Post by @smallcircles@social.coop

I am writing a blog post around the opportunities that C2S and the ActivityPub API offer to the fediverse, and I was wondering which FEP's you consider to be essential to adopt for any implementer moving in this direction. And perhaps which ones are good should-haves and nice-to-haves.

I gather that FEP-fc48: Generic ActivityPub server is likely part of this list. @Steve_Bate in his article on C2S also lists a number of related FEP's.

Is it an idea to have an overarching profile, that keeps track of these requirements, or is there already something along these lines?

5 Replies

1 Boost

silverpill

@silverpill@mitra.social 2 days ago

@smallcircles @Steve_Bate

FEP-fc48: Generic ActivityPub is a thought experiment. I think it would be great to get more eyes on it but it is certainly not essential.

Any conversation about C2S should start with the question "do we really need it?". Just because this API is described in ActivityPub spec doesn't mean it is a good idea. So far, REST APIs worked very well for fediverse.

The second question is security.

The C2S API is unique in that it enables users to create arbitrary objects and activities on the server. This is useful if you're an operator of a single-user instance with admin privileges. But it is a disaster for multi-user instances because any user can impersonate other local users.

The isolation of local actors is covered in FEP-fe34: Origin-based security model, although that work is not finished yet.

Codeberg.org

fep/fep/fe34/fep-fe34.md at main

fep - Fediverse Enhancement Proposals

silverpill

@silverpill@mitra.social 2 days ago

@smallcircles @Steve_Bate

FEP-fc48: Generic ActivityPub is a thought experiment. I think it would be great to get more eyes on it but it is certainly not essential.

The second question is security.

The isolation of local actors is covered in FEP-fe34: Origin-based security model, although that work is not finished yet.

Codeberg.org

fep/fep/fe34/fep-fe34.md at main

fep - Fediverse Enhancement Proposals

Steve Bate

@Steve_Bate@mastodon.social 51 min. ago

@silverpill @smallcircles > The C2S API is unique in that it enables users to create arbitrary objects and activities on the server.

Not true. Similar to S2S, a C2S server can restrict the types of objects (including activities) that can be created by a user.

Steve Bate

@Steve_Bate@mastodon.social 56 min. ago

@silverpill @smallcircles
> So far, REST APIs worked very well for fediverse.

This point isn't clear to me. I assume you're referring to the Mastodon API. If so, the #ActivityPub API (including C2S) is a REST API too.

The Mastodon API has worked reasonably well for its intended microblogging use case. However, it's not a governed API and the Mastodon team has made it clear it could change at any time without warning or community involvement.

🫧 socialcoding..

@smallcircles@social.coop 2 days ago

@silverpill @Steve_Bate

Thank you!

On your first question, if anything I think it can be an incentive and opportunity to introduce that paradigm shift I mentioned in the other thread..

https://social.coop/@smallcircles/117194662868256325

Though by itself it doesn't bring that, it is an enabler. Other than that it bumps into the same social challenges of what the fediverse is, can be, and who + how to get there, and I found the current approaches across the ecosystem to be very tech-first, "let's create the tech and then see what it can do" like. There's no real consensus on what C2S is and can bring to the ecosystem, I guess.

Discussion

Discussion