First question and I'm already challenging it: strictu sensu, there is no private messaging in AP and as:to and as:cc *are not* related to private messaging.
@raphael It depends on how "private" is defined (direct non-public communication vs EEE or something else). I've updating the wording a bit to hopefully make it less ambiguous.
Let's say that my actor creates a message that the audience is one specific object, but I place it on my outbox and is visible to anyone who GETs into the collection and the object.
This is perfectly valid according to AP, the message is not *meant* for the public, but is still *accessible*.
@raphael Although it's frustrating how vague it is, the spec does state that outbox contents are "subject to the ability of the requestor to retrieve the activity (that is, the contents of the outbox are filtered by the permissions of the person reading it)". Most implementations (AFAIK) will not provide direct/private messages to an unauthorized user via the outbox. However, it would be difficult to argue that allowing it is conformant. 🤷♂️
I think that the reason the spec is vague is *precisely* to avoid defining at the protocol level something that can be up to the application. If the *application* wants to treat a message with a single object in the audience as "private", then it is free to do so, but AFAIK the audience field does not establish any type of *permission* to access the resource.
@raphael *Everything* in ActivityPub could have been defined as application-specific behaviors. I think one purpose of the AP specification was to provide a standard framework for implementing interoperable federated servers. My opinion is that leaving authorization behaviors vague has not been a benefit to AP developers nor the user community. I understand you may disagree.
Raphael Lullis
in reply to Steve Bate • • •Steve Bate
in reply to Raphael Lullis • • •Raphael Lullis
in reply to Steve Bate • • •It's not even a matter of encryption.
Let's say that my actor creates a message that the audience is one specific object, but I place it on my outbox and is visible to anyone who GETs into the collection and the object.
This is perfectly valid according to AP, the message is not *meant* for the public, but is still *accessible*.
Steve Bate
in reply to Raphael Lullis • • •Raphael Lullis
in reply to Steve Bate • • •Steve Bate
in reply to Raphael Lullis • • •julian
in reply to Steve Bate • • •Re: Just for fun...