Post AluCXCdFBaA5aR7boO by thisismissem@hachyderm.io
(DIR) More posts by thisismissem@hachyderm.io
(DIR) Post #AluCX67TOnBPOAD9SS by hongminhee@fosstodon.org
2024-09-11T17:00:53Z
0 likes, 1 repeats
I received a request from @ghost today to add #LDSignatures to @fedify for compatibility with #Mastodon, as Mastodon does not plan to implement Object Integrity Proofs (FEP-8b32) for the near future. 😩However, Mastodon's implementation of LD Signatures does not even use valid JSON-LD properties (despite the name), so I'm not sure how to make it compatible with Mastodon since #Fedify does JSON-LD processing. 🤔#ActivityPub #fedidev
(DIR) Post #AluCX76Rk5xKRGjqUq by hongminhee@fosstodon.org
2024-09-11T17:04:35Z
0 likes, 0 repeats
As the creator of Fedify, I'd like to see either ActivityPub implementations all deal with JSON-LD properly, or the ActivityPub spec gives up on JSON-LD. 😩
(DIR) Post #AluCX7Iqzxsf3kXkps by liaizon@social.wake.st
2024-09-11T17:20:15Z
0 likes, 0 repeats
@hongminhee hey @thisismissem, @andypiper what do yall think of this situation? where are we going here? I keep seeing dev after dev complain about the JSON-LD issue with Mastodon and I personally dont even know where to stand on it but it seems its a major hurdle.
(DIR) Post #AluCX84i82A5SAvyQi by andypiper@macaw.social
2024-09-11T18:02:59Z
0 likes, 0 repeats
@liaizon @hongminhee @thisismissem I think it may be something long-standing here, is there an existing GitHub issue where I can get more background? I know it’s pretty complicated at this point though.
(DIR) Post #AluCX8qZG6RVqbKC1Y by andypiper@macaw.social
2024-09-11T18:06:42Z
0 likes, 0 repeats
@liaizon @hongminhee @thisismissem (also asking as I’m on my phone walking right now and can’t search so easily!)
(DIR) Post #AluCX9nPjJVwn6rBkO by thisismissem@hachyderm.io
2024-09-11T18:28:02Z
0 likes, 0 repeats
@andypiper @liaizon @hongminhee the version of JSON-LD Signatures that mastodon supports is old, basically they implemented it, then the spec completely changed.That's why stuff doesn't look right.The question is then: how do you migrate forwards without breaking compatibility with existing deployments. That's gonna need time & money thrown at the problem to solve.
(DIR) Post #AluCX9vvDgJtDUpz0a by andypiper@macaw.social
2024-09-11T18:42:24Z
0 likes, 0 repeats
@liaizon @hongminhee @thisismissem no promises on how quickly this can be resolved, but it is in progress. It needs more work and probably backporting etc. https://github.com/mastodon/mastodon/pull/31871
(DIR) Post #AluCXAL5i6S8TYc5Eu by silverpill@mitra.social
2024-09-11T20:55:29.082560Z
0 likes, 0 repeats
@thisismissem @liaizon @andypiper @hongminheeFEP-8b32 is designed to be compatible with existing implementations. The upgrade path for Mastodon may look like this:1. Support multiple public keys per actor2. Start publishing second Ed25519 key as described in FEP-521a3. Start adding FEP-8b32 integrity proofs in addition to LD signatures (as specified in "Backward compatibility" section of FEP-8b32)4. Stop adding LD signatures
(DIR) Post #AluCXCdFBaA5aR7boO by thisismissem@hachyderm.io
2024-09-11T18:33:18Z
0 likes, 0 repeats
@andypiper @liaizon @hongminhee See here: https://docs.joinmastodon.org/spec/security/#ld
(DIR) Post #AluPD2Nws7gdQ4gMHQ by silverpill@mitra.social
2024-09-11T23:17:33.382514Z
0 likes, 0 repeats
@hongminhee Do they want LD signatures in Fedify in order to process forwarded Create activities? I simply fetch object by its id when signer and actor do no match.