> @juliansaid:
>
> * I have to be careful when I use the term "authorization" because if I say it three times @thisismissem will show up and start talking about OAuth2/OIDC again.
Correction: it's just a single mention that makes me appear, people tend to confuse me with a genie but we're quite different.
(Also I saw other replies here but had an MCAS attack hangover today so didn't have energy to reply. I'll try to reply soon)
Well, yeah, that's why I linked what T&S is doing here to fix the moderator use case. At present I don't know of anyone sending cross-actor delete/update actions, so we'd be adding capability with the moderatedBy
@julian yeah, but the problem with the same-origin model is that you don't know who the moderator is. the actor https://social.example/joe shouldn't be able to delete https://social.example/steve`'s posts or issue updates. But if steve is moderatedByhttps://social.example/mods, then a Delete or Update from https://social.example/mods for https://social.example/steve
So whilst you have same-origin, you actually also have same-actor and http-message-signatures indicated authenticated actor.
> @juliansaid:
>
> A strict reading of this does not preclude the ability of a same-origin moderator to modify and delete the object. This is my argument.
I think I'd ask here is why is the Delete/Update coming from the moderator, instead of from the account that posted the thing, since that account is the owner of that thing?
Edit: For the moderation use case, I believe Moderation Actors will be the answer here.
> @julian said: > > * I have to be careful when I use the term "authorization" because if I say it three times @thisismissem will show up and start talking about OAuth2/OIDC again.
Correction: it's just a single mention that makes me appear, people tend to confuse me with a genie but we're quite different.
(Also I saw other replies here but had an MCAS attack hangover today so didn't have energy to reply. I'll try to reply soon)
Well, yeah, that's why I linked what T&S is doing here to fix the moderator use case. At present I don't know of anyone sending cross-actor delete/update actions, so we'd be adding capability with the
moderatedBy@julian yeah, but the problem with the same-origin model is that you don't know who the moderator is. the actor
https://social.example/joe shouldn't be able to deletehttps://social.example/steve`'s posts or issue updates. But if steve ismoderatedByhttps://social.example/mods, then a Delete or Update fromhttps://social.example/modsforhttps://social.example/steveSo whilst you have same-origin, you actually also have same-actor and http-message-signatures indicated authenticated actor.
> @julian said: > > A strict reading of this does not preclude the ability of a same-origin moderator to modify and delete the object. This is my argument.
I think I'd ask here is why is the Delete/Update coming from the moderator, instead of from the account that posted the thing, since that account is the owner of that thing?
Edit: For the moderation use case, I believe Moderation Actors will be the answer here.