this post was submitted on 01 Sep 2024
754 points (97.4% liked)
Technology
58134 readers
4466 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Personally I wish there was a better way to link multiple accounts together to say they're the same person. When I switched to hosting my own instance, I basically just abandoned my old account, but I would have loved to link them to have the history there.
We have the technology, it could be as simple as SSH keys, or like how bitcoin wallets are unique and don't require internet to verify a match.
Edit: I actually just discovered that this is one of the main feature differences between ActivityPub and BlueSky's AT Protocol. BlueSky has "account portability", and now that you can self-host it, I'm seriously considering setting it up. It would be really nice if we get an update that lets the protocols federate with each other. I think that BlueSky has said they intend to support ActivityPub federation in the future.
ActivityPub actually has a similar mechanism of a "Move" activity. There are just very few implementations that support that kind of thing.
The main problem with that seems to be that the original server needs to be active to migrate. If the instance I'm on shuts down or is uncooperative, then my account history is gone. And for Mastodon, that's even worse if you have a bunch of followers. These are all reasons I decided to self-host before I built up too much of a presence.
Right, of course. I don't really see any way any protocol can get around that though. If the original server is suddenly just gone, there is no way to tell it to move your account elsewhere. Hopefully such a situation should happen very rarely though.
Supposedly BlueSky has solved this by separating the data storage servers from the "relays" and "app view" servers, and since your account's posts are cryptographically signed, they can come from any instance as long as the signature matches.
That at least covers migrating followers and new posts, but I'm not really sure what would happen to old posts if a data server just went offline. I've still got more reading to do.
But what if the server that holds the cryptographic keys is suddenly gone? Then what?
Or does Bluesky use client-held keys? I just think client-held private keys is probably too complicated for most people to realistically and safely use.
I assume you hold your own cryptographic keys, but I'm not actually sure how that works. Your client needs access to them to make posts, and it wouldn't make sense for the server to hold your private key, since that would mean the owner of your instance could make posts as you.
I haven't actually signed up to BlueSky to figure this out yet.
Edit: So it looks like users are authenticated using https://github.com/did-method-plc/did-method-plc But the keys are stored on the server, with an option to view your key for backup and migration. That does mean a certain level of trust with your instance, but you can self-host if that's a concern. A malicious host at least can't prevent you from rotating your keys and leaving (unless of course they steal your account entirely by rotating your keys themselves)
I mean, this is quite normal and common for all traditional social media (or any site really) you sign up for. It's what most ActivityPub instances do too, though there's nothing in ActivityPub that requires the server to hold the private key. It could in principle be held by the client but I don't believe there is any implementation that does that currently.
Yeah, this is just me tacking on extra features I'd like. My security-minded programmer brain can't help but think of all the edge-cases. It's something that is suddenly possible with distributed social media that never was before.