Jane's in the blue shirt here is going to do something for you and you know when I leave
Okay, I love you, God. Thank you, thank you.
And that's where you want to buy a screen, so this is going to be nice.
All right, I'll get out of the right.
One, two, yeah.
Hello.
Thanks for having me here today.
Today, I'd like to give my talk about Verify activity pop,
sub or framework for TypeScript.
If you have tried to build federated social app, you know the pain,
and today I show you how Verify and to element these pains.
So let me introduce myself.
I'm home in here and I'm from South Korea.
It was, it was about 10 hours from there to here.
Thank you.
It's my first time to be here in Europe.
So, it's exciting. Thank you.
And I'm trying to verify and follow and bucket.
And I also organized federated care which is Korean community for federated developers.
And I also run a hospital.
This is a software engineers,
logins prep on the, on the very first.
And yeah.
Let's start with the problem.
So, why did I build Fed5 in the first press?
When, when I started to build hollow,
my single, single user, single user, Fed5 starboard software.
I started, it would be very easy.
Because at this point, it's just just JSON over SP.
And there are obviously specs.
There are many implementations, existing implementations,
to, to, I, so I can look, look into that.
So, I estimated about two weeks, but, how, what it was not.
It's, it's, first, it's not just JSON.
It's JSON early.
And property names can expand to your eyes.
And same data can have multiple shades.
Specs are, specs are very, very extensible,
but it also, on the specified.
And many, in case, are left to interpretation.
So, there are many implementations, but they,
they literally differ.
So, for example, activities that, let me also,
might be rejected by, miskey.
So, I spent over a month debugging,
so, see, in the old property problems.
So, I, I, I, I decided to build my own framework for activity power.
First.
So, what is fetched by?
It's an opinionated factory power framework for high-screen.
Opinionated means, it makes decisions for you,
for you, the right decisions.
We have key features like, such a thing.
First, let's start with the most fundamental problem.
Telling me Jason Ali.
Jason Ali is the root cause of activity power complexity,
in my opinion.
Same data can be multiple representations.
And, for example, our property can be a string,
or an object, or an array,
and there's no static types.
So, you need to, you have to check everything at runtime.
And, you need to resolve context,
so that property names can, property names,
expand to for URIs, qualified URIs.
So, there are also implementation differences.
Most of them don't do it one way.
Minsky or another.
So, without proper exception,
you, you are called, because,
a mess of tight text and case cases.
So, here's, here's some example.
So, the actual property,
in an activity can be just URIs 3,
or it can be a, it can also be an object embedded
object with several properties,
or it can be an array of multiple actors.
And, so, our, sorry, are valid representations,
according to the spec.
So, you're called the most handy or real damn.
So, it means writing,
if and as a change for every single property,
that's what role activity property parameters looks like.
So, verify, test it away.
With verify, you just call activity that,
get actor method.
In need of actor or norm,
and TypeScript knows the exact type.
If the actor, if the actor is URI,
verify that she's in automatic query.
If it's embedded, you get, you get it directly.
And if there are multiple actors,
you can interact with, get actors method.
So, your ID gives you auto compression,
and type errors are caught at compile time,
that in production.
And, I also noticed that the secret if we note.
So, cross-origin embedded objects are automatically
refetched from the origin.
These pre-banned spoofing attacks
were some, someone,
embedded the fake actor object.
Next, let's talk about cryptographic signatures.
Another major source of pain
in activity pop development.
Every activity part requires
needs cryptographic signatures.
For outgoing activities, you sign with your privacy.
And for incoming activities,
you verify against the sender's public key.
It sounds simple at first,
but which signature scheme are there.
So, there are four major signature schemes.
One is draft cavity.
This is the defect of standard.
And IFC-1941 is the official standard
that widely audited.
And I think Masoldoen recently audited this.
And L.D. signatures for embedded profiles,
but it's also solid.
And there are object to integrate the profiles
for embedded profiles, as well.
It's modernly pre-announced,
refreshment of L.D. signatures,
but not widely audited.
Different servers, different schemes,
and you need hand over all of them.
But you can use that type instead,
which supports all four ultimate curry.
So, with FFI, you just write your business and logic.
Look at this code.
You define an inbox listener for follow activities.
And when follow activity arrives,
the signature is already verified.
You don't write any signature verification code yourself.
When you call, context that send activity,
message, verify science is automatically.
You don't think about which is akin to use.
There's a magic called double knocking, as well.
And FFI tries to RFC-1941 first.
And if the servers reject it,
FFI falls back to draft activity,
which is the reverse standard.
And it also remembers the pre-fronts for future requests.
So double knocking is only happening at first time for each peer.
And this is kind of interoperability.
Well, for you, you shouldn't have to do yourself.
And FFI does it for you.
And next, let's talk about Scarogchi,
specifically the FNL-FNL problem.
What happens when you post to 10,000 followers,
there's a night approach, 10,000 HP requests.
And you are sovereign with timeout.
Because some servers are slow,
and some servers are temporarily down.
And you should, FFI delivers should be
retried with exponential tech curve,
and memory pressure with a from cue request.
And there are many more.
In actuality poll, there's actually inboxes,
as well.
And many servers have a single inbox for all users.
And you should send the ones for server
that wants for actor.
So you need to detect it,
and detect this.
So, building this all this from scratch
would be, would take weeks of work.
So you will probably get it wrong the first few times.
So, FFI, just configure or message queue.
And this exam preshows how to use reddit.
But FFI also supports any other message queue
like ANQP, DinoKibi, post to rescue,
and so on.
And you can implement your own adapter as well.
If you want to configure it automatically
literally with exponential tech curve up to ten
or ten by default,
and show the inbox optimization is also over a level set.
And so if you set pre for show the inbox option
to two, and then with FFI,
you duplicate it automatically.
So, FFI also have two state files
since version 105.
And so activity is go to the queue immediately,
and walk us delivery in parallel.
So, you are post returns instantly,
and delivery happens in the background walker.
So, and FFI, the delivery are also
retried automatically.
This is production ready quality of scalability
with minimal configuration.
And one more thing about FFI's philosophy is
it doesn't detect your technology scale.
FFI works as a middleware for your existing framework.
That was a good framework.
For example, Hono, example, express FFI
or Netflix, or anything that speaks the standard request
or response API or property.
You can use your preferred volume.
That's only the comment is a key value store for catching.
So, we have deliverable devices as well.
And we have FFI new call for
to let you inspect any activity power OZ.
It takes FFI, FFI, or you are,
it fetchs the OZ.
It also provides, also provides fetch thread.
And it generates a temporary key pair of signs
though, we test for you.
FFI inbox is even more powerful.
It spins the temporary activity of server
with a public URL, and you get an anchor
with an inbox that can list of activities.
It looks like this.
You can see the full HP request activity
and detailed the logs.
And when it, you are done testing press,
controversy and FFI sends delete application
activities to our peers.
So, ghost is a major portion platform
with millions of users, and they choose FFI.
And they are also different projects
that depend on FFI too.
So, thank you.
Thank you for all of us.
Thank you.