Where to ask newbie implementor questions?

Programming
1

Hi all

I’m a retired Lisp hacker with about 40 years experience. I’m thinking about playing with an ActivityPub library in Clojure, and reading through the W3C recommendation; and of course there are things I want to clarify.

For example, under 3. Objects, immediately after Example 7, I read

it should dereference the id both to ensure that it exists and is a valid object

Does this mean I am expected to issue an HTTP GET or HEAD request for each object referenced? Does this not generate an enormous amount of network overhead? While I’m at it, the id values in the Mastodon sample data I’m playing with are not URIs, as the recommendation says they should be, but large integers; and I am seeing many things which appear to be objects but which don’t have a type key.

Obviously I don’t want to clutter up this forum with nonsense as basic as this, but is there some forum where newbie questions would be welcome?

2 Likes
2

The quoted text is part of an explanatory paragraph for this requirement:

Servers SHOULD validate the content they receive to avoid content spoofing attacks. (A server should do something at least as robust as checking that the object appears as received at its origin, but mechanisms such as checking signatures would be better if available).

So the requirement here is about verifying that the activity came from the server in question, rather than being spoofed. Mastodon uses HTTP Signatures to achieve this verification (Security - Mastodon documentation), which avoids the extra HTTP request (especially because some activities may not be publicly available, meaning that they can’t be verified in this way)

Another important part of this check is the origin check—you need to make sure that the HTTP signature’s actor, the activity and the object all have the same origin, so that server A can’t pollute the ID namespace of server B.

Not sure what you mean by this. Here’s an example of a mastodon activity object: https://mastodon.social/users/Gargron/statuses/109502941346549786/activity

{
  "id": "https://mastodon.social/users/Gargron/statuses/109502941346549786/activity",
  "type": "Create",
  "actor": "https://mastodon.social/users/Gargron",
  "published": "2022-12-12T21:58:03Z",
  "object": {
    "id": "https://mastodon.social/users/Gargron/statuses/109502941346549786",
    "type": "Question",
    "summary": null,
    "inReplyTo": null,

What do you mean by large integer here? All of the ids I see here look like URIs to me.

This forum is fine! The Mastodon discord and Github forums also see a fair amount of use for questions like this.

2 Likes