Post from @rabble on why he's chosen to use #Nostr and not #ActivityPub and the #Fediverse. He makes some compelling points. Personally I am not too worried about the server admin parts of his argument (I have enough control, even if I don't control th...

Tim Chambers

@ricmac @rabble This feels solvable with a “login with your Mastadon” Oath like solution — I think @newsmast and @PixelFed have already implemented and @julian is adding to #NodeBB…

m_u_v

@tchambers @ricmac @rabble @newsmast @PixelFed @julian or login with nostr (nos2x / nip07). Delta chat has a interesting way to do onboarding / create ( https://delta.chat/en/2023-12-13-chatmail ), and use a private certificate to access instance. Public key can be the account, but limited / read only and with possibility of alias. Validated accounts, by nostr or email, can be full. https://keyoxide.org can help with that, also.

julian

@[email protected] yes it'd be interesting to experiment with for sure. Using OAuth one could authenticate access using another instance's account, but one problem remains:

I cannot act on behalf of that user, because to do so would mean I need to integrate with Mastodon's API, and I do not want to do that.

They would need to support the AP C2S API.

Matt Terenzio

@ricmac @rabble I also think Nostr is way bigger than Mastodon(or name your AP service) with a portable identity. It's more like a decentralized database with a portable identity. The possibilities are so limitless, it defies description. It's everything digital with a portable identity

rabble

@tchambers @ricmac @newsmast @PixelFed @julian yeah I think it’d be great if the fediverse added support for login with oauth from one server to another. Many of the things I think the fediverse is missing can be solved, if there is a will.

Cassandrich

@rabble @tchambers @ricmac @newsmast @pixelfed @julian You really do not want that. It completely messes up trust and privacy models and makes all sorts of vectors for impersonation. A server other than your own never needs to know who you are or create actions claiming to be on your behalf.

Cassandrich

@rabble @tchambers @ricmac @newsmast @pixelfed @julian Or, if you meant just for other servers you have accounts on... that has its own very different problems, like getting locked out of service B because service A suspended you or went down or got bought by someone awful. Inherent flaw of OAuth.

Boris Mann

@tchambers @ricmac @rabble Pixelfed only does it on sign up and all it does is copy over profile info. Then you need to use your Pixelfed login.

Multi server / types of notes “joint” accounts would make the different AP Servers / types useful but it needs a lot more than “login with OAuth”. That saves a password but you still have multiple accounts.

rabble

@boris @tchambers @ricmac yeah not login to migrate but oauth to login to keep your same account/identity on multiple kinds of apps.

rabble

@dalias @tchambers @ricmac @newsmast @PixelFed @julian uh the fediverse by design lacks any privacy whatsoever. It’s designed to not have privacy. Instance admins have all of your data and no checks on their use. It’s easy to snoop on dm’s and get at ‘private’ accounts. It’s just like living in a place where no locks are allowed. Sure most people knock and don’t go uninvited in to other people’s rooms or houses.

Tim Chambers

@rabble @boris @ricmac Exactly.

Cassandrich

@rabble @tchambers @ricmac @newsmast @pixelfed @julian "Privacy" doesn't mean "DMs" or "post visibility". It involves things like ability to snoop on who is reading what and amass and mine data on that. The fediverse model makes your instance a "privacy union" of sorts so that other instances can't see this sort of thing. Identifying to other instances breaks thay.

Eugen Rochko

@ricmac @rabble Pixelfed and Mastodon are not isolated from each other. I have Pixelfed users in my home feed on Mastodon. That's a very weird definition of isolated. Mastodon has search too. Phanpy has a catch-up algorithm. I don't find the arguments in the post compelling.

[email protected]

@Gargron @ricmac @rabble

Pixelfed and Mastodon are not isolated from each other. I have Pixelfed users in my home feed on Mastodon. That’s a very weird definition of isolated.

UI-mismatch is the issue there and as well as with the “promise” of the fediverse. A shared protocol isn’t the same as a shared UI.

Then there’s the whole data-model-mismatch problem, where platforms only implement parts of the protocol such that things get lost or misinterpreted between platforms.

And so, despite being technically “not isolated”, people have multiple accounts all over the place to reroute around these mismatch frictions, which are significant enough to create prohibitive separations.

Whether its a misinterpretation from users or an overzealous advocacy of the power of the protocol and fediverse … I think it’s absolutely fair enough to say that we’ve arrived at a point where the promise of multiple platforms and instances all in a single unifying space is a bad over promise.

The friction involved in trying to reach for that is bad enough that most just bounce off of it, either ditching the fediverse, or giving up on this so called promise and staying on their platform of choice, or just creating multiple accounts and tolerating the chaos.

At the root of it is this lack of mobile identity (as well as, IMO, some other general design decisions). Not least because bridging these gulfs is exactly the sort of thing necessary to make the fediverse realise its killer potential. At the moment to many, probably most, the fediverse is in practice “just” a sea of disparate platforms. Which is a shame TBH, but also shouldn’t be glossed over as a non-issue.

Mike McCue

@ricmac Of the issues that @rabble raises the one that I think is the most important to address is:

"Each kind of fediverse server is isolated. You can use a Peertube instance to federate with other Peertubes for video, or Mobilizon for meetup-style events, or Pixelfed for Instagram-like photo sharing, or WriteFreely for blogs. But each of these is isolated. I need a new account on an instance of each of these servers. They all run the same protocol, but they aren’t actually interoperable. You can’t use a single fediverse identity with your profile and followers in Peertube, Mobilizon, WriteFreely, and Pixelfed. You need a totally separate account in each one. With Nostr, you can use dozens of apps all with your same identity, content, and followers."

cc @evan @Gargron @dansup @JsonCulverhouse @greg @emilynguyen

Chris Trottier

@mike @ricmac @rabble @evan @Gargron @dansup @JsonCulverhouse @greg @emilynguyen But I don’t see how Nostr solves that problem because, at its root, this isn’t a problem of software but of culture.

For example, if I created a YouTube-style app based on Nostr, people who use Nostr for microblogging would still bristle at this use case if all they ever encountered was Nostr for microblogging.

Tim Bray

@mike @ricmac @rabble @evan @Gargron @dansup @JsonCulverhouse @greg @emilynguyen My feeling is that the world’s UI innovators may solve this problem for us. What with Ivory and Mona and Elk and Phanpy, you can already have wildly-different experiences of the same underlying network. Seems to me that many of the things that distinguish these alternate servers can be accomplished with sufficiently good client-ware.

Matt Terenzio

@atomicpoet @evan @JsonCulverhouse @emilynguyen @greg @mike @Gargron @dansup @rabble @ricmac App diversity is good. Having a different account for each app is not. In an ideal world, everyone should have one ActivityPub compliant identity and be able to use any ActivityPub compliant application

Jon

@[email protected] ActivityPods is an intriguing project along those lines! https://activitypods.org/

The replies to your post are interesting. I'm in the camp that agrees that point about needing separate accounts was a very strong one -- okay, I buy that it's not an inherent problem with ActivityPub but it's very much an issue with today's actually existing fediverse. So the responses saying that it's not an issue, or not a big issue, strike me as somewhat in denial.

Simon Lucy

@ricmac

There's no particular reason that you can't use the same authoriser if they accept oAuth and Mastodon and Pixelfed can do that at least, I don't know about Writefreely.

You have multiple accounts but the same method to authorise.