12
!world@quokk.au, world news without a bot
(quokk.au)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 13 Oct 2024
12 points (66.7% liked)
New Communities
16945 readers
180 users here now
A place to post new communities all over Lemmy for discovery and promotion.
Rules
The rules may be more established as time goes on, but it's important to have a foundation to work on.
1. Follow the rules of Lemmy.world - These rules are the same as Mastodon.world's rules, which can be found here.
2. Include a community title and description in your post title. - A following example of this would be New Communities - A place to post new communities all over Lemmy for discovery and promotion.
3. Follow the formatting. - The formatting as included below is important for people getting universal links across Lemmy as easily as possible.
Formatting
Please include this following format in your post:
[link text](/c/community@instance.com)
This provides a link that should work across instances, but in some cases it won't
You should also include either:
or instance.com/c/community
FAQ:
Q: Why do I get a 404?
A: At least one user in an instance needs to search for a community before it gets fetched. Searching for the community will bring it into the instance and it will fetch a few of the most recent posts without comments. If a user is subscribed to a community, then all of the future posts and interactions are now in-sync.
Q: When I try to create a post, the circle just spins forever. Why is that?
A: This is a current known issue with large communities. Sometimes it does get posted, but just continues spinning, but sometimes it doesn't get posted and continues spinning. If it doesn't actually get posted, the best thing to do is try later. However, only some people seem to be having this problem at the moment.
Image Attribution:
Fahmi, CC BY 4.0 https://creativecommons.org/licenses/by/4.0, via Wikimedia Commons
founded 1 year ago
MODERATORS
I believe that the basic metric of trust is instance-level. That is, it's the TLS certificates and whether-or-not an instance is federated that is the basis of trust. I don't think that users have individual keys -- I mean, it'd be meaningless to generate one rather than just trusting a home instance without client-side storage, and that definitely doesn't exist.
Having client-side keys would potentially, with other work, buy some neat things, like account portability across instances.
But the problem is that, as you point out, any solution on vote trust can't just be user-level keys, unless every admin is gonna police who they federate with and maintain only a network of instances that they consider legit. Once I federate with an instance, I grant it the right to create as many accounts as it wants and vote how it wants. And keep in mind that ownership of an instance could change. Like, an admin retires, a new one shows up, stuff like that.
Your actor (
https://lemmy.today/u/tal)'s public key is:All ActivityPub users have their own private keys. I'm not completely sure, and I just took a quick look through the code and protocols and couldn't find the place where vote activity signatures are validated. But I swear I thought that all ActivityPub activities including votes were signed with the key of the actor that did them.
Regardless, I know that when votes federate, they do get identified according to the person who did the vote.
In practice, you are completely correct that the trust is per-instance, since the instance DB keeps all the actor private keys anyway, so it's six of one vs. half dozen of the other whether you have 100 fake votes from bad.instance signed with that instance's TLS key, or 100 fake votes signed with individual private keys that bad.instance made up. I'm just nitpicking about how it works at a protocol level.
Ah, thank you for that, then; that makes sense. And yeah, if there is a per-user key, then I'd expect it to be signing votes.