#social 2018-09-20
2018-09-20 UTC
xmpp-social, kaniini, vt, vasilakisfil, _xmpp-social, dlongley, Fox and jdormit joined the channel; fiatjaf and vt left the channel
# 
heluecht[m] How can I check if my LD signature is correct? Testing against my own routines is looking good. But Mastodon - for example - doesn't seem to care about a valid signature. My post with an invalid one had been accepted.
# puckipedia try sending the post with a Signature header of another user
# heluecht[m] I just wrote some "ddsdfjs" instead of a valid signature - and this was accepted.
# puckipedia like, if the actor in the json and the keyId of the http signature don't match
# heluecht[m] I don't mean the HTTP signature, but LD sifnature
# nightpool[m] you can test the ld signature by not providing a http signature
# nightpool[m] I believe
# puckipedia nope
# puckipedia the signature still has to check out
# nightpool[m] hmm
# nightpool[m] grr
# puckipedia heluecht[m]: yes. If the owner of the object and the person that signed the HTTP Signature do not correspond, it validates the JSON-LD signature
# heluecht[m] Only then? Why?
# puckipedia it's used when another server wants to send the reply to e.g. the followers of the object that you replied to
# heluecht[m] But why not checking it at any time?
# nightpool[m] because there's no need to?
# heluecht[m] Is it defined that way?
# puckipedia it is not
# puckipedia there's no real information about how to authorize requests in AP
# heluecht[m] And Mastodon relays answers with signatures to the other persons in the thread?
# heluecht[m] Or only under certain circumstances?
# nightpool[m] mastodon relays answers with signatures to the followers of the root post
# heluecht[m] Does it matter if the post was public or private or directed to the followers collection or not?
# puckipedia must be public/unlisted
# heluecht[m] What does "unlisted" mean in this situation?
# puckipedia the four privacy modes that Mastodon has are:
# puckipedia public (the AS2 Public collection is in to)
# puckipedia unlisted (the AS2 Public collection is in cc)
# puckipedia private (either to or cc contains the follower collection of the person making the post)
# puckipedia s/private/follower/
# puckipedia private (no public collection nor follower collection)
# heluecht[m] So on private posts to the follower collection there is no relaying?
# heluecht[m] Why?
# puckipedia because you have to send them to all your followers anyways
# puckipedia also. blame like. bad audience targetting features in mastodon. i guess
# heluecht[m] But when I reply to a private post with the followers collection, then I cannot distribute my comment to all followers of the original poster, because I don't know them.
# puckipedia like. Mastodon doesn't support that
# puckipedia when I say "follower collection" above, it's only of the follower collection of the author of the post
# nightpool[m] AP specifically mentions this as a use-case for forwarding, but mastodon doesn't support it because we find it unintuitive for microblogging
# nightpool[m] obviously for, say, comments on a private blog post, it would be a different story
# heluecht[m] I guess there will be a huge list of incompatibilities between Friendica and Mastodon :)
# heluecht[m] I personally don't see any difference between the distribution of a private or public post.
# puckipedia same here
# nightpool[m] what?
# nightpool[m] I'm not sure what you mean by "the distribution of"
# nightpool[m] the problem isn't that nastodon doesn't forward the post, the problem is that it has no way to conceptualize the audience targeting that might cause it to forward the post
# heluecht[m] Situation: A posts something (private or public post to the followers collection). Then B replies to it. Then I would expect that A distributes the comment from B to all followers of A.
# puckipedia in case of a private post, the followers of A can't see the reply anyways
# heluecht[m] I mean a non public post to the followers collection. This should be visible to all followers.
# puckipedia yes, but Mastodon doesn't support it if it's the follower collection of someone that isn't the owner of the reply
# heluecht[m] I would expect that only the followers collection of the starting post should be valid.
# heluecht[m] And Mastodon should know that - if the starting post was made on the server.