Feature Request: Support for importing non-inlined starter kits

[jfietkau]

What

Heya. I'm currently helping out fedidevs.com with a little bit of ActivityPub support for their starter kits. There's ongoing work in anze3db/fedidevs/pull/177 if you want to watch (or partake).

Since this plugin is the only publicly existing consumer of starter kits that I know of, I figure it makes sense to check that we're compatible. 🙂

My current plan (which is still being discussed) is to publish fedidevs.com starter packs with the items listed as IDs instead of as inlined objects, like this:

{
    "@context": "https://www.w3.org/ns/activitystreams",
    "type": "Collection",
    "id": "https://example.org/s/abcde/",
    "name": "Test Starter Pack",
    "totalItems": 2,
    "items": [
        "https://example.org/users/test",
        "https://example.social/p/a487c0ae-5218-4632-b1a3-59053a79494f"
    ]
}

As I assume you know, this is equivalent JSON-LD to having the objects inlined, and an ActivityPub recipient accepting one should also accept the other.

Now, it's been well over a decade since I did any PHP programming to speak of, so I'm not 100% confident. But if I'm reading this and this correctly, then it looks like your importer doesn't yet support this kind of object reference. Since it looks like you're transforming the objects back into IDs right afterwards anyway, maybe it'd be a quick fix. But if you need to do any checks on the object (looks like you're validating the types?), maybe it's not trivial.

I'm filing this as a feature request since it doesn't currently break anything, but if your goal is to be able to parse all valid ActivityPub starter kits conforming to Dan's schema, this would technically be a bug.

Why

tl;dr: Readiness for compatibility with fedidevs.com's ActivityPub starter packs whenever we launch them.

How

No response

[obenland]

Thanks! This should work with the next plugin update.

[jfietkau]

Thank you for the lightning-fast work!

[jfietkau]

@obenland @pfefferle The ActivityPub support for starter packs is now live on fedidevs.com if you'd like to test it with your importer (I don't have a WP test instance on hand).

Here's an example starter pack: https://fedidevs.com/s/NDYw/

The URL is also the ActivityPub ID and will return its ActivityPub format if you request it with a fitting Accept header.

Over at Fedidevs, we're not officially announcing this yet because I want to finish my work on the splash images before we ask people to try it out. So this is on the down-low for now. 🙂

[pfefferle]

@jfietkau This is awesome! It worked like a charm!

I will add an option to the importer to import via URL and to preview the list before importing!

What do you think about having a fallback to the mastodon importer?

A quick and rough idea:

1. Change the wording in the follow overlay to something more generic like "provide us your fediverse handle or login with mastodon"
2. If it is a username (URL or WebFinger) do a WebFinger lookup (if it is a mastodon account, you can still start the OAuth handshake)
3. Check for the http://ostatus.org/schema/1.0/subscribe uri template (here is an example of my blog https://webfinger.net/lookup/?resource=pfefferle%40notiz.blog)
4. Call the template with the starter kit as param, like for example: https://notiz.blog/wp-api/activitypub/1.0/interactions?uri=https://fedidevs.com/s/NDYw/

This way we could re-use the already widely adopted subscribe endpoint (https://www.w3.org/community/ostatus/wiki/Howto.html) and start evangelizing to not only support remote following one account, but also lists of users.

I think I could have a prototype ready by the end of the week!

[pfefferle]

@jfietkau first PR to make show some of the extra informations from fedidev: #2047

[pfefferle]

@jfietkau import directly from an URL #2048

[jfietkau]

@pfefferle

This is awesome! It worked like a charm!

Yay! 😀 Looks great in #2047. A couple of notes:

I'm sure you're already thinking about this, but the ActivityPub IDs in the items can of course be individually resolved so you can show the names, handles, or both instead of the raw ID. Same goes for attributedTo. If you don't want to be forced to fire off too many HTTP requests, you could consider limiting this to accounts that you have already cached locally. By the way, Fedidevs limits starter kits to 150 entries, but the schema imposes no upper limit. Could be sensible to define a hard cap somewhere anyway. A starter kit with a million entries is almost certainly some sort of DoS attack.

We're sending alt text for the splash image in the summary property that I'd recommend using on your end wherever the image is displayed. It currently looks like our alt text will continue to be the empty string (because we consider our splash images to be “either decorative or supplemental to the rest of the content, redundant with some other information in the document” – WHATWG, HTML Living Standard), but we're trying to nudge future starter kit hosts to think about whether their splash images should have alt text. So the logic could be to use the summary as alt text if present and fall back to a default alt text if it isn't. Or you could also use the default alt text if summary is present but empty, in case you don't trust our judgment on that point. 😉

Since Fedidevs knows the authoring user's AP account, we send that info in attributedTo. (In Dan's schema discussion, I advocated for making this attribute mandatory to facilitate accountability. Do you think it would be good on the consuming end to show some sort of warning if a starter kit doesn't provide information on who's responsible for it?) However, since fedidevs.com is a different HTTP origin than whatever AP home server people are using and we don't have a way to get any sort of cryptographic signature from people to sign the starter kit, this is a violation of FEP-fe34 and the ownership remains unverifiable. I.e. a malicious server could attribute whatever weird starter kits to you or me. The attributedTo property anticipates a future where people will be able to host their starter kits on their home server, kinda like public Mastodon lists. I think the information on the author is still valuable, but it could be good to contextualize it in the UI – for example, you could show a green check mark if the HTTP origin of the starter kit matches that of the attributedTo user ID, and instead show a little ℹ️ icon if it isn't (or if the starter kit was imported from a file), with a note that the authenticity cannot be verified and might be fabricated.

Also, this plugin has server blocks / defederation, right? Are you checking the list of accounts in a starter kit against that yet? Could be good to skip those from the import UI and instead show some small print like “Not showing $n accounts that are blocked or defederated.”

Sorry for the lengthy recommendations, but I think for the time being, since AFAIK Pixelfed hasn't made their starter kits public yet, WordPress will be the biggest consumer of ActivityPub starter kits and Fedidevs will be the biggest producer, so I think we should both try very hard to serve as good role models on this. I bet other implementations will look at us more than they will look at the schema definition.

What do you think about having a fallback to the mastodon importer?

To be honest I only half-understand this proposal. Is the “Mastodon importer” for adding accounts to people's Mastodon follows, and this would be to give people the ability to use WordPress to import a starter kit into their Mastodon account, am I getting that right? If so, sounds neat, but it would involve clicking through each account individually, right?

[pfefferle]

+1 on all suggestions!

To be honest I only half-understand this proposal. Is the “Mastodon importer” for adding accounts to people's Mastodon follows, and this would be to give people the ability to use WordPress to import a starter kit into their Mastodon account, am I getting that right? If so, sounds neat, but it would involve clicking through each account individually, right?

No, it is about the other way around! I would love to start the initial process of importing starter kits into a WordPress blog, directly on fedidevs.com (in a similar way you do for mastodon) and because the ActivityPub plugin does not support the proprietary Authentication process of Mastodon, I thought about an alternative.

And that is what I tried to describe.

[jfietkau]

Ah right, now I get it. Yeah, there is currently a lot to Fedidevs that's Mastodon-only. Officially it doesn't even support listing non-Mastodon accounts, since it uses the Mastodon API instead of ActivityPub to grab profile details. Anže has said that he would like to change that, but I only joined the project last week to work on ActivityPub starter kits, so that'll be a future task.

I like the idea of offering a way on Fedidevs to import a starter pack into other server software, but I'm afraid that'll probably be even further in the future. Your suggested process makes sense to me now.