I said better, not more secure. It’s not as easy to accidentally leak the message. It’s equally easy to intentionally leak it.

I mean, have you ever read anything about any dictatorship?

But if you officially operate somewhere, they can sue you, I thought that was common knowledge?

Anyway, not complying with local laws and operating in the country can get you in some serious trouble. And the trouble will escalate until you comply or pull out of the country.

Kim Jong Un can sue anyone. Like, they can sue Signal if they want. Sure, they have no way to enforce it, but they can sue (and win the case). It’s not like this would be a first, that happened quite a few times. Especially in dictatorship.

There is a reason: you will be sued out of existence. And the bit about North Korea made me laugh, so thanks.

Yep. Sadly, Lemmy will move on to implement this exact horrible mess in future versions.

The current ChatMessage approach is much better than crazy shenanigans with to/cc/mentions.

I shared a bit about exactly this here: https://lemmyverse.link/lemmings.world/comment/14476151

Using Laravel as a framework should be the first red flag, I yet have to meet a Laravel dev who understands architecture (and I interviewed quite a bit of them). That framework is several anti-patterns bundled into a nice package.

I actually like how Lemmy handles it, it warns you that it’s unencrypted and that it recommends Matrix

It also uses an entirely separate AP type that’s not used for anything else (ChatMessage) unlike Mastodon which uses Note, which is also used for: Mastodon posts and comments, Lemmy comments, most likely others.

ChatMessage type also has strict requirements about recipients, the chances to leak them are slimmer. Additionally, if the target app does not support the type, it’s very unlikely it will handle it at all, but Note will most likely be handled in some way.

In conclusion, Lemmy PMs are very hard to leak accidentally (still very easy to leak intentionally).

Sadly, Lemmy will be moving to Mastodon-style PMs.

You know they can’t legally operate there if they don’t follow the law, right?

Pulling out is the only form of protest they have as a company. The rest is up to its users.

Anyway, if it happened, you could still use Signal anyway, perhaps with the help of a relay like other countries who prefer spying over privacy.

I did elaborate a bit in a sibling comment.

I don’t exactly think ill of him, but I’ll stay away from any platform he creates. He shared one snippet of code where he disabled validating certificate validity and certificate names. When called out on it, he decided to delete the post.

Security and standards don’t seem like the first things on his mind.

Who would’ve thunk that misusing the same type for both public and private posts (with a sprinkle of weird mention rules to determine the visibility) could backfire?

Well, definitely not Mastodon devs. Lemmy’s current approach of using an entirely different type is much better.

If you’re interested in some details, I recently wrote a comment about it: https://lemmyverse.link/lemmings.world/comment/14476151

Good luck! I did the same recently. I wrote my own blog system, though. I can share it with you, but I’m not sure it’s the best for anyone else, there were some shortcuts taken given I did not intend to share it.

You can check out my blog and let me know whether you want to try it: https://chrastecky.dev/ (or federated: !programming@chrastecky.dev, !3d-printing@chrastecky.dev, !gaming@chrastecky.dev).

Stupid term for when people who don’t know how to program ask AI to generate code for them which they have no expertise to actually validate.

Edit: It took 20 minutes, but I finally found the poster child for vibe coding (time well spent):

Can you send me some details at my totally valid email "Rikudou's personal email"@5.75.133.3?

There’s no spec for private messages at all, there’s no standard to implement. See also my explanation/rant as the other reply I made to the parent comment.

I recently did a library implementing pretty much the whole ActivityPub protocol and let me tell you one thing I’ve learned: ActivityPub is a half-assed unfinished mess.

It has so little constraints that pretty much anything is valid. You’d think that there was some logic at the core, but not really.

For example, there’s the Like activity, the name is pretty self-explanatory. But it’s valid to like anything. You want to like another Like activity? Why not! So you can like a like that likes a like…

Obviously, no real project implements such nonsense. But because almost everything is valid and up to interpretation of the implementer, there really is no single ActivityPub to implement that gets you running smoothly. There are many de-facto standards with various levels of compatibility with each other. Sending private messages is one such thing that many projects chose to implement in different ways.

Fun fact: Without implementing the HTTP Signatures spec, your app will not be able to send any activities to any software, because ActivityPub allows anyone to impersonate anyone, which obviously didn’t really fly with people developing actual software that uses it.

In conclusion, pure ActivityPub is an unusable mess in its pure form that literally won’t be able to communicate with other software implementing “ActivityPub,” so everyone is kind of implementing a similar slice/hybrid of ActivityPub and other protocols, but not exactly the same ActivityPub.

Yep, it was, but the spec still exists and few projects borrowed the ChatMessage type from it.

They’re not, they’re a different kind of object on the ActivityPub level. Lemmy and some others use the unofficial extension called Litepub which includes a custom ChatMessage type, while Mastodon and others have chosen to repurpose the Note object (used for posts and comments on Mastodon and comments on Lemmy) with limited visibility and weird mention rules.

Well, at least they explained it! /s

I thought it just allowede easier debugging, sorry

Source

Edit: This comment is a gem, too.