Hey, i'm a software developer and i'm considering trying to build a site using ActivityPub, but i have a few concerns about it.
My first concern is that if the platform is open source someone can host a malicious version of it, where certain requests may be ignored (such as deletion).
This leads into my next concern which is GDPR, because now i can't be certain that a users data gets deleted upon their request and i'm not certain whether i would be liable since my instance federates with the malicious instance (which may also not be hosted in the EU which is itself problematic, and even if i'm not liable it's still not great).
I considered if it was viable to make the platform invite based somehow, so that it doesn't federate with everything by default, but that also sort of defeats the purpose of using ActivityPub.
The loss of control over content is also something that i don't particularly like, since some people may use their own instance for harassment or something else gross, but i guess that wouldn't be my problem since i just wrote the code and wouldn't have anything to do with the hosting of such sites.
i'd appreciate any feedback since i think the technology and the fediverse is very interesting, i would definitely like to try it out, but i'm not sure how to go about these challenges.
ActivityPub is a standard, Lemmy, KBin & Mastodon are open source applications built on the standard. It's the same relationship as Hypertext Transfer Protocol (HTTP) and Chrome, Safari, Firefox, Apache & IIS.
As a client/server architecture, Lemmy is no more or less vulnerable to malicious actors than a web browser or a web server. You're at least as likely to have a rogue admin mishandle data as someone build Evil-Lemmy. While I consider myself a good netizen, if you delete this post right now I'm still going to have a copy for at least six months because that's my current backup retention for this instance.
I'm no GDPR expert but I can't see how an instance owner who does comply with GDPR can be punished for instances they don't control not deleting federated data. There are ongoing conversations throughout the Fediverse on this topic.