Everyone: see what you think:
The Seven Deadly #Fediverse UX Sins Part 2: The Road To Redemption: https://www.timothychambers.net/2025/06/24/the-seven-deadly-fediverse-ux.html
Don't claim that these are final answers - but hope they help continue constructive motion to final answers!
cc: @renchap @dansup
@cheeaun @scottjenson @newsmast @andypiper @ricmac @evan @laurenshof @pfefferle @fediversenews #fedidev #mastodev @timbray
Thanks Tim. Fantastic article! I’ll have more to say after I re-read this a dozen times, but I want to get out early with an answer to #3: remote actions…
This is why I built fep-3b86 “Activity Intents” which lets people take remote actions from their home server with one click and zero fuss. No JS, no funny protocols required.
Could you please weigh in on this?
@tchambers @renchap @dansup @cheeaun @scottjenson @newsmast @andypiper @ricmac @evan @laurenshof @pfefferle @fediversenews @timbray
@benpate - can you post a link to that #FEP here? Is this it: https://codeberg.org/fediverse/fep/src/branch/main/fep/3b86/fep-3b86.md
I understand wanting to bundle things into AP. Let’s fix the core and not abandon it, right?
But the use case here isn’t in ActivityPub. It happens when I’m visiting a website OUTSIDE of my home server. It’s how we see 90% of the internet.
So building this feature into AS doesn’t make sense.
These interactions need to tie more deeply into Fediverse servers in the same way that the FB “like” button does. That’s what FEP-3b86 does.
@benpate @rakoo @tchambers I agree 1,000% with this, put it in the servers.
If I Like something on a web site, and that web site has previously stored my preferred handle, just like it. Don't offer me an account picker, don't show me a page, just Like it.
If AP server B on platform C knows my webfinger, send it to My Home Server A and just. do. it.
Eventually this will be a Thing on non-AP web sites (and maybe in the browser), but we should focus on the main AP platforms for now.
@benpate @rakoo @tchambers (or, show me an account picker every time even if you already know one account for me, until I say "Do not show me an account picker again")
I struggled with the UX on this, b/c Emissary lets you identify multiple accounts at once, but I like where I ended up:
1) IF 1 account, just open your home server's "like" page. (needed b/c we're not authenticated on the remote server, it's just a username)
2) IF >1 account, show that damned account picker (but you brought it on yourself)
3) Always show a little link that says... "As ﹫foo and ﹫bar
We can wiggle the specifics, but the general flow is very smooth
@benpate @rakoo @tchambers can I not get a onetime OAuth flow giving me a forever token (or a long lived token that refreshes if I revisit before expiry) like various third party clients do? I open Phanpy, I'm authenticated and authorised, no?
I would love to have this. I think @j12t mentioned something like this in another thread.
It will require A LOT more work from both ends of the interaction support this. The home server and remote server would both need to implement C2S and OAuth.
This feels like one of those chicken-and-egg problems where nobody wants to support it because nobody supports it.
I'd say: start with Activity Intents b/c everyone can support iteasily, then we add this C2S API as step 2.
@benpate @jaz @rakoo @tchambers We need a roadmap for the entire network, not just individual servers, and some consensus around it. Then "everybody" can implement it "simultaneously".
Agree: there is more functionality needed for the open social web than AP.
Coming back to add: OAuth tokens would also be giving A LOT of power to that remote server, to share, like, follow, and block tons of things in your behalf.
I might not want to give that power to many sites.
@benpate @jaz @rakoo @tchambers there are ways to do that fairly safely, e.g., using DPoP request signing, which largely prevents token thefts
@thisismissem @benpate @jaz @rakoo @tchambers as a non techy person, I would super like to be able to interact with stuff across fedi from an account I choose (most likely this one). I don't really want to have to deal with extra pop ups and choosing which account. I'd prefer to just say "this is my main account" and then it just work to do everything from that (with the option to add/change accounts for folks who want).
@alexisbushnell @benpate @jaz @rakoo @tchambers unfortunately that's not possible automatically with FedCM and similar due to security and privacy reasons.
@jaz @benpate @rakoo @tchambers that "sign in and post from anywhere" is possible, via OAuth, FedCM and DPoP (it's a security mechanism) — this is something that's being worked towards on the OAuth front by me in Mastodon, but it's a slow grind on this work and getting it right.