<![CDATA[Okay, so]]>Okay, so

https://docs.joinmastodon.org/spec/security/

According to resources linked in the docs, it seems that signature validation gets the entire Actor (thus the `#main-key` which the server is supposed to ignore) and then within the Actor it gets the `publicKey` property.

Soooo back to the `#main-key` nomenclature, I guess

]]>https://bb.devnull.land/topic/8606de2d-083a-48da-9fd9-edd89dc45694/okay-soRSS for NodeTue, 25 Aug 2026 02:43:19 GMTFri, 07 Aug 2026 15:58:49 GMT60<![CDATA[Reply to Okay, so on Wed, 19 Aug 2026 05:14:05 GMT]]>@dusoft Thank you

]]>https://bb.devnull.land/post/https://qaf.men/ap/users/116906449450988726/statuses/117120463366192365https://bb.devnull.land/post/https://qaf.men/ap/users/116906449450988726/statuses/117120463366192365Wed, 19 Aug 2026 05:14:05 GMT<![CDATA[Reply to Okay, so on Tue, 18 Aug 2026 22:11:09 GMT]]>@mooooooo@qaf.men You can try checking my code:
https://github.com/nekromoff/mastodon-bots

]]>https://bb.devnull.land/post/https://activitypub.space/post/2370https://bb.devnull.land/post/https://activitypub.space/post/2370Tue, 18 Aug 2026 22:11:09 GMT<![CDATA[Reply to Okay, so on Fri, 07 Aug 2026 20:45:55 GMT]]>@trwnh @julian @mooooooo it's also crappy for caching. Using a standalone document for the key lets you set a far-future expiry header, `Cache-Control: max-age=315360000`. So, clients never need to refetch. If you want to rotate the key, you give a new ID with a new URL.

]]>https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/117056179757228776https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/117056179757228776Fri, 07 Aug 2026 20:45:55 GMT<![CDATA[Reply to Okay, so on Fri, 07 Aug 2026 20:40:55 GMT]]>@julian @mooooooo

> a "Mastodon-ism". It's not strictly right

actually it's not wrong, especially when/because the key is a fragment of the returned document.

you're supposed to get the document and then *find the graph node that matches the input id*.

i suspect some implementations don't recognize that they need to do this, and they just assume that the key is *always* at $.publicKey.publicKeyPem or at $.publicKeyPem. that's incorrect.

]]>https://bb.devnull.land/post/https://mastodon.social/users/trwnh/statuses/117056160102524539https://bb.devnull.land/post/https://mastodon.social/users/trwnh/statuses/117056160102524539Fri, 07 Aug 2026 20:40:55 GMT<![CDATA[Reply to Okay, so on Fri, 07 Aug 2026 16:05:41 GMT]]>@mooooooo@qaf.men sort of! Mastodon does it that way, where if you request the keyId as identified in the HTTP signature, it returns the entire user object.

That's what we call a "Mastodon-ism". It's not strictly right, but it is what it is. AP implementations should properly handle it if you return just the publicKey portion alone.

For example, @evan's tags.pub does this correctly. @test@tags.pub will return the full actor object, but if you query the publicKeyPem, you get this: https://tags.pub/user/test/publickey

]]>https://bb.devnull.land/post/https://activitypub.space/post/2215https://bb.devnull.land/post/https://activitypub.space/post/2215Fri, 07 Aug 2026 16:05:41 GMT<![CDATA[Reply to Okay, so on Fri, 07 Aug 2026 15:59:58 GMT]]>Implementing your own Fedi server is shit, don't do it, I can't believe I ruined the last 4 days of my life with this

]]>https://bb.devnull.land/post/https://qaf.men/ap/users/116906449450988726/statuses/117055055337740263https://bb.devnull.land/post/https://qaf.men/ap/users/116906449450988726/statuses/117055055337740263Fri, 07 Aug 2026 15:59:58 GMT