#social 2018-03-18
2018-03-18 UTC
xmpp-social, cwebber, timbl, bwn and fr33domlover joined the channel
# 
fr33domlover Hello
# fr33domlover I'm writing a decentralized web application
# fr33domlover And I want to pick an authentication protocol(s)
# fr33domlover I'm looking for any advice :)
# fr33domlover It seems GNU Social and Pump.io use Oauth 1
# fr33domlover And ActivityPub wiki says Oauth 2
# fr33domlover Thanks aaronpk
# fr33domlover Ok sorry Idk the protocol details yet ^_^
# fr33domlover Thanks
# fr33domlover aaronpk, basically what I'm looking for is: If user a@x wants to comment on a post made by user b@y how does server y know that the person who made the comment is really the owner of user a
# fr33domlover It shouldn't ask for the user's password
# fr33domlover Instead, it gets come token via server x
# fr33domlover Are these details part of the spec though?
timbl joined the channel
# fr33domlover aaronpk, should I look into Oauth 1 or 2?
# fr33domlover I'm unsure which one would be best
# fr33domlover I read in Wikipedia and other places and saw tons of issues about Oauth2
# fr33domlover the people who wrote it quitting the team etc.
# fr33domlover Hmmmmm ok then
# fr33domlover I'll look at both and aim at 2
# fr33domlover Yeah sure
# fr33domlover I just mean, GNU Social and Pump.io seem to need it
# fr33domlover And since my web app is similarly decentralized (well, hypotheicaly lol) I'm just guessing I'll need it too
# puckipedia I think I get what you want to do
# puckipedia you want user b@y to log in on server x to comment on a post by a@x?
# fr33domlover puckipedia, idk, I'm asking how it's done for activitypub/pump.io/etc.
# fr33domlover I mean theoretically there are many ways
# puckipedia so the way it's done in activitypub, user b only logs in on server y, and looks up the post by a@x on b's server
# fr33domlover yeah that's the way I want that
# puckipedia then, the fact that the reply was made, is sent authenticated by b@y's public key to @x
# puckipedia if you e.g. look at https://mastodon.social/users/Gargron.json you can see the `publicKey` property
# fr33domlover puckipedia, can you describe that process again please? If user a@x wants to make a comment on a post by user b@y, which requests are made exactly?
bwn joined the channel
# fr33domlover (if ActivityPub specifies these details, I'll just see them there and not bother you people with these questions ^_^)
# puckipedia it does, but I'll explain a bit:
# puckipedia fr33domlover: when a@x looks up the post, that post is requested by server x. Then, when the user places a comment, they create a object like this:
# puckipedia
{"type": "Create", "id": "https://x.example.com/activity/123", "actor": "https://x.example.com/user/a", "object": {"type": "Note", "content": "this is now a reply", "id": "https://x.example.com/note/123", "to": "https://y.example.com/user/y", ..}, ...}# puckipedia based on to/cc/etc (which I mostly omitted), the server of x looks up all the inboxes of everyone that should receive a notification about the message (like email)
# fr33domlover puckipedia, what does "look up the post" mean?
# puckipedia fr33domlover: just GET the id, in case the server doesn't know it exists yet
# fr33domlover what if it's a public post they see while browsing server y
# puckipedia you can e.g. copy the URL of the post and put it in, like, a search field
# puckipedia at the end, for each inbox, the server sends out a POST request (signed using HTTP signatures and the keypair of the user) containing that Create
# fr33domlover puckipedia, and does the reply get a canonical URL on server y after that?
# puckipedia it does not. the only official URL that the post is available at is on server x
# puckipedia of course, the server y might use an internal numbering scheme (mastodon has its own ID numbers for its client API)
# fr33domlover Hmmmm I'm confused
# fr33domlover Suppose user b@y made that post and I assume it's store on server y
# fr33domlover And it has a public URL on server y
# puckipedia yes
# fr33domlover If you browse to server y,
# fr33domlover You can see the comments too I assume?
# fr33domlover Including the one made by user a@x
# puckipedia yes. The server y will store a local 'cache' of replies and posts by other servers, also to build a timeline for logged in users
# fr33domlover And does each such reply have a canonical URI? And is it on server y (because it's a reply on a post made by b@y) or server x (because it's made by a@x)?
# puckipedia the canonical URI for replies is on the server of the user it's made on
# fr33domlover Hmmm I see
# fr33domlover puckipedia, so basically all the content you make is kept on the server where your account is, even is semantically some of your content is a "reply" to other content from elsewhere or someone posted "to" some user or page or whatever on another server?
# fr33domlover *even if
# puckipedia yes
# puckipedia you can navigate mastodon for a bit to see this
# fr33domlover Ah yes I can see that
# fr33domlover puckipedia, aaronpk, I'm also wondering about Mastodon vs Pump.io vs ActivityPub - I've really really like, if possible, for my web app to be able to federate with these apps
# fr33domlover What are the differences in their protocols?
# puckipedia activitypub is the protocol that mastodon uses, activitypub has been inspired by pump.io and there's work to add ActivityPub support into pump.io
# fr33domlover Thanks puckipedia
# fr33domlover I'll start reading :)
# fr33domlover puckipedia, if user a@x makes a post on the user page of b@y and then server x goes offline, can people still make replies on that post?
# fr33domlover I mean is the URL of the post enough to make replies, even if the domain in that URL doesn't exist anymore
dustyweb_ joined the channel
# puckipedia fr33domlover: answer is, usually? as long as the server the user replies from is aware the post exists
# fr33domlover puckipedia, hmmm how likely is it that the server is aware?
# puckipedia usually? quite
sknebel_ joined the channel
# fr33domlover puckipedia, nice!