Nice to see a blogpost on the Mastodon blog about implementing a basic ActivityPub server https://blog.joinmastodon.org/2018/06/how-to-implement-a-basic-activitypub-server/
(Though technically webfinger isn't needed for activitypub, but it is for mastodon interop!)
@cwebber I'm curious how subscribing between different AP server implementations is going to work UX-wise. Mastodon, Pleroma and peertube all work with the user @ domain webfinger scheme, but what identifiers shall be used for implementations lacking webfinger?
@schmittlauch Subscription should work without webfinger I think...? It's a Follow activity to the actor's id, so...
@cwebber I mean how shall that work UX wise?
If I want to follow user foo at peertube instance bar, I can do that by just following @ foo @ bar from mastodon thanks to Webfinger.
But how to do that for non-webfinger AP servers?
If I'm not mistaken there's no canonical URI scheme for AP making this possible withput webfinger, is it?
@schmittlauch Webfinger makes sense indeed when you have a user@domain email style addressing expectation. That's not the only UI experience possible, and indeed it won't even be feasible if people start doing interesting things like ActivityPub + tor onion services. Something something petnames here.
@schmittlauch I didn't suggest that route
@cwebber It's the only thing I could come up with so far.
But I also havent carefully read the AP spec so far, maybe I should do that first before speculating based on hearsay knowledge.
It's just a potential rupture point for different instances and their possibility to subscribe to each other. AFAIK Mastodon currently only supports the webfinger UX flow
@schmittlauch How do you send someone an email? Either you have that person "bookmarked" in your addressbook, or they were part of the addressing in that conversation (by introduction)
I have some more in this unfinished document https://github.com/cwebber/rebooting-the-web-of-trust-spring2018/blob/petnames/draft-documents/making-dids-invisible-with-petnames.md
@cwebber maybe I'm just too narrowly-minded or not creative enough, but the approach where the remote instance handles authentication using OAuth and entering credentials directly there creeps me out – too easy to confuse and impersonate the real instance.
But let's see how things develop, hopefully I'm not the first one having to come up with solutions.