Conversation

Notices

1. Embed this notice
   silverpill (silverpill@mitra.social)'s status on Sunday, 24-Nov-2024 00:15:06 JST silverpill

   "FEP-171b: Conversation Containers" finally has been published:

   https://codeberg.org/fediverse/fep/src/branch/main/fep/171b/fep-171b.md

   Conversation Containers are conceptually very similar to FEP-1b12: activities are sent to a conversation owner, who manages the conversation and synchronizes it between participants. Differences are mostly superficial and may disappear in the future.

   #FEP #ConversationContainers #ActivityPub

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Sunday, 24-Nov-2024 06:29:32 JST silverpill

     in reply to

     • Ben Pate 🤘🏻

     @benpate Yes, this is a description of what Streams does with some minor additions of my own. It is not officially produced by the Working Group but they are aware of this FEP and we are trying to figure out how to arrive on a single standard.

     Conversation Containers help bridge the gap between the "threadiverse" (which mostly uses FEP-1b12) and the micro-blogging space, where this mechanism can be used to implement reply controls and followers-only posts.

   • Embed this notice
     Ben Pate 🤘🏻 (benpate@mastodon.social)'s status on Sunday, 24-Nov-2024 06:29:33 JST Ben Pate 🤘🏻

     in reply to

     @silverpill

     I’m super interested in all of these efforts to improve conversations and relies.

     This looks like it’s pulled from Streams, yes? Which means it’s not related to the Forums and Threaded Discussions Working Group, is that right?

     There are some cool ideas in here. Hopefully we can consolidate all of them to arrive at a single standard to implement.

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Sunday, 24-Nov-2024 23:23:12 JST silverpill

     in reply to

     • Mario Vavti

     @mario If conversation participants do not perform authentication procedure described in the FEP, the owner will be able to impersonate other participants (or anyone, if conversation is public) by sending an Add(Create(Note)) activity where Create(Note) is forged.

     The argument can be made that if you participate in a conversation, you necessarily trust the owner (Lemmy et al operate with this assumption), but I'm not convinced that it is true.

     >In this case the message will be rejected allthough its authenticity is verified.

     How other servers can verify messages made by remotely authenticated actor? I'm not familiar with OpenWebAuth

   • Embed this notice
     Mario Vavti (mario@hub.somaton.com)'s status on Sunday, 24-Nov-2024 23:23:14 JST Mario Vavti

     in reply to
     @silverpill in regard to authentication: isn't it sufficient to trust the sender at last? In this case the context owner?
     
     Let's assume this situation: an actor is remotely authenticated at a server via OpenWebAuth and comments on a post there. No proof can be added and the object is not yet available at the actors origin server. In this case the message will be rejected allthough its authenticity is verified.
   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Monday, 25-Nov-2024 01:51:46 JST silverpill

     in reply to

     • Mario Vavti
     • FenTiger

     @mario 61cf explains how to log in to "target" instance using "home" credentials, but I can't follow the algorithm past this step:

     >2. The /magic endpoint at the user's home instance first checks that the user is logged in.

     How does it check that the user is logged in? Does it present a login form?

     And then, after login, which instance generates activities?

     What URI is being put into actor field of activity, and what URI is being put into keyId parameter of HTTP signature?

     cc @fentiger

   • Embed this notice
     Mario Vavti (mario@hub.somaton.com)'s status on Monday, 25-Nov-2024 01:51:47 JST Mario Vavti

     in reply to
     @silverpill
     How other servers can verify messages made by remotely authenticated actor? I'm not familiar with OpenWebAuth
     Basically the visitor is authenticated by exchanging an encrypted token: #^https://codeberg.org/fediverse/fep/src/branch/main/fep/61cf/fep-61cf.md
   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Tuesday, 26-Nov-2024 01:45:35 JST silverpill

     in reply to

     • Mario Vavti
     • FenTiger

     @fentiger @mario

     >It checks whether the user has a session cookie.

     Ah, I see. Consider adding this information to the description of step 2.

   • Embed this notice
     FenTiger (fentiger@zotum.net)'s status on Tuesday, 26-Nov-2024 01:45:37 JST FenTiger

     in reply to

     • Mario Vavti
     @silverpill
     How does it check that the user is logged in? Does it present a login form?
     It checks whether the user has a session cookie. Hubzilla doesn't show a login form here; it could, but that wouldn't work so well for eg image fetches.
     And then, after login, which instance generates activities?
     FEP-61cf only covers authenticating the user. It doesn't tackle the question of what happens when the now-authenticated user writes a post. How should that post federate outwards, in such a way that other instances can trust it? I don't know how Hubzilla approaches this; maybe @Mario Vavti can comment.
   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Tuesday, 26-Nov-2024 02:05:20 JST silverpill

     in reply to

     • Mario Vavti

     @mario

     >Actor is the remotely via OWA logged in actor., the HTTP requesti is signed by the thread owner.

     This violates same origin policy, but I will mention in the FEP that implementations may accept such activities if conversation owner is trusted.

   • Embed this notice
     Mario Vavti (mario@hub.somaton.com)'s status on Tuesday, 26-Nov-2024 02:05:21 JST Mario Vavti

     in reply to
     @silverpill
     How does it check that the user is logged in? Does it present a login form?
     The user has to be logged in at his home instance before starting an OWA attempt to another instance.
     
     What URI is being put into actor field of activity, and what URI is being put into keyId parameter of HTTP signature?
     Actor is the remotely via OWA logged in actor., the HTTP requesti is signed by the thread owner.