NodeBB

@Kye I bet if someone keeps putting "neo" in front of libertarian they'll finally end up with a new term they can define and nobody will take it over for sure this time

@Kye If we were going to push the liberatarian angle, I'd note that there's nothing more libertarian than taking a ton of VC money for your startup and having a whole "ecosystem" revolving around that one corporation

But it's not really helpful to make that analysis, I think.

@Kye It's not really libertarian, but it does reflect the same organizing challenges that left-leaning groups face everywhere. If it were anything, I'd say it was anarcho-socialist, but I don't think that's really accurate either.

I don't really think it's useful to throw around that analysis; a lot of what is happening in the ATmosphere is because one big player is from a largely central perspective organizing and declaring a bunch of design effort, but there's also *money* there, which the fediverse is much poorer on, and that changes things somewhat.

There are things both groups are doing well, technically and organizationally both. It would be helpful if it were possible to cross the domains of information exchange with less snark (I'm guilty of it myself), and I know that *is* a thing you're trying to do, to your credit!

@Kye Also I just attended another such event in Montreal hosted by @evan just a couple months ago. Things are happening, though I agree that both camps are largely not seeing each other.

Perhaps we need an event to pull everyone together to fix that.

@Kye There were also multiple hugely attended social devrooms at FOSDEM. 2025's in particular was one of the biggest lecture halls at FOSDEM, and the room was filled!

I think there's a lot that's happened. But the fediverse is scrappier, more spread out. That's partly Conway's Law in action, I suppose.

@Kye There were two APconfs, 2019 and 2020. There have been quite a number of events since, (Berlin Fediverse Day, Fediform, etc) but yes, I do think it's true that the fediverse shouldn't underestimate the amount of energy is in the ATmosphere right now

@deadsuperhero if I meet any I'll let you know

@eyeinthesky @smallcircles @evan To be clear, I think json-ld has a lot of great ideas in it, and it's the extensibility and linked data compatibility (which was a strong group requirement) story we had at the time.

"JSON-LD is bad" doesn't really capture my views. "JSON-LD turned out to be too complicated for the majority of the ecosystem to work with, particularly when we gave the view that you could ignore it, except it creates a rift of interoperability between those who ignore it and those who don't and puts a burden on the latter who are doing their best to behave well" does match my views.

There are paths out of the situation, but I'm not confident in the discourse around them right now, and hesitant about how much I want to engage with it.

@evan @patmikemid @kopper @hongminhee Okay, sorry for blowing up in public, this is a heated issue for me, and something I strongly regret us not just shipping an answer for, and something I have been troubled by for what's now, well, a decade. But I should have taken this to DMs rather than blowing up in public. Mea culpa.

@evan ESPECIALLY if it's on something like IPFS, you need signatures, because there's no "see if it's on this instance" to speak of as a trust step!!!!

Am I am losing my mind over here

@evan If it's a popular author, which most commonly is the type who causes the thundering herd, then the chances the key is cached is very high!

@evan @patmikemid @kopper @hongminhee I'm sorry hold on Evan I'm sorry but it's NOT very low risk. That's a COMPLETE misunderstanding of the information landscape we are currently in.

Trust THEN verify?!?! Trust AND THEN verify?!?!!?!?!?!?

"A random several minutes" until we know whether or not the content delivered authentically is from said actor...

Even ONE minute is enough for someone to read, and believe, something false, and to reply, or to *take action*. Or to boost a post, which is then distributed across the fediverse, and then seen by a bunch of other nodes which also have not yet verified?

Trust AND THEN verify doesn't make sense!!!

AAAAAA I am losing my marbles over this one

@evan @patmikemid @kopper @hongminhee I would consider myself a user which, when at her computer, is in a state we might call "terminally online"

@evan @patmikemid @kopper @hongminhee Trust *then* verify?! That means accepting windows of impersonation attacks necessarily then, right...?!

@evan @kopper @hongminhee But that means either:

- Users don't get to see content that has been federated to them for *minutes*
- Unless we show unverified messages, allowing for windows of impersonation attacks, in which substantial reputational damage can be done!

And also:

- Whenever I boost several of @vv's posts, her server can be down *for a while*. Random delays can help reduce load but not as substantially as signature verification
- This has to be done for both the activity *and* the object
- And there's no reason to include either the activity or the object if you care about not risking impersonation attacks, because you might as well just send {"@id": "https://example.org/post/12345/"}

@kopper @hongminhee @evan Interesting... I guess it means you can't re-compact with a new outer context, but maybe that's fine

@evan @kopper @hongminhee The problem is that signing json-ld is extremely hard, because effectively you have to turn to the RDF graph normalization algorithm, which has extremely expensive compute times. The lack of signatures means that when I boost peoples' posts, it takes down their instance, since effectively *every* distributed post on the network doesn't actually get accepted as-is, users dial-back to check its contents.

Which, at that point, we might as well not distribute the contents at all when we post to inboxes! We could just publish with the object of the activity being the object's id uri

@kopper @hongminhee As the person probably most responsible for making sure json-ld stayed in the spec (two reasons: because it was the only extensibility answer we had, and because we were trying hard to retain interoperability with the linked data people, which ultimately did not matter), I agree with you. I do ultimately regret not having a simpler solution than json-ld, especially because it greatly hurt our ability to sign messages, which has considerable effect on the ecosystem.

Mea culpa

I do think it's fixable. I'd be interested in joining a conversation about how to fix it.

@evan @fribygda meowth that's right!