Egregoros

Trusting Trust in the Fediverse

A very long blog post about the various "safety and privacy" features that got added over the years to ActivityPub and how useless they can be in the eyes of users unaware of the inner workings.

There's nothing really new I talk about, but it is a long explanation of my reasoning behind why I don't take "features" such as signed fetches and interaction consent seriously. What can be considered "new" to most, is the last section of bypassing signed fetch enforcement without impersonation, which I talked about probably twice over the years.

https://evilmaid.net/blog/trusting-trust-fediverse/index.html

(If there are styling issue, tell me. I've written the CSS from scratch, and I suck at it.)

@phnt Great post, thanks. I'm in the process of drafting a FEP for GTS interaction policies (collaborating with the team, since they said they weren't going to submit one), so the criticism is useful.

I can't say it's shifted my thinking on the feature much, but then I am in the technical weeds. I think of interaction policies as a way to declare & federate filters, so benevolent and willing servers can play along with them.

This is my current draft for the FEP summary, does it sound sensible?

@julian I think it accurately describes what it does, or at least tries to do. So in that way, I think it is very sensible.

My main issue with the extension besides it being rather complicated, is that I think users aren't aware of what it can't do. It's not apparent to users that it effectively hides interactions that happened from them in GTS, nor that it may not work as advertised. For the latter, a user has to click on the link in GTS settings, and only at the end of the section does it mention, that it is done solely on best-effort basis. You summary is upfront about it, which I think is a good thing.