2026-09-01 10:24 UTC
Replies (4)
-
@Edent@mastodon.social 2026-09-04 09:26
Another Mastodon / ActivityPub signature question. Alice reposts Bob. Bob updates their post. Alice's instance syndicates that update to her followers. The message Alice's instance sends has an Actor of Bob. But the headers are signed by Alice. So the signature doesn't match the actor. Which means Bob's embedded RsaSignature2017 *also* needs to be checked. https://docs.joinmastodon.org/spec/security/#ld-sign But that doesn't mean I can skip checking Alice's signature, right?
-
@denny@boing.world 2026-09-01 10:33
@Edent@mastodon.social Looking at it from the other angle, there doesn't seem much upside to accepting it.
-
@mradcliffe@nokoto.org 2026-09-01 11:48
Re: How much skew do you allow before rejecting a message? @Edent@mastodon.social I do not think the published date would matter to the request itself. What if the content was in draft or some other editing process by the author? Why would you reject the content because the published, changed dates in the object are different from when the request was sent out?What if your server timed out the first time, and the message is being resent from a poison queue?What if the average request time was 5 seconds, and it was delivering to over 120 instances and yours was last on the list?What if there is a queue that processes outgoing activities, and it only does it once per...
-
@toddsundsted@epiktistes.com 2026-09-04 13:28
@Edent@mastodon.social I don’t treat the published date as authoritative of anything—it’s just a piece of user-supplied information