Discussion
I think the #RFC9421 HTTP Signature algorithm should be explicitly included in #Mastodon's requests.
Feedback welcome - especially those explaining politely why I'm a wrong about this.
https://github.com/mastodon/mastodon/issues/29905#issuecomment-5440336919
A weird #ActivityPub message from #Frendica.
Signed on 2026-09-01
Published on 2026-03-02
That's a skew of six months! The message type is "Undo" - so they're undoing a like they sent in March.
Is there *really* a worry about accepting requests like this? Given the message has been signed, what risk is there to replay attacks?
Bug report at https://github.com/friendica/friendica/issues/16150
Another Mastodon / ActivityPub signature question.
Alice reposts Bob.
Bob updates their post.
Alice's instance syndicates that update to her followers.
The message Alice's instance sends has an Actor of Bob. But the headers are signed by Alice. So the signature doesn't match the actor.
Which means Bob's embedded RsaSignature2017 *also* needs to be checked.
https://docs.joinmastodon.org/spec/security/#ld-sign
But that doesn't mean I can skip checking Alice's signature, right?
The documentation says:
> Strip type, id, and signatureValue from the signature, leaving only signature[creator] and signature[created].
> Base64-decode the signatureValue and verify it against the public key in signature[creator].
But it doesn't say *what* to validate the signature against!
Is it a JSON document just containing creator and created? Or is it something else?
Install Fedizen
Get the full app experience
Hey, #Mastodon and #ActivityPub developers.
How much skew do you allow before rejecting a message?
I've just received something where the header is signed:
Mon, 31 Aug 2026 20:09:54 GMT
But the ActivityPub message was published:
Mon, 31 Aug 2026 19:58:36 GMT
That's a little over 10 minutes. Is that too much? Should I not care as long as the signature validates?