Untitled attachment

Notices where this attachment appears

1. Embed this notice
   pistolero (p@fsebugoutzone.org)'s status on Monday, 07-Apr-2025 16:13:01 JST pistolero

   in reply to
   @eso
   
   > I don't know anything about those, but I'll look it up, thanks.
   
   Possibly easier to explain. You create an activity on these servers by doing "POST /inbox", but the request has to be signed by the instance in order to validate it; this is done to cut down spam. Some people were upset to discover that when they blocked another instance, that instance could still see their posts; the POST signature method was reappropriated for signed fetches.
   
   :mycomputer: https://fsebugoutzone.org/objects/b853247e-1500-4a43-897e-c7f6585de880
   :hal9000: 200 OK
   :hal9000: {"big_wad_of":["JSON", "representing", "the", "post"]}
   :mycomputer: curl -H 'Accept: application/json' -vv https://outerheaven.club/objects/fbc83c99-0d6e-4491-b0c1-9e9103d5877c
   :hal9000: 401 Unauthorized
   :hal9000: Request not signed
   
   (Not to pick on outerheaven.club, just I remember them having signed fetches enabled.)
   
   The reason is that instance-blocking itself was created in a rush because mastodon.social was terrified of The Loli (ask nepfag if you see him around, the screenshots are pretty funny). The Mastodon project repeatedly ignored suggestions that an instance's blocklist could be put into a machine-readable place, and as a consequence, instances that are blocked had no way to know this, so they went on fetching posts. Signed fetches were created to stop that. GotoSocial doesn't let you disable signed fetches, I think.
   
   > In fact I believe the only gts instance I've ever seen is the one sigrid from 9front is on.
   
   Oh, sigrid's cool, I saw her around the hubchat a few times. I've only been on there once since mycroftiv died. (Still running ANTS, Revolver is being developed on ANTS.)