changes, the biggest piece of software claiming to implement it doesn't even implement it (Mastodon), the only piece of software that stays semi-faithful is full of devs who hate it (Pleroma).
AP is completely broken for anything but publicly-scoped content, relying on a lot of trust for every party involved. This gets broken frequently, and has had consequences so far on networks implementing it (like half of them are incompatible implementations, so I think it's completely fine to say "networks").
The specification itself is far too ambiguous. Here's a post by a maintainer of Diaspora explaining this part further: https://schub.io/blog/2018/02/01/activitypub-one-protocol-to-rule-them-all.html https://schub.io/blog/2018/02/01/activitypub-one-protocol-to...
So let's assume you can get Twitter to implement ActivityPub perfectly to-spec. Great! It doesn't work with literally any pre-existing ActivityPub software, and users' DMs and are more or less public, with users' private accounts literally being public.
I use AP daily, and while it's fine for technical users with a reasonable understanding that anything they post is public, putting naive users' data at risk has never and will never be acceptable; pushing AP will harm everyone.
- laksmanv 7y agoCould I shoot you an email about this?
- kick 7y agoI guess. I'll ping you on yours so you can say whatever; I don't keep mine in my profile (mostly out of laziness).
- jasonzemos 7y agoI'd rather see interest in Matrix than ActivityPub.
- kick 7y agoMatrix has a lot of problems, too, but at least it's not fundamentally flawed, which is a good thing.
- Arathorn 7y ago(matrix proj lead here): ooi what sort of problems are you thinking of here? just to check they are on our radar at the right priority.
- kick 7y ago(Breaking out this sentence into blocks because it's very large.) The specification as-written is really, really bad (though I don't think this is a fault of the protocol), Synapse is kind of...and work on Dendrite seems to have mostly stalled, the billion people signed up on matrix.org has allowed for a sort of de facto centralization (not a huge problem, though in practice it sort of is, given how much the server buckles under the weight of all of the users; might be solved if it's ever moved onto a more performant implementation?), the lack of encryption by default is iffy (though done for understandable reasons). To lend credence to the specification being bad: "I tried writing a matrix homeserver but I couldn't figure out how the state resolution process works" said by the author of Audacious/one of the authors of Pleroma/much more, so certainly a person who should be able to understand something that simple: https://socially.whimsic.al/notice/9oxtjVqQw8gRS6QDKa https://socially.whimsic.al/notice/9oxtjVqQw8gRS6QDKa I know multiple people who've tried to implement the spec but who have gotten stuck on things that should be simple but are unclear if going by the spec.
- Arathorn 7y agoThanks for answering. > The specification as-written is really, really bad We get a pretty wide range of feedback on the spec fwiw: some people seem to really like it. Others say that it’s “really, really bad” which doesn’t exactly give us much to go on... > Synapse is kind of... and Dendrite is stalled We have no choice but improve Synapse currently, and while it is still quite a resource hog it’s improved by at least 3-5x over the last year. Dendrite instead has become more of an R&D project for future homeserver shapes, but it’s not entirely stalled. > The matrix.org server causes de-facto centralisation The server has been less than 50% of the visible network for several years now - and ironically the datacenter perf issues (unrelated to Synapse) we had over the last few months have shifted that balance further - it’s about 35% and dropping. Ideally we will turn it off entirely once we have decentralised accounts. > lack of e2ee by default is iffy Our main project right now is to fix this. Cross-signing is mid flight; E2E search is done; Pantalaimon (E2E compat for dumb clients) is done; remaining key distribution bugs are in flight. We’re aiming to turn it in by default in Jan. > “I couldn’t figure out how the state resolution works” State resolution is the main technical novelty in Matrix, and yeah - it’s hard, much like git’s merge resolution is not exactly easy either. Unfortunately it comes with the territory; if you want to have consistent room state while replicating them over a byzantine network of servers to stop hijacks and other abuse, you have a relatively hard problem to solve. We got it wrong the first time; the current version gets it right (as far as we know). The spec (which is deliberately formal and terse) is https://matrix.org/docs/spec/rooms/v2 https://matrix.org/docs/spec/rooms/v2 However, there are supporting documents linked from the spec to help clarify: the original spec proposal at https://github.com/matrix-org/matrix-doc/blob/erikj/state_res_msc/proposals/1442-state-resolution.md https://github.com/matrix-org/matrix-doc/blob/erikj/state_re... and the guide at https://matrix.uhoreg.ca/stateres/reloaded.html https://matrix.uhoreg.ca/stateres/reloaded.html etc Ironically I think that state res is one of the best documented and understood bits of Matrix now (which is just as well, given how important it is).
- mactavish88 7y agoSure, Mastodon doesn't implement the full ActivityPub spec [0]. They're still very much behind the effort though, it seems [1] (or at least they were in 2018). I'm not a Mastodon developer, nor have I developed with it, but surely there are learnings there that could potentially be contributed back to the W3C to make ActivityPub better (including making it more rigorously spec'd). The people at the W3C are not gods - they're human beings just like the rest of us. Why not get involved in the conversation there? The only genuine reason I can think of to split away from the ActivityPub effort to build a completely different protocol would be if the W3C's working group on ActivityPub is filled with such toxic politics that it's impossible to make any progress on making the spec better. (That's been the only reason I could see in the past when I've been part of protocol standardization efforts). Without evidence of that, however, I'd say that it's far better for the community to get involved in making the existing spec better. Robust debate (supported by evidence, such as that which Mastodon's built up) is incredibly valuable to the community as a whole. Also, it's incredibly valuable from a political decentralization perspective to have as neutral a party as possible facilitating the standardization efforts, to minimize the risk of Big Tech shaping standards in ways that would suit them financially (and potentially against the interests of the average internet user). [0] - https://activitypub.rocks/implementation-report/ https://activitypub.rocks/implementation-report/ [1] - https://blog.joinmastodon.org/2018/06/why-activitypub-is-the-future/ https://blog.joinmastodon.org/2018/06/why-activitypub-is-the...
- kick 7y agoSure, Mastodon doesn't implement the full ActivityPub spec [0]. They're still very much behind the effort though, it seems [1] (or at least they were in 2018). Not only this, but they go against it in multiple places. How they've implemented 'summary' and the bizarre things they've done to create compatibility with Misskey (but not in an actually-compatible way, Misskey's had to patch their own solution every time) has made every implementation have to implement an against-spec trashfire. I'm not a Mastodon developer, nor have I developed with it, but surely there are learnings there that could potentially be contributed back to the W3C to make ActivityPub better (including making it more rigorously spec'd). Alternatively, the AP spec is fundamentally broken in many ways, and that effort would be better off going into a protocol like Secure Scuttlebutt (not a fan, but it's much better than AP) or Diaspora (also not a fan, but it's much better than AP). The people at the W3C are not gods - they're human beings just like the rest of us. Why not get involved in the conversation there? The only genuine reason I can think of to split away from the ActivityPub effort to build a completely different protocol would be if the W3C's working group on ActivityPub is filled with such toxic politics that it's impossible to make any progress on making the spec better. (That's been the only reason I could see in the past when I've been part of protocol standardization efforts). Not only politics, but it's incredibly slow. Webber has written a post on how troublesome the standardization process was, though he doesn't go into just how bad it was: https://dustycloud.org/blog/on-standards-divisions-collaboration/ https://dustycloud.org/blog/on-standards-divisions-collabora... Without evidence of that, however, I'd say that it's far better for the community to get involved in making the existing spec better. Robust debate (supported by evidence, such as that which Mastodon's built up) is incredibly valuable to the community as a whole. There are already existing specifications, none of them as bad as ActivityPub. I'm fully for going in one of those directions, but AP is more or less a failed experiment. Also, it's incredibly valuable from a political decentralization perspective to have as neutral a party as possible facilitating the standardization efforts, to minimize the risk of Big Tech shaping standards in ways that would suit them financially (and potentially against the interests of the average internet user). W3C is not neutral, and not only are they not neutral, but the RIAA and MPAA are people with enough sway to have messed up the entire web multiple times (see: making EME a standard). A neutral party sounds great! The W3C should not get to be involved, however.
- djsumdog 7y agoI've contribute to Mastodon and run an instance. Yes, it's very silly to think you can use Activity Pub for non-public things .. but isn't that going to be true of ANY distributed social networking protocol? Direct point-to-point we can make secure (relatively) yes. You can run your own e-mail server, setup up PGP keys, and once you make it through that usability nightmare, you now have secure e-mail (if you trust your hosting provider) that will probably get dropped as SPAM 1/3 of the time when e-mailing anyone on Google/MS/Yahoo. There's an interesting case where Mastodon and Pleroma respect and forward delete requests. Say you have a thread started on BigInstanceA and I reply from PersonalInstanceB. Someone from IAC replies to the same thread and B sees it, but A can't because C is banned from A. The reply gets dropped. You now have two conversations not in sync. Say A deletes the original. B gets the delete request, but C never does, since it's a banned instance from A's perspective and doesn't exist ... even though it has a full copy of the deleted thread. Deletes are truly fucking silly in the AP world. As much criticism as Zuckerberge gets (and deserves), back in the day he just wanted everything public, and I'm kinda for that too. If I post something online, it's never personal. If I need to talk about something personal, I call a friend, or text them, or meet them in a bar or plan my next vacation to be in their city. Real conversations don't happen in this space.
- anaphor 7y agoNot necessarily, if you use an actor-model where content is addressable using cryptographic keys, then you can get an object-capability system where having a reference to a piece of content is sufficient to grant access to it. This seems to be the way that some people are going with newer designs. Also, the way you ban people is basically by having unique capabilities handed out to everyone. Then you can do various things to stop access (it's called a revoker in ocap jargon). See http://habitatchronicles.com/2017/05/what-are-capabilities/ http://habitatchronicles.com/2017/05/what-are-capabilities/
- kick 7y agoHi djsumdog! Weird to see you here! Use search to find Kaniini's threads about Rapunzel. Also, no, it's not something inherent in distributed social networking as a whole (previous attempts have avoided it), and it's not even inherent to push protocols, but without a bit of thinking behind it, it's easy to collide with. Deleting is stupid, though, yeah.
- the8472 7y ago> putting naive users' data at risk has never and will never be acceptable That's a misrepresentation of history. Being responsible for your own data hygiene has been the norm in many online circles for a long time. I have often experienced pretend-stalking (e.g. via exif information not stripped from images) as a way of opening the eyes of community members about the data they leak.
- danShumway 7y agoI think this is a mischaracterization. I've read Webber's writing on OcapPub[0], and his more recent writing on ActivityPub[1]. I'm not getting the impression that Webber thinks ActivityPub is broken, or that he's stopped advocating for it, or that he's trying to replace it. In his own words: > "OcapPub" sounds like a new protocol, whereas it's really just a way-to-use ActivityPub mostly as it already exists. Maybe time for a new name for that? Even if Webber does think ActivityPub has fundamental problems, he doesn't seem to be discouraging anyone from pushing it. I mean, go ahead and watch his most recent talk and decide whether or not Webber is "trashing" ActivityPub.[2] > "It was 3 years of really hard work, and it wasn't clear in the process if it was going to pay off. And it has. We now have this as a standard that we can all use to be able to speak to each other, and I think this is really exciting." [0]: https://gitlab.com/spritely/ocappub/blob/master/README.org https://gitlab.com/spritely/ocappub/blob/master/README.org [1]: https://dustycloud.org/blog/2019-10-01-updates/ https://dustycloud.org/blog/2019-10-01-updates/ [2]: https://conf.tube/videos/watch/2b9a985b-ccdd-49ce-a81b-ed00d2b47c85 https://conf.tube/videos/watch/2b9a985b-ccdd-49ce-a81b-ed00d...
- faissaloo 7y agoThis is a silly criticism, the same thing happened with HTTP, that's why HTTP 1.1 happened
- masukomi 7y agoActivityPub literally isn't a viable solution to this because it isn't decentralized. It's federated. There's a big difference.
- emacsen 7y ago> Webber's trashed it (the initial author) and is working on a way to mitigate the problems of it by implementing incompatible changes, This is not true on multiple levels Webber has not trashed ActivtiyPub. I'd love if you could provide some evidence. And the updates, in the form of OcapPub, are not at all incompatible with the current AP. They're an optional add-on that has a good default behavior. Source: I worked on the same paper where Webber talks about improving ActivityPub, I presented my own white paper about ActivityPub. I gave a talk about these possible upgrades at the ActivityPub conference and I do a podcast with Webber where we talk about ActivityPub.
- asymmetric 7y agoWhat’s the podcast named?
- FemmeAndroid 7y agoI think it's Libre Lounge - https://librelounge.org/ https://librelounge.org/
- fiatjaf 7y agoThank you for saying this. ActivityPub is so wrong in so many ways, and still people keep pushing it as if it was a silver bullet. I think people who talk about it and think it's very good never tried to understand it or write something with it.
- sectiondetail 7y agoI don't think people are pushing ActivityPub as a silver bullet, so much as they're using it as "the currently-available and less-awful alternative to closed silos". If someone is starving, they're not going to hold out for a gourmet cheesecake that's a year away from being made. They'll happily take an immediately-available baked potato instead.
- kick 7y agoDiaspora's been here for years and works better than AP; AP is purely hype.
- sectiondetail 7y agoI do apologize; you seem to have mistaken me as someone who actually cares about your weird axe-to-grind obsession on the subject. I'm sorry if this mistaken impression has come across.
- fiatjaf 7y agoPeople are pushing AP as a silver bullet. Look at this thread! Twitter is funding work to be done in more than an year and people are saying that should just use AP. And that analogy doesn't make any sense.
- sectiondetail 7y agoI disagree. I think most of the people in this thread are promoting Activitypub merely as a starting point. Sure, it could use some tweaks and improvements, but it's a good foundation to build on.
- neonate 7y agoHe showed up here to dispute what you're saying: https://news.ycombinator.com/item?id=21764564 https://news.ycombinator.com/item?id=21764564.