Sometimes I learn things about #ActivityPub and wonder “what the hell were they smoking?” https://cyberplace.social/@GossiTheDog/114058565002752078
@jwildeboer lol, thankfully that's not a protocol thing.
@mariusor@metalhead.club @jwildeboer@social.wildeboer.net this is mildly concerning, but is no different from an http server serving different websites for different clients.
Were they smoking things when designing http? Probably, but that's tangential
@julian maybe I misunderstood the post from LivingCooki, but I really don't think that HTTP has that kind of string interpolation anywhere in its protocol.
@jwildeboer@social.wildeboer.net actually while I'm at it, "http servers serving different things based on who's requesting it" is a foundational element of the web.
The fact that you are a "logged in" version of your app is proof of that.
@jwildeboer I mean, basically just an instance modified to serve different content based on who is asking?
That's a fun hack, but is it #ActivityPub related?
I think it's just important to be aware of it - in theory, the fediverse *you* see may be different from the one someone else gets if there's a malicious actor involved.
@larsmb @jwildeboer Does it really work? I've just tried $INSTANCE$host$ and I see the variables, no expansion.
Also when visiting https://void.rehab/notes/a4fh6wx4mlfrinaz there is no expansion.
Seems like a bug in a certain ActivityPub implementation, not in ActivityPub itself.
@taschenorakel It's a specific change they've implemented.
It doesn't work generally.
And they only activate it when pulled via ActivityPub (e.g., via your instance, not when you fetch it via the browser directly).