#authorized_fetch — Public Fediverse posts

@thedarktangent The problem may be related to the #authorized_fetch parameter being enabled.

Here is the GitHub discussion:

https://github.com/LemmyNet/lemmy/issues/4451

Here is the parameter specification in the Mastodon documentation:

https://docs.joinmastodon.org/admin/config/#authorized_fetch

@signorina37 @grabbi_it @[email protected] @support @TCMBC @[email protected]

Acho que terminei minhas ponderações e o #snac ganhou, segundo lugar forte do #gotosocial. Acho que a única coisa que me chateia um pouco do gts é que #authorized_fetch é forçado. A solução do snac me parece bem mais elegante.

@fediverse

Fedifyを開発していて気づいたことなんですが、MisskeyのActivityPubオブジェクトへのアクセス処理について少し疑問があります。リモートサーバーから、アクセス権限のあるアクターの有効なHTTP Signaturesを含むリクエストでフォロワー限定投稿やDMにアクセスしようとしても、Misskeyは内容を返さずに404を返すようです。どうやらMisskeyはHTTP Signaturesを検証せず、visibilityフィールド（publicとhome）だけを確認しているようです。

Mastodonの場合、authorized fetchを有効にすると、HTTP Signaturesを検証して、リクエストしているアクターに権限があれば内容を返します。MisskeyもMastodonのような仕組みを採用してくれたら、ActivityPubが意図しているアクセス制御のセマンティクスをより適切に尊重できるんじゃないかと思います。他の方も同じようなことに気づかれたことはありますか？それとも、Misskeyがこのような処理をしている特別な理由があるのでしょうか？

#Fedify #Misskey #ActivityPub #Mastodon #authorized_fetch #fedidev

While working on #Fedify, I noticed something about how #Misskey handles #ActivityPub object access. When a remote server requests a followers-only post or DM with a valid HTTP Signatures (draft-cavage) from an authorized actor, Misskey still returns 404 instead of the content. It seems Misskey only checks the visibility field (public/home) without verifying the signature at all.

#Mastodon takes a different approach—when #authorized_fetch is enabled, it validates the HTTP Signatures and returns the content if the requesting actor has permission. I think it would be beneficial if Misskey could adopt a similar mechanism, since it would better respect the access control semantics that ActivityPub intends. Has anyone else run into this, or are there specific reasons Misskey handles it this way?

#fedidev

As proof, #ActivityPub objects that require #AUTHORIZED_FETCH can be easily looked up with the `fedify lookup -a` command.

https://fedify.dev/cli#a-authorized-fetch-authorized-fetch

所信發言: #ActivityPub 소프트웨어들이 #AUTHORIZED_FETCH, 이른바 시큐어 모드(secure mode)를 갖추는 것은 이름과 달리 정말로 시큐리티가 나아지게 하지 않으며, 오히려 安全하다는 錯覺(false sense of security)을 주기 때문에 나쁘다고 생각한다.

https://swicg.github.io/activitypub-http-signature/#authorized-fetch

Hot take: It is bad that #ActivityPub software implements #AUTHORIZED_FETCH, also known as secure mode, because, contrary to its name, it does not actually contribute to security and instead gives a false sense of security.

https://swicg.github.io/activitypub-http-signature/#authorized-fetch

Ep! resulta que quan un admin d'un servidor #Mastodon bloca/suspén un altre servidor Mastodon, aquest servidor encara pot veure els tuts del que l'ha suspés.
Es pot evitar activant #AUTHORIZED_FETCH en la configuració i reiniciant el servidor.
#NotaMental #mastoadmin