2 ms·

> The signature is a relatively small hurdle (it's an RSA public key encoded in base64 ... Heh. If you look at the problem like this, I believe you have alread

> The signature is a relatively small hurdle (it's an RSA public key encoded in base64 ... Heh. If you look at the problem like this, I believe you have already implemented it wrong. The signature has an algorithm that you can specify, but sadly Mastodon only accepts RSA 256 keys which then rippled into the wider ecosystem and everyone is just accepting those. Sigh. A valid HTTPSignature can be built using almost any key algo, the fact that servers only accept RSA is an endless frustration of mine.

jeroenhd 3y ago
That's true, but this post is quite specifically about getting Mastodon to follow the blog. Of course you could use more modern alternatives for other platforms, but like with other federated protocols, your freedom is often restricted by the most outdated common client implementation. Very few ActivityPub servers are actually spec-compliant, but unless Mastodon loses its leading position, I don't think we'll see spec compliance become relevant soon.
- deleted 3y ago
  [deleted]