Does the instance actor have special privileges?
-
Just something I noticed while testing non-public posts... when I try to message @jdp23@blahaj.zone, sharkey tries to grab the
inReplyTo, but it attempts to do so with the instance actor, which obviously doesn't have access to the chat.Feels like a Sharkey bug, but I also noticed this behaviour when I tried to use @crepels@mastodon.social's activitypub.academy... using the search bar (and the explorer) caused the request to be made with the instance actor.
So now I'm not even sure what to think.
-
> treat the resolved actor via HTTP signature to be like an API token, it's basically a fancy password!
yup, exactly. imagine if we used out-of-band bearer tokens. same principle. same with DPoP. the keys are all custodial in most cases. any “security” comes from the bidirectional link between actor and key (and it’s not much, but it’s barely enough to establish an identity at all)
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login