Post #3262351

I tried to implement the "standard" ActivityPub #C2S API in Mitra. It's an interesting exercise, but I am not sure if I'll ever enable it by default. Permitting clients to publish arbitrary JSON is equivalent to allowing them to publish unsanitized HTML. This may be acceptable if you're an admin on a single-user instance, but it is a really stupid thing to do when there are multiple users. Although it might be possible to validate activities using strict JSON schemas, that would require a lot of work. You may as well create your own API that will have none of those issues. FEP-ae97 API is also tricky to implement, but at least it offers a genuine advantage over regular REST APIs: nomadic identity. Also, its security is more straightforward because portable actors and objects are namespaced by DIDs.