fediverse

Bilingual

Boy I was wrong about the Fediverse
2 months ago
- The author was never an 'online community first' person, using the internet mainly to keep in touch with real-life contacts.
- They moved to Mastodon after Twitter was bought by Elon Musk, finding its lack of ads and recommendations charming.
- Initially apathetic to online causes, the author later saw the US press collapse due to Trump's lawsuits, making reliable news hard to find.
- The Fediverse became the only consistent source of trustworthy news, especially about Trump's threat to invade Greenland.
- Direct communication with experts on the Fediverse provided valuable, unmediated information without brand-building or algorithms.
- The author contrasts this with other platforms like Threads (boring, brand-focused) and Bluesky (trying to recapture 2008 Twitter).
- They criticize the protocol debate as irrelevant, noting convenience always wins over technical merit.
The Long Tail of Work Left Until ActivityPub Has E2EE
2 months ago
- The W3C is developing end-to-end encryption (E2EE) for ActivityPub, separate from a key transparency proposal for the Fediverse.
- Three main goals are outlined: enabling E2EE messaging (Fundamental), ensuring correct encryption (Security), and verifiably authenticating user keys without central authority (Authenticity).
- Key transparency provides a decentralized root of trust by logging which ActivityPub actor controls which signing keys, addressing authenticity.
- Current direct messages lack E2EE, posing legal risks for instance hosts due to plaintext storage of sensitive content like images.
- MLS (Messaging Layer Security) implementations in various languages (e.g., TypeScript, Rust) are needed for E2EE, with post-quantum ciphersuites recommended.
- Client software must manage digital signature keys (e.g., Ed25519, ML-DSA) to authenticate MLS KeyPackages, linking to key transparency for public key verification.
- Authentication methods considered include certificate authorities, key fingerprinting, and key transparency, with a proposed traffic light protocol (green/amber/red) for user verification.
- HTTP Message Signature libraries need updates to support ML-DSA-44, and Fediverse software should adopt FEP-521a for multiple signing keys per actor.
- Adoption requires third-party assessments (cryptography audits, penetration tests) and funding for expert reviews to build trust in the implementations.
- The work emphasizes that most tasks involve general software development and collaboration, not deep cryptography, encouraging broad technical contribution.
Why implementing ActivityPub is hard, and why it doesn't have to be
3 months ago
- Implementing ActivityPub from scratch is challenging due to complexities like handling multiple signature standards, JSON-LD shape variations, and ensuring secure defaults.
- Fedify is a TypeScript framework that abstracts away these complexities, providing built-in solutions for signatures, interoperability quirks, and delivery infrastructure.
- The framework supports various web frameworks and databases, includes development tools like CLI and debugging, and is used in production by platforms like Ghost and Hollo.

fediverse

Boy I was wrong about the Fediverse

The Long Tail of Work Left Until ActivityPub Has E2EE

Why implementing ActivityPub is hard, and why it doesn't have to be