diff options
Diffstat (limited to 'docs/federation/behaviors')
| -rw-r--r-- | docs/federation/behaviors/conversation_threads.md | 45 | ||||
| -rw-r--r-- | docs/federation/behaviors/outbox.md | 49 | ||||
| -rw-r--r-- | docs/federation/behaviors/request_throttling.md | 3 |
3 files changed, 0 insertions, 97 deletions
diff --git a/docs/federation/behaviors/conversation_threads.md b/docs/federation/behaviors/conversation_threads.md deleted file mode 100644 index 4e6f6b0ee..000000000 --- a/docs/federation/behaviors/conversation_threads.md +++ /dev/null @@ -1,45 +0,0 @@ -# Conversation Threads - -Due to the nature of decentralization and federation, it is practically impossible for any one server on the fediverse to be aware of every post in a given conversation thread. - -With that said, it is possible to do 'best effort' dereferencing of threads, whereby remote replies are fetched from one server onto another, to try to more fully flesh out a conversation. - -GoToSocial does this by iterating up and down the thread of a conversation, pulling in remote statuses where possible. - -## Example - -Let's say we have two accounts: `local_account` on `our.server`, and `remote_1` on `remote.1`. - -In this scenario, `local_account` follows `remote_1`, so posts from `remote_1` show up in the home timeline of `local_account`. - -Now, `remote_1` boosts/reblogs a post from a third account, `remote_2`, residing on server `remote.2`. - -`local_account` does not follow `remote_2`, and neither does anybody else on `our.server`, which means that `our.server` has not seen this post by `remote_2` before. - - - -What GoToSocial will do now, is 'dereference' the post by `remote_2` to check if it is part of a thread and, if so, whether any other parts of the thread can be obtained. - -GtS begins by checking the `inReplyTo` property of the post, which is set when a post is a reply to another post. [See here](https://www.w3.org/TR/activitystreams-vocabulary/#dfn-inreplyto). If `inReplyTo` is set, GoToSocial derefences the replied-to post. If *this* post also has an `inReplyTo` set, then GoToSocial dereferences that too, and so on. - -Once all of these **ancestors** of a status have been retrieved, GtS will begin working down through the **descendants** of posts. - -It does this by checking the `replies` property of a derefenced post, and working through replies, and replies of replies. [See here](https://www.w3.org/TR/activitystreams-vocabulary/#dfn-replies). - -This process of thread dereferencing will likely involve making multiple HTTP calls to different servers, especially if the thread is long and complicated. - -The end result of this dereferencing is that, assuming the reblogged post by `remote_2` was part of a thread, then `local_account` should now be able to see posts in the thread when they open the status on their home timeline. In other words, they will see replies from accounts on other servers (who they may not have come across yet), in addition to any previous and next posts in the thread as posted by `remote_2`. - -This gives `local_account` a more complete view on the conversation, as opposed to just seeing the reblogged post in isolation and out of context. It also gives `local_account` the opportunity to discover new accounts to follow, based on replies to `remote_2`. - -## Privacy and Security - -During the dereferencing process, GoToSocial signs outgoing requests using the key of the actor who received the activity that necessitated dereferencing. To use the above example, this means that all dereferencing requests would be signed by `local_account`. This gives remote servers the ability to refuse these dereferencing requests, assuming that `local_account` is blocked by one or more participants in the conversation. - -From GoToSocial's side, domain blocks will be respected during the dereferencing process, to avoid making calls to servers that `our.server` has blocked. - -Individual account blocks will also be respected, meaning that `our.server` won't try to dereference posts from accounts blocked by `local_account`. - -Finally, GoToSocial expects that remote servers will only list replies that are marked as public (either `to` or `cc`). GtS may *try* to dereference followers-only posts, but it will assume that remote servers will check whether or not `local_account` is allowed to view them, and refuse accordingly. - -Of course, when `local_account` opens up the conversation thread in whatever application they are using, GoToSocial will apply the usual post visibility filtering to ensure that they do not see any posts that they shouldn't have access to. diff --git a/docs/federation/behaviors/outbox.md b/docs/federation/behaviors/outbox.md deleted file mode 100644 index 2583efe79..000000000 --- a/docs/federation/behaviors/outbox.md +++ /dev/null @@ -1,49 +0,0 @@ -# ActivityPub Outbox - -GoToSocial implements Outboxes for Actors (ie., instance accounts) following the ActivityPub specification [here](https://www.w3.org/TR/activitypub/#outbox). - -To get an [OrderedCollection](https://www.w3.org/TR/activitystreams-vocabulary/#dfn-orderedcollection) of Activities that an Actor has published recently, remote servers can do a `GET` request to a user's outbox. The address of this will be something like `https://example.org/users/whatever/outbox`. - -The server will return an OrderedCollection of the following structure: - -```json -{ - "@context": "https://www.w3.org/ns/activitystreams", - "id": "https://example.org/users/whatever/outbox", - "type": "OrderedCollection", - "first": "https://example.org/users/whatever/outbox?page=true" -} -``` - -Note that the `OrderedCollection` itself contains no items. Callers must dereference the `first` page to start getting items. For example, a `GET` to `https://example.org/users/whatever/outbox?page=true` will produce something like the following: - -```json -{ - "id": "https://example.org/users/whatever/outbox?page=true", - "type": "OrderedCollectionPage", - "next": "https://example.org/users/whatever/outbox?max_id=01FJC1Q0E3SSQR59TD2M1KP4V8&page=true", - "prev": "https://example.org/users/whatever/outbox?min_id=01FJC1Q0E3SSQR59TD2M1KP4V8&page=true", - "partOf": "https://example.org/users/whatever/outbox", - "orderedItems": [ - { - "id": "https://example.org/users/whatever/statuses/01FJC1MKPVX2VMWP2ST93Q90K7/activity", - "type": "Create", - "actor": "https://example.org/users/whatever", - "published": "2021-10-18T20:06:18Z", - "to": [ - "https://www.w3.org/ns/activitystreams#Public" - ], - "cc": [ - "https://example.org/users/whatever/followers" - ], - "object": "https://example.org/users/whatever/statuses/01FJC1MKPVX2VMWP2ST93Q90K7" - } - ] -} -``` - -The `orderedItems` array will contain up to 30 entries. To get more entries beyond that, the caller can use the `next` link provided in the response. - -Note that in the returned `orderedItems`, all activity types will be `Create`. On each activity, the `object` field will be the AP URI of an original public status created by the Actor who owns the Outbox (ie., a `Note` with `https://www.w3.org/ns/activitystreams#Public` in the `to` field, which is not a reply to another status). Callers can use the returned AP URIs to dereference the content of the notes. - -Contrary to the ActivityPub spec, GoToSocial will deny requests that are not HTTP signed--that is, unauthenticated requests. This is consistent with GoToSocial's authentication policies for other federation API endpoints. This is to ensure that GoToSocial can deny requests from domains or users that have been blocked either by the GoToSocial instance itself (domain block), or by the individual owner of the Outbox. diff --git a/docs/federation/behaviors/request_throttling.md b/docs/federation/behaviors/request_throttling.md deleted file mode 100644 index e44e26811..000000000 --- a/docs/federation/behaviors/request_throttling.md +++ /dev/null @@ -1,3 +0,0 @@ -# Request Throttling and Rate Limiting - -GoToSocial applies rate limiting and http request throttling to the ActivityPub API endpoints (inboxes, user endpoints, emojis, etc). For more details on this, please see the [throttling](../../api/throttling.md) and [rate limiting](../../api/ratelimiting.md) documents. |