@GavinChait @benpate @ramsey

1. Someone offers me an endorsement (Ben likes tea)
2. I accept, because tea is dandy
3. They change the endorsement (Ben likes coffee)
4. Coffee is disgusting. I’m deeply embarrassed.

The current protocol does not protect against this. I’d thought no cryptography would be needed, but now I’m convinced that endorsements MUST be signed in some way.

Object Identity Proofs, anyone?

@julian

@GavinChait @benpate @tchambers

And, you sold me on this, too.

My original idea was to define a protocol, then hand wave at the various uses.

The community interest has been awesome, and (rightfully) focused on the human-cale uses of this kind of thing.

Its most important for me that we lock down abuse vectors before they happen. But everything else really SHOULD be left up to implementors.

YOU should choose what you believe online — that shouldn’t be up to the protocol.

@julian @evan

But, I’d expect a proper LOLA data migration would move endorsements as easily as any other records. Encryption keys may be a complicating factor, but that’s something to hash out on Codeberg.

@ramsey @scottjenson @GavinChait @tchambers

But need is clear. Follows and likes aren't enough. This is a public connection *between* two people. That is its difference. It's power comes from the "rel=me" aspect of both people agreeing. That appears powerful. It is a stronger signal to to build a web of trust, feels decentralized, durable, and seemingly unspoofable (I hope?).

But we really do have to keep it simple. Maybe we call it something else? But I'm hearing the concern that you feel it's not actually that valuable? Do I have that right?

These levels can mean different things to different people, and how you vet also differs, but ultimately, you’re trying to say, “I trust (to some low/med/hi degree) this is Alice.”

Is the goal with this proposal to establish a trust system?

@benpate @ramsey @tchambers

Hopefully, if someone’s endorsements are for sale, this might be visible in the rest of their behavior, and we could simply not trust their endorsements.

@ramsey @tchambers @scottjenson

IndieWeb uses “Vouch” for a loosely-related anti-spam object.

BadgeFed uses “Badges” (obviously)

I’m trying to avoid collisions with “Like” because we’re already using that on the Fediverse.

What else: Recommend? Certify? Approval? Relationship?

Names are hard, but important. So I’d love to get this right.

@ramsey @tchambers @scottjenson

I think “endorsement” isn’t a good term for this, since it lends itself to something others want to receive or acquire for cred.

If I'm selling a book I wrote and someone else tries to sell the same book, my timestamped attestation with signature is an authentic claim to prior rights. From a fedi perspective, we can send a takedown `Flag` and the site hosting the duplicate should honour that, or be defederated.

My use-case is very specific. Each person takes responsibility for a decision they make. All their decisions can be reviewed. Each attestation serves a purpose in commercial probity.