I am publishing a small #ActivityPub / #fediverse project: https://fietkau.software/webfinger_canary and @canary

Julian Fietkau

@yala @jon I'm not surprised some clients would get this wrong somehow.

Also, some platform developers take a stance that custom domains should not be allowed, or that someone's handle domain should not be "too different" from their ActivityPub server's domain. I disagree and think people should be allowed to go wild with custom domains.

jon ⚝

@julian
What a good idea! For user-generated aliases, it would probably be good to have some kind of DNS-based verification involved.
@jon

Julian Fietkau

@yala @jon In the current scheme supported by Mastodon and some others, proof of domain ownership happens by serving a specific path (the WebFinger endpoint) on the target domain. This can be done through an HTTP redirect to make it as easy as possible. But yeah, DNS-based validation would do the job as well, it's just less common outside of Bluesky.

Marcus Rohrmoser 🌻

Hi @julian @aSeppoToTry @canary,
hm, interesting. I doubt there is a correct answer. Because #Webfinger doesn't care about #ActivityPub and ActivityPub doesn't care about Webfinger neither specifies how to construct the handle from a profile document. It would have to be explicitly mentioned which it isn't. All other is idiosyncratic, proprietary oracles.

According to https://www.w3.org/TR/activitypub/ the actor id is the canonical identifier.

With best faith #Seppo combines the preferredUserName and the profile document's domain. What else could you do?

Julian Fietkau

@mro The actor ID should be the thing uniquely identifying an account, yes. However, in conversations we use tags/handles and not AP IDs, so we gotta construct these handles somehow. Your approach, using the AP host, is equally as idiosyncratic as using the WebFinger host. Both ways exist in the wild – Pixelfed, Misskey and Friendica do it the way you do; Mastodon, GoToSocial and Iceshrimp do it the way I do. I just prefer this way because it lets people use their domains more easily.

Marcus Rohrmoser 🌻

Hi @julian,
but how do you (they)? The actor just doesn't know the handle domain. Strictly spoken not eve the local part but there seems to be consensus to use the preferredUserName. Serious question.

Julian Fietkau

@mro You do a WebFinger request on the AP host domain, and its response will give you a subject with the correct handle domain. See for example this account: https://toot.kif.rocks/@team and its WebFinger response: https://toot.kif.rocks/.well-known/webfinger?resource=acct:[email protected] This is a Mastodon split-domain setup.

The process is described here: https://www.w3.org/community/reports/socialcg/CG-FINAL-apwf-20240608/#reverse-discovery (step 4 is important for this)

Marcus Rohrmoser 🌻

Hi @julian,
the document is a report from @evanprodromou mid 2024, not a standard and not part of #AP. And at step 4 it reads "4. Optionally:". But it proposes a solution - thanks for bearing with me. So the #rfc7033 subject: "acct:[email protected]" would be it.

Feels hacky, IMO the profile should be explicit about the handle just like the way round #webfinger is explicit about the actor id.

Julian Fietkau

@mro There is a suggested FEP to include the WebFinger resource in the actor document: https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md But I have not seen it implemented anywhere. In the meantime, the hacky approach works and is reasonably popular.

I don't want to push you into supporting something you don't want to support. Just keep in mind that your software is showing different account handles than Mastodon for some users.

Do you want me to add Seppo to the overview table anyway?

Marcus Rohrmoser 🌻

Hi @julian,
a pity @silverpill doesn't use https://www.w3.org/TR/xmlschema-2/#anyURI and doesn't keep the acct:[email protected] from https://www.rfc-editor.org/rfc/rfc7565.html.

And yes, I'd be happy if you add #Seppo!

Julian Fietkau

@mro I see now that you were active in the discussion thread: https://socialhub.activitypub.rocks/t/fep-2c59-discovery-of-a-webfinger-address-from-an-activitypub-actor/3813 my bad for retreading ground you already know.

@silverpill

silverpill

@mro @julian Could you elaborate? Where should I use anyURI?

silverpill

@mro Is it related to me trying to follow Seppo actor?

I just received a Create(Note) where Note doesn't have attributedTo property (but is has actor property, which should be used only on activities afaik).