ActivityPub Won by Being Boring

ActivityPub 的胜出之道：平庸的力量

At FediForum 2026, Evan Prodromou gave a talk with the kind of title only a protocol co-author can get away with: “How To Bullshit Your Way Through a Conversation about ActivityPub.” The joke worked because the speaker had no need to bluff. Prodromou is one of the five authors listed on the W3C ActivityPub Recommendation and the author of O’Reilly’s ActivityPub book. The self-deprecating frame covered an honest architecture talk about why the Fediverse works at all. 在 2026 年的 FediForum 大会上，Evan Prodromou 发表了一场演讲，其标题只有协议的共同作者才敢使用：“如何通过胡扯来完成一场关于 ActivityPub 的对话”。这个笑话之所以成立，是因为演讲者根本无需虚张声势。Prodromou 是 W3C ActivityPub 推荐标准列出的五位作者之一，也是 O’Reilly 出版社 ActivityPub 相关书籍的作者。这种自嘲式的开场背后，是一场关于联邦宇宙（Fediverse）为何能够运作的诚恳架构探讨。

His running gag was that every term could be treated as a portmanteau. Fediverse is federated plus universe. ActivityPub is activity plus publishing. RESTful, in his groaner version, is rest plus full. Fine. Protocol people deserve hobbies too. Behind the jokes was a serious claim: ActivityPub works because its core is intentionally ordinary. It is impressive in the way a good loading dock is impressive. Trucks arrive. Boxes move. Nobody writes a poem about the forklift. 他贯穿全场的梗是：每一个术语都可以被看作是一个合成词。Fediverse 是“联邦（federated）”加“宇宙（universe）”；ActivityPub 是“活动（activity）”加“发布（publishing）”；而他那个让人冷汗直流的解释是：RESTful 是“休息（rest）”加“充满（full）”。好吧，搞协议的人也需要点业余爱好。在这些玩笑背后是一个严肃的论点：ActivityPub 之所以有效，是因为其核心是刻意保持平庸的。它的出色之处就像一个优秀的装卸码头：卡车抵达，箱子搬运，没人会为叉车写诗。

Any competent Web engineer from the mid-2010s could look at ActivityPub and think, yes, this is roughly how I would have done it. If you want the primer before the argument, start with What Is ActivityPub?. This piece is about why those familiar parts mattered. 任何 2010 年代中期的合格 Web 工程师看到 ActivityPub 时，都会觉得：“没错，这大概就是我会采用的做法。”如果你在深入探讨前需要入门知识，可以先阅读《什么是 ActivityPub？》。而本文将探讨这些熟悉的组件为何如此重要。

The protocol part is deliberately dull. Federation starts with a modest agreement. Independent networks agree to exchange activity data. They do not agree on a database, a moderation model, an admission policy, a user interface, a ranking system, or a product category. That minimum agreement is the important part. Mastodon, PeerTube, Lemmy, WriteFreely, Pixelfed, WordPress, and small single-user servers keep their own shape. It is why our Mastodon service on C.IM, PeerTube service on P.LU, and Lemmy service on R.NF can share a social graph without becoming one product. 协议部分是刻意枯燥的。联邦始于一个简单的共识：独立的网络同意交换活动数据。它们并不统一数据库、审核模型、准入策略、用户界面、排名系统或产品类别。这种最低限度的共识才是关键所在。Mastodon、PeerTube、Lemmy、WriteFreely、Pixelfed、WordPress 以及小型单用户服务器都保持着各自的形态。这就是为什么我们在 C.IM 上的 Mastodon 服务、P.LU 上的 PeerTube 服务和 R.NF 上的 Lemmy 服务可以在不合并成单一产品的情况下，共享同一个社交图谱。

The ActivityPub specification describes two layers: a client-to-server API and a server-to-server federation protocol. In practice, the server-to-server part is where most Fediverse operators feel the machinery. Actors have inboxes and outboxes. Servers deliver activities to remote inboxes. Other servers fetch actor documents, objects, and collections by URL. The model is almost aggressively plain. An activity is a sentence: subject, verb, object. Alice liked the article. Bob followed Alice. A server created a note. Someone announced a post. ActivityPub 规范描述了两个层级：客户端到服务器的 API 和服务器到服务器的联邦协议。在实践中，服务器到服务器的部分是大多数联邦宇宙运营者最能感受到其运作机制的地方。参与者（Actors）拥有收件箱和发件箱。服务器将活动投递到远程收件箱。其他服务器通过 URL 获取参与者文档、对象和集合。这个模型极其朴素。一个活动就是一个句子：主语、谓语、宾语。Alice 喜欢了这篇文章；Bob 关注了 Alice；服务器创建了一条笔记；某人转发了一篇帖子。

The thing crossing the wire is often the sentence about the content, not merely the content itself. That distinction makes ActivityPub social. A content-sync protocol can move articles and images. A social protocol also has to move reactions, follows, blocks, shares, undo operations, and the context that makes those actions meaningful. 在网络上传输的往往是关于内容的描述，而不仅仅是内容本身。这种区别使 ActivityPub 具备了社交属性。内容同步协议可以传输文章和图片，但社交协议还必须传输反应、关注、屏蔽、分享、撤销操作，以及赋予这些动作意义的上下文。

Prodromou’s funniest historical aside was that the activity concept traces back to 1930s Soviet activity theory, associated with psychologist Alexei Leontiev, and then wandered through user-experience research before landing in Activity Streams. The Fediverse running on repurposed Marxist psychology sounds like satire written by committee. Protocol concepts rarely arrive cleanly from first principles; they get dragged in from wherever the previous generation left useful tools. Prodromou 最有趣的题外话是，活动（activity）这一概念可以追溯到 20 世纪 30 年代的苏联活动理论（与心理学家 Alexei Leontiev 相关），随后在用户体验研究中流转，最终落脚于 Activity Streams。联邦宇宙运行在经过改造的马克思主义心理学之上，听起来就像委员会写出的讽刺作品。协议概念很少能从第一性原理中纯粹地诞生；它们往往是从前人留下有用工具的地方被“拖”过来的。

The transport is even less exotic. ActivityPub uses HTTP. Fetch an actor’s URL to learn about the actor. POST an activity to an inbox to deliver it. The spec’s overview says the quiet part directly: inboxes and outboxes are URLs, and federation usually happens by servers posting messages to other servers’ inboxes. Even the familiar user@domain handle is not fundamental to ActivityPub. It comes through WebFinger, a modernization of older Internet identity lookup habits. The protocol needs identifiers. Humans like handles because @[email protected] fits in a search box better than a full actor URL. This is why ActivityPub spread. JSON-ish objects, HTTP GET, HTTP POST, URLs, collections, actors, inboxes, outboxes. None of this is dazzling. Boring is implementable. 传输层则更加平庸。ActivityPub 使用 HTTP。获取参与者的 URL 以了解该参与者；向收件箱 POST 一个活动以进行投递。规范概述直接道出了核心：收件箱和发件箱就是 URL，联邦通常是通过服务器向其他服务器的收件箱发送消息来实现的。甚至连我们熟悉的 user@domain 句柄也不是 ActivityPub 的基础，它是通过 WebFinger 实现的，这是对旧式互联网身份查找习惯的现代化改造。协议需要标识符，而人类喜欢句柄，因为 @[email protected] 比完整的参与者 URL 更适合放入搜索框。这就是 ActivityPub 能够传播的原因。类 JSON 对象、HTTP GET、HTTP POST、URL、集合、参与者、收件箱、发件箱——这些都不炫目。枯燥，意味着易于实现。

The technical debt is less charming. Boring protocols still accumulate weird debt. ActivityPub has a good example sitting in authentication. The Fediverse commonly uses HTTP Signatures for server-to-server request authentication. The awkward part is which HTTP Signatures. The deployed Fediverse grew around the older draft-cavage-http-signatures-12, an Internet-Draft that is now expired and archived. The IETF work later produced RFC 9421, HTTP Message Signatures, published in February 2024, with a different design. Minimum-consensus evolution looks like this in practice: a draft is useful enough, implementers ship, the network grows, and the official standard arrives later with a different shape. Nobody can fix that by saying “the spec says” loudly at a server log. 技术债务则没那么迷人。枯燥的协议依然会积累奇怪的债务。ActivityPub 在身份验证方面就是一个很好的例子。联邦宇宙通常使用 HTTP 签名（HTTP Signatures）进行服务器间的请求验证。尴尬的是，到底该用哪种 HTTP 签名？现有的联邦宇宙是围绕较旧的 draft-cavage-http-signatures-12 发展起来的，这是一份现已过期并归档的互联网草案。IETF 后来发布了 RFC 9421（HTTP 消息签名），发布于 2024 年 2 月，但设计完全不同。在实践中，最低共识的演进就是这样：草案足够好用，开发者就直接部署，网络随之增长，而官方标准姗姗来迟且形态各异。没人能通过对着服务器日志大喊“规范上是这么说的”来解决这个问题。

Security has another blunt edge. ActivityPub has addressing. A to field can say which actor or collection an activity is intended for. Servers can deliver only to addressed recipients, and they can check authorization when someone fetches a private object. The ActivityPub spec explicitly allows servers to require authorization and return 403 or 404 when a request should not see a target object. That gives the Fediverse an access-control model. It does not give it end-to-end encryption. Content usually sits in cleartext on the instance that hosts it. Admins with database or filesystem access can read what their server stores. Backups, object storage, logs, full-text indexes, and search pipelines can widen the practical trust surface if an operator is careless. For instance admins and self-hosters, this is the operational truth worth writing on the wall: the instance is the trust boundary. Running your own server can shrink that boundary to infrastructure you control. Choosing someone else’s server means choosing an operator, their security practices, their backup habits, their incident response, and their judgment. That is the direct consequence of a federated publishing system without built-in end-to-end encryption. 安全性则是另一个尖锐的问题。ActivityPub 具有寻址功能，“to”字段可以指定活动的目标参与者或集合。服务器只能投递给指定的接收者，并且可以在有人获取私有对象时检查授权。ActivityPub 规范明确允许服务器要求授权，并在请求不应查看目标对象时返回 403 或 404。这为联邦宇宙提供了一个访问控制模型，但它并没有提供端到端加密。内容通常以明文形式存储在托管它的实例上。拥有数据库或文件系统访问权限的管理员可以读取服务器存储的所有内容。如果运营者粗心大意，备份、对象存储、日志、全文索引和搜索管道可能会扩大实际的信任风险面。对于实例管理员和自托管用户来说，这是一个值得铭记的运营真理：实例就是信任边界。运行自己的服务器可以将该边界缩小到你所控制的基础设施内。选择他人的服务器，意味着选择了一位运营者，以及他们的安全实践、备份习惯、事件响应能力和判断力。这就是一个没有内置端到端加密的联邦发布系统的直接后果。