@nicole6870 thanks for your feedback!
You’re right, the plugin is a spare time project and far from feature complete, but I tried to make this transparent by declaring it (very dominant in the README) as beta.
Still, I’d like to explain myself on some of your assumptions!
> I and as I understand most others can’t find ourselves in Mastodon no matter what we do to redirection and htaccess…
Indeed, there are common issues which are dominating the bug lists, but they say nothing about the overall usage at all. There are a thousand active users of the plugin which have no issues.
> …and this is mostly because of Mastodon’s security, which is a good thing.
I am not sure to what you are refering here, but if it is about the redirecting issues, it has nochting to do with Mastodons security requirements, but with WebFinger. WebFinger simply maps an identifier like this [email protected]
to something like this https://domain.tld/@username
.
Fun fact because you referenced Mastodon: WebFinger is not part of the ActivityPub spec, but required by Mastodon, so I had to add this feature only to be comatible to that plattform. Still nothing to do with security.
> The developers should sit down with some people running serious instances about how to make it accessible without compromising security.
I “sat down” a lot with every serious provider of an ActivityPub enabled software to get this plugin compatible with it. Friendi.ca, Pixelfed, Pleroma and Mastodon to only mention the big ones.
Talking about “serious instances”: The problem is that most users have no “serious instance” (like a root or a dedicated server) but a shared hosting env and that is what I/we have to fight with. There are a lot of different setups for PHP/Webserver/SSL, that it is very hard to handle all of that. The ActivityPub Spec (with the all the Mastodon specialties) have a lot of requirements to the server, so it might not work on every shared hosting without tweaking stuff. Still no security issue!
I spend at least half of my development time on Health Check code in the plugin and with answering support questions. It would be nice if we could talk if you have such an issue (using the forums or GitHub) in the future, because maybe I am able to help you.
It is sad that it does not work for you, but (in most cases) it has nothing to do with security or me/us not talking to other plattform providers.