WebSub and Hub Handshakes: How ActivityPub Platforms Relay Social Feeds Without Polling

On a typical Tuesday, a mid-sized Mastodon server dispatches roughly 4.5 million outbound HTTP requests just to deliver user posts. It does not achieve this scale by constantly asking other servers if they have new content. Instead, it relies on an automated push mechanism.[3]

If every server in a decentralized network had to constantly poll every other server for updates, the internet would drown in empty queries. The architecture requires a way to flip the model from asking for data to receiving it automatically.[2]

ActivityPub, the protocol powering platforms like Mastodon and Threads, solves this using WebSub. Originally drafted in 2009 under the name PubSubHubbub, this protocol dictates how independent servers negotiate the delivery of real-time updates without overwhelming each other.[1][2]

Platform marketing often frames federated social media as a seamless, borderless town square. The engineering reality is a rigid, highly choreographed sequence of cryptographic handshakes and hub relays that constantly threaten to fracture under heavy load.[4]

The polling problem and the push mandate

In standard web syndication, a reader application checks a server every few minutes to see if a new file exists. This polling model works perfectly for a single user checking a dozen static blogs.[1]

Scaled to a social network, polling becomes mathematically catastrophic. If 10,000 servers check 10,000 other servers every minute, the network generates 100 million requests per minute, with the vast majority returning zero new posts.[4]

WebSub eliminates this waste by introducing a specialized routing node called a hub. Instead of repeatedly asking a publisher for updates, a subscribing server tells the hub to send a payload only when a specific feed actually updates.[1]

"The protocol's mechanism is to allow subscribers to register for updates from publishers, via a hub, so that they receive updates when they happen," the W3C specification states regarding the architecture.[1]

When a user publishes a post, their home server pings the hub with the new content. The hub then takes over the distribution, blasting the payload out to all registered subscribers simultaneously.[1][3]

This architectural shift reduces the network load from an exponential curve to a linear one. It is the primary structural reason a decentralized network of hobbyist servers does not immediately melt under its own traffic.[4]

The anatomy of a WebSub handshake

The delivery pipeline begins with a formal subscription request. A receiving server sends a POST request to the publisher's designated hub, declaring its intent to follow a specific user's inbox.[1]

The hub does not blindly trust this incoming request, as doing so would enable massive distributed denial-of-service attacks. Instead, it immediately fires back a verification challenge to the subscriber containing a random string of characters.[1]

The subscribing server must echo that exact string back to the hub, accompanied by a 200 OK HTTP status code. This exchange proves the subscriber actually controls the destination address and genuinely wants the data.[1]

Once verified, the hub grants the subscriber a temporary lease, which typically lasts between a few days and a month. The subscriber must proactively renew this lease before it expires, or the hub silently drops them from the routing table.[1][3]

Cryptographic signatures and payload delivery

Speed is useless without authentication in a federated environment. When the hub pushes a new post to a subscriber, it includes an X-Hub-Signature header attached to the payload.[1]

This signature is a Hash-based Message Authentication Code, or HMAC. It is generated using a shared cryptographic secret that the hub and the subscriber negotiated during their initial handshake.[1]

The receiving server recalculates the hash using the incoming payload and its own copy of the secret. If the two hashes match perfectly, the server knows the post genuinely originated from the claimed hub and was not tampered with in transit.[1][3]

Without this strict cryptographic check, the network would be entirely defenseless. Anyone could forge a POST request and inject fake messages into a server's timeline, masquerading as a high-profile user or a system administrator.[4]

Where the hub model fractures

The WebSub system appears elegant in specification documents, but real-world implementation reveals deep structural fractures. Hubs represent a central point of failure in an ecosystem explicitly designed to avoid centralization.[4]

If a major instance's hub goes offline due to a hardware failure or a traffic spike, the publisher's posts simply stop propagating. Subscribers have no fallback mechanism to discover they are missing content until the hub recovers.[3][4]

Furthermore, WebSub delivery operates on a strict fire-and-forget basis. If a receiving server is temporarily down for database maintenance, the hub attempts a few retries with exponential backoff, then permanently discards the message.[1]

"Hubs MAY reduce the payload to a minimum or provide a diff," the W3C specification explicitly warns, leaving the burden of full reconstruction entirely on the receiving server if a packet is dropped.[1]

This brittle delivery mechanism creates the split timeline phenomenon common across ActivityPub platforms. Two users on different servers looking at the exact same thread will often see a completely different set of replies.[3][4]

The illusion of instant federation

Corporate marketing often describes federation as an instantaneous broadcast. The underlying protocol mechanics dictate otherwise, especially when massive instances attempt to synchronize with thousands of smaller nodes.[4]

When a user with a million followers across 8,000 distinct instances posts a message, the hub must queue and execute 8,000 separate TLS-encrypted POST requests. The cryptography alone requires significant compute cycles.[3][4]

Even with aggressive parallel processing, this massive fan-out takes physical time to complete. A post might appear on a server in Germany within 200 milliseconds, but take 45 seconds to reach a server in Japan sitting at the back of the queue.[4]

Protocol developers are currently debating extensions to ActivityPub that would allow hubs to batch multiple updates into a single payload. However, backward compatibility requirements with older server software make protocol upgrades notoriously slow to deploy.[2][4]

Why shared inboxes do not replace handshakes

Recent network optimizations have focused heavily on the shared inbox concept. This technique compresses delivery by sending one copy of a post to a server, rather than one copy for every individual user on that server who follows the publisher.[2][3]

While the shared inbox drastically reduces the total payload count, it does not replace the fundamental WebSub handshake. The trust pipeline must still be established before any data can flow.[1][3]

Every server must still maintain active, cryptographically verified leases with the hubs of every user its members follow. The administrative overhead of managing tens of thousands of expiring leases remains a constant background process.[1][4]

The fediverse relies on millions of continuous, invisible negotiations to maintain the illusion of a unified network. It is held together entirely by a 15-year-old protocol originally designed to notify feed readers about blog updates.[1][4]

As commercial entities integrate with these open protocols, the strain on the hub architecture will only increase. The system works today, but its reliance on synchronous handshakes makes it inherently fragile at a global scale.[4]

Engineers face a difficult choice between maintaining the decentralized purity of individual hubs or adopting centralized message queues that can handle enterprise traffic. The protocol's survival depends on how it resolves that tension.[4]

The next verifiable checkpoint for this architecture arrives with the upcoming W3C Social Web Incubator Community Group meeting. The numbers will dictate whether WebSub remains the foundation of the fediverse, or if a new delivery mechanism must take its place.[2][4]