ViatorOmnium

joined 6 months ago
[–] ViatorOmnium@piefed.social 5 points 5 days ago

https://www.w3.org/wiki/ActivityPub/Primer/Authentication_Authorization mentions HTTP signatures since the very first version of the document in 2017. The current efforts seem more in the direction of describing standardizing the existing usage.

[–] ViatorOmnium@piefed.social 5 points 5 days ago (2 children)

One example is HTTP signatures. Servers sign their payloads and receiving servers should validate not just the hash but ensure the payload is not too old. Mastodon allows for a twelve hour difference (https://docs.joinmastodon.org/spec/security/#http-signatures) but other software might be stricter for security reasons. The a bunch of things like webfinger were designed around public dns and public key chains A mastodon server running on the open internet and/or expecting public keychain HTTPs will not be able to federate with something running in tor.

You could cut enough corners to make something that federates inside tor, but at that point it's better to design something around tor's features.

[–] ViatorOmnium@piefed.social 28 points 5 days ago (4 children)

That's just a frontend issue. You can have clients that don't try to do regular polling.

Having reliable activitypub federation is going to be a much harder challenge. The server to server protocol has a bunch of assumptions that are not true for tor and i2p.

And unless you want the entire network to become a CSAM and Nazi cespool, you would also need a reliable way of identifying servers, which defeats the purpose.

[–] ViatorOmnium@piefed.social 49 points 1 week ago

Immigrants that accept that they are immigrants or self-described expats?

As long as you don't try to make your surroundings a mini-'Murica you should be fine everywhere in Europe.