@p @nepfag @sjw
>what does it do
it signs object fetches with an instance-wide fetching actor signature to authentifucate the fetch. although we originally wanted to implement it when OCAP is a thing so we could only sign the capability negotiation, instead of every fetch, mastodon implemented "safe mode" which requires signing fetches of even public posts with httpsigs, so we decided to implement them as a temporary bandaid.
> What is it supposed to solve
admitedly, the feature probably originated from people who don't want blocked instances to see their public posts, but I am intrested in it because it allows
1. to send deletes/updates to instances that fetched the post, which is much better than our current approach (send deletes only to recipients of original activity) and mastodon's approach (send deletes to every known instance)
2. to delete fo posts/dms when compacting objects as well, because they can actually be refetched now
>what does it do
it signs object fetches with an instance-wide fetching actor signature to authentifucate the fetch. although we originally wanted to implement it when OCAP is a thing so we could only sign the capability negotiation, instead of every fetch, mastodon implemented "safe mode" which requires signing fetches of even public posts with httpsigs, so we decided to implement them as a temporary bandaid.
> What is it supposed to solve
admitedly, the feature probably originated from people who don't want blocked instances to see their public posts, but I am intrested in it because it allows
1. to send deletes/updates to instances that fetched the post, which is much better than our current approach (send deletes only to recipients of original activity) and mastodon's approach (send deletes to every known instance)
2. to delete fo posts/dms when compacting objects as well, because they can actually be refetched now
Follow
@rin
What if I try to fetch a post from an instance on which the post didn't originate?
Like this https://catgirl.life/notes/7vhp6e2y8f
@p @sjw@neckbeard.xyz @nepfag
@matrix @p @sjw @nepfag pleroma (and I am sure mastodon too) will reject the post if the url is on a different domain than the actor is on, pretty sure you have seen what happened when nikki found out we don't do this in OStatus
@rin
Sorry. This is unrelated to the previous question. If I tried to fetch a post from an instance that has my instance blocked, how is it going to know that it shouldn't sign it. Can't this be circumvented just by doing "curl webfinger" or whatever the syntax is and then passing it on to the actual AP software instead of the software itself doing the fetching?
@p @nepfag @sjw@neckbeard.xyz
