it would be cool if this toot reached a lot of different fediverse implementations (boosts welcome)
@Thib are you doing fedicrimes
@dashie no, it's exceedingly lawful here 😩
i just rewrote the HTTP Sigs verifier, checking that it still works and checking whether we could safely enforce stricter settings now without breaking compatibility with older stuff
observations so far:
- some hubzilla instances have a system account and sign requests with it but do not serve an ActivityPub object for it
- some Mastodon instances do not render their instance actor for some reason