--- title: ActivityPub Won by Being Boring | daily.dev description: Reflecting on Evan Prodromou's FediForum 2026 talk, the piece argues ActivityPub succeeded precisely because its core design is deliberately unremarkable:... canonical: https://daily.dev/posts/activitypub-won-by-being-boring-aamynsjj8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ActivityPub Won by Being Boring | daily.dev og:description: Reflecting on Evan Prodromou's FediForum 2026 talk, the piece argues ActivityPub succeeded precisely because its core design is deliberately unremarkable:... og:url: https://daily.dev/posts/activitypub-won-by-being-boring-aamynsjj8 og:image: https://api.daily.dev/og/posts/AAmYNSjj8.png og:image:alt: ActivityPub Won by Being Boring og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ActivityPub Won by Being Boring **[Lobsters](https://daily.dev/sources/lobsters)** · 10 min read · 0 upvotes · 0 comments ## Summary Reflecting on Evan Prodromou's FediForum 2026 talk, the piece argues ActivityPub succeeded precisely because its core design is deliberately unremarkable: simple HTTP-based actors, inboxes, outboxes, and activity objects that any web engineer could implement. It covers the protocol's technical debt (the mismatch between the widely-deployed draft-cavage HTTP Signatures and the newer RFC 9421), the lack of end-to-end encryption, and governance challenges like defederation. It also details W3C's newly chartered Social Web Working Group (chartered January 15, 2026, running through January 2028), which expects backward-compatible, largely editorial updates to ActivityPub, Activity Streams, and Activity Vocabulary by Q3 2026, plus a tentative account-portability spec called LOLA. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between draft-cavage-http-signatures and RFC 9421 in the Fediverse? The deployed Fediverse largely relies on the older draft-cavage-http-signatures-12, an expired and archived IETF Internet-Draft, for server-to-server request authentication. The IETF later published RFC 9421, HTTP Message Signatures, in February 2024, using a different design, but the network's installed base still runs on the older draft, creating ongoing compatibility debt. _Track authentication standards like this on daily.dev before they cause federation headaches in production._ ### When is the next ActivityPub specification update expected from W3C? A newly chartered W3C Social Web Working Group, chaired by Darius Kazemi and running from January 15, 2026 through January 31, 2028, lists Q3 2026 as the expected completion for updated ActivityPub, Activity Streams, and Activity Vocabulary documents. The revision is described as backward-compatible and largely editorial, clarifying underspecified behavior already implemented in practice rather than introducing breaking changes. _Fediverse operators can follow standards timelines like this on daily.dev to plan upgrades without surprises._ ### What is LOLA in the context of ActivityPub account portability? LOLA is a proposed specification for live online account portability between ActivityPub servers, allowing a user to move their account, copy content, transfer follower relationships, notify followers, and handle redirects and trust decisions during the transfer. It is a tentative deliverable of the W3C Social Web Working Group's charter, pending incubation progress and implementer interest before becoming a Recommendation-track spec. _Anyone weighing self-hosting versus platform lock-in can watch portability proposals like this develop via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 21 comments across lobsters, hackernews (as of 2026-08-15). **TL;DR:** Commenters largely push back on the premise, arguing ActivityPub's 'win' is really just Mastodon's popularity dragging the protocol along, and that implementing it (especially JSON-LD and auth) is anything but boring or easy. **Sentiment:** 10% positive · 30% mixed · 60% skeptical **The case for** - Some note the protocol proved versatile enough that other projects (Lemmy, PieFed, Mbin, Pixelfed) adopted it successfully beyond Mastodon. - Its plain-JSON subset is simple enough that most implementations can ignore the harder JSON-LD/RDF extensibility. **The pushback** - Several argue implementing ActivityPub is ridiculously hard in practice, mainly due to JSON-LD complexity and authentication. - Some contend the protocol only 'won' because Mastodon happened to adopt it, not because of inherent technical merit. - A property can be a single value, an array, or a link to a collection, which adds parsing complexity. - One commenter calls a textual, JSON-based protocol wasteful compared to a bespoke binary protocol, attributing its spread to network effects/familiarity rather than implementability. - Some dispute that lack of end-to-end encryption should even be framed as 'technical debt'. - A couple of replies flatly reject the framing that the protocol 'won' anything at all. **By community** - lobsters (skeptical): Extensive pushback on the 'boring' framing, with detailed technical complaints about JSON-LD, auth, and attribution of success mainly to Mastodon's popularity rather than protocol design. - hackernews (skeptical): Brief, dismissive replies questioning whether the protocol actually won anything. **Hottest debate:** Whether ActivityPub succeeded due to genuinely good, boring design or simply because Mastodon happened to adopt it and create a network effect. **Open questions** - Is JSON-LD/RDF complexity a fundamental flaw or just an ignorable optional layer for most implementers? - Should end-to-end encryption be retrofitted into ActivityPub or left to purpose-built protocols? **Highlights** > The JSON-LD part of AP is far from boring and is actually fairly madness-inducing. Edit: See https://lobste.rs/s/1g5bum/why_implementing_activitypub_is_hard_why > — [Hecate on lobsters · 36 points, 5 comments](https://lobste.rs/s/ngz2wn/activitypub_won_by_being_boring#c_sohcgj) > ActivyPub "won" (insofar as it did...) By being used by Mastodon. That's it. Mastodon was popular, adopted the protocol, now the protocol is common. > — [singpolyma on lobsters · 16 points, 1 comments](https://lobste.rs/s/ngz2wn/activitypub_won_by_being_boring#c_59hyi9) > > This is why ActivityPub spread. JSON-ish objects, HTTP GET, HTTP POST, URLs, collections, actors, inboxes, outboxes. None of this is dazzling. Boring is implementable. And yet, these are so much more complicated, so much more wasteful, than a bespoke binary protocol would have been. OK, maybe keep the URLs since those are human facing, but the rest has no business being textual. The real criterion here is familiarity and leveraging existing implementations, not actual implementability. Typical network effect. > — [Loup-Vaillant on lobsters · 6 points](https://lobste.rs/s/ngz2wn/activitypub_won_by_being_boring#c_srlomy) > Yeah the article says "boring is implementable" but implementing an activitypub server is ridiculously hard, in big part due to json-ld. Second hard thing being auth. > — [mccd on lobsters · 7 points](https://lobste.rs/s/ngz2wn/activitypub_won_by_being_boring#c_sil8u0) > Reality: It really didn't win anything. > — [rvz on hackernews](https://news.ycombinator.com/item?id=49303282) **Source threads** - [lobsters](https://lobste.rs/s/ngz2wn/activitypub_won_by_being_boring) · 24 points · 17 comments - [hackernews](https://news.ycombinator.com/item?id=49303266) · 6 points · 4 comments ## Similar posts on daily.dev - [Book Review: ActivityPub by Evan Prodromou](https://daily.dev/posts/book-review-activitypub-by-evan-prodromou-dpy4t8tac) · Terence Eden · 2 upvotes · 1 comments - [Why implementing ActivityPub is hard, and why it doesn't have to be](https://daily.dev/posts/why-implementing-activitypub-is-hard-and-why-it-doesn-t-have-to-be-uc9l3hqnb) · Lobsters · 0 upvotes · 1 comments - [How We Lost Communication to Entertainment](https://daily.dev/posts/how-we-lost-communication-to-entertainment-bimwqdf4c) · Hacker News · 2 upvotes · 0 comments - [The Long Tail of Work Left Until ActivityPub Has E2EE](https://daily.dev/posts/the-long-tail-of-work-left-until-activitypub-has-e2ee-zx7yeq1dk) · Dhole Moments · 0 upvotes · 0 comments - [ActivityPub Over ATProto](https://daily.dev/posts/activitypub-over-atproto-dfp3mnmz3) · Hacker News · 0 upvotes · 0 comments --- Tags: [#mastodon](https://daily.dev/tags/mastodon), [#fediverse](https://daily.dev/tags/fediverse), [#activitypub](https://daily.dev/tags/activitypub) [View this post on daily.dev](https://daily.dev/posts/activitypub-won-by-being-boring-aamynsjj8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ActivityPub Won by Being Boring","url":"https://daily.dev/posts/activitypub-won-by-being-boring-aamynsjj8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/activitypub-won-by-being-boring-aamynsjj8"},"datePublished":"2026-08-15T06:08:28.172Z","dateModified":"2026-08-15T09:09:14.297Z","description":"Reflecting on Evan Prodromou's FediForum 2026 talk, the piece argues ActivityPub succeeded precisely because its core design is deliberately unremarkable:...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c871de5e0ca93b1c3db96bcc8cfaa688?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c871de5e0ca93b1c3db96bcc8cfaa688?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/activitypub-won-by-being-boring-aamynsjj8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"mastodon,fediverse,activitypub","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"ActivityPub Won by Being Boring"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/activitypub-won-by-being-boring-aamynsjj8#faq","mainEntity":[{"@type":"Question","name":"What is the difference between draft-cavage-http-signatures and RFC 9421 in the Fediverse?","acceptedAnswer":{"@type":"Answer","text":"The deployed Fediverse largely relies on the older draft-cavage-http-signatures-12, an expired and archived IETF Internet-Draft, for server-to-server request authentication. The IETF later published RFC 9421, HTTP Message Signatures, in February 2024, using a different design, but the network's installed base still runs on the older draft, creating ongoing compatibility debt. Track authentication standards like this on daily.dev before they cause federation headaches in production."}},{"@type":"Question","name":"When is the next ActivityPub specification update expected from W3C?","acceptedAnswer":{"@type":"Answer","text":"A newly chartered W3C Social Web Working Group, chaired by Darius Kazemi and running from January 15, 2026 through January 31, 2028, lists Q3 2026 as the expected completion for updated ActivityPub, Activity Streams, and Activity Vocabulary documents. The revision is described as backward-compatible and largely editorial, clarifying underspecified behavior already implemented in practice rather than introducing breaking changes. Fediverse operators can follow standards timelines like this on daily.dev to plan upgrades without surprises."}},{"@type":"Question","name":"What is LOLA in the context of ActivityPub account portability?","acceptedAnswer":{"@type":"Answer","text":"LOLA is a proposed specification for live online account portability between ActivityPub servers, allowing a user to move their account, copy content, transfer follower relationships, notify followers, and handle redirects and trust decisions during the transfer. It is a tentative deliverable of the W3C Social Web Working Group's charter, pending incubation progress and implementer interest before becoming a Recommendation-track spec. Anyone weighing self-hosting versus platform lock-in can watch portability proposals like this develop via daily.dev."}}]} ```