Future Protocols

ActivityPub is a W3C Recommendation (2018) for decentralized social networking. It defines a server-to-server federation protocol and a client-to-server API, both using ActivityStreams 2.0 JSON-LD as the data format. Actors (users, groups, services) have inbox and outbox endpoints. Mastodon, PeerTube, Pixelfed, Lemmy, and 10,000+ servers form the Fediverse – a federated social network of 10+ million users all interoperating via ActivityPub.

The AT Protocol (Authenticated Transfer Protocol) is a decentralized social networking protocol developed by Bluesky. It uses self-certifying data – every record is cryptographically signed and verifiable without trusting any server. Identity is based on DIDs (Decentralized Identifiers) anchored in the DID PLC directory. Bluesky (bsky.app) is the primary deployment with 30+ million users as of 2026.

MASQUE (Multiplexed Application Substrate over QUIC Encryption) is an IETF protocol for proxying arbitrary traffic over HTTP/3 and QUIC. It enables UDP proxying (RFC 9298), IP proxying (RFC 9484), and TCP proxying via HTTP CONNECT. MASQUE is used in iCloud Private Relay and Cloudflare WARP to proxy traffic through HTTP/3 proxies while appearing as normal HTTPS traffic – enabling VPN-like functionality through firewalls that only allow HTTPS.

Media over QUIC (MoQ) is an IETF protocol (draft-ietf-moq-transport) for live media streaming built on QUIC. It aims to replace the fragmented RTMP-ingest + HLS/DASH-delivery + WebRTC-for-real-time stack with a single publish-subscribe protocol that delivers sub-500ms latency at CDN scale. MoQ multiplexes live and on-demand content over QUIC streams with publisher-defined object priorities.

Nostr (Notes and Other Stuff Transmitted by Relays) is a censorship-resistant decentralized protocol for social publishing. Every user has a cryptographic keypair (secp256k1); every note is a JSON event signed by the user's private key. Clients connect to multiple relays (WebSocket servers) to publish and subscribe to events. No central server, no accounts – identity is purely cryptographic.

Oblivious HTTP (RFC 9458) is an IETF privacy protocol that prevents a server from linking HTTP requests to the client that made them. A client encrypts requests using the gateway's public key (HPKE), sends them through a relay (which sees the client IP but not the content), and the gateway decrypts and forwards to the target (which sees the content but not the client IP). Neither relay nor gateway alone can link requests to a client identity.

Server-Sent Events (SSE) is a server-push technology over plain HTTP that lets a server stream data to a browser or client via a persistent connection. The client subscribes using the EventSource API; the server responds with Content-Type: text/event-stream and writes newline-delimited events indefinitely. SSE is unidirectional – server to client only. It became dominant in 2023–2026 as the streaming transport for every major LLM API (OpenAI, Anthropic, Google Gemini).

Web Real-Time Communication (WebRTC) is a collection of IETF and W3C standards that enables peer-to-peer audio, video, and arbitrary data exchange directly between browsers and devices, without plugins or intermediate servers for the media path. WebRTC is used by Google Meet, Discord, Zoom (web), WhatsApp Web, and every major video calling product.

WebTransport is a W3C/IETF protocol framework that provides browser-accessible low-latency, bidirectional transport over QUIC (HTTP/3). It supports reliable ordered streams, reliable unordered datagrams, and out-of-order delivery – capabilities impossible with WebSocket. WebTransport reached Baseline in March 2026 with support across Chrome, Edge, Firefox, and Safari 26.4. It is the primary transport for real-time gaming, AI agent communication, and Media over QUIC.