-- Leo's gemini proxy
-- Connecting to bbs.geminispace.org:1965...
-- Connected
-- Sending request
-- Meta line: 20 text/gemini; charset=utf-8
i am sorry, i understand i need to wrap up this. i wouldn't even write this, just i noticed there was a draft, and i thought it is already posted, and i deleted it.
so in it i was basically saying that to me the old internet way is when the university had a server, and the user was represented by that server.
to me the old internet way is how the email or xmpp designed.
and then the evil greedy corps came to the internet, and they used xmpp but broke the federation. you want to talk to whatsapp user? you cannot from your server, bring them to whatsapp. whatsapp was, and maybe still is based on xmpp. same with many others.
aol tried to only allow emailing those who uses aol.
Apr 26 · 3 weeks ago
so activity pub for me is nothing about 2.0, it's about old good internet, just implemented for some reason with http.
it had not be http, but well, that's their decision. the decentralized social media in our days was created by webdevs, and web is about http. so obviously they would use http.
there is an alternative, that's xmpp blogging. i am attracted to it, i'll try it.
well, even xmpp has problems. let's say http_upload widely used today for some reason exposes ip of the person who downloads the file to the server of the uploader.
if you hide behind vpn, then the server knows about your activity.
that problem was solved by mastodon to some extent, they cache images.
what i am saying is that decentralization as i understand it makes it less possible/convenient to track user's behaviour and activity.
that's why we need it.
now i'll say 'bbs', but that's just an example. i have only warm feelings for bbs and its developer. what i am saying are theoretical speculations.
bbs knows lots of things about me. bbs would have known less if i was using it via my server. if my server would fetch the feeds i am subscribed to, if my server wouldn't let the bbs know when i am reading, and which posts interest me.
it is still possible to do, because bbs offers feeds - one way of decentralization.
it would be consistent if i was able to comment as my server's user
@norayr Can’t respond to that whole chain atm, but I can’t think of a time in the old internet that there wasn’t masquerading. Literally as soon as it left the universities you had servers making accounts for unverified users. Who the heck was verified on Geocities or Angelfire? And once anyone could get an email address you had random people on Usenet. IRC was always the Wild West. That was the culture at the time for everyone who wasn’t an academic.
I still quite like my suggestion of a convention for a per-user opt-in way for servers to show client certificate fingerprint <hashes> as identity verification--check my capsule and Skyjake's reply linked above--as an <idea>.
But it's not a fit for Gemini, there isn't a strong need and people simply don't want it. That's pretty conclusive ;)
A gemini-friendly solution to ID masquarading:
create account on gemini://gemid.info (<- doesn't exist yet) which generates a verification code
post verification on gemini://bbs/s/gemID or Station or a gemlog with the code
add link to gemid.info account to verify
add site/id pairs to gemid.info account, and any other info
It's opt-in, doesn't follow you around, isn't a login-scheme, but addresses some of the security concerns we might have about verifying identities, and also serves, like linktree or finger, as a convenient place to present one's public-facing identity. Some care would be required by the owner so that skyjake@randopage.com didn't takeover the real @skyjake.
I experimented with something like that, id.gemlog.org, but people didn't want a service that stores data. Which is perfectly reasonable.
So now it doesn't store any data, but it does show a text representation of your client certificate hash.
Which is good for nothing as nobody else uses the same hash+rendering :)
@Morgan, am I missing something, or does your idea require that I must trust servers to create and not fake hashes?
@stack that's right, with that idea every "social" or "id" server owner would run the same algorithm to display the same hash, (opt in per user), so as to not leak the underlying certificate fingerprint.
A malicious or hacked server could lie, so it's not e2e identification proof, but "if you trust the server". I think a malicious or hacked server gets you enough other problems that them forging ids is not super important by itself.
openid for gemini — i believe that activity pub is an overkill for the problem it is trying to solve. we have rss/atom/yyyy-mm-dd for fetching news. rss solves the problem of fetching new content, following someone. openid solves the problem of replying/commenting/reacting as someoe. in a sense, we don't need a social network because internet is already one. internet with rss and openid covers essential features of what we call a social network. so let's adapt or design something like...
-- Response ended
-- Page fetched on Mon May 20 14:20:14 2024