4 ms·

It means that your identity is tied to the server. If you ever got tired of running your server and decided to just use someone else's server, you can not just

It means that your identity is tied to the server. If you ever got tired of running your server and decided to just use someone else's server, you can not just bring your keys and make a DNS change to point to the new place.

mariusor 2y ago
Just because there isn't such a mechanism in use currently, doesn't mean that there's something preventing ActivityPub actors using the same type of DNS pointing to DID, or IRI mechanism ATProtocol is using.
- rglullis 2y ago
  There are some extensions proposed, but to this day all AP actors are controlled by the server. No ActivityPub software today is built in a way where the client can provide their own keys. They are all generated in the server. Even the "Client-to-Server" AP spec is written in a way where the "client" does not interact with the outside web, but always initiates every interaction through the outbox hosted by the server. I'm not saying this just for pedantry. I'm saying this because I actually wrote a server that implements ActivityPub according to the spec [0], and realized that identity portability is not possible unless you deliberately break away from the AP spec. [0]: https://activitypub.mushroomlabs.com https://activitypub.mushroomlabs.com
  - mariusor 2y ago
    I am not convinced that it can't be done. (Saying this also as someone that wrote a spec compliant ActivityPub server: https://github.com/mariusor/fedbox https://github.com/mariusor/fedbox) Nothing says you can't extend an actor to provide for a did: based identity which gets stored wherever you want to. I think the main dev of Mitra[1] is someone that's exploring very strongly in this direction. [1] https://mitra.social/ https://mitra.social/
- lxgr 2y ago
  I'd consider the effort of migrating the entire ecosystem to a fundamentally different identity resolution mechanism somewhat of a barrier.
  - mariusor 2y ago
    Allowing for extensions to the current ActivityPub/ActivityStreams vocabulary is one of the tenants of the specification. Nothing says everyone must implement everything.
    - lxgr 2y ago
      I don't see how this could be done in a backwards compatible way. How would incompatible servers know to trust a server foo.com to publish posts for an account bar.com? How would they know where to look for bar.com's posts when their users search for it?
genewitch 2y ago
how many bluesky "servers" are there?
- rglullis 2y ago
  Look who is moving the goal posts! We are talking about ActivityPub tying identity to the server. ATProto is designed from the ground to separate user data from your identity (through its Personal Data Servers), so the answer to your question is "many. There are many servers out there." Bluesky has many issues (and I for one still think it has fundamental flaws that still make me prefer AP), but identity coupling is not one of them.
  - genewitch 2y ago
    I think i just don't understand the distinction. I have a domain, so i set up my domain so i have an identity on bluesky. I'm with you on that part. and then what? i can take my identity and do what with it? change PDS? but bluesky itself shows everyone that i am the same person? i didn't move the goalposts, i just don't get the distinction everyone is making here with "identity", of course if i prove i own a domain i can verify, but i can do that on mastodon, too, I can add the below to my domain that will checkmark my username on mastodon. I assume if i move servers and want people to follow me, i will just do the same on that server, too; they know it's me because the service says so. > <a rel="me" href="https://fosstodon.org/@picofarad">Mastodon</a> https://fosstodon.org/@picofarad">Mastodon</a> that is all i have to do to prove i own that username on that instance - put that on a domain i own and add it to one of the user editable fields on my public profile. so maybe you understand my confusion. i never received a bluesky invite nor do i want to pay (a couple mentions here of paying for it). > Verifying your identity on Mastodon is for everyone. Based on open web standards, now and forever free. All you need is a personal website that people recognize you by. When you link to this website from your profile, we will check that the website links back to your profile and show a visual indicator on it. The link on your website can be invisible. The important part is rel="me" which prevents impersonation on websites with user-generated content. You can even use a link tag in the header of the page instead of <a>, but the HTML must be accessible without executing JavaScript. i can also export all my followers, so when i join a new instance, i can direct message them all and let them know i've moved, and they can see it's the same person because the service says so, because i own the same domain.

mariusor 2y ago

Just because there isn't such a mechanism in use currently, doesn't mean that there's something preventing ActivityPub actors using the same type of DNS pointing to DID, or IRI mechanism ATProtocol is using.

rglullis 2y ago
There are some extensions proposed, but to this day all AP actors are controlled by the server. No ActivityPub software today is built in a way where the client can provide their own keys. They are all generated in the server. Even the "Client-to-Server" AP spec is written in a way where the "client" does not interact with the outside web, but always initiates every interaction through the outbox hosted by the server. I'm not saying this just for pedantry. I'm saying this because I actually wrote a server that implements ActivityPub according to the spec [0], and realized that identity portability is not possible unless you deliberately break away from the AP spec. [0]: https://activitypub.mushroomlabs.com https://activitypub.mushroomlabs.com
- mariusor 2y ago
  I am not convinced that it can't be done. (Saying this also as someone that wrote a spec compliant ActivityPub server: https://github.com/mariusor/fedbox https://github.com/mariusor/fedbox) Nothing says you can't extend an actor to provide for a did: based identity which gets stored wherever you want to. I think the main dev of Mitra[1] is someone that's exploring very strongly in this direction. [1] https://mitra.social/ https://mitra.social/
lxgr 2y ago
I'd consider the effort of migrating the entire ecosystem to a fundamentally different identity resolution mechanism somewhat of a barrier.
- mariusor 2y ago
  Allowing for extensions to the current ActivityPub/ActivityStreams vocabulary is one of the tenants of the specification. Nothing says everyone must implement everything.
  - lxgr 2y ago
    I don't see how this could be done in a backwards compatible way. How would incompatible servers know to trust a server foo.com to publish posts for an account bar.com? How would they know where to look for bar.com's posts when their users search for it?

genewitch 2y ago

how many bluesky "servers" are there?

rglullis 2y ago
Look who is moving the goal posts! We are talking about ActivityPub tying identity to the server. ATProto is designed from the ground to separate user data from your identity (through its Personal Data Servers), so the answer to your question is "many. There are many servers out there." Bluesky has many issues (and I for one still think it has fundamental flaws that still make me prefer AP), but identity coupling is not one of them.
- genewitch 2y ago
  I think i just don't understand the distinction. I have a domain, so i set up my domain so i have an identity on bluesky. I'm with you on that part. and then what? i can take my identity and do what with it? change PDS? but bluesky itself shows everyone that i am the same person? i didn't move the goalposts, i just don't get the distinction everyone is making here with "identity", of course if i prove i own a domain i can verify, but i can do that on mastodon, too, I can add the below to my domain that will checkmark my username on mastodon. I assume if i move servers and want people to follow me, i will just do the same on that server, too; they know it's me because the service says so. > <a rel="me" href="https://fosstodon.org/@picofarad">Mastodon</a> https://fosstodon.org/@picofarad">Mastodon</a> that is all i have to do to prove i own that username on that instance - put that on a domain i own and add it to one of the user editable fields on my public profile. so maybe you understand my confusion. i never received a bluesky invite nor do i want to pay (a couple mentions here of paying for it). > Verifying your identity on Mastodon is for everyone. Based on open web standards, now and forever free. All you need is a personal website that people recognize you by. When you link to this website from your profile, we will check that the website links back to your profile and show a visual indicator on it. The link on your website can be invisible. The important part is rel="me" which prevents impersonation on websites with user-generated content. You can even use a link tag in the header of the page instead of <a>, but the HTML must be accessible without executing JavaScript. i can also export all my followers, so when i join a new instance, i can direct message them all and let them know i've moved, and they can see it's the same person because the service says so, because i own the same domain.