Conversation

Notices

1. Embed this notice
   silverpill (silverpill@mitra.social)'s status on Wednesday, 02-Sep-2026 05:59:09 JST silverpill

   in reply to

   • 🫧 Social coding commons

   @smallcircles @Steve_Bate

   FEP-fc48: Generic ActivityPub is a thought experiment. I think it would be great to get more eyes on it but it is certainly not essential.

   Any conversation about C2S should start with the question "do we really need it?". Just because this API is described in ActivityPub spec doesn't mean it is a good idea. So far, REST APIs worked very well for fediverse.

   The second question is security.

   The C2S API is unique in that it enables users to create arbitrary objects and activities on the server. This is useful if you're an operator of a single-user instance with admin privileges. But it is a disaster for multi-user instances because any user can impersonate other local users.

   The isolation of local actors is covered in FEP-fe34: Origin-based security model, although that work is not finished yet.

   • Embed this notice
     🫧 Social coding commons (smallcircles@social.coop)'s status on Wednesday, 02-Sep-2026 05:59:10 JST 🫧 Social coding commons

     @silverpill

     I am writing a blog post around the opportunities that C2S and the ActivityPub API offer to the fediverse, and I was wondering which FEP's you consider to be essential to adopt for any implementer moving in this direction. And perhaps which ones are good should-haves and nice-to-haves.

     I gather that FEP-fc48: Generic ActivityPub server is likely part of this list. @Steve_Bate in his article on C2S also lists a number of related FEP's.

     Is it an idea to have an overarching profile, that keeps track of these requirements, or is there already something along these lines?