From 656b9750d0ef0ef23721c468e88655354948067e Mon Sep 17 00:00:00 2001 From: cjslep Date: Mon, 14 Dec 2020 08:30:06 +0100 Subject: [PATCH 1/4] Add Smithereen as a server side NodeInfo implementer --- feps/fep-f1d5.md | 1 + 1 file changed, 1 insertion(+) diff --git a/feps/fep-f1d5.md b/feps/fep-f1d5.md index 0da7af4..eb34afd 100644 --- a/feps/fep-f1d5.md +++ b/feps/fep-f1d5.md @@ -83,6 +83,7 @@ This list is not comprehensive: * PixelFed * Misskey * Funkwhale +* Smithereen * Plume * GNU Social * lemmy From f45c73b8b601ac080c63ca6fc6a711f5719fc43c Mon Sep 17 00:00:00 2001 From: cjslep Date: Mon, 14 Dec 2020 08:45:33 +0100 Subject: [PATCH 2/4] Clarify alternatives are illustrative, not prescriptive --- feps/fep-f1d5.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/feps/fep-f1d5.md b/feps/fep-f1d5.md index eb34afd..854db58 100644 --- a/feps/fep-f1d5.md +++ b/feps/fep-f1d5.md @@ -41,7 +41,9 @@ Fediverse software SHOULD implement NodeInfo [NodeInfoRepository]. ## Caveats At the time of this FEP's writing, the current objections to the current state -of NodeInfo that have been identified by the community are: +of NodeInfo that have been identified by the community are below. Note that any +technical alternatives identified are meant to be illustrative and not +prescriptive: * The `software.name` regex is unnecessarily strict. For example, no uppercase letters, no spaces, no non-English-alphabet, and no special characters besides From 6cf1310052c3c2f8c4bc4c7a0f82b1de077e550b Mon Sep 17 00:00:00 2001 From: cjslep Date: Mon, 14 Dec 2020 08:56:57 +0100 Subject: [PATCH 3/4] Additional usage.users feedback Mike provided the insight that NodeInfo ties user identity to a single specific instance for the purposes of total user counts and user activity. --- feps/fep-f1d5.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/feps/fep-f1d5.md b/feps/fep-f1d5.md index 854db58..fe31d81 100644 --- a/feps/fep-f1d5.md +++ b/feps/fep-f1d5.md @@ -56,9 +56,20 @@ prescriptive: * Lacks an extendable method for identifying and versioning other features, such as HTTP Signatures, webfinger, or OAuth. Whereas the specification is very strict, the `metadata` is too lax. -* The `users.usage` is not denormalized, such that implementations can provide +* The `usage.users` is not denormalized, such that implementations can provide custom pairs of `(activity counts, time period in days)` that make sense for the software. +* The `usage.users` assumes that user identity is tied to a specific instance of + running software. It is unclear how to count `total` users when user identity + is: spread across multiple servers, spread across multiple groups, or present + within multiple collections of users. Multiple software instances could each + have a resonable claim to counting the user as "using" their software, which + globally results users being counted more than once. +* The `usage.users` activity counts likewise assume that user identity is tied + to a specific instance of running software. For the same reasons above, where + the `total` user counts may result in duplicate counts of the same user across + all software running, the activity counts `activeHalfYear` and `activeMonth` + may also result in a globally inflated count. * The `activeHalfyear` and `activeMonth` are ill-named properties for describing the time periods of 180 days and 30 days, respectively. A "half of one year" is 180 days 0% of the time and roughly 182.5 days only 75% of the time. A From d634a88e5146b1a22745cc6a13aa54b96f8b82f7 Mon Sep 17 00:00:00 2001 From: cjslep Date: Mon, 14 Dec 2020 20:57:00 +0100 Subject: [PATCH 4/4] Add caveat for `software.version` Mike pointed out that forcibly divulging `software.version` data is potentially a security issue. I am not quite sure I completely understand, but since he feels stronger about it than I, I want to be sure to include it. --- feps/fep-f1d5.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/feps/fep-f1d5.md b/feps/fep-f1d5.md index fe31d81..1b09a88 100644 --- a/feps/fep-f1d5.md +++ b/feps/fep-f1d5.md @@ -48,6 +48,9 @@ prescriptive: * The `software.name` regex is unnecessarily strict. For example, no uppercase letters, no spaces, no non-English-alphabet, and no special characters besides hyphen are permitted. +* The `software.version` field is required, which is unnecessarily strict. + Forcibly requiring software to divulge version information is potentially a + security issue. * The `inbound` and `outbound` elements are specified as a closed set of enums instead of a simple string. Protocol versioning manifests as renaming, having to add a new enum, which results in unclear version management.