Bonjour.
Marre des #fachos sur #Diaspora et des copains de fachos, genre #Souverainistes et autres #Trolls #troll soit-disant à gauche !!
Je cherche un #RéseauSocial avec une réelle #Modération du #racisme ainsi que tout ce qui dédiabolise le racisme. Par exemple, à exclure les gens qui se font passer pour être de de #gauche, mais qui sont en fait de #droite (les fameux trolls à gauche) et potes avec les fachos, vu leur délire #Souverainiste.

#Mastodon ? #Friendica ?

Je ne veux pas juste une #instance qui dit vouloir lutter contre le #racisme, je veux une #instance qui BLOQUE les #Puants.
J'ai des pistes (des #instances), mais je ne veux pas me fixer à la légère, vos avis comptent.

J'avoue, une personne ici, en particulier (que je ne nomme pas), j'attends son avis... 😀
(précision : une instance avec les inscriptions ouvertes, + dans le #Fediverse !)

A pluche. 😀
https://jointhefediverse.net/join

IFTAS is happy to announce the public availability of our DSA Guide for Decentralized Services – a practical guide for small and micro services that are subject to the EU’s Digital Services Act.

If your server has member accounts in the EU, or is publicly viewable in the EU, your service is most likely impacted by this regulation, even if you are not based or hosted in the EU.

Developed in collaboration with the great people at Tremau, our DSA Guide is designed to help independent social media service providers navigate these complex regulations and achieve compliance with these new rules without compromising the unique qualities of federated, open social networks.

As part of our Needs Assessment activities, we’ve heard a repeated need for help understanding the complex regulatory landscape that decentralized services need to consider, and this DSA Guide is the first of many in our plan to provide clear, actionable guidance to a range of regulations for the community.

As of February 2024, all online services and digital platforms that offer services in the European Union are required to be fully compliant with the DSA.

However, various portions of the DSA are not applicable to “small and micro” services, and this guide will show you clearly which parts apply and which do not.

For administrators of platforms like Mastodon, PeerTube, and Pixelfed, the DSA Guide can help demystify the requirements and offer practical advice on achieving compliance for the over 27,000 independent operators of these and other decentralized social media services who otherwise may not be able to obtain the guidance and advice that larger operations can afford to invest in.

Download the DSA Guide for Decentralized Fediverse Services.

To join the discussion, visit our community chat service at https://matrix.to/#/#space:matrix.iftas.org or stay tuned to join our community portal in the coming weeks!

https://about.iftas.org/2024/04/09/dsa-guide-for-the-fediverse/

#ActivityPub #BetterSocialMedia #DSA #Fediverse

IFTAS

2024-04-09 12:02:00

IFTAS is happy to announce the public availability of our DSA Guide for Decentralized Services – a practical guide for small and micro services that are subject to the EU’s Digital Services Act.

If your server has member accounts in the EU, or is publicly viewable in the EU, your service is most likely impacted by this regulation, even if you are not based or hosted in the EU.

Developed in collaboration with the great people at Tremau, our DSA Guide is designed to help independent social media service providers navigate these complex regulations and achieve compliance with these new rules without compromising the unique qualities of federated, open social networks.

As part of our Needs Assessment activities, we’ve heard a repeated need for help understanding the complex regulatory landscape that decentralized services need to consider, and this DSA Guide is the first of many in our plan to provide clear, actionable guidance to a range of regulations for the community.

As of February 2024, all online services and digital platforms that offer services in the European Union are required to be fully compliant with the DSA.

However, various portions of the DSA are not applicable to “small and micro” services, and this guide will show you clearly which parts apply and which do not.

For administrators of platforms like Mastodon, PeerTube, and Pixelfed, the DSA Guide can help demystify the requirements and offer practical advice on achieving compliance for the over 27,000 independent operators of these and other decentralized social media services who otherwise may not be able to obtain the guidance and advice that larger operations can afford to invest in.

Download the DSA Guide for Decentralized Fediverse Services.

To join the discussion, visit our community chat service at https://matrix.to/#/#space:matrix.iftas.org or stay tuned to join our community portal in the coming weeks!

https://about.iftas.org/2024/04/09/dsa-guide-for-the-fediverse/

#ActivityPub #BetterSocialMedia #DSA #Fediverse

The extraterritorial implications of the Digital Services Act - DSA Observatory

Laureline Lemoine & Mathias Vermeulen (AWO) As the enforcement of the Digital Services Act (DSA) is gathering speed, a number of non-EU based civil society and research organizations have wondered to what extent the DSA can have an impact on their wo…

^{admin (DSA Observatory)}

Es gibt noch Tickets für das #FediCamp2024 vom 16. bis 21. Juli 2024 in Gedelitz.

Camping am Arsch der Heide mit den tollen #FediWesen, die ihr sonst nur hier im #Fediverse trefft.

Mehr Infos findet ihr unter https://fedi.camp.

Und meinen kleinen Liebesbrief in Videoform zum ersten #Fedicamp gibt es hier:
https://video.dresden.network/videos/watch/2f8850b2-7c72-42ed-bebb-1dadab126a8c

@fedicamp

Ückück / Stephanie Henkel

2022-08-18 09:55:23

Erfahrungsbericht: Fedicamp 2022

Ich war beim Fedicamp 2022!

Und wie schön es war, Teil des ersten Fedicamps zu sein, erfahrt ihr in diesem kurzen Bericht.

Timestamps:
00:00:00 Begrüßung
00:00:39 Wie alles begann - Die Planung
00:01:46 Lokaler Hintergrund
00:02:21 Die Reise beginnt
00:02:50 Campleben
00:04:53 Workshops und andere Highlights
00:09:29 Kommende Camps und Treffen
00:10:07 Fazit

Weiterführende Links:
Website zum Fedicamp - https://fedi.camp/
Website vom Packpapierverlag - https://www.packpapierverlag.de/
Das Gasthof Wiese - https://region-wendland.de/unterkunft/gasthaus-wiese/

Fedicamp

^fedi.camp

Fediverse | Probleme bei der Federation

Es gibt im Fediverse einige Newsbots deren 'Anrisse' bei mir scheinbar ohne Link zum Orginalbeitrag sind. Nehmen wir zum Beispiel diesen Beitrag. Bei mir (Friendica) sieht er so aus:

Sprich es gibt nur einen kurzen Textanriss und ansonsten gar nichts. Gehe ich dann auf den Orginalbeitrag (ebenfalls Friendica), so sieht es so aus:

Nun stellt sich die Frage wo unterwegs das Bild als auch der Link auf der Strecke geblieben sind. Liegt es daran das ich die Vorschau für Links deaktiviert habe? Wenn ja, dann müsste ja doch trotzdem irgendwo der entsprechende Link im Beitrag sein, oder sehe ich das falsch?

Achso, der Vollständigkeit halber findet man hier auch noch die verlinkte Seite bei DW.

#Frage #Fediverse #Friendica #News #LInks #Sascha #2024-03-24 @Friendica Support

Deutsche Welle (inoffiziell)

2024-03-23 15:17:00

Im zweiten Anlauf hat der Start in Baikonur geklappt: Eine neue Crew ist auf dem Weg zur Internationalen Raumstation. Erstmals an Bord: eine Kosmonautin aus Belarus.

Zwei Raumfahrerinnen und ein Kosmonaut unterwegs zur ISS

^{Deutsche Welle}

Note: This post is also available on my website, where it will be periodically updated.

There is a whole science to manipulating our attention. And because there is a lot of money to be made by doing this well, it means we all encounter attempts to manipulate what we pay attention to each day. What is this, and how is it harmful? This post will be the first on a series on the topic.

Why is attention so important?

When people use Facebook, they use it for free. Facebook generally doesn’t even try to sell them anything, yet has billions in revenues. What, then, is Facebook’s product?

Well, really, it’s you. Or, more specifically, your attention. Facebook sells your attention to advertisers. Everything they do is in service to that. They want you to spend more time on the site so they can show you more ads.

(I should say here that I’m using Facebook as an example, but this applies to other social media companies too.)

Seeking to maximize attention

So if your attention is so important to their profit, it follows naturally that they would seek ways to get people to spend more time on their site. And they do. They track all sorts of metrics, including “engagement” (if you click “like”, comment, share, or otherwise interact with content). They know which sorts of things are likely to capture your (and I mean you in specific!) attention and show you that. Your neighbor may have different interests and Facebook judges different things are likely to capture their attention.

Manipulating your attention

Attention turning into money isn’t unique for social media. In fact, in the article If It Bleeds, It Leads: Understanding Fear-Based Media, Psychology Today writes:

In previous decades, the journalistic mission was to report the news as it actually happened, with fairness, balance, and integrity. However, capitalistic motives associated with journalism have forced much of today’s television news to look to the spectacular, the stirring, and the controversial as news stories. It’s no longer a race to break the story first or get the facts right. Instead, it’s to acquire good ratings in order to get advertisers, so that profits soar.

News programming uses a hierarchy of if it bleeds, it leads. Fear-based news programming has two aims. The first is to grab the viewer’s attention. In the news media, this is called the teaser. The second aim is to persuade the viewer that the solution for reducing the identified fear will be in the news story. If a teaser asks, “What’s in your tap water that YOU need to know about?” a viewer will likely tune in to get the up-to-date information to ensure safety.

You’ve probably seen fear-based messages a lot on Facebook. They will highlight messages to liberals about being afraid of what Trump is doing, and to conservatives about being afraid of what Biden is doing. They may or may not even intentionally be doing this; it is their algorithm predicts that those would maximize time and engagement for certain people, so that’s what they see.

Fear leads to controversy

It’s not just fear, though. Social media also loves controversy. There’s nothing that makes people really want to stay on Facebook like anger. See something controversial and you’ll see hundreds or thousands of people are there arguing about it — and in the process, giving Facebook their attention. A quick Internet search will show you numerous articles on how marketing companes can leverage controvery to get attention and engagement with their campaigns.

Consequences of maximizing fear and controversy

What does it mean to society at large — and to you personally — that large companies make a lot of money by maximizing fear and controversy?

The most obvious way is it leads to less common ground. If the posts and reactions that show common ground are never seen because they don’t drive engagement, it poisons the well; left and right hate each other with ever more vigor — a profitable outcome to Facebook, but a poisonous one to all of us.

I have had several friendships lost because I — a liberal in agreement with these friends on political matters — still talk to Trump voters. On the other side, we’ve seen people storm the Michigan statehouse with weapons. How did that level of disagreement — and even fear behind it — get so firmly embedded in our society? Surely the fact that social media shows us things designed to stimulate fear and anger must play a role.

What does it do to our ability to have empathy for, and understand, others? The Facebook groups I’ve been in for like-minded people have largely been flooded with memes calling the President “rump” and other things clearly designed to make people angry or fearful. It’s a worthless experience, and not just that, but it’s a harmful experience.

When our major media — TV and social networks — all are optimizing for fear, anger, and controvesry, we have a society beholden to fear, anger, and controvesy.

In my next installment, I’m going to talk about what to do about this, including the decentralized social networks of the Fediverse that are specifically designed to put you back in charge of your attention.

Update 2020-12-16: There are two followup articles for this: how to join the Fediverse and non-creepy technology purchasing and gifting guides. The latter references the FSF’s page on software manipulation towards addiction, which is particularly relevant to this topic.

https://changelog.complete.org/archives/10119-how-the-attention-economy-hurts-you-via-social-media-sites-like-facebook

#anger #facebook #fear #fediverse #socialmedia

John Goerzen

2020-12-16 05:38:45

Note: this page is also available on my webiste, where it will be periodically updated.

In a recent post, I wrote about how the attention economy in use at big social networks hurts you.

In this post, I’m going to suggest what to do about it.

Mastodon and the Fediverse

When you use email, you can send a message from an account at Google to one at Yahoo, Microsoft, or any of millions of businesses and organizations running their own mail server. Unlike, say, Facebook, email isn’t a single service, but rather a whole bunch of independent systems that can communicate (or federate) with each other.

The Fediverse is similar, and the most advanced Fediverse client is Mastodon.

Mastodon:

• Lets you easily migrate your account from one Mastodon instance to another, similar to how you can migrate a phone number from one carrier to another
• Lets you communicate with users across the Fediverse (other Mastodon instances, and those running other software too)
• Supports very high-quality conversations through sensible moderation controls

It’s easy to get started! Head over to joinmastodon.org and click “Get Started”. Pick a community — don’t worry, this isn’t a hugely consequential decision, as you can always move or change later. You can browse activity from across the Fediverse, or just on your local community, so if you find a community with similar interests, it can be a neat way to find others to follow.

If you’re looking for more details, mastodon.help has a nice guide.

Defeating the Attention Economy

So, why does Mastodon make a difference?

First of all, you get to pick your host (and even software). With Twitter, you pretty much are using Twitter (yes, I know of things like Hootsuite, but for the vast majority of people, it’s twitter.com only). With Mastodon, you have choice. Pick the host that runs the software and has the kind of moderation you like.

Secondly, Mastodon is not for profit. There is no money to be made in keeping you on the site. Almost all Mastodon instances are ad-free. And Mastodon’s completely open protocols make it easy to go elsewhere if you like.

It’s Not Just Mastodon!

There are plenty of other programs in the Fediverse. And, this is really key, they all interact with each other. You can share photos in Pixelfed (sort of like a federated Instagram) and see them and comment in Mastodon! Some things to point out:

• Pixelfed is federated image sharing
• Peertube is federated video sharing

And there are many others.

This blog, for instance, runs WordPress and uses an ActivityPub connector; comments from the Fediverse integrate here.

Find me in the Fediverse

You can look me up: just type in @jgoerzen in the search box of any Mastodon instance and click Follow. You can also follow this blog at @jgoerzen.

https://changelog.complete.org/archives/10124-how-to-join-the-fediverse-and-cast-off-the-attention-economy

#fediverse #mastodon #socialmedia

Mastodon - Decentralized social media

Learn more about Mastodon, the radically different, free and open-source decentralized social media platform.

^{joinmastodon.org}

Note: this page is also available on my webiste, where it will be periodically updated.

In a recent post, I wrote about how the attention economy in use at big social networks hurts you.

In this post, I’m going to suggest what to do about it.

Mastodon and the Fediverse

When you use email, you can send a message from an account at Google to one at Yahoo, Microsoft, or any of millions of businesses and organizations running their own mail server. Unlike, say, Facebook, email isn’t a single service, but rather a whole bunch of independent systems that can communicate (or federate) with each other.

The Fediverse is similar, and the most advanced Fediverse client is Mastodon.

Mastodon:

• Lets you easily migrate your account from one Mastodon instance to another, similar to how you can migrate a phone number from one carrier to another
• Lets you communicate with users across the Fediverse (other Mastodon instances, and those running other software too)
• Supports very high-quality conversations through sensible moderation controls

It’s easy to get started! Head over to joinmastodon.org and click “Get Started”. Pick a community — don’t worry, this isn’t a hugely consequential decision, as you can always move or change later. You can browse activity from across the Fediverse, or just on your local community, so if you find a community with similar interests, it can be a neat way to find others to follow.

If you’re looking for more details, mastodon.help has a nice guide.

Defeating the Attention Economy

So, why does Mastodon make a difference?

First of all, you get to pick your host (and even software). With Twitter, you pretty much are using Twitter (yes, I know of things like Hootsuite, but for the vast majority of people, it’s twitter.com only). With Mastodon, you have choice. Pick the host that runs the software and has the kind of moderation you like.

Secondly, Mastodon is not for profit. There is no money to be made in keeping you on the site. Almost all Mastodon instances are ad-free. And Mastodon’s completely open protocols make it easy to go elsewhere if you like.

It’s Not Just Mastodon!

There are plenty of other programs in the Fediverse. And, this is really key, they all interact with each other. You can share photos in Pixelfed (sort of like a federated Instagram) and see them and comment in Mastodon! Some things to point out:

• Pixelfed is federated image sharing
• Peertube is federated video sharing

And there are many others.

This blog, for instance, runs WordPress and uses an ActivityPub connector; comments from the Fediverse integrate here.

Find me in the Fediverse

You can look me up: just type in @jgoerzen in the search box of any Mastodon instance and click Follow. You can also follow this blog at @jgoerzen.

https://changelog.complete.org/archives/10124-how-to-join-the-fediverse-and-cast-off-the-attention-economy

#fediverse #mastodon #socialmedia

John Goerzen

2020-12-10 18:40:45

Note: This post is also available on my website, where it will be periodically updated.

There is a whole science to manipulating our attention. And because there is a lot of money to be made by doing this well, it means we all encounter attempts to manipulate what we pay attention to each day. What is this, and how is it harmful? This post will be the first on a series on the topic.

Why is attention so important?

When people use Facebook, they use it for free. Facebook generally doesn’t even try to sell them anything, yet has billions in revenues. What, then, is Facebook’s product?

Well, really, it’s you. Or, more specifically, your attention. Facebook sells your attention to advertisers. Everything they do is in service to that. They want you to spend more time on the site so they can show you more ads.

(I should say here that I’m using Facebook as an example, but this applies to other social media companies too.)

Seeking to maximize attention

So if your attention is so important to their profit, it follows naturally that they would seek ways to get people to spend more time on their site. And they do. They track all sorts of metrics, including “engagement” (if you click “like”, comment, share, or otherwise interact with content). They know which sorts of things are likely to capture your (and I mean you in specific!) attention and show you that. Your neighbor may have different interests and Facebook judges different things are likely to capture their attention.

Manipulating your attention

Attention turning into money isn’t unique for social media. In fact, in the article If It Bleeds, It Leads: Understanding Fear-Based Media, Psychology Today writes:

In previous decades, the journalistic mission was to report the news as it actually happened, with fairness, balance, and integrity. However, capitalistic motives associated with journalism have forced much of today’s television news to look to the spectacular, the stirring, and the controversial as news stories. It’s no longer a race to break the story first or get the facts right. Instead, it’s to acquire good ratings in order to get advertisers, so that profits soar.

News programming uses a hierarchy of if it bleeds, it leads. Fear-based news programming has two aims. The first is to grab the viewer’s attention. In the news media, this is called the teaser. The second aim is to persuade the viewer that the solution for reducing the identified fear will be in the news story. If a teaser asks, “What’s in your tap water that YOU need to know about?” a viewer will likely tune in to get the up-to-date information to ensure safety.

You’ve probably seen fear-based messages a lot on Facebook. They will highlight messages to liberals about being afraid of what Trump is doing, and to conservatives about being afraid of what Biden is doing. They may or may not even intentionally be doing this; it is their algorithm predicts that those would maximize time and engagement for certain people, so that’s what they see.

Fear leads to controversy

It’s not just fear, though. Social media also loves controversy. There’s nothing that makes people really want to stay on Facebook like anger. See something controversial and you’ll see hundreds or thousands of people are there arguing about it — and in the process, giving Facebook their attention. A quick Internet search will show you numerous articles on how marketing companes can leverage controvery to get attention and engagement with their campaigns.

Consequences of maximizing fear and controversy

What does it mean to society at large — and to you personally — that large companies make a lot of money by maximizing fear and controversy?

The most obvious way is it leads to less common ground. If the posts and reactions that show common ground are never seen because they don’t drive engagement, it poisons the well; left and right hate each other with ever more vigor — a profitable outcome to Facebook, but a poisonous one to all of us.

I have had several friendships lost because I — a liberal in agreement with these friends on political matters — still talk to Trump voters. On the other side, we’ve seen people storm the Michigan statehouse with weapons. How did that level of disagreement — and even fear behind it — get so firmly embedded in our society? Surely the fact that social media shows us things designed to stimulate fear and anger must play a role.

What does it do to our ability to have empathy for, and understand, others? The Facebook groups I’ve been in for like-minded people have largely been flooded with memes calling the President “rump” and other things clearly designed to make people angry or fearful. It’s a worthless experience, and not just that, but it’s a harmful experience.

When our major media — TV and social networks — all are optimizing for fear, anger, and controvesry, we have a society beholden to fear, anger, and controvesy.

In my next installment, I’m going to talk about what to do about this, including the decentralized social networks of the Fediverse that are specifically designed to put you back in charge of your attention.

Update 2020-12-16: There are two followup articles for this: how to join the Fediverse and non-creepy technology purchasing and gifting guides. The latter references the FSF’s page on software manipulation towards addiction, which is particularly relevant to this topic.

https://changelog.complete.org/archives/10119-how-the-attention-economy-hurts-you-via-social-media-sites-like-facebook

#anger #facebook #fear #fediverse #socialmedia

Managing depression requires you to mind your media intake.

News programming uses a hierarchy of. "if it bleeds, it leads." If you live with depression, read on for why fear-based media may not be good for your mental health.

^{Deborah Serani Psy.D. (Psychology Today)}

HTTP Signature Infinite Loop?
https://shkspr.mobi/blog/2024/02/http-signature-infinite-loop/

I'm trying to get my head round HTTP Signatures as they're used extensively in the Fediverse.

Conceptually, they're relatively straightforward.

You send me a normal HTTP request. For example, you want to POST something to https://example.com/data

You send me these headers:

POST /dataHost: example.comDate: Sat, 24 Feb 2024 14:43:48 GMTAccept-Encoding: gzipDigest: SHA-256=aaC57TDzM0Wq+50We2TkCsdMDvdqON92edg7KI+Hk8M=Content-Type: application/activity+jsonSignature: keyId="https://your_website.biz/publicKey",algorithm="rsa-sha256",headers="(request-target) host date digest content-type",signature="JGQ53kEoIiMWRp9By9jajVGCOCu4n7XBeiA1uY5xLcnAxL2Y1GIgU/...=="Connection: Keep-AliveContent-Length: 751

1. Check the SHA-256 hash of the message matches the content of the "Digest" header.
2. Check the timestamp is somewhat fresh.
3. Check the signature matches.

The first is simple: base64_encode( hash( "sha256", $request_body, true ) ).
The second is a matter of opinion. I might be happy to receive messages from the distant past or far in the future. For the sake of a little clock drift, let's allow 60 seconds either way.
The third gets complicated.

First, I need to get the public key published at keyId="https://your_website.biz/publicKey".

Next, I need to know which algorithm is being used to sign the headers: algorithm="rsa-sha256"

Then, I need to know which headers - and in what order - are being signed: headers="(request-target) host date digest content-type"

So I create a string using the received details which matches those headers in that specific order:

(request-target) POST /dataHost: example.comDate: Sat, 24 Feb 2024 14:43:48 GMTDigest: SHA-256=aaC57TDzM0Wq+50We2TkCsdMDvdqON92edg7KI+Hk8M=Content-Type: application/activity+json

openssl_verify(    $headersString,     $signature,     $publicKey,     $algorithm);

But can you spot the implicit problem?

How do I get your server's public key?

I just GET https://your_website.biz/publicKey - but if your server uses something like Authorised Fetch then I have to sign my request to you.

Which means your server will need to validate my signature by obtaining my public key. Which it will get by signing a request and sending it to me. Which, before I return my public key, I will need to validate your signature by obtaining your public key. Which I will get by signing a request... and so on.

This deadlock loop is documented. The usual way around it is either for the sending server to use an instance-specific signature which can be retrieved by an unsigned request, or to allow any unsigned request to access a user's public key.

I get why things happen this way - I just wish it were easier to implement!

https://shkspr.mobi/blog/2024/02/http-signature-infinite-loop/

#ActivityPub #CyberSecurity #encryption #fediverse #http

Terence Eden’s Blog

2024-02-26 12:34:28

HTTP Signature Infinite Loop?
https://shkspr.mobi/blog/2024/02/http-signature-infinite-loop/

I'm trying to get my head round HTTP Signatures as they're used extensively in the Fediverse.

Conceptually, they're relatively straightforward.

You send me a normal HTTP request. For example, you want to POST something to https://example.com/data

You send me these headers:

POST /dataHost: example.comDate: Sat, 24 Feb 2024 14:43:48 GMTAccept-Encoding: gzipDigest: SHA-256=aaC57TDzM0Wq+50We2TkCsdMDvdqON92edg7KI+Hk8M=Content-Type: application/activity+jsonSignature: keyId="https://your_website.biz/publicKey",algorithm="rsa-sha256",headers="(request-target) host date digest content-type",signature="JGQ53kEoIiMWRp9By9jajVGCOCu4n7XBeiA1uY5xLcnAxL2Y1GIgU/...=="Connection: Keep-AliveContent-Length: 751

In order to verify the contents of the message, I need to do three things:

1. Check the SHA-256 hash of the message matches the content of the "Digest" header.
2. Check the timestamp is somewhat fresh.
3. Check the signature matches.

The first is simple: base64_encode( hash( "sha256", $request_body, true ) ).
The second is a matter of opinion. I might be happy to receive messages from the distant past or far in the future. For the sake of a little clock drift, let's allow 60 seconds either way.
The third gets complicated.

First, I need to get the public key published at keyId="https://your_website.biz/publicKey".

Next, I need to know which algorithm is being used to sign the headers: algorithm="rsa-sha256"

Then, I need to know which headers - and in what order - are being signed: headers="(request-target) host date digest content-type"

So I create a string using the received details which matches those headers in that specific order:

(request-target) POST /dataHost: example.comDate: Sat, 24 Feb 2024 14:43:48 GMTDigest: SHA-256=aaC57TDzM0Wq+50We2TkCsdMDvdqON92edg7KI+Hk8M=Content-Type: application/activity+json

I can verify if the signature - signature="JGQ53kEoIiMWRp9By9jajVGCOCu4n7XBeiA1uY5xLcnAxL2Y1GIgU/...==" matches by:

openssl_verify(    $headersString,     $signature,     $publicKey,     $algorithm);

If that's TRUE then all is well.

But can you spot the implicit problem?

How do I get your server's public key?

I just GET https://your_website.biz/publicKey - but if your server uses something like Authorised Fetch then I have to sign my request to you.

Which means your server will need to validate my signature by obtaining my public key. Which it will get by signing a request and sending it to me. Which, before I return my public key, I will need to validate your signature by obtaining your public key. Which I will get by signing a request... and so on.

This deadlock loop is documented. The usual way around it is either for the sending server to use an instance-specific signature which can be retrieved by an unsigned request, or to allow any unsigned request to access a user's public key.

I get why things happen this way - I just wish it were easier to implement!

https://shkspr.mobi/blog/2024/02/http-signature-infinite-loop/

#ActivityPub #CyberSecurity #encryption #fediverse #http

Authorized Fetch and the Instance Actor

Using an instance actor for mitigating the authorized fetch key retrieval bug seems strange to me so I dug into the historical record to try to understand how this all evolved.

^SocialHub

Aufgrund des Artikels zur Fediverse Spamwelle von Codeberg (Link ganz unten) ist mir wieder Folgendes eingefallen.

Ich hatte da mal vor längerer Zeit eine Art Spam-Trust-Abo Addon für Friendica vorgeschlagen, mit dem die Blockliste einer anderen Instanz oder mehreren Instanzen abonniert werden kann, denen vertraut wird. So dass ...

1. die Information rein kommt, welche Instanzen und Accounts auf die Blocklisten gekommen sind, oder generell vorhanden sind, aber ohne dass diese automatisch übernommen werden. Aktuell ist die Info über solche Accounts oft Zufall oder durch proaktives Suchen im Fediverse auffindbar. Oder das Absuchen von Blocklisten auf github. Also maximal manuell.
2. Eine Option, in der Blöcke sofort übernommen werden und in einer Liste zur Bestätigung angezeigt werden. So dass immer klar ist, was neu und was alt ist.
3. Die 2. Option als temporäre Lösung verfügbar ist z.B. bei Urlaub, Krankheit usw.
4. Dieses Feature bidirektional mit jeder dieser Optionen funktioniert.

Leider wurde dieser Vorschlag recht rabiat mit etwas abstrusen Vorwürfen niedergemacht. Aber vielleicht ist jetzt die Zeit gekommen, mit einem kühlen Kopf über so eine Lösung nachzudenken.

Denkbar ist natürlich, dass hier ein größeres Trustnet aufgebaut werden kann, in dem es auch "rejects" gibt. Oder auch Trustkarma für Instanzen, die sehr seriös mit dem Thema umgehen oder eben kaum Trustkarma für Hyperventilierer und Empöristen. Das ist dann aber ein ganz anderes und recht komplexes Thema.

What we can learn from the Fediverse spam for Codeberg
https://blog.codeberg.org/what-we-can-learn-from-the-fediverse-spam-for-codeberg.html

#Fediverse #Friendica #Addon