6 ms·

Eh, it’s worse than just funny; it’s concerning, because they should have known about and easily avoided this kind of vulnerability, it’s standard stuff you hav

Eh, it’s worse than just funny; it’s concerning, because they should have known about and easily avoided this kind of vulnerability, it’s standard stuff you have to think about. So what else have they missed?

steveklabnik 4y ago
This is a private beta. Nobody is suggesting that any of this be used for anything serious just yet. Development happens out in the open, you can go find out what else they've missed by doing the work, or by waiting until others you trust have done so. I myself have had an account for like a month now, but only started really using it a week ago, because that calculus changed for me, personally. Like, it's not even possible to truly delete posts at the moment. This all needs to be treated as a playground until things mature. This isn't even the first "scandal" related to this feature already!!!! There is another hole in what currently exists that allowed someone to temporarily impersonate a Japanese magazine a few weeks back.
- YtvwlD 4y ago
  Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.
  - steveklabnik 4y ago
    I don't personally believe that one mistake indicates ignorance of an entire topic.
    - seba_dos1 4y ago
      In general - no, but this kind of fundamental mistake might.
      - steveklabnik 4y ago
        I hope I never work on software you folks use. The grand claims about something that is not even hard to fix is just wild to me.
        gowld 4y ago
        What about the next 500 easy-to-fix bugs? Is there a public test suite?
        steveklabnik 4y ago
        > Is there a public test suite? The entire specification (which is admittedly incomplete) and implementation are open source. I am not aware of a dedicated test suite for alternative implementations. It's too early, IMHO. I personally would much prefer the team to focus their time elsewhere for the time being.
        ShroudedNight 4y ago
        My instincts may be way off-base, but if I was developing a protocol at the core of my product vision, even if there was only one implementation, I would a want an authoritative test suite. I wouldn't trust myself not to integrate load-bearing idiosyncrasies (and bugs, honestly) otherwise.
        steveklabnik 4y ago
        I mean, I don't think you're incorrect, but I do think that like, semantics matters here. There is a test suite, of their implementation. Just because they have not extracted it and made it easily re-usable for alternative doesn't mean that they don't have checks to ensure regressions don't appear, you know? They already build off of many related specifications, which have independent implementations, and a lot of the core protocol is RPC style, with schemas that they do publish. So there's already a lot of rigidity here for alternative implementations to use in a way that is extremely likely to be compliant. I guess another way of putting it is "I don't exactly disagree with you but doing that takes work, and we're at the stage of this stuff where that work is being done, so expecting it right now feels premature to me." The spec isn't "released" or "done," it's in development.
  - rchaud 4y ago
    The pull of NIH is a strong one.
  - linuxdude314 4y ago
    Paul has lots of experience designing protocols. He designed SSB. ActivityPub does a lot of things wrong from first principals. The whole point was to start from scratch.
    - mariusor 4y ago
      > ActivityPub does a lot of things wrong from first principals I'd be curious to learn about those.
      - capableweb 4y ago
        There is a lot more information here: https://twitter.com/bluesky/status/1511811083954102273?lang=en https://twitter.com/bluesky/status/1511811083954102273?lang=... From my own understanding, the biggest useful differences for me personally is: account portability, domains as usernames and content-addressable from the ground up. - Account portability - Useful if/when you want to move between servers - Domains as usernames - Ties into the same value as account portability. I've owned my own domain for decades, it never changes and probably won't, until years after I die - Content-addressable - Caching and syncing becomes so much easier, which is a huge issue Mastodon currently suffers from.
        mariusor 4y ago
        Since you seem to default to sending me to RTFM :D, I'll give you a similarly short reply: ActivityPub can identify users based on their domain too. Probably better than BlueSky does, because it uses better standardized mechanisms - the URI needs to dereference to a valid ActivityPub actor and the community has converged to using webfinger for discovery. The fact that web-finger is generally used for user discovery makes it easier to use the identical mechanism that BlueSky uses - where the identity (which in ActivityPub is a URL) is not tied directly to a domain. (Eg, if you do a webfinger query for marius.federated.id you will get a response where it tells you that one of the URLs for the ActivityPub identity associated with that is https://metalhead.club/@mariusor https://metalhead.club/@mariusor, you can check it out right now with curl https://marius.federated.id/.well-known/webfinger?resource=https://marius.federated.id https://marius.federated.id/.well-known/webfinger?resource=h...). Account portability can exist in ActivityPub because the verbs for signaling to the network that an object/actor has moved to a different URL are in the vanilla vocabulary. The fact that nobody has implemented this so far does not make it impossible. (It's not like anyone so far needed to move from BlueSky to ... I don't know... BlueSky. So it being capable of moving identities is still equally theoretical in my view). Regarding your last point (or the one made about it in the twitter thread), I don't really understand about how identifying content by its cryptographic signature is conducive to better caching and "syncing" (how in the world a hash would make it easier to sync content than a URL I don't know). HTTP clients, servers and proxies have very good caching and syncing mechanisms for anything that uses URLs to identify resources. Whatever BlueSky wants to do, must invent their own intermediary layers before anyone will be able to say "it's easier" with any certainty. In my opinion nothing you mentioned can be called a "doing things wrong from first principals(sic)" - and I'm still hoping that linuxdude314 can make a better argument. ActivityPub is fine for what it was designed to be: an exchange mechanism for "low impact" social activity. It's not meant to interact with cryptocurrencies, it's not meant to shelter dissidents from corrupt governments, it's not meant to help you interact with your drug dealer, nor whistle-blow on your employer. There are already options for those things. It is meant to allow your grandma to like your cat pictures in a more distributed manner than facebook offers. The people that imagine BlueSky will be doing something more than that, are - in my opinion - vastly overevaluating it. (PS. Apparently this was not "similarly short", apologies.)
- 9dev 4y ago
  Dunno. That’s such a fundamental piece of thinking you just have to come across in the design phase, I don’t know how you would build a beta that didn’t avoid the issue in the first place unless you had a flawed take on security in the first place.
  - steveklabnik 4y ago
    It is surely easy to cast stones at a single bug, but I don't think that's the right way to look at things.
    - 9dev 4y ago
      I wouldn’t have made my remark if this would just be a bug, though. We’re looking at a bespoke domain ownership verification mechanism that doesn’t handle its primary usecase well, failing at something solved in lots of different ways over the past decades. I have written atrocious bugs over the years, so I’m definitely not in the stone casting business here. However, I can’t see this as simply a bug, rather than a fundamental design flaw. And if an entity is both becoming infamous for reinventing the wheel, and attempting to fill a sensitive niche, I feel it has somewhat of an obligation to accept criticism such as that.
      - steveklabnik 4y ago
        > We’re looking at a bespoke domain ownership verification mechanism that doesn’t handle its primary usecase well Okay this is exactly what I mean. How well do you know the AT Protocol? Because this comment seems to indicate you just learned about it from this link, yet you're still making grand claims like this. This method of validating your identity isn't the primary one. It's not even documented! It was added two weeks ago, as an API endpoint to help serve moderation and administrative needs. Turns out the URL structure of the rest of the API is a bad call for this endpoint. > and attempting to fill a sensitive niche, If you want to criticize AT Protocol on privacy issues, there are far more important things that are closer to the fundamental aspect of the design to criticize.
    - bisby 4y ago
- codetrotter 4y ago
  Are there any Rust implementations of the protocol yet :vv:
  - steveklabnik 4y ago
    Multiple, in varying degrees of maturity. And I'm also writing one from scratch, don't know if I'll bother to share it with anyone though, I just want to learn more deeply, and implementation is the best way to do that. I have my eyes on https://github.com/sugyan/atrium https://github.com/sugyan/atrium as a foundational library in this space, and expect folks to coalesce on it. But we'll see.
- account42 4y ago
  But this isn't a implementation issue. This is a fundamental design issue. If their design philosophy is to throw stuff against the wall and see what fits then I don't see this as ending up as better than the existing fediverse.
capableweb 4y ago
Wouldn't be funny if it was a public beta that they want people to use for serious stuff. But it's neither serious, a beta or public, but basically a private alpha for playing around, so i'd be a bit lenient on screwups.
vidarh 4y ago
For me, the worst thing about it is that they didn't just use webfinger. So webfinger isn't perfect, but it's there and in use. When they choose to invent new mechanisms for things there are perfectly serviceable options for, it makes me instantly sceptical of the rest.

steveklabnik 4y ago

This is a private beta. Nobody is suggesting that any of this be used for anything serious just yet. Development happens out in the open, you can go find out what else they've missed by doing the work, or by waiting until others you trust have done so. I myself have had an account for like a month now, but only started really using it a week ago, because that calculus changed for me, personally. Like, it's not even possible to truly delete posts at the moment. This all needs to be treated as a playground until things mature. This isn't even the first "scandal" related to this feature already!!!! There is another hole in what currently exists that allowed someone to temporarily impersonate a Japanese magazine a few weeks back.

YtvwlD 4y ago
Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.
- steveklabnik 4y ago
  I don't personally believe that one mistake indicates ignorance of an entire topic.
  - seba_dos1 4y ago
    In general - no, but this kind of fundamental mistake might.
    - steveklabnik 4y ago
      I hope I never work on software you folks use. The grand claims about something that is not even hard to fix is just wild to me.
      - gowld 4y ago
        What about the next 500 easy-to-fix bugs? Is there a public test suite?
        steveklabnik 4y ago
        > Is there a public test suite? The entire specification (which is admittedly incomplete) and implementation are open source. I am not aware of a dedicated test suite for alternative implementations. It's too early, IMHO. I personally would much prefer the team to focus their time elsewhere for the time being.
        ShroudedNight 4y ago
        My instincts may be way off-base, but if I was developing a protocol at the core of my product vision, even if there was only one implementation, I would a want an authoritative test suite. I wouldn't trust myself not to integrate load-bearing idiosyncrasies (and bugs, honestly) otherwise.
        steveklabnik 4y ago
        I mean, I don't think you're incorrect, but I do think that like, semantics matters here. There is a test suite, of their implementation. Just because they have not extracted it and made it easily re-usable for alternative doesn't mean that they don't have checks to ensure regressions don't appear, you know? They already build off of many related specifications, which have independent implementations, and a lot of the core protocol is RPC style, with schemas that they do publish. So there's already a lot of rigidity here for alternative implementations to use in a way that is extremely likely to be compliant. I guess another way of putting it is "I don't exactly disagree with you but doing that takes work, and we're at the stage of this stuff where that work is being done, so expecting it right now feels premature to me." The spec isn't "released" or "done," it's in development.
- rchaud 4y ago
  The pull of NIH is a strong one.
- linuxdude314 4y ago
  Paul has lots of experience designing protocols. He designed SSB. ActivityPub does a lot of things wrong from first principals. The whole point was to start from scratch.
  - mariusor 4y ago
    > ActivityPub does a lot of things wrong from first principals I'd be curious to learn about those.
    - capableweb 4y ago
      There is a lot more information here: https://twitter.com/bluesky/status/1511811083954102273?lang=en https://twitter.com/bluesky/status/1511811083954102273?lang=... From my own understanding, the biggest useful differences for me personally is: account portability, domains as usernames and content-addressable from the ground up. - Account portability - Useful if/when you want to move between servers - Domains as usernames - Ties into the same value as account portability. I've owned my own domain for decades, it never changes and probably won't, until years after I die - Content-addressable - Caching and syncing becomes so much easier, which is a huge issue Mastodon currently suffers from.
      - mariusor 4y ago
        Since you seem to default to sending me to RTFM :D, I'll give you a similarly short reply: ActivityPub can identify users based on their domain too. Probably better than BlueSky does, because it uses better standardized mechanisms - the URI needs to dereference to a valid ActivityPub actor and the community has converged to using webfinger for discovery. The fact that web-finger is generally used for user discovery makes it easier to use the identical mechanism that BlueSky uses - where the identity (which in ActivityPub is a URL) is not tied directly to a domain. (Eg, if you do a webfinger query for marius.federated.id you will get a response where it tells you that one of the URLs for the ActivityPub identity associated with that is https://metalhead.club/@mariusor https://metalhead.club/@mariusor, you can check it out right now with curl https://marius.federated.id/.well-known/webfinger?resource=https://marius.federated.id https://marius.federated.id/.well-known/webfinger?resource=h...). Account portability can exist in ActivityPub because the verbs for signaling to the network that an object/actor has moved to a different URL are in the vanilla vocabulary. The fact that nobody has implemented this so far does not make it impossible. (It's not like anyone so far needed to move from BlueSky to ... I don't know... BlueSky. So it being capable of moving identities is still equally theoretical in my view). Regarding your last point (or the one made about it in the twitter thread), I don't really understand about how identifying content by its cryptographic signature is conducive to better caching and "syncing" (how in the world a hash would make it easier to sync content than a URL I don't know). HTTP clients, servers and proxies have very good caching and syncing mechanisms for anything that uses URLs to identify resources. Whatever BlueSky wants to do, must invent their own intermediary layers before anyone will be able to say "it's easier" with any certainty. In my opinion nothing you mentioned can be called a "doing things wrong from first principals(sic)" - and I'm still hoping that linuxdude314 can make a better argument. ActivityPub is fine for what it was designed to be: an exchange mechanism for "low impact" social activity. It's not meant to interact with cryptocurrencies, it's not meant to shelter dissidents from corrupt governments, it's not meant to help you interact with your drug dealer, nor whistle-blow on your employer. There are already options for those things. It is meant to allow your grandma to like your cat pictures in a more distributed manner than facebook offers. The people that imagine BlueSky will be doing something more than that, are - in my opinion - vastly overevaluating it. (PS. Apparently this was not "similarly short", apologies.)
9dev 4y ago
Dunno. That’s such a fundamental piece of thinking you just have to come across in the design phase, I don’t know how you would build a beta that didn’t avoid the issue in the first place unless you had a flawed take on security in the first place.
- steveklabnik 4y ago
  It is surely easy to cast stones at a single bug, but I don't think that's the right way to look at things.
  - 9dev 4y ago
    I wouldn’t have made my remark if this would just be a bug, though. We’re looking at a bespoke domain ownership verification mechanism that doesn’t handle its primary usecase well, failing at something solved in lots of different ways over the past decades. I have written atrocious bugs over the years, so I’m definitely not in the stone casting business here. However, I can’t see this as simply a bug, rather than a fundamental design flaw. And if an entity is both becoming infamous for reinventing the wheel, and attempting to fill a sensitive niche, I feel it has somewhat of an obligation to accept criticism such as that.
    - steveklabnik 4y ago
      > We’re looking at a bespoke domain ownership verification mechanism that doesn’t handle its primary usecase well Okay this is exactly what I mean. How well do you know the AT Protocol? Because this comment seems to indicate you just learned about it from this link, yet you're still making grand claims like this. This method of validating your identity isn't the primary one. It's not even documented! It was added two weeks ago, as an API endpoint to help serve moderation and administrative needs. Turns out the URL structure of the rest of the API is a bad call for this endpoint. > and attempting to fill a sensitive niche, If you want to criticize AT Protocol on privacy issues, there are far more important things that are closer to the fundamental aspect of the design to criticize.
  - bisby 4y ago
codetrotter 4y ago
Are there any Rust implementations of the protocol yet :vv:
- steveklabnik 4y ago
  Multiple, in varying degrees of maturity. And I'm also writing one from scratch, don't know if I'll bother to share it with anyone though, I just want to learn more deeply, and implementation is the best way to do that. I have my eyes on https://github.com/sugyan/atrium https://github.com/sugyan/atrium as a foundational library in this space, and expect folks to coalesce on it. But we'll see.
account42 4y ago
But this isn't a implementation issue. This is a fundamental design issue. If their design philosophy is to throw stuff against the wall and see what fits then I don't see this as ending up as better than the existing fediverse.

capableweb 4y ago

Wouldn't be funny if it was a public beta that they want people to use for serious stuff. But it's neither serious, a beta or public, but basically a private alpha for playing around, so i'd be a bit lenient on screwups.

vidarh 4y ago

For me, the worst thing about it is that they didn't just use webfinger. So webfinger isn't perfect, but it's there and in use. When they choose to invent new mechanisms for things there are perfectly serviceable options for, it makes me instantly sceptical of the rest.