daveid

Here is a thread about why Vero is bad: https://twitter.com/_heyheytyler/status/968301107536523265

The exact methods of authentication are simply "out of scope" for the ActivityPub standard itself. As far as I understand simply for bureaucratic reasons. In reality there's already agreed upon mechanisms for doing this.

Each actor has an RSA keypair. Server-to-server requests are authenticated using HTTP signatures (that's a different spec), so you know a delivery is legit and on behalf of which actor it is. For messages that are passed directly between origin and destination there is no reason to believe the sender has tampered with the message (SSL is a prerequisite anyway). For messages that are about other messages, such as reblogs, you would not trust the sender, you would look up the message by its ID on its origin server instead. This is always possible because ActivityPub prescribes IDs to be resolveable URIs. There's also another method to verify the authenticity of a passed message, called Linked-Data Signatures (that's a different spec). It's a way of signing JSON inside JSON, it's a bit of a bother to implement though (To make sure the signature works regardless of how the payload is re-formatted or re-ordered in transit, the JSON is "canonicalized" using RDF)

>for example a ratio of 1 full time CSR (customer services representative) per 1000 users, not the 1 per 20k or worse they are currently trying to do

Hey, that's the Mastodon model! Relatively small independent servers with own admin/moderator teams responsible only for their own servers. That's scalable moderation.

With cryptography.

HTTP signatures and LD-signatures serve different purposes. HTTP sigs authenticate server-to-server requests, while LD-signatures allow to forward verified messages in the network. The forwarding part is a good extra for UX purposes but it's not necessary for your implementation, you can just stick to HTTP sigs which are really simple. I agree that LD-signatures are very complicated to implement. If you avoid LD-signatures then you don't have to mess with JSON-LD canonicalization either, you can just treat the JSON as simple JSON (though it's still a bit fiddly because a value can often be either a URI string, an array of URI strings, an object, or an array of objects).

Do you want a button pushing clerk to be able to write any message to millions of people over an emergency network? There is so much potential for disaster in that idea. Options is much better. Having the employee type out the predefined message word for word would really be a good confirmation though.

Do you realize the EU was co-created by Britain and many EU laws and regulations were drafted by British politicians as well as voted on by them?

The transparency might be a turn-off for individuals. Some artists on Patreon choose to hide the amount they receive altogether.

Mastodon uses ActivityPub and has over a million users

About a year ago I wrote an essay with this idea [1]. You really don't want your company to be at the behest of facebook/twitter, they can pull the plug on you, change their algorithms, change their rules, force you to pay up, since they control the audience. This is why a platform like Mastodon [2] is attractive (or should be attractive!) to businesses. If you host your own instance of Mastodon, you have full control over your own megaphone.

And that's just the basic principle. Given that Mastodon does not attempt to mess with people's feeds using clever algorithms, instead accepting that when people follow someone they want to see those posts in chronological order, it should be even more attractive to companies used to facebook hiding their posts from their own fans unless they pay up.

[1]: https://medium.com/@Gargron/two-reasons-why-organizations-sh... [2]: https://joinmastodon.org/

Mastodon is a microblogging platform. This does not fit into the format.

Mastodon has no home to phone to. You only host your own user's data and the data they request by e.g. following users on other instances. If your users don't follow anyone on the outside, nothing will leave your instance.

You've got it a bit backwards, because instances don't connect and have no reason to connect except for following specific people. So you follow someone -> that creates a connection. Not the other way around.

Mastodon[1] is European :)

[1]: https://joinmastodon.org

Reposting from Mastodon: https://mastodon.social/@Gargron/18213943

If you think the only reason to use a self-hosted social network is if you want to circumvent the laws, you're making the same argument as only wanting privacy if you've got something to hide. YouTube ran an algorithm to delete "extremist videos" and accidentally irreversibly deleted a bunch of historical evidence of destruction of Syrian historical sites. Shit like that happens all the time when someone else is in charge.

Not quite. Version 2.0 will remove some OStatus extensions that we originally invented to circumvent the limitations of OStatus in regards to privacy. Traditional OStatus support will remain for the foreseeable future.

Mastodon supports photos and videos.

Perhaps it would be better to submit https://joinmastodon.org instead of the flagship instance. The project homepage has links to all the info as well as a directory of servers (instances), which might spread out new users better.

Mastodon is built on open web protocols. Currently that's OStatus, coming forward we're adapting ActivityPub (which is probably what you meant? ActivityFeeds is not a real thing as far as I can see)

Mastodon first got on the frontpage 292 days ago, then a second time 203 days ago (https://joinmastodon.org). Federated network now more than 2,000 servers, 720,000 users, GitHub repository closing in on 10k stars. Pretty happy with that!

Mastodon is a federated, open-source social network based on open web protocols

https://joinmastodon.org https://github.com/tootsuite/mastodon https://mastodon.social

Higher quality, better UX, less bugs, more features

Twitter as a company needs to think about how to be profitable. Twitter as a way for people to talk to each other and broadcast important events needs to be neither commercial nor centralized [1]

[1]: https://hackernoon.com/the-power-to-build-communities-a-resp...

Mastodon the software is not politically aligned. mastodon.social the flagship instance of the developer (me) that simply runs/demonstrates the latest code, is, in this case, leaning left. You can run your own.

Your toots will travel to all your followers, regardless of which site they're on.

There are mod tools like sandboxing spam accounts or outright suspending any account (preventing it from posting and removing all of its data from the db).

I have multiple quitter.se followers and am following multiple quitter.se people. Are you sure it's not some sort of temporary issue with quitter.se? You could ask @hannes2peer@quitter.se (admin of quitter.se)

I added a "back" button to the headers of the public and hashtag timelines that takes you back to the getting started page, just for you.

I'm almost certain that Twitter is still using Rails in parts of the stack (they replaced the messaging bus with Scala, or something of that sort). Most importantly, a single Mastodon instance is not supposed to grow as big as Twitter. Lots of smaller instances don't have to deal with the same load as Twitter alone.

Here are all the OStatus specs and RFCs used: https://github.com/Gargron/mastodon/wiki/Specs-and-RFCs-used