#social 2017-01-20
2017-01-20 UTC
fabrixxm and lambadalambda joined the channel
# 
lambadalambda hello, quick question about activitypub.
# lambadalambda i read the current draft spec, but i don't understand what mechanism is supposed to replace salmons in the ostatus.
# lambadalambda the spec talks about signing, but i don't really understand in what cases an activity is supposed to be signed.
fabrixxm joined the channel
# 
@csarven @fils @timrdf @pgroth @gklyne @soilandreyes @TomDeNies In case haven't across this yet, you might find https://www.w3.org/TR/ldn/ of interest (twitter.com/_/status/822450830829846529)
# cwebber hey lambadalambda
# cwebber lambadalambda: so two things to that. the thing that replaces the server to server side of things with private communication is simply the servers posting to individual inboxes
# cwebber but
# cwebber where does the signing / cryptography come in?
# cwebber well, as for encryption... hopefully it's tls encrypted, but
# cwebber as for signing
# cwebber we *do* have an option for that
# cwebber unfortunately, it's not a "hard requirement" because the technology it suggests is very young
# cwebber and the rest of the group decided they didn't want signatures as a hard requirement
# cwebber personally I think signing is going to be pretty important tho
# cwebber https://www.w3.org/TR/activitypub/#authorization-lds here's the section on how to do it with Linked Data Signatures + signed HTTP messages
# cwebber lambadalambda: are you interested in implementing that? if so I'd be interested in testing our implementations against each other
# lambadalambda i am interested in implementing it
# lambadalambda but i'm a bit puzzled why the signing isn't a hard requirement
# lambadalambda how is a server supposed to verify that a post comes from the person it says it comes from?
# cwebber lambadalambda: because the group decided against making it a hard requirement in favor of dialing back and verifying that the content exists on the origin server
# cwebber which, if you're like "but what if it's a transient communication"
# cwebber you're absolutely right
# lambadalambda oh, that's how it works!
# lambadalambda you look it up on the origin server?
# cwebber lambadalambda: if you don't implement signatures, yes
# lambadalambda but that doesn't work with restricted content, right?
# lambadalambda if my post can only be read by user y on server b, if server b asks me if it exists, i shouldn't tell it.
# cwebber lambadalambda: in the OAuth mechanism, your server can give your credentials so they can have access to the restricted post
# cwebber but it's not as good as signatures IMO
# cwebber because it requires keeping the content around
# lambadalambda sounds complicated, signatures seem to be easier.
# cwebber I agree :)
# cwebber lambadalambda: so the mechanism is, in theory, there
# cwebber if you'd like to work with me on testing it out... :)
# lambadalambda i'm still working on ostatus support for my server, i wanted to add activitypub after that
# lambadalambda on the other hand, activitypub seems to be easier to implement....
# lambadalambda is your code publicly accesible so i can take a look at it?
# cwebber lambadalambda: yes but I don't have the signatures yet, and it needs more work in general... :)
# lambadalambda i'll have to read through the spec again, i'll get back to you once i actually have something going :)
# cwebber lambadalambda: I'm a bit embarassed about my implementation, but you can take a look at it
# cwebber it only barely federates so far
# cwebber i've been working on other infrastructure things
# cwebber so that it'll be easier to flesh it out
# cwebber lambadalambda: but, I should be fleshing things out more over the next month
# lambadalambda but i'm surprised that the signature system isn't specified more explicitly, seems pretty essential to me.
# cwebber so...
# lambadalambda cwebber thank you
# cwebber lambadalambda: again, I agree.
# cwebber lambadalambda: my hope in writing the LDS + HTTP signatures stuff is
# cwebber maybe we could get it good enough that this will become the default mechanism
# cwebber and if that happens, we could add some later document suggesting such
# cwebber but the tech it relies on is too young to do that now.
# lambadalambda it does sound like a sensible approach
# lambadalambda there isn't any special pubsub mechanism in activitypub, right?
# lambadalambda just the posting to users inboxes?
# cwebber lambadalambda: right, that minimal interface turns out to be able to get the whole job done
# lambadalambda i really like that aspect
# cwebber me too :)
timbl joined the channel
# lambadalambda are there any working activitypub clients already?
# lambadalambda i'm just doing a GS like server, so something simple would be enough.
# 
rhiaro Here's a blog post from last year (wow that was a long time ago) very briefly describing a client, and it links to a post about the server portion of the protocol too https://rhiaro.co.uk/2016/05/minimal-activitypub
fabrixxm joined the channel