Conversation

Notices

1. Embed this notice
   Steve Bate (steve@social.technoetic.com)'s status on Sunday, 06-Jul-2025 21:56:33 JST Steve Bate

   To follow up on my #ActivityPub C2S post from a few days ago, I wrote a blog article on my thoughts about improving the C2S protocol and a description of some related experimentation I've been doing.
   https://www.stevebate.net/activitypub-client-api-a-way-forward/

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Sunday, 06-Jul-2025 21:56:31 JST silverpill

     in reply to

     @steve

     Treating ActivityPub messages as plain JSON undermines extensibility because it prevents the use of JSON-LD features like context definitions, leading to potential property name collisions and making it difficult for implementations to reliably interpret or extend messages.

     No, treating ActivityPub as JSON doesn't undermine extensibility. ActivityPub is extended by adding new properties to JSON objects, and if you want to avoid collisions you can use URLs or reverse-DNS strings for property names. JSON-LD is not needed for that, it only complicates things for no reason.

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Sunday, 06-Jul-2025 23:22:34 JST silverpill

     in reply to

     @steve Why would I send an expanded toot: URI when all servers expect a short name? Your example is another proof that JSON-LD is only useful for solving problems created by JSON-LD.

   • Embed this notice
     Steve Bate (steve@social.technoetic.com)'s status on Sunday, 06-Jul-2025 23:22:36 JST Steve Bate

     in reply to

     • silverpill

     @silverpill Those workarounds for the undermined extensibility don't negate my point and will not generally interoperate. According to the ActivityPub book, "One point to note is that correctly parsing and interacting with AS2 objects with extended properties requires a JSON-LD-aware parser." I agree this isn't absolutely true (in special cases) but try sending expanded "toot" context term URIs and see how well it works 😉 (since all servers AFAIK expect those terms to be compacted).

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Tuesday, 08-Jul-2025 04:04:26 JST Haelwenn /элвэн/ :triskell:

     in reply to
     @steve Is there code somewhere for Flowz?
     At least Pleroma has AP C2S so probably could be another choice of client (only one I know with AP C2S being AndStatus).
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Tuesday, 08-Jul-2025 15:46:34 JST Haelwenn /элвэн/ :triskell:

     in reply to
     @steve Yeah Pleroma's default frontend uses heavily modified Mastodon API, hence why it's only AndStatus (Android application).
   • Embed this notice
     Steve Bate (steve@social.technoetic.com)'s status on Tuesday, 08-Jul-2025 15:46:35 JST Steve Bate

     in reply to

     • Haelwenn /элвэн/ :triskell:

     @lanodan There’s no public repo yet. It’s WIP. Isn’t Pleroma C2S only supported on the server side?

   • Embed this notice
     Blurry Moon (sun@shitposter.world)'s status on Tuesday, 08-Jul-2025 15:50:37 JST Blurry Moon

     in reply to

     • silverpill
     @steve @silverpill is there even a single ap server implementation that can handle arbitrary json-ld and not just compacted to specific prefixes
     Phantasm likes this.
   • Embed this notice
     Blurry Moon (sun@shitposter.world)'s status on Tuesday, 08-Jul-2025 16:01:00 JST Blurry Moon

     in reply to

     • silverpill
     @steve @silverpill alright. I found it basically impossible to store and index efficiently for common access patterns and gave up and just went back to treating it as json. I tried a few triple store databases and the performance wasn't great for my historic dataset. I'll try it again someday though
   • Embed this notice
     Steve Bate (steve@social.technoetic.com)'s status on Tuesday, 08-Jul-2025 16:01:01 JST Steve Bate

     in reply to

     • silverpill
     • Blurry Moon

     @sun @silverpill Vocata, ActivityPods, rdf-pub, …

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Thursday, 10-Jul-2025 07:23:59 JST silverpill

     in reply to

     • Raphael Lullis

     @raphael @steve

     There is no such thing as "namespace" in JSON. Another problem that was created by JSON-LD to be solved by JSON-LD.

   • Embed this notice
     Raphael Lullis (raphael@mastodon.communick.com)'s status on Thursday, 10-Jul-2025 07:24:00 JST Raphael Lullis

     in reply to

     • silverpill

     @silverpill @steve

     > Why would I send an expanded toot: URI

     Because you might be using a different namespace which is conflict with the one from mastodon, so the extended form is needed to remove ambiguity?

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Thursday, 10-Jul-2025 09:17:59 JST silverpill

     in reply to

     • Raphael Lullis

     @raphael @steve Sorry, I don't know what that means. Fediverse developers use JSON, it works just fine and everyone is happy with it.

   • Embed this notice
     Raphael Lullis (raphael@mastodon.communick.com)'s status on Thursday, 10-Jul-2025 09:18:00 JST Raphael Lullis

     in reply to

     • silverpill

     @silverpill @steve

     > There is no such thing as "namespace" in JSON

     Right, so what is your suggestion? To force all application developers to conform to one unique schema, or to come up with an ad-hoc, bug ridden re-implementation of namespaces on top of plain JSON?

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Thursday, 05-Feb-2026 23:09:18 JST Matthias Pfefferle

     in reply to

     @steve (how) can I test Flowz?

     I would love to implement C2S in WordPress and need a test client https://github.com/Automattic/wordpress-activitypub/pull/2851

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 06-Feb-2026 01:11:12 JST Matthias Pfefferle

     in reply to

     • marius
     • django

     @mariusor @django @steve I talked with him at FOSDEM and I want to test his client as soon as he release it!

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Friday, 06-Feb-2026 01:11:14 JST marius

     in reply to

     • Matthias Pfefferle
     • django

     @pfefferle also perhaps @django will be interested in collaborating. He's the latest to try to implement clients for C2S, and I imagine WordPress would be a sweet, sweet target for him.

     @steve

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Friday, 06-Feb-2026 01:11:15 JST marius

     in reply to

     • Matthias Pfefferle

     @pfefferle if you're satisfied with using a CLI tool, you can try the client I created for GoActivityPub based servers: https://git.sr.ht/~mariusor/box

     It supports OAuth2 dynamic client creation either with CIMD or with RFC7591

     It supports creating activities for publishing text content and some basic loading of information about ActivityPub objects.

     In the near future it will also support proxyUrl to interact with secure fetch servers, but not just yet.

     @steve

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 06-Feb-2026 01:35:15 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor @steve but it seems to not support PKCE 🤔

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 06-Feb-2026 02:06:42 JST Matthias Pfefferle

     in reply to

     @steve nice!

     I think the PR is at least ready for a test run!

   • Embed this notice
     Steve Bate (steve@social.technoetic.com)'s status on Friday, 06-Feb-2026 02:06:43 JST Steve Bate

     in reply to

     • Matthias Pfefferle

     @pfefferle I haven't been working on Flowz for the last 6 or 7 months, but I plan to dust it off and continue work on it given the recent interest in the ActivityPub client API. I subscribed to the github issue and will track that. Is the WP implementation ready for testing?

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 06-Feb-2026 07:37:47 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor I worked against https://github.com/swicg/activitypub-api

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Friday, 06-Feb-2026 07:37:48 JST marius

     in reply to

     • Matthias Pfefferle

     @pfefferle that seems like a weird ask for a client you want to prototype with, but indeed, BOX does not support PKCE yet.

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Sunday, 08-Feb-2026 01:35:00 JST Matthias Pfefferle

     in reply to

     @steve awesome, thanks!

   • Embed this notice
     Steve Bate (steve@social.technoetic.com)'s status on Sunday, 08-Feb-2026 01:35:01 JST Steve Bate

     in reply to

     • Matthias Pfefferle

     @pfefferle I did some
     initial testing of the Wordpress C2S support 👍and left some comments on the github issue.

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Monday, 09-Feb-2026 05:58:22 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor when box tries to dereference an Activity, can you maybe add the `application/activity+json` header to the request?

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Monday, 09-Feb-2026 16:51:29 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor it seems to be a different issue!

     (I am not very familiar with go, so please don't blame me if what I say is totally wrong)

     I think box is checking for an Actor object and if it finds only a URI, it simply assumes that the Outbox is `{profile-id}/outbox` instead of checking for the real outbox URL!?

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Monday, 09-Feb-2026 16:51:31 JST marius

     in reply to

     • Matthias Pfefferle

     @pfefferle that should already be the case. How does the accept header look like for you on the server? I'll double check tomorrow if I'm doing something stupid and haven't noticed until now. :D

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 13-Feb-2026 01:16:20 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor it seems to work now! awesome!

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Friday, 13-Feb-2026 01:16:21 JST marius

     in reply to

     • Matthias Pfefferle

     @pfefferle I changed some stuff to a potential place where this could have happened.

     If you can build a new version of BOX, please try again and let me know if it fixes the issue for you.

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Friday, 13-Feb-2026 01:16:23 JST marius

     in reply to

     • Matthias Pfefferle

     @pfefferle yes, that might be possible. BOX is strongly biased with the conventions of GoActivitPub where actorIRI/outbox is most of the time a safe assumption to make.

     But there are mechanisms to dereference the oubox correctly after loading an Actor object, and usually I default to that, the "just append outbox to the URL" logic is a last resort.

     Do you think you can send an email to the GoActivityPub mailing list with details about your issue, so I can try to find where exactly this happens? TY

     Just click new post on this page: https://lists.sr.ht/~mariusor/go-activitypub-dev

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 13-Feb-2026 01:18:18 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 13-Feb-2026 01:24:39 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor yea, I think the scopes and the PKCE part was the issue!

     but finally... 😊

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Friday, 13-Feb-2026 01:24:41 JST marius

     in reply to

     • Matthias Pfefferle

     @pfefferle love it! 💗

     GoActivityPub doesn't really do "scopes" because I couldn't think of a way store the permissions on the server side in a way that doesn't require custom logic to interact with vanilla ActivityPub objects.

   • Embed this notice
     Matthias Pfefferle (pfefferle@mastodon.social)'s status on Friday, 13-Feb-2026 01:27:16 JST Matthias Pfefferle

     in reply to

     • marius

     @mariusor awesome! ♥️

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Friday, 13-Feb-2026 01:27:17 JST marius

     in reply to

     • Matthias Pfefferle

     @pfefferle I added a PKCE task to my todo list:

     https://todo.sr.ht/~mariusor/go-activitypub/440