Conversation
Lucy 
MOVED
methyltheobromine
imagine instance A posts something, it federates to instance B, but the post hasn't reached instance C. let's say B is a malicious actor, so B will send a post to C with the same ID as the previous post. B does that with every incoming post. C wouldn't be able to tell what posts are legit, and multiple posts can't have the same id.
what would happen? what am I missing? AP can't be THAT broken, right?
what would happen? what am I missing? AP can't be THAT broken, right?
6
3
5
Lucy MOVED
methyltheobromine
@Arcana posts simply have uuids and the id doesn't contain any information about who created it. this could be simply solved by concatenation an arbitrary id with the instance's domain for example. but that wouldn't work because existing AP implementations wouldn't know how to handle that. (could be implemented as an extension as a secondary id that can be verified and whoever doesn't implement it would die in a fire)
0
0
1
Lucy MOVED
methyltheobromine
@Johann150 but IDs don't contain that info. B doesn't post in the name of A, B's post just has the same uuid. (which doesn't contain info about who created it or the post identified by it)
1
0
0
Lucy MOVED
methyltheobromine
@lanodan this id is what then? I just fetched the last post on /api/v1/timeslines/public of our instance
1
0
0
Lucy MOVED
methyltheobromine
1
0
0
Lucy MOVED
methyltheobromine
@Johann150 true I just assumed why would it use different ids? lot's of confusion
1
0
0