Post #2770060

2026-05-22 22:25 UTC

1. I find the use of attributedTo here confusing, because normally this property is used to indicate who owns an object or a collection, and its value is an actor. I am aware that attributedTo is used in a similar way in FEP-1b12, but it would be better to introduce a new property (administrators) instead of continuing to abuse attributedTo. 2. You say that your FEP supersedes the same-origin assumption described in FEP-fe34, but I think it describes a reciprocal claim, also described in FEP-fe34: https://codeberg.org/fediverse/fep/src/branch/main/fep/fe34/fep-fe34.md#reciprocal-claims. I suggest clarifying which aspect of FEP-fe34 is being superseded. 3. In the section "Security and Authorization" you say "authenticity" but what actually is being verified is a permission. 4. The entire problem of non-same-actor updates and deletes can be avoided by using different activities. For example, Update can be replaced with an annotation activity. Delete can be replaced with Remove (from thread). 5. FEP links lead to w3id.org site, not directly to FEPs.

Replies (3)

@julian@activitypub.space 2026-05-22 22:45

@silverpill@mitra.social said: You say that your FEP supersedes the same-origin assumption described in FEP-fe34, but I think it describes a reciprocal claim, also described in FEP-fe34: https://codeberg.org/fediverse/fep/src/branch/main/fep/fe34/fep-fe34.md#reciprocal-claims. I suggest clarifying which aspect of FEP-fe34 is being superseded. I suppose supercedes is the incorrect term. It extends fe34, in a way. Would that be acceptable? Definitely not meaning to imply that fe34 is insufficient in any way. #3 :heavy_check_mark: okay

Open ##2770475
@julian@activitypub.space 2026-05-22 22:43

@silverpill@mitra.social said: FEP links lead to w3id.org site, not directly to FEPs. Wasn't aware this was a problem? Figured the redirects would be okay.

Open ##3082812
@julian@activitypub.space 2026-05-23 01:11

@silverpill@mitra.social said: The entire problem of non-same-actor updates and deletes can be avoided by using different activities. For example, Update can be replaced with an annotation activity. Delete can be replaced with Remove (from thread). While true, this is outside the scope of the FEP. Update/Delete were mentioned in the FEP as they are recognizable, but this sort of explicit authorization* is relevant to any activity type. Offer, Undo, Bite, Zooboomafoo, etc. * I have to be careful when I use the term "authorization" because if I say it three times @thisismissem will show up and start talking about OAuth2/OIDC again.

Open ##3082814