Lemmy does not seem to include any kind of authentication on the user level (such as a user keypair and signatures using that on their posts and comments client-side) so allowing one user from a remote instance would at least trust the owner of that instance to not impersonate the user who is allowed to post.
In fact, how does ActivityPub in the threadiverse even ensure that the instance is who they say they are? The W3C document on it seems to indicate that there is no standardized way to authenticate servers to other servers yet.
That’s a good point about the user authentication, but I’m not quite sure we’d need it quite yet to reduce spam in this way. It is absolutely something to keep in mind though.
I think the other instances allowing federation in the first place grants “I trust the owner to not impersonate users” part of the chain. In Reddit there’s that trust too, the whole “I trust the admins to NOT edit my comments silently at the database level”…
Lemmy does not seem to include any kind of authentication on the user level (such as a user keypair and signatures using that on their posts and comments client-side) so allowing one user from a remote instance would at least trust the owner of that instance to not impersonate the user who is allowed to post.
In fact, how does ActivityPub in the threadiverse even ensure that the instance is who they say they are? The W3C document on it seems to indicate that there is no standardized way to authenticate servers to other servers yet.
That’s a good point about the user authentication, but I’m not quite sure we’d need it quite yet to reduce spam in this way. It is absolutely something to keep in mind though.
I think the other instances allowing federation in the first place grants “I trust the owner to not impersonate users” part of the chain. In Reddit there’s that trust too, the whole “I trust the admins to NOT edit my comments silently at the database level”…