elle

@davidrevoy sending all the love 💜

your work is awesome, and I thoroughly enjoy the fact that you use FOSS to create it.

stay up, internet stranger 💪 🖤 ✊

@silverpill absolutely, E2EE is still WIP. I don't think MLS is so complicated that no one can implement it. in a lot of cases, implementers shouldn't have to touch the low-level MLS implementation. OpenMLS exists for Rust, and ts-mls exists for TS/JS. the OpenMLS can be wrapped by anything that can talk to a C FFI. at least how I understand the Embassy/Bonfire impls, they are using those MLS primitives to build up the protocol.

@silverpill that's interesting information I wasn't privvy to, thanks for changing that.

no, I don't see many fedi devs there, outside of Embassy + Bonfire folks. I'm also not a fan of the use of GitHub, and brought up moving to an alternative git forge. we reached a middle-ground of linking to discussions on activitypub.space, but I still don't like the continued presence of FOSS on a platform like GitHub that is actively hostile to its existence.

@silverpill @benpate yeah, fwiw they are the main standards body, though. i know you know that, just saying that there is value in trying to work together with them, since w/e protocol they land on will likely be adopted by Mastodon, and thus a very significant portion of the fediverse.

not saying an independent alternative impl is valueless, i'm serious about working on it, only that we're still at a stage in fedi-e2ee dev to meaningfully influence the protocol in a positive direction

@silverpill I agree MLS is complicated, however it's the best standard for doing E2EE, and it's been vetted by a number of trustworthy professional cryptographers. whatever alternative is chosen would need to meet at least that level of scrutiny. also, if we want to be interoperable with what SWICG is working on, it would need to be MLS based, as that's what they've chosen.

if going in a totally different direction, I'd be interested to hear what you have in mind

@silverpill yeah, that staging process is definitely more bureaucratic and formal than "write a FEP, implement it, respond to feedback". but plenty of non-corpo entities have a similar level of bureaucracy, especially in the standards space. idk, am relatively new to the space, so if there is some history or context I'm missing, I'm open to new info.

I'm also down to work together with you on writing an FEP together, and/or writing up some of my ideas about how an MLS-based protocol could work

@silverpill @mkljczk I can't load that for some reason... it redirects me to this link: https://pl.fediverse.pl/@/posts/AmWtsGl9UNnu7VAzqq

@silverpill @mkljczk minutes are posted to this repo: https://github.com/swicg/meetings

I think the ones from today will be posted in the near future. basically, @benpate + @mayel discussed their impls + doing a demo. all of us discussed metadata leakage mitigations + alternatives for the AP actor that will be the MLS auth service (AS). plus some meta conversations about using alt spaces to GitHub like activitypub.space to host spec discussion

fwiw, I like the idea of using FEP process to dev e2ee

@silverpill understandable. fwiw the gate is pretty easy to open, but does require signing a CLA.

how else do you suggest we develop an E2EE protocol for the fediverse? you mention in your FEP that you are giving up on it for a proper E2EE impl. genuinely asking b/c I'm interested in getting E2EE, hopefully interoperable with widest number of clients possible.

also, what do you mean by corporate takeover?

@silverpill nice! there is a workgroup meeting tomorrow for activitypub-e2ee, are you planning to be there?

https://www.w3.org/events/meetings/ad4d3e0b-e227-4119-acdc-9943a2b19f70/20260728T150000/