I don't think ActivityPub is hard to implement, actually. It's fairly specific JSON with a weird structure, but that structure isn't hard to implement.

It does come with an oversight, though; the protocol doesn't define how to ensure activities propagate to every server. That's why following a Lemmy community from Mastodon will spam your feed with boosts, and why Mastodon instances all have different amounts of comments and likes on them. Some other things are also underspecified (like how to propagate creates through boosts, are those two events of is boosting a create enough?). These can use some fleshing out.

One thing that's definitely underspecced is the client-server API. It's practically impossible to take the spec and write a client for a C2S server that's also built around the spec, because crucial things like "authentication" simply aren't specified. Very few servers bother to implement C2S and even fewer of those cover more than the bare basics.

At some point I tried setting up a sort-of-tumblr clone by combining Fedibox with a C2S client, but I found it impossible to set everything up properly, and no other backends seemed to provide more than a basic C2S implementation. There's potential there, but it's hard to do it without an opinionated take on the spec that I feel shouldn't be necessary.

I've been in tech for multiple decades, and when I looked at the structure of the JSON and the developer documentation, my eyes glazed over and I bounced off of it. It's worse than "not elegantly designed", it's (in my opinion) kinda slapped together without much thought or testing. This is a thing seems to me to have been a side-project that had some anemic interest for a long time, then became spontaneously exponentially popular on accident (because of a dying bird and a terribly handled forum API), and now it's just sunken cost.

https://www.w3.org/TR/activitystreams-vocabulary/#actor-types : this is a fucking nightmare, and almost all of the decisions here are completely arbitrary. Like, seriously, what the hell is this?

There's also no real reference implementation, so it's almost guaranteed that various apps won't be able to talk to each other without some kind of translation layer (See: Mbin's implementation of a Mastodon-like microblog). Mbin/Lemmy/Mstodon/etc don't even have agreement on how likes, votes, or boosts work. User addresses are also wacky; Is it @someuser@server.tld or server.tld/u/someuser ? Both?

Why is it hard to implement? It's not really a standard, it's a college dorm data-structure fan-fic that wished it was RSS with a like button (and a bunch of other buttons that apparently no one needs or wants, since no one uses them). I'm utterly flabbergasted that the w3 published this. Like, there's literally a section on Spam that just kinda says "figure it out yourself". This is a useless document, which also hilariously contains an entire section of self-congratulation for a "standard" that hand-waves things like how to handle a DOS and doesn't even bother suggesting a method of authentication since their "years of hard work and experience by a number of communities exploring the space of federation on the web" couldn't agree on one.

What could have been done better? Having consensus from a larger group of better developers during the protocol phase (mostly to weed out silly crap that isn't useful, and actually defining - you know - a standard), and some decent time in the oven for server implementations before millions of people flooded into a series of barely connected instances that are running software that isn't really ready for production (many of which are really close, but are hamstrung by this awful protocol).

I think the biggest issue is HTTP Signatures - they're not part of the standard, they're not well-documented, and without them your server won't federate with anything and so you have no idea whether it works.

Plus sometimes an implementation works with Mastodon but not something else. I think Mastodon just uses certain headers when calculating the signature, but Bridgy Fed also includes the URL or something. The C# code I'd copied was programmed to exclude the URL always, so I had to change that, but it took a while to figure out that that was the issue.

@matcha_addict@lemy.lol @fediverse@lemmy.world