@37e938b2 paging @f23362a3 on this one! 

 @52c96f46 what about adding some sort of "confidence score"? 

 @6b43cb18 no, not at all. Mastodon gGmbH only has Eugen & Claire working on mastodon/mastodon, then there's an SRE or two on mastodon.social and mastodon.online (there's also mods of course)

I know this, because I applied to be the third engineer on the team to work full-time on mastodon/mastodon, unfortunately it fell through.

The numbers I gave account for MUAs for all servers running Mastodon. Point is, even at $1/yr each, we'd have that money. 

 @6b43cb18 I mean, it doesn't need to be 60 people, but like, just scaling Mastodon from 2 full time engineers on core to 5. That's like.. €500k/year. Maybe a bit more or less (given "good" European salaries, and taxes / insurance)

Given there's 1.3 million MAU that should be easy to reach. 

 @6b43cb18 well, the way I see it is that we're going to have to get comfortable with asking for money & investing it into the types of platforms and tools we want to use 

 @6b43cb18 that's what I'm meaning. Imagine if the funding for that existed. Even if it was just for 6 months to 2 years. 

 @59c6c59c it's all available via the solid project website, it's one of the official specs but got superseded by solid-oidc, but I know TimBL still believes in it because OIDC annoys him 

 @59c6c59c I guess what I'm getting at is: key management and security is difficult, particularly distributed, and requires sneakernet verification often. So if you just blindly trust that a key mentioned in the Actor object is authentic, then that's the flaw in your security, because you service also doesn't want to be checking the origin's Actor object for every activity or federations-request, so would need to cache known keys, which would mean a single mitm would poison the key cache 

 @59c6c59c I think you may be searching for solid with solid-tls for auth 

 @59c6c59c well, in your system if te actor wasn't signed, I could mitm a server, add a new key to a copy of your actor object, and suddenly get that new key federated out. 

 @59c6c59c Mastodon & fedi software only deals with any of those fpr their webapps and extensibility use cases, not for federation 

 @59c6c59c how can you add it to your actor object if you actor object is sogned with the previous key? 

 @59c6c59c problem with that is securely storing the private keys. 

 @59c6c59c hmm, maybe that's fine then! 

 @59c6c59c I'm pretty sure that host may be spoofable.. 

 @59c6c59c streaming isn't always more efficient 😇