Notices by Cody Casterline 🏳️‍🌈 (nfnitloop@mastodon.social)

RE: https://indieweb.social/@laurenshof/116103545853411360

This thread talks about going back to an #ActivityPub users's home server to validate a user's content, because you can't trust that the event you got for it is unmodified.

But you can't trust what the home server tells you the content of the message is either! There's nothing stopping a home server from serving a modified version of your content every time it's requested, say, to inject ads into it, or censor bits it doesn't like.

Or to just completely fabricate new content from you.

@aral 👋 I was reading https://kitten.small-web.org/tutorials/end-to-end-encrypted-peer-to-peer-small-web-apps/ today and saw mention of the "Small Web Protocol".

So I visited https://small-web.org, but … its SSL cert just expired. ⚠️

I'm interested to read more about this "Small Web Protocol", and key exchange. Is it mostly this?
https://kitten.small-web.org/reference/#reserved-small-web-protocol-routes

Kitten looks pretty nice!

I did some googlin' for #smallweb chats (IRC/Discord/whatever) and didn't find any, so I made one. Come hang out and say hi if that's your kind of thing!

#smolweb #indieweb

https://discord.gg/GAqQDp5ZkH

@micahflee Good article -- I learned some things.

But, right after talking about being in a group with 500 members, you say:

> […] a Signal group [is] all private, and it can't be shared with law enforcement.

A conversation with 500 people isn't private. Any one of their (possibly multiple) devices might be hacked, or confiscated by law enforcement. Some of the members may BE law enforcement.

It's important not to oversell the security of the protocol w/ such a big attack surface area.