Hello, and welcome to this talk.
This is how to level up the Fedivers.
Who here came and saw our talk last year, right?
The solid few.
So if you know, if you know the reality of the situation,
I'm Christine Lemmer, Robert.
This is Jessica Talon.
It's difficult to get in a word,
adjoised with Jessica, and I'm the shy one.
But anyway, but she's kindly let me speak a bit in this time.
So, you know, but who are we?
What are we doing here, right?
Well, you know, you might have heard of this thing called Activity Pub.
Has anybody heard of Activity Pub?
Yeah, okay, all right, a little bit of knowledge.
So, you know, some decentralized social-weddes thing, basically.
And, well, would you know, would you look at this?
It's got, who are the editors, Christine Lemmer,
Weber, and Jessica Talon?
That's us, we're here, we're so okay.
So, that's, that's us from the stage.
We know a thing or two, we've got to, we've got some ideas, right?
We've been doing this for a while.
And actually, we work at this organization called The Sprayatly Institute.
We're doing research in next generation decentralized networking tech.
And, and we're here to talk about how this relates to the Fedivers.
But we do a whole lot of different things.
So, actually, because we love cutesy characters,
we have a bunch of different characters that represent our cutesy stuff.
As in terms of the very serious tech that we actually do work on,
we're not going to talk about all of this,
not all the super-applies to the Fedivers,
but quite a bit of it does, actually.
And, and, and, and, and so, the big, the biggest thing that we want to talk about here
is that from our perspective, the Fedivers has not done.
There, it's, we've have a lot of adoption, it's great.
There's a lot of things that do go really well,
but there's some things that are really missing, right?
So, one of the biggest complaints is people are afraid to adopt the server,
because a server can go down and they lose access to their content,
so it's a graph to their identity, right?
And, so we want portable content and identity.
We have some stuff Jessica is going to talk about the importance of client the server.
We're going to talk about a better security model.
Self-hosting is clearly hard, and this back is not quite as peer-to-peer.
And, also, if I boost your post, it might take down your instance.
So, then that shouldn't happen.
So, um, now you may be aware that I wrote this blog post and a follow-up
that got quite a bit of attention, kind of critiquing AT Prodo and in kind of in-depth.
And, I think, I think if you didn't read it, you might just think that I'm,
it was either Pro One Camp or against another, but in reality, actually,
it's just that I think there are certain ideas that are really important and useful
from various pieces of tech.
And now I'm going to throw myself under the bus by saying that actually,
I go off a proposal for a blue sky at one point.
And actually, I think this right up is not what happened with blue sky,
but I actually think it has a lot of the ideas that are articulated in this from a thing
in 2020 or a lot of the ideas that we're going to hear us talking about today.
These ideas don't aren't new, and the idea of combining the ideas from different types
of approaches is also not new.
And, in fact, actually, you can go even further back to that.
Before activity, Pub was actually successfully ratified as a W3C standard.
I co-authored this paper activity Pub from decentralized to distributed social networks,
and that was in 2017.
So these ideas of being able to bring the Fediverts in some of this direction,
the idea that the Fediverts just as in terms of the way that the document was written
is not the complete and final story, and that there are ways that are specification and compatible
that we can improve things is really at the heart of what we're talking about today.
So the first thing I want to talk about is content addressing is a freaking great idea.
So I don't know if you're familiar with content addressing,
but you're certainly familiar with links like this.
There's this lovely cat picture, right?
It's at example.org slash cat.jpg, but example.org goes down,
and you can't access this picture anymore, right?
So this is a problem with HTTP based links.
And it turns out there's more than one type of link.
You know, HTTP is one of them.
Here's another type.
So this is a URN for a hash, right?
And technically, anything that actually matches this hash,
so this is a hash to the cat picture, is the actual version of this cat picture, right?
And but you're like, okay, well, great.
So this means that if example.org goes down,
then I can still get the cat picture, but how do I know where I should get it from, right?
So there's something called magnet links, which actually combine these ideas and several others.
So for example, right here, you see it has the hash version of the hash to the cat.jpg,
but as the exact topic, but it also says, as an acceptable source,
you can get it from at this link.
And so that actually composes those ideas together.
And it turns out that this can, this is specification compatible with activity pub.
And very early on in Spratley's history, I wrote this little demo that actually showed
an activity pub compatible implementation that uses constant addressing, right?
That says, you know, here is a way to be able to distribute objects that are referred to by their content.
In a way that is compatible with activity pub, you thought to make sure that activity pub could actually contain more than just HTTP URIs in it.
And it's a demo, but it works.
And there's ways, that is really washed out looking on the screen.
But this is the mascot for our character, Port Bella, which represents a project where we have
encrypted content address storage, so hosting providers can actually host things without even knowing the exact details of the content that they're hosting and that you can be able to retrieve them.
And this is the one thing that I'm going to say that the blue sky got right.
I have a lot of criticisms that their current infrastructure is not actually fully decentralized,
but this idea is correct, right?
It doesn't originate with blue sky and hp, but the decision to be able to make this a key part of the system is actually
one that I think the Fedivers should adopt and I've been arguing so for it since about 2017.
And it turns out if you have content addressing and you have the ability to have updates to it,
you can think of how Git is immutable, but you can actually have updates to a Git repository, right?
There is a similar idea that as in terms of mutable content addressing,
this is actually sufficient to be able to have decentralized identity and activity pub.
Because if you have an activity pub profile that has an inbox, you can point the inbox at a new location
as you end up moving between different servers.
But I'm going to hand it over to Jessica.
Hello.
So the first thing I'm going to talk about is this paper that we worked on at Spritely.
And it's a humane approach to secure decentralized naming.
Naming on distributed social networks is important where there are a lot of people and people have
names and we want to be able to have contacts and and build a network and everything.
I'm not going to go through this entire paper, but it's on our website if you want to.
Oops. This is, yeah. And this is Brooks. This is another one of our map scouts.
And this is an implementation of the pet name system.
And I'm going to go into what pet names actually are in a second.
But first let's just look at how naming works on the teddyverse at the moment.
So this is mastered on and you can see we were starting to type a post and it's
hopefully trying to fulfill some of these names. So we can order to complete this.
But if you think about it, this is this is very fishable. Someone could easily create a profile
and set their display name and picture and try and fish you with this system.
And so that's, that's not ideal. And if you think to what Chrissy was talking about with
distributed identity, well, I might be able to remember Cweberatsocial.co-op, but my memory is not
good enough to remember this, as certainly not for a lot of people. And so what do we do about that?
And turns out pet names can help with this too. There's something called Zuko's Triangle,
which says you can pick two of the following. So names can either be globally unique,
decentralized or human meaningful. And it turns out in a, well, we want decentralized,
because we're building the decentralized social networks. We want them to be globally unique,
like Chrissy was saying. But we're also people and we want them to be meaningful to ourselves.
So how do we solve this? And it turns out pet names are the solution to this.
Now, pet name might not be something you're familiar with, but you might actually be more familiar
with it than you think. This is a picture and you can see it looks like your phone dialer. And indeed,
you have a sort of pet name system in your pocket already in your contacts list.
You probably don't remember all of the phone numbers in that contact list, but you're assigning
names. And those names are not just generic names in a lot of cases. They're human meaningful,
them mum, for example. And my mum is not the same as any of your mum's. And so these can be
highly personal and highly meaningful to you. And these are names you give, you give contacts
yourself. And these are actual pet names in the pet name system. There are two other types of names too.
And when you're searching for a name, as you can see here, we're searching for Ben,
and you can see some pet names. But under here, you can see network contacts. And this is another
type of name. This is what's called an edge name. And you can see here that Alicia is sharing
a name to us for a contact. And this name is Ben Bitbiddle. And that's the name she's given.
And you can rely on your network of people to provide names and help you corroborate who people are
and give you a better idea. And so you can sort of rely on that trusted network of people
or directory's even. And this is a mock-up of a chat application, but this could easily apply to
mastered or some other social network sort of setting. And this has two kinds of names. You can see
a star light here. And that's a pet name. It's got a solid border around it. And you can also see
Carol here with a question mark. And this dotted line around it. And this is what's called
a self-propos name. And this is a name you give yourself. Think of it like an IRC handle or something
like that. You display name on master. And this is a name you give yourself and people can see.
So with all of these three types of names together, you can solve distributed naming.
By keeping the human meaningfulness, but also apply it to distributed identities.
And this is not just something that applies in chat settings and things. This is a mock-up of how
it could apply to master it on. So this can certainly apply to social applications like
Nفسed Honor or any other activity probe implementation. Another thing I want to talk about
is the client to server specification. And I think there was a talk this morning that I didn't
end up making so I'll have to catch up on that. But this is a very important part of the spec.
So if you look at the specification, you see, okay, there's a server to server spec. And this is
what most people know. And if you're implementing activity probe, it's probably what you're
looking at in the spec. And you know, that's great. But if you actually keep scrolling,
there is another protocol in the specification called the client to server specification. And it's
there for a really good reason. And people need to pay attention to it and think about implementing it.
And if we look here, this is peer trooper. And on this, you could post a video and then you can
see it in master it on, you can see it. You can even post a comment and let me hold that
fatter rates back to peer trooper. And this is a great success of case, right? This is what we
know activity probe to be. And it's great and wonderful. And it's a really good success case.
But this idea of let's build a video, social network application. And let's build one for my
crow blogging or one for blogging or one for like lemme for Reddit style content. That's the wrong
model in my opinion, at least. We really should be building, we should really be building generic
applications. And this is a pub straight. It was developed by Christine in the standardization
process of activity pub. And we can see here, it supports micro blogging and here's some
micro blogs posted by Christine. And that's great. And then we can also see you can post images,
wonderful. And you can also post videos and you can post any number of content. And I think this is
is the direction that we should have been going. And if you look at the history of activity
activity probe and what came before it, there was Evans, Pompeo and a few. If you're a Pompeo user,
anyone remember, open farm game? We're watering your tomatoes. And you could post any number of
content. And you can also, you know, you can have generic servers where you set up a profile
and then very flexible clients. And in Pompeo, it would display what it could have a fallback
of display what it could. But you can also have very specific clients too. And one of the great
things about the client to server protocol is that it supports this wide range of content.
So if you wanted to build a very specific client for posting YouTube, you could use that with the
generic server, but you could also use a more broad generic one with the same server. And that would
allow you to have a single account on the Fediverse and have a single set of followers and people
could follow you. And you could be interacting on lemme or peer tube and posting lots of diverse
amounts of content. And I think that's a better model than having many accounts over different
instances. And if you're setting these up yourself, add meaning, many different instances.
And now I'm going to talk about the active model. And what is the active model? Well, it's actually
a, it's a programming paradigm, similar to our object orientation or imperative or whatever.
And I'm not in the wrong room. I'm still talking about the social network. And if you look in the
activity per spec, you'll see we mention the active model a bunch. And why do we do that? It turns out
the active model is actually really good at implementing this decentralized applications. And
it's the foundation also of activity, but obviously we're working in often Django or Rails or whatever
and these object orientated languages. And so here's another character and a family of characters
and sprightly. And this is Goblins. And this is an activity, sorry, an active model framework
written in scheme that we've worked on for a long time. And this is another character called Mandy.
And this is activity pub on Giles. On the Goblins' active model framework. And currently it's
just a prototype. Don't go running it unless you just want to play with it. Don't use it in
production. It's what I'm trying to say. It's not very featureful, but it's showing this idea of
message passing between activities and really adopting it in its sort of native environment.
And I think that can be really powerful too. I'm going to hand back to Christine.
So part of the reason we bring this up is a few years ago, who's seen this document? The
okay pub networks of consent. Okay, a few people have seen it. So every now and then some sort of
crisis happens on the pediverse and people are like, oh crap, how do we solve this? And people are like,
oh, Christine actually was writing about this a few years ago. And so this is a document talking
about security model aspects and also some social aspects of a system that's trying to be very
consent respecting of people on the system. It uses this model of security called object capability,
security. You can actually think of capability security as actually being a consent granting
mechanism, where which is accountable, revocable, and is very intentionally granted and is limited.
And one of the big challenges we had when I wrote this is that people were like, it's really
hard for me to think about this and kind of like a Jango Rails type perspective.
So this is kind of, and in many ways actually this kind of informed some of the future work
to happen on spritly of trying to actually push the frontier of some actor model type programming
so that you know, you could see, well, what ends up happening when you start thinking in terms
of kind of actor model development. But I guess we had one more thing, which is who's ever had
a post-boosted by me or somebody else's topic that kind of took down your own instance.
Okay, a couple of people, I'm sorry, and the happens to my girlfriend all the time.
But actually this is partly a consequence of something that we kind of knew about
and is actually mentioned in the spec, but it's not a normative requirement. So at the end of the
spec, it basically talks about how do you authenticate messages, right? And how do you do authentication
and authorization? This thing of Ocap Pub is about, if you want to get into maybe this is a
little bit too computer sciencey for some people, but this is more about the authorization,
how you can do things thing. And then this one's about the side of authentication as in terms of
how do you know that somebody is actually said the things that they did, right? So the reason that if I
boost my girlfriend's post, that it takes down her server and all of her friends,
is that what happens right now to be able to verify that she said the thing is since we don't
have reliable signatures. And to Amazon's credit actually, Amazon did implement JSON all the
signatures, but very few other things did, because it turns out they're difficult to
canonicalize for a technical reason that's kind of more out of scope of this particular talk.
But if we did have a signature solution, and I believe we could build one, including one that
addresses the things that ended up being challenging with JSON all these signatures,
what we would be able to do is to be able to distribute messages. And if I distribute my girlfriend
VV's message, and then you receive it, you don't have to dial back to her server to make sure that
it's actually there. You can actually, if you've already retrieved VV's profile at one time,
and you know, you can see that it's signed with her key, you can say, okay, I'm pretty confident
actually that VV sent this, and so unless it's within that time period, she had to revoke
that key or something like that, you would be very certain, right? You'd actually be quite certain
that she had said this thing, and we wouldn't have this thing where boosting posts actually
can actually have a performance hit, which is kind of anti-social when you're what you're
trying to do is actually to show how much you like something. So let's get to the wrap-up,
we've set a lot of things. Part of the thing here is that we've, since despite these institutes
started actually, one of the reasons we're giving this talk today is that it kind of looked like
we ran off, and we did all these things over here, and people were like, aren't you the activity
put people, you're supposed to be working on stuff relevant to us, and we are, but I think
in some ways it wasn't quite obvious, because we have some other layers of our protocol that
we've also been very focused on, but the goal here is to actually talk about how this stuff is
very local and relevant. Yeah, and I just want to say that there are plenty of parts of the
talk that may be sound a bit out there if you're just writing an activity pump implementation
today with Rails or whatever, but there's a lot of this talk that you could do today. This is not
requesting changes to the activity pump spec. This is not necessarily rewriting your entire app.
This is things like adopting the client server API, which actually if you look at it,
it looks very similar to the server to server API. It really isn't going to be that crazy to
it implement, and they decentralize naming. That doesn't require a spec change. That is perfectly
compatible with the spec. And even some of the other stuff in here, we've been working on, you know,
where Sprite Lease Research Institute, we've done a lot of work on this, we've published
the Pat Names paper, and we're working on Goblins, and lots of Porto Baller for the technology
behind a lot of this. So if you want to, you can come, this paper is published on our website,
but I do want you to take away, you can do this today, and a lot of it. There's a lot of low hanging
fruit. And on that note, if you haven't checked out the Sprite Lease Research Institute, we've got a lot
of cool stuff. You should check it out. We even published video games, so you can test out the
weird low-level tech that we're talking about. You want to experience time-traveled debugging
live while playing a video game. You can do it on the Sprite Lease. We have a whole arcade page.
But, you know, are we a decentralized networking research organization, or are we a queer
indie game development organization? Why not both? So anyway, and you can also donate to help
move along the work that we're doing, and also kind of help us, we would like to bring it
spend more of the time focusing on bringing things back to the Fediver's type space. And so yeah,
the, that's it. I'm going to stop. Thanks.
So Jessica, may I give you this one? Can we give me the hand light?
Try, just test it. Test test? Good. All right, let's see. Do we have any questions for Jessica and
Christine? One way up there, of course.
So first of all, I think FedNames are really cool. We create a video.
But I want to ask if there's any way of reducing the friction for adding and following people.
So for example, on the centralizing networks, it's very easy at Joe or whatever. But like,
if you want to follow me on, I don't know, first of all, or whatever, then I need to put the
full URL and that confuse this people. So is there any pen name like feature for this sort of
interaction? This is a good question, which is that it's already pretty difficult to be able to follow
people on the FedNames, basically, if you, here's somebody's handler or whatever.
So there is, part of the challenge here is actually the challenge of the fact that we're doing
things inside of browsers. And the fact that, you know, what you really would want to be able to do
is to recognize that you're accessing some sort of link that expresses an intent that it's relevant
to, you know, your FedNames type works that you could. So there have been some other work on things
like Web Intense and stuff like that that would be really helpful. I am not up this bit on
where that current work is, but I think that I think that, you know, a lot of what we're talking
about here is kind of like, in, like, kind of in band of the stuff that you're doing inside of the
FedNivers, but there are ways to be able to simplify it, but it gets a little bit into kind of like
the, like, how would you actually implement Web Intense and stuff like that in a way that
browsers would actually cooperate with. And that's a little bit out of scope for me to get into
right here. And also, I'm not quite as up to state on the latest efforts in that space.
How does the OCAP Pub plan compare to existing FedNivers enhancement proposals about decentralization
and core block checks? So the OCAP Pub right up is, it is, I think the big challenge with the
OCAP Pub work is actually how likely is it that the FedNivers will actually be interested in
at this point, right? And as I actually think it's very interesting, I think it's Benjamin Goring
has done some work towards actually trying to implement the stuff, but the big challenges,
a lot of assumptions kind of have, when I wrote that up, I was kind of writing it up in a panic
as in terms of, like, I was worried about some things that ended up becoming kind of very focused
on kind of domain-oriented things, getting embedded in there. And the OCAP Pub is not as focused
on portable objects that's kind of more of the content addressing side of things. And I know there
have been attempts to do things that are not as content addressing oriented in the FEPs,
I'm not as up to date on them, but I do think that content addressing is the right way to do it
personally. In terms of OCAP Pub, part of the reason I was writing it up then was, you know,
kind of a concern that if I didn't get it written, we might kind of miss the opportunity
and that the FedNivers may also fly. I'm not sure if that's actually already passed. It could be
that the authorization side of things is actually the hardest nut to crack. You might notice that we
spent the least amount of time kind of talking about OCAP Pub in here. That's partly because I don't,
I don't know how much interest there was. When I originally started writing up OCAP Pub and
talking about it with FedNivers implementers, a lot of the response that I got was this sounds really
good, but it sounds a little bit too off-track for the direction that things are kind of going
in the type of frameworks that we're currently using. So I would like to see it advanced further,
but it actually requires us being able to kind of, it would require, it would require some more
dedicated research time and effort, and we've kind of only barely dipped into that, just to
have a little bit of time to be able to work on Mandy and show off how it could apply. But we
it is something that let me put it this way. If you think that the kind of networks of consent
model actually sounds really appealing, we could really use to help actually as in terms of being
able to get some enough resources to be able to provide dedicated time on that. By the way,
spray lead on institute slash donate. Always could use help there. Any other questions or do we
have time for any? Okay, go ahead. Thanks. Do you have other thoughts on the ecosystem behind
these ideas that you've outlined? So I was starting to write a service one to two implement this,
but kind of didn't find any libraries for implementing the low-level stuff that I needed.
What do you think is missing most there? That's a big question. It's about, we'll go ahead, just
it. We're trying to work on some of the libraries and things to do with it. So obviously,
we work in schemes. So maybe it's an applicable, I don't know. But hopefully these will come
in time. Goblins is awesome and you should be using it. I will say that.
Okay, I think that's it. All right, thanks everybody.