3 ms·

There are ready made ActivityPub signature algorithms for all kinds of languages. If you're planning on implementing them yourself, you could try finding an exi

There are ready made ActivityPub signature algorithms for all kinds of languages. If you're planning on implementing them yourself, you could try finding an existing implementation to get inspiration from in a language that suits you but I don't agree that there are only Typescript examples. As for the HTTPS thing: last time I messed with ActivityPub, I solved that problem with a Let's Encrypt wildcard certificate that I copy between hosts, but there are ActivityPub servers that will let you run in debug mode and federate over HTTP. I think the problem with implementing ActivityPub is that the protocol looks deceptively simple at first glance, and people seem to expect it to be somewhat like RSS. However, when you actually start implementing it, you realise how many edge cases the protocol needs to deal with (and doesn't deal with). The signature is a relatively small hurdle (it's an RSA public key encoded in base64, almost every language I know has a library to do the hard parts) but it's one of many. ActivityPub isn't a protocol you just tack onto your code in an afternoon, especially if you don't like using external libraries, even if it looks like it's just a bunch of JSON.

lambdaone 3y ago
"Not being a protocol you tack onto your code in an afternoon" suggests that there is a big hole in the ActivityPub ecosystem; it should absolutely be possible to do that. You can, for example, write a basic HTTPS application server in an afternoon in Python, because libraries to implement all the hard bits have already been packaged by someone else. And similar functionality exists in other languages. A similar level of cross-platform library support for ActivityPub would greatly ease its adoption across the universe of Internet applications.
- whstl 3y ago
  I remember about 10-15 years ago there used be packages aimed at supporting ActivityPub, or whatever it was called back them. One of them, for Ruby, was even maintained by Steve Klabnik of Rust fame. Perhaps there's something like that now again, but last I checked, the protocol got quite a bit more complex in its requirements, so there was no ready-to-go option, everything required a lot of manual testing and adaptation.
- jeroenhd 3y ago
  There are a whole bunch of small projects that turn an RSS feed into ActivityPub posts. In theory, a well-placed JSON file (the webfinger part) could direct anyone trying to subscribe to the blog to a dedicated fediverse server. The protocol has been wrapped a whole bunch of times in various languages, but I don't know what protocol this particular blog uses, so I can't comment on what would be appropriate.
mariusor 3y ago
> The signature is a relatively small hurdle (it's an RSA public key encoded in base64 ... Heh. If you look at the problem like this, I believe you have already implemented it wrong. The signature has an algorithm that you can specify, but sadly Mastodon only accepts RSA 256 keys which then rippled into the wider ecosystem and everyone is just accepting those. Sigh. A valid HTTPSignature can be built using almost any key algo, the fact that servers only accept RSA is an endless frustration of mine.
- jeroenhd 3y ago
  That's true, but this post is quite specifically about getting Mastodon to follow the blog. Of course you could use more modern alternatives for other platforms, but like with other federated protocols, your freedom is often restricted by the most outdated common client implementation. Very few ActivityPub servers are actually spec-compliant, but unless Mastodon loses its leading position, I don't think we'll see spec compliance become relevant soon.
  - deleted 3y ago
    [deleted]

lambdaone 3y ago

"Not being a protocol you tack onto your code in an afternoon" suggests that there is a big hole in the ActivityPub ecosystem; it should absolutely be possible to do that. You can, for example, write a basic HTTPS application server in an afternoon in Python, because libraries to implement all the hard bits have already been packaged by someone else. And similar functionality exists in other languages. A similar level of cross-platform library support for ActivityPub would greatly ease its adoption across the universe of Internet applications.

whstl 3y ago
I remember about 10-15 years ago there used be packages aimed at supporting ActivityPub, or whatever it was called back them. One of them, for Ruby, was even maintained by Steve Klabnik of Rust fame. Perhaps there's something like that now again, but last I checked, the protocol got quite a bit more complex in its requirements, so there was no ready-to-go option, everything required a lot of manual testing and adaptation.
jeroenhd 3y ago
There are a whole bunch of small projects that turn an RSS feed into ActivityPub posts. In theory, a well-placed JSON file (the webfinger part) could direct anyone trying to subscribe to the blog to a dedicated fediverse server. The protocol has been wrapped a whole bunch of times in various languages, but I don't know what protocol this particular blog uses, so I can't comment on what would be appropriate.

mariusor 3y ago

> The signature is a relatively small hurdle (it's an RSA public key encoded in base64 ... Heh. If you look at the problem like this, I believe you have already implemented it wrong. The signature has an algorithm that you can specify, but sadly Mastodon only accepts RSA 256 keys which then rippled into the wider ecosystem and everyone is just accepting those. Sigh. A valid HTTPSignature can be built using almost any key algo, the fact that servers only accept RSA is an endless frustration of mine.

jeroenhd 3y ago
That's true, but this post is quite specifically about getting Mastodon to follow the blog. Of course you could use more modern alternatives for other platforms, but like with other federated protocols, your freedom is often restricted by the most outdated common client implementation. Very few ActivityPub servers are actually spec-compliant, but unless Mastodon loses its leading position, I don't think we'll see spec compliance become relevant soon.
- deleted 3y ago
  [deleted]