@thisismissem Yeah, it's just that that assumption isn't part of the spec. 🤷 Probs just an edge case that will happen sometimes that folks don't need to worry too hard about I guess.
@thisismissem By fetching the actor data from their url instead of cache. For example what if you send the update but the server doesn't have your old actor cached already.
@thisismissem Interesting. So they sign it with the old key instead of the new one? That'll cause some errors for my current setup. 🤔
@thisismissem @joelving Oh one last bit with ActivityPub in particular, you can send an Update activity to people's inboxes which can enable even more aggressive caching while still being able to invalidate the cache when needed.
@thisismissem @joelving Every ActivityPub implementation needs to do some variation on this sadly.
@thisismissem @joelving Yup! Tradeoffs
@thisismissem @joelving At the moment I'm using HTTP caching mechanisms (E.G. ETAG) to reduce how much data is being re-fetched. So it's a bit better than a one time MITM being able to poison the cache forever and a bit better than fetching for each authentication.
@BigTittyBimbo We need more Non-binary drone operators! More transmac cops!
@jeremy_list Oh wow. What environment are you in that you had to make your own JSON parser? 🤯
I hate it when you follow a link to a really great blog post and you're two paragraphs in thinking oh my god this is really good but then a modal popup window from substack asks you to subscribe to this newsletter and you have to hit "continue reading" to finish and then you wonder if this great blog entry will last on someone else's service that may not be around in a few years
@thisismissem Neat yeah. I like the use of linking to profiles with the SubjectAlternativeName field in the certificate. Still wishing we had the future where we used client certs for auth. 😩
OIDC makes sense given the larger "identity" industry. Agree it can be annoying though. So many little pieces to keep track of.
@thisismissem Yup I getcha!
@thisismissem Mind linking to a TLDR for how that works? Solid is defs something I'm interested in.
Is solid-tls the tls client certificate auth? I was ranting about how it sucks that isn't used more a few months ago :P
Sadly I couldn't get it working on Linux with chromium or firefox so I gave up on pursuing it further.
@thisismissem Yeah! That's what I meant about being overly dependent on DNS. If you can't trust an HTTPS request the whole thing breaks.
Occult Enby that's making local-first software with peer to peer protocols, mesh networks, and the web.
Exploring what a local-first cyberspace might look like in my spare time.