Notes on the implementation of Data Portability in #tootik
https://github.com/dimkr/tootik/blob/v0.19.0/FEDERATION.md#data-portability
nomadicidentity
The NomadPub intro page now includes a "Research" section:
https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md#research
I listed the most important open research problems there: key management (alt-DIDs), alternative transports, E2EE and generic servers.
#tootik implemented FEP-ef61
We have 3 independent implementations now:
https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md#status
@dimkr #fep_ef61 #NomadicIdentity
RE: https://hd.206267.xyz/post/0198d701-8bdd-71f2-bd56-9f381e18f15f
Added Nomadic ActivityPub page to the ap-next repository:
https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md
This is a brief summary of the work we've done. Feedback is welcome!
Edited 1y ago
I've made several changes to FEP-ef61: Portable Objects
https://codeberg.org/fediverse/fep/pulls/668
Section "Authentication and authorization" explains the differences between portable objects and non-portable objects (FEP-fe34):
- Cryptographic origins are used instead of RFC-6454 web origins.
- Portable objects can't be fetched from their origins.
Activities delivered to an inbox MUST NOT be forwarded more than once (to avoid infinite loop). Requirements related to outbox implementation has been clarified.
Gateways SHOULD implement FEP-ae97 actor registration process (previously it was MAY).
Announcing Mitra Mini v0.1.0
Mitra Mini is an ActivityPub client that implements nomadic identity. It has become stable enough that I decided to cut the first release.
The basic features have been implemented: posts, reposts, likes. For more information, check the project's readme:
https://codeberg.org/silverpill/minimitra
It all started nearly four years ago with a vague idea that linking cryptographic keys to #ActivityPub actors could unlock decentralized identity in Fediverse. Eventually, the solution was discovered, and implemented by several projects, but these implementations were servers, not clients. Now there is finally a client, and the design has been proven to work well.
FEP-ef61: Portable Objects has been updated: https://codeberg.org/fediverse/fep/pulls/872
The ap+ef61 URI scheme is now allowed, while ap remains the recommended one. This is to ensure compatibility with @fedify whose maintainers decided to use the ap+ef61 scheme until the specification is finalized.
Updating FEP-ef61: Portable Objects: https://codeberg.org/fediverse/fep/pulls/883
I added a section about key management. This part of nomadic identity was often misunderstood - some people thought that secret keys need to be managed by servers, and that servers could impersonate users.
No, there are 3 options:
- Server-side signing: secret keys are managed by a server (gateway). Activities are generated and immediately signed by a server.
- Delegated signing: secret keys are managed by a separate service. Activities are generated by a server, which calls a signing service and then adds integrity proofs to activities.
- Client-side signing: secret keys are managed by a client. Activities are generated and signed by a client, which communicates with a server via FEP-ae97 API.
Server-side signing is easier to implement, but client-side signing was the goal from the beginning - and this is what I am trying to do with Mitra Mini