5 ms·

Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.

by YtvwlD 3y ago

steveklabnik 3y ago
I don't personally believe that one mistake indicates ignorance of an entire topic.
- seba_dos1 3y ago
  In general - no, but this kind of fundamental mistake might.
  - steveklabnik 3y ago
    I hope I never work on software you folks use. The grand claims about something that is not even hard to fix is just wild to me.
    - gowld 3y ago
      What about the next 500 easy-to-fix bugs? Is there a public test suite?
      - steveklabnik 3y ago
        > Is there a public test suite? The entire specification (which is admittedly incomplete) and implementation are open source. I am not aware of a dedicated test suite for alternative implementations. It's too early, IMHO. I personally would much prefer the team to focus their time elsewhere for the time being.
        ShroudedNight 3y ago
        My instincts may be way off-base, but if I was developing a protocol at the core of my product vision, even if there was only one implementation, I would a want an authoritative test suite. I wouldn't trust myself not to integrate load-bearing idiosyncrasies (and bugs, honestly) otherwise.
        steveklabnik 3y ago
        I mean, I don't think you're incorrect, but I do think that like, semantics matters here. There is a test suite, of their implementation. Just because they have not extracted it and made it easily re-usable for alternative doesn't mean that they don't have checks to ensure regressions don't appear, you know? They already build off of many related specifications, which have independent implementations, and a lot of the core protocol is RPC style, with schemas that they do publish. So there's already a lot of rigidity here for alternative implementations to use in a way that is extremely likely to be compliant. I guess another way of putting it is "I don't exactly disagree with you but doing that takes work, and we're at the stage of this stuff where that work is being done, so expecting it right now feels premature to me." The spec isn't "released" or "done," it's in development.
    - seba_dos1 3y ago
      Being easy to fix is completely irrelevant. The thing is that it's easy to avoid. The only way to end up there is to not put any thought into the domain verification scheme before deploying it. Any kind of review would catch it. That's what makes it look really bad.
      - deleted 3y ago
        [deleted]
    - account42 3y ago
      If your response to a fundamental design flaw of identy verification is "something that is not even hard to fix" then that hope is mutual.
rchaud 3y ago
The pull of NIH is a strong one.
linuxdude314 3y ago
Paul has lots of experience designing protocols. He designed SSB. ActivityPub does a lot of things wrong from first principals. The whole point was to start from scratch.
- mariusor 3y ago
  > ActivityPub does a lot of things wrong from first principals I'd be curious to learn about those.
  - capableweb 3y ago
    There is a lot more information here: https://twitter.com/bluesky/status/1511811083954102273?lang=en https://twitter.com/bluesky/status/1511811083954102273?lang=... From my own understanding, the biggest useful differences for me personally is: account portability, domains as usernames and content-addressable from the ground up. - Account portability - Useful if/when you want to move between servers - Domains as usernames - Ties into the same value as account portability. I've owned my own domain for decades, it never changes and probably won't, until years after I die - Content-addressable - Caching and syncing becomes so much easier, which is a huge issue Mastodon currently suffers from.
    - mariusor 3y ago
      Since you seem to default to sending me to RTFM :D, I'll give you a similarly short reply: ActivityPub can identify users based on their domain too. Probably better than BlueSky does, because it uses better standardized mechanisms - the URI needs to dereference to a valid ActivityPub actor and the community has converged to using webfinger for discovery. The fact that web-finger is generally used for user discovery makes it easier to use the identical mechanism that BlueSky uses - where the identity (which in ActivityPub is a URL) is not tied directly to a domain. (Eg, if you do a webfinger query for marius.federated.id you will get a response where it tells you that one of the URLs for the ActivityPub identity associated with that is https://metalhead.club/@mariusor https://metalhead.club/@mariusor, you can check it out right now with curl https://marius.federated.id/.well-known/webfinger?resource=https://marius.federated.id https://marius.federated.id/.well-known/webfinger?resource=h...). Account portability can exist in ActivityPub because the verbs for signaling to the network that an object/actor has moved to a different URL are in the vanilla vocabulary. The fact that nobody has implemented this so far does not make it impossible. (It's not like anyone so far needed to move from BlueSky to ... I don't know... BlueSky. So it being capable of moving identities is still equally theoretical in my view). Regarding your last point (or the one made about it in the twitter thread), I don't really understand about how identifying content by its cryptographic signature is conducive to better caching and "syncing" (how in the world a hash would make it easier to sync content than a URL I don't know). HTTP clients, servers and proxies have very good caching and syncing mechanisms for anything that uses URLs to identify resources. Whatever BlueSky wants to do, must invent their own intermediary layers before anyone will be able to say "it's easier" with any certainty. In my opinion nothing you mentioned can be called a "doing things wrong from first principals(sic)" - and I'm still hoping that linuxdude314 can make a better argument. ActivityPub is fine for what it was designed to be: an exchange mechanism for "low impact" social activity. It's not meant to interact with cryptocurrencies, it's not meant to shelter dissidents from corrupt governments, it's not meant to help you interact with your drug dealer, nor whistle-blow on your employer. There are already options for those things. It is meant to allow your grandma to like your cat pictures in a more distributed manner than facebook offers. The people that imagine BlueSky will be doing something more than that, are - in my opinion - vastly overevaluating it. (PS. Apparently this was not "similarly short", apologies.)

Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.

by YtvwlD 3y ago

Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.

steveklabnik 3y ago

I don't personally believe that one mistake indicates ignorance of an entire topic.

seba_dos1 3y ago
In general - no, but this kind of fundamental mistake might.
- steveklabnik 3y ago
  I hope I never work on software you folks use. The grand claims about something that is not even hard to fix is just wild to me.
  - gowld 3y ago
    What about the next 500 easy-to-fix bugs? Is there a public test suite?
    - steveklabnik 3y ago
      > Is there a public test suite? The entire specification (which is admittedly incomplete) and implementation are open source. I am not aware of a dedicated test suite for alternative implementations. It's too early, IMHO. I personally would much prefer the team to focus their time elsewhere for the time being.
      - ShroudedNight 3y ago
        My instincts may be way off-base, but if I was developing a protocol at the core of my product vision, even if there was only one implementation, I would a want an authoritative test suite. I wouldn't trust myself not to integrate load-bearing idiosyncrasies (and bugs, honestly) otherwise.
        steveklabnik 3y ago
        I mean, I don't think you're incorrect, but I do think that like, semantics matters here. There is a test suite, of their implementation. Just because they have not extracted it and made it easily re-usable for alternative doesn't mean that they don't have checks to ensure regressions don't appear, you know? They already build off of many related specifications, which have independent implementations, and a lot of the core protocol is RPC style, with schemas that they do publish. So there's already a lot of rigidity here for alternative implementations to use in a way that is extremely likely to be compliant. I guess another way of putting it is "I don't exactly disagree with you but doing that takes work, and we're at the stage of this stuff where that work is being done, so expecting it right now feels premature to me." The spec isn't "released" or "done," it's in development.
  - seba_dos1 3y ago
    Being easy to fix is completely irrelevant. The thing is that it's easy to avoid. The only way to end up there is to not put any thought into the domain verification scheme before deploying it. Any kind of review would catch it. That's what makes it look really bad.
    - deleted 3y ago
      [deleted]
  - account42 3y ago
    If your response to a fundamental design flaw of identy verification is "something that is not even hard to fix" then that hope is mutual.

rchaud 3y ago

The pull of NIH is a strong one.

linuxdude314 3y ago

Paul has lots of experience designing protocols. He designed SSB. ActivityPub does a lot of things wrong from first principals. The whole point was to start from scratch.

mariusor 3y ago
> ActivityPub does a lot of things wrong from first principals I'd be curious to learn about those.
- capableweb 3y ago
  There is a lot more information here: https://twitter.com/bluesky/status/1511811083954102273?lang=en https://twitter.com/bluesky/status/1511811083954102273?lang=... From my own understanding, the biggest useful differences for me personally is: account portability, domains as usernames and content-addressable from the ground up. - Account portability - Useful if/when you want to move between servers - Domains as usernames - Ties into the same value as account portability. I've owned my own domain for decades, it never changes and probably won't, until years after I die - Content-addressable - Caching and syncing becomes so much easier, which is a huge issue Mastodon currently suffers from.
  - mariusor 3y ago
    Since you seem to default to sending me to RTFM :D, I'll give you a similarly short reply: ActivityPub can identify users based on their domain too. Probably better than BlueSky does, because it uses better standardized mechanisms - the URI needs to dereference to a valid ActivityPub actor and the community has converged to using webfinger for discovery. The fact that web-finger is generally used for user discovery makes it easier to use the identical mechanism that BlueSky uses - where the identity (which in ActivityPub is a URL) is not tied directly to a domain. (Eg, if you do a webfinger query for marius.federated.id you will get a response where it tells you that one of the URLs for the ActivityPub identity associated with that is https://metalhead.club/@mariusor https://metalhead.club/@mariusor, you can check it out right now with curl https://marius.federated.id/.well-known/webfinger?resource=https://marius.federated.id https://marius.federated.id/.well-known/webfinger?resource=h...). Account portability can exist in ActivityPub because the verbs for signaling to the network that an object/actor has moved to a different URL are in the vanilla vocabulary. The fact that nobody has implemented this so far does not make it impossible. (It's not like anyone so far needed to move from BlueSky to ... I don't know... BlueSky. So it being capable of moving identities is still equally theoretical in my view). Regarding your last point (or the one made about it in the twitter thread), I don't really understand about how identifying content by its cryptographic signature is conducive to better caching and "syncing" (how in the world a hash would make it easier to sync content than a URL I don't know). HTTP clients, servers and proxies have very good caching and syncing mechanisms for anything that uses URLs to identify resources. Whatever BlueSky wants to do, must invent their own intermediary layers before anyone will be able to say "it's easier" with any certainty. In my opinion nothing you mentioned can be called a "doing things wrong from first principals(sic)" - and I'm still hoping that linuxdude314 can make a better argument. ActivityPub is fine for what it was designed to be: an exchange mechanism for "low impact" social activity. It's not meant to interact with cryptocurrencies, it's not meant to shelter dissidents from corrupt governments, it's not meant to help you interact with your drug dealer, nor whistle-blow on your employer. There are already options for those things. It is meant to allow your grandma to like your cat pictures in a more distributed manner than facebook offers. The people that imagine BlueSky will be doing something more than that, are - in my opinion - vastly overevaluating it. (PS. Apparently this was not "similarly short", apologies.)