I was also a little concerned when I saw this in the release notes earlier today. Why not make this opt-in (with a warning explaining the reasoning behind it) rather than opt-out via about:config?!

If you implement IP over smoke signals then perhaps :)

Every user, post, community, etc. on each of these services is represented as an ActivityPub object. Let’s take the example of following your Lemmy user from Mastodon. I can search for @Gohos@lemmy.ml in Mastodon and in the background my Mastodon instance will issue the following WebFinger request to lemmy.ml: https://lemmy.ml/.well-known/webfinger?resource=acct:Gohos@lemmy.ml. This will return the following JSON: -

{
  "subject": "acct:Gohos@lemmy.ml",
  "links": [
    {
      "rel": "http://webfinger.net/rel/profile-page",
      "type": "text/html",
      "href": "https://lemmy.ml/u/Gohos"
    },
    {
      "rel": "self",
      "type": "application/activity+json",
      "href": "https://lemmy.ml/u/Gohos",
      "properties": {
        "https://www.w3.org/ns/activitystreams#type": "Person"
      }
    }
  ]
}

From here I can request the application/activity+json URL at https://lemmy.ml/u/Gohos and if I request JSON I get: -

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    "https://w3id.org/security/v1",
    {
      "lemmy": "https://join-lemmy.org/ns#",
      "litepub": "http://litepub.social/ns#",
      "pt": "https://joinpeertube.org/ns#",
      "sc": "http://schema.org/",
      "ChatMessage": "litepub:ChatMessage",
      "commentsEnabled": "pt:commentsEnabled",
      "sensitive": "as:sensitive",
      "matrixUserId": "lemmy:matrixUserId",
      "postingRestrictedToMods": "lemmy:postingRestrictedToMods",
      "removeData": "lemmy:removeData",
      "stickied": "lemmy:stickied",
      "moderators": {
        "@type": "@id",
        "@id": "lemmy:moderators"
      },
      "expires": "as:endTime",
      "distinguished": "lemmy:distinguished",
      "language": "sc:inLanguage",
      "identifier": "sc:identifier"
    }
  ],
  "type": "Person",
  "id": "https://lemmy.ml/u/Gohos",
  "preferredUsername": "Gohos",
  "inbox": "https://lemmy.ml/u/Gohos/inbox",
  "outbox": "https://lemmy.ml/u/Gohos/outbox",
  "publicKey": {
    "id": "https://lemmy.ml/u/Gohos#main-key",
    "owner": "https://lemmy.ml/u/Gohos",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwDc9TbmcvR/eRx0zuXl5\nqUu8vwcU3K1/70BqLdae/HtbjqXoHbVUI3exSVOTLVmPQ4oHjf6Lq5axyRRwihTh\nbDgWYSBCqZ07L6VrgXVg2APCkFpX32XlbFbbMQDXf+kodj6YrzwelXEJ03eTDKaa\nuFkFt0Uelu1k0AZVydGYT3U2iZ0jNGvpUMWQycTJ/k0r8n61JLuEMkvkVlH4ZDGb\nGTjwjLRds/zawe8FAK/Grn+AW/UTmW/1kBLcqhkeRYzWhyrVy+/f9jf03s0rW92w\n8PWM02AAE9edIpnK2XgElfkVWJenQzw7WDp045XPHMlUh5iizAJGcPAzdeEVNLq8\nGQIDAQAB\n-----END PUBLIC KEY-----\n"
  },
  "endpoints": {
    "sharedInbox": "https://lemmy.ml/inbox"
  },
  "published": "2023-06-03T17:30:16.990908+00:00"
}

This includes two important properties: inbox and outbox. Using ActivityPub I now know I can send you a message by POSTing a request to your inbox and I can fetch posts, comments, etc. you’ve made via your outbox.

Your public key is also included. This is how, if you sent me a message, I can verify that the message actually came from you.

That’s a very brief overview but I hope that helps!