Email or username:

Password:

Forgot your password?
Emelia's posts Post Back to profile
Top-level
Emelia ๐Ÿ‘ธ๐Ÿป

I think something @bengo does kind of miss in this article is how these decisions would impact end users, would it simplify things or add more complexity? โ€œWait, now you mean I need to choose an authentication server AND a mastodon server???โ€

For non-technical people, a lot of these proposals would absolutely loose them. Only technical minded folks even know that public/private keys are used in Mastodon.

16 October at 21:24 | Open on hachyderm.io
6 comments
bengo

@thisismissem hey I didn't miss that. FWIW I actually don't think new users should have an 'identity server' at all (until they want one). but we do agree new users shouldn't have to make the choice as you present it. longer discussion I'll write up later.

17 October at 17:18 | Open on mastodon.social
bengo

@thisismissem this is what I was getting at with:
> Something that shakes out of unbundling Authentication from Social Servers and even Actor Servers (e.g. using cryptographic authentication and not a actor-server-dependent authentication scheme) is the ability to fully author signed social content without an internet connection

17 October at 17:19 | Open on mastodon.social
Emelia ๐Ÿ‘ธ๐Ÿป

@bengo aah, okay. The article was pretty technical, and for a lot of users they just want to get setup and start posting.. and then stuff happens later and their like "ughโ€

17 October at 17:26 | Open on hachyderm.io
bengo

@thisismissem my goal is to get it so users can get setup and start creating posts without talking to a server (identity or social) *at all* and only replicate to one or more servers when they are ready/able/connected to share those posts with others. i.e. inkandswitch.com/local-first/

17 October at 17:36 | Open on mastodon.social
Marcus Rohrmoser ๐ŸŒป

Hi @bengo @thisismissem,
love the idea but AP being a protocol of 1:1 delivery that wants direct contact to each recipient doesn't sound feasible for multiple followers which may be offline.

And each delivery must be mutually visible from the internet for the http signature callback.

17 October at 20:34 | Open on digitalcourage.social
Mike Macgirvin (dev)
Delivery of signed, portable objects (ala FEP-ef61) don't actually require http signatures. The only reason to still use them is to glean the identity behind fetch requests which have no signed payload and maintain compatibility with legacy ActivityPub applications like Mastodon.  

And in any case, authoring a post and delivering  post are completely different functions and there's absolutely no reason they need to take place on the same device.
Delivery of signed, portable objects (ala FEP-ef61) don't actually require http signatures. The only reason to still use them is to glean the identity behind fetch requests which have no signed payload and maintain compatibility with legacy ActivityPub applications like Mastodon.  
17 October at 21:05 | Open on fediversity.site
Go Up