Gregory's ServerWell, you can pick your privacy/security models:
- HTTP signatures, ensuring your JSON-LD isn't putting private fields into public payloads, ensuring delivery matches the recipients list, handling other software's visibility (followers only, unlisted), etc
- OCAP
- <something else>
Nothing says these can't be bridged; they can coexist; adopt the style you want.
@darius @cwebber If you don't trust OCAP, that's OK. But I think the interfaces it provides are far simpler than the current surface area that current Fediverse software has landed at. The bad thing about AP is that it didn't specify the privacy/security model, the good thing is that it means we can improve (and we should).