@osma @benpate @scottjenson
And here, `hop:authorisedBy` points at Mara's own `editor` attestation, issued by an admin, whose `admin` attestation came from the instance actor, whose authority is declared in nodeinfo. Four fetches, and a verifier knows who vouched for what, under whose authority.

My use-case is very specific. Each person takes responsibility for a decision they make. All their decisions can be reviewed. Each attestation serves a purpose in commercial probity.

@osma @benpate @scottjenson There's also something else that emerges from this, and that's authenticity.

If I'm selling a book I wrote and someone else tries to sell the same book, my timestamped attestation with signature is an authentic claim to prior rights. From a fedi perspective, we can send a takedown `Flag` and the site hosting the duplicate should honour that, or be defederated.

I'm certain a lot of analysis exists to describe the language needed to convey first-party claims, second-party attestations and third-party endorsements. Not so intimately familiar with the topic I could immediately refer (endorse) a good source for it though..
@GavinChait @benpate @scottjenson

@osma @benpate @scottjenson sure, I'd appreciate that.

@tchambers @benpate @scottjenson I can imagine folks trying to buy endorsements.

I think “endorsement” isn’t a good term for this, since it lends itself to something others want to receive or acquire for cred.

@benpate I am very interested in this, I can see this being very useful for Loops and Pixelfed!

@dansup Awesome.. just one more thing to hash out over beers

What would work better?

IndieWeb uses “Vouch” for a loosely-related anti-spam object.

BadgeFed uses “Badges” (obviously)

I’m trying to avoid collisions with “Like” because we’re already using that on the Fediverse.

What else: Recommend? Certify? Approval? Relationship?

Names are hard, but important. So I’d love to get this right.

@ramsey @tchambers @scottjenson

There’s a lot we can model from the real world, here.

Hopefully, if someone’s endorsements are for sale, this might be visible in the rest of their behavior, and we could simply not trust their endorsements.

@ramsey @tchambers @scottjenson

@benpate @ramsey @tchambers We're a little stuck here because as we've discussed in a previous thread, follows is not a strong enough signal. We want something that is intentional, something like "A vouches for B." I"m not saying this is better then endorses, just that by the very nature of this stronger signal, it will *always* have value. I'm not sure we can get around that.

@scottjenson my question is "A vouches for what for B?" If it's just an endorsement in general, then it's equivalent to a like on a post. But a post is usually about something. And if an endorsement is for something specific, then who decides? LinkedIn has their version, which is for a list of terms. Derive common hashtags for that person & vouch for that?

@benpate @ramsey @tchambers

@tchambers @benpate @scottjenson “vouch” or “vet” might work.

@GavinChait @scottjenson @benpate @tchambers That’s what I’m trying to understand, too. In PGP, the concept of vetting often involves meeting and looking at IDs or equivalent to check identities, and you sign their key with yours and set a trust level.

These levels can mean different things to different people, and how you vet also differs, but ultimately, you’re trying to say, “I trust (to some low/med/hi degree) this is Alice.”

Is the goal with this proposal to establish a trust system?

@ramsey @GavinChait @benpate @tchambers
I agree with your concerns. This is what I meant by the complexity issue in a previous thread. It *is* YAF (yet another feature) and if we're not careful, people just a) won't get it or b) not be bothered.

But need is clear. Follows and likes aren't enough. This is a public connection *between* two people. That is its difference. It's power comes from the "rel=me" aspect of both people agreeing. That appears powerful. It is a stronger signal to to build a web of trust, feels decentralized, durable, and seemingly unspoofable (I hope?).

But we really do have to keep it simple. Maybe we call it something else? But I'm hearing the concern that you feel it's not actually that valuable? Do I have that right?

There’s enough issues here that Mastodon is starting to break down as a communication tool. We may need to move this over to code edge issues soon.

But, I’d expect a proper LOLA data migration would move endorsements as easily as any other records. Encryption keys may be a complicating factor, but that’s something to hash out on Codeberg.

@ramsey @scottjenson @GavinChait @tchambers

Sold.

@julian @evan

@julian

And, you sold me on this, too.

My original idea was to define a protocol, then hand wave at the various uses.

The community interest has been awesome, and (rightfully) focused on the human-cale uses of this kind of thing.

Its most important for me that we lock down abuse vectors before they happen. But everything else really SHOULD be left up to implementors.

YOU should choose what you believe online — that shouldn’t be up to the protocol.

@benpate @julian +1

@ramsey
Two separate issues:
1. moving servers (happy to discuss that in another thread)
2. What is an endorsement?
I'd like to keep to that topic for now. My understanding of Ben's proposal (please correct if I'm wrong:
* It's a TWO way bridge, e.g. I have to endorse and you have accept
* At a core level, that's it, just a series of two-way connections
* But the question is "what do we do with these connections?
* I'm suggesting that it's more helpful in aggregate (I think Ben agrees)
* So the real question is how do we rollup these various signals and present them to the user? When I see your avatar on a post or reply, what do I see that gives me confidence you are a trusted person? 3 people I know endorse you? etc...

@GavinChait @benpate @tchambers

Another example has come up that shows the overlap of protocol design and potential uses cases:

1. Someone offers me an endorsement (Ben likes tea)
2. I accept, because tea is dandy
3. They change the endorsement (Ben likes coffee)
4. Coffee is disgusting. I’m deeply embarrassed.

The current protocol does not protect against this. I’d thought no cryptography would be needed, but now I’m convinced that endorsements MUST be signed in some way.

Object Identity Proofs, anyone?

@julian