So I'm trying to add support for automatically embedding Fediverse posts on this blog, right? And yeah I could use the Mastodon API for it, but I'd really rather be able to make it work with anything that speaks ActivityPub. So okay, I look up the ActivityPub spec. It's a bit confusing, but I figure out how to at make a GET request for an ActivityPub resource: just add Content-Type: application/ld+json; profile="https://www.w3.org/ns/activitystreams". I can even make a request for one of my statuses and it works! Fantastic!

Just to verify, I make a request to another server, and that's where things start getting hairy. Instead of a nice JSON representation of the post, I get back a 401 Unauthorized with a body that says "Request not signed". This is a public post, but after some digging it turns out Mastodon (and by extension ActivityPub as a whole) has a "secure mode" where all requests have to be signed.

Signed by what though? This is a distributed system—there's no central authority to distribute authorization in the first place.

To answer that I looked in the spec. I searched for "signature" and found nothing particularly relevant. Eventually I found the Authentication and Authorization section, which says "Unfortunately at the time of standardization, there are no strongly agreed upon mechanisms for authentication." Well, shit. Clearly some people agree enough for it to be implemented, but I guess not enough for it to be actually specified!

This does, mercifully, link to a wiki page that purports to lay out "some possible directions" and, under the Server to Server section, seems to describe the scheme that this StackOverflow post describes as "an odd, somewhat well-known ActivityPub quirk"^[1]. This wiki page may not be an official specification, but at the very least it describes the publicKey field that I can see in the actor JSON on Mastodon.social.

This is all fundamentally busywork. Because the whole thing is decentralized, the receiving instance has no choice but to trust whatever public key a new requesting instance provides. All this scheme really does is prove that someone making requests runs a server somewhere that speaks basic ActivityPub, and even then this constraint only exists for ActivityPub requests—HTTP requires no authentication at all.

{
  "id": "https://mastodon.social/users/nex3",
  "type": "Person",
  /* ... */
  "publicKey": {
    "id": "https://mastodon.social/users/nex3#main-key",
    "owner": "https://mastodon.social/users/nex3",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\n"
  }
}

Or does it? The publicKey link there points to https://web-payments.org/vocabs/security#publicKey, a URL that at time of writing is refusing HTTPS connections entirely. Naturally I looked it up on archive.org, only to find that the specification for the publicKey field is not only totally different from what I'm observing in the wild, its one-sentence specification is essentially useless: "A public key property is used to specify a URL that contains information about a public key." The example included doesn't even have a publicKey field.

{
  "@context": "https://w3id.org/security/v1",…

it'll turn on automatically if you have it enabled at the OS or browser level. let me know if you notice any issues!

Okay I set up a new comment system! Shouts out to Damien for hosting it. It's definitely better than CommentBox: it's got real formatting, you can change your avatar, and you can link back to your homepage.

The catch is that CommentBox didn't actually include commenter emails in its data export, so you won't be able to update your old comments by default. If you want to do so, send me an email at ask@nex-3.com with a link to one of your old comments and I'll manually reset the email associated with that account so you can go through the password recovery flow.

I'll make a more thorough post about this at some point, but the short answer is that all you really need to do is tell my Webmention receiver the URL to your post and the URL to the post it's reblogging. You can do that manually by pasting the link to your post in the little webmention form beneath each of mine, or automatically by hooking up your blog's RSS feed to webmention.app.

The only bit of markup that can help here is adding either class="u-repost-of" or class="u-in-reply-to"^[1] on your post to indicate what it's reposting or replying to. Use u-repost-of if it's just a plain repost without any additions, and u-in-reply-to if you're adding any additional content. You can put these on:

• A simple <a> tag whose href is my post.
• The root element of an h-cite that provides more metadata about my post.
• The root element of an h-entry fully embeds my post in your blog. (This is technically non-standard but it's what I do and it seems to work with everything I've tested.)

I've set up my site so that it hides Webmention likes and reposts, but displays replies as comments below the post. See this post for an example of that in action.

---

1. Technically you can also do class="u-like-of" to indicate a like but that's not something that makes a lot of sense in a static site context. ↩︎

The avatar is by subspaceskater, Zandra did the layout, and I made the nettle leaf (with substantial help from a photo reference). Feel free to use it to link here if that's your thing!

I got a new commission from the inimitable subspaceskater! This one's going on my 404 page to greet everyone who doesn't know where they're going.

trying to get tumblr post embedding working properly, which is to say using the official API to get the semantic building blocks of each post instead of the dog vomit HTML they actually contain, and I've found myself shaving a yak. hopefully someone other than me will find this useful

oops I lied

Actually it's just the theme Taylor Titmouse was using that has the right metadata. There's no way to get it for any arbitrary tumblr post. I'll have to write that custom scraper after all 😩

At least this post motivated me to come up with some sort of a story for reposts!

Thank you for giving me a reason to make an ask component. 🙂

When I include a repost like this in my Atom feed, I treat it as though the post I'm reblogging is itself in the feed, rather than a wrapper that contains that post. Generally speaking, As such, most of the metadata (author name, link, title if it has one) is in the rest of the feed entry rather than in the HTML contents. I don't create embeds directly from feeds—I always go to the source web page and create the embed from that—but if I were to do so, I'd treat all that metadata the same way I treat h-entry metadata for sites.

I also always wrap the things I'm embedding in some extra markup to get the nice little boxes…

I was all set to set up a custom Tumblr scraper so I could reblog art and stuff on here, but it turns out Tumblr already uses the h-entry microformat out of the box! I don't have to do anything special at all! Except maybe to handle reblog chains, but that's something I should really do anyway.