Recent searches
Search options
Your irregular reminder that this problem of not owning your social media accounts applies to the AP-based fediverse as a whole as well.
ATP is much better in this aspect than we are here, in truth, so if this is something you care about that's an element to consider.
https://infosec.exchange/@josephcox/113551027621445584
@hrefna To ask a maybe silly question: I thought AP’s use of HTTP Signatures meant the messages, including the domain of the account, were tied to WebPKI? Of course this absolutely doesn’t stop someone from running an AP server from totally ignoring the signatures (and, e.g., substituting other content), which is maybe the actual threat here?
@gsnedders A few things are important here, the first of which is that HTTP Signatures aren't part of AP at all ^^
So since it is orthogonal both the use of signatures and how we use them are more localized server design choices than something intrinsic to AP
Second: the signature is non-forwardable and the key is owned by the server, not by the user. It isn't the domain of the _account_ that is controlling, it is the domain of the server, which "owns" the account and can act on its behalf.
@hrefna@hachyderm.io @gsnedders@glauca.space AP mandates HTTPS though right? It's more of we use HttpSignature because it's already there but nothing is forcing us to use it as a way of verifying things. we have things like json-ld signing. (I've seen signed activities they're cool)
Nope. It does not mandate a secure channel at all, and there's some resistance to adding that as a requirement:
https://github.com/w3c/activitypub/issues/429
(It also doesn't specify HTTP at all, but that's a separate question)
@hrefna@hachyderm.io @gsnedders@glauca.space yay. i was told it did during one of my shitposts about AP over FTP instead of HTTP
@hrefna@hachyderm.io @gsnedders@glauca.space now time to go make AP over FTP like god intended 
I keep threatening to write one almost entirely in gopher, including for S2S pieces.
@hrefna @puppygirlhornypost2 @gsnedders I think it doesn't specify http in the same way it doesn't have servers. It does require the application/ld+json content type and accept headers. I'm not sure how many other contexts that would make sense.
But that's kind of separate to whether you could (yes) or should (no) do it.
Oh 100%. Absolutely.
I've just been informed very confidently that—despite that it is written almost entirely in HTTP terms down to response codes—it still does "not require" HTTP.
I've just been informed very confidently that
