Authorized Fetch and the Instance Actor

[stevebate]

@silverpill

There’s no bug, instance actor is a useful construction and authorized fetch is not the only reason why it exists.

I suppose one person’s bug is another person’s feature. In any case, I’m only discussing an “instance actor” being used to mitigate the authorized profile fetch problem for signature verification. Whether it’s useful for other purposes is a different topic of discussion.

@trwnh posted a good summary of some of the issues associated with using the “instance actor” in the context of authorized profile (and other content?) fetches.

FEP-ceee: Instance-Level Actor Discovery using WebFinger

Yes, the “instance actor” is really just a proxy. It grew out of the same-origin assumption of security, i.e., any actor on the host is thought to entail delivery, processing, and potentially visibility on that entire host. It’s the same with sharedInbox as a construct. This is why Mastodon refers to its “instance actor” as a “representative account”. Technically, since the keys are all custodial, an admin can use any actor on any domain they control to sign the fetch. They don’t even have to b…