What is Hackers' Pub?

Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.

0
0
0

RFC 9421 HTTP signatures in 2026

Robey Pointer @robey@socialhub.activitypub.rocks

Now that RFC 9421 has been published and is no longer a draft, I think it would be a good idea to write a FEP (or other document) with implementation recommendations, to ensure interoperability between AP servers. The RFC describes how to create and verify signatures, but it’s still up to us to define things like the required fields to be signed, which algorithms are likely to work, and how to discover servers that support it.

I believe HTTP signatures are still useful even with FEP-8b32 object signing, because they prove the authenticity of the origin server. That can be used to implement federation policies on private networks (not connected to the wider “fediverse”), or as a basis of trust before even parsing the AP object body. FEP-8b32 proofs validate the activity object itself and remain with the object as it traverses the network; HTTP signatures validate each link at the transport layer.

Also, I think it’s fine & good for the popular servers (mastodon, misskey, gotosocial, …) to wait for smaller servers to shake out interoperability first. It’s easier for the small servers to iterate and debug. Once we have something working, the more popular servers can implement our consensus requirements with a higher confidence it will “just work”.

Silverpill, in a separate thread, pointed me to a list of tootik’s HTTP signature requirements (here: https://github.com/dimkr/tootik/blob/d6fecfefd80a445b27f589250bb19ebcd95acee2/FEDERATION.md#http-signatures) and I think they make a good starting point, so I’ll kick off discussion with a lightly modified version:

  • require ed25519, recommend rsa-v1_5_sha256 also
  • required signed fields: @method, @target-uri
    • if a query is present, require: @query
    • for POST, also require: content-type, content-digest
  • advertise support using FEP-844e on the server actor
  • signatures must use public keys from FEP-521a (“assertionMethod”)
  • signatures must have a “recent” (one hour?) “created=” time, since this is a transport signature
  • signatures may use the server actor key if a FEP-8b32 object proof is present

I’ve implemented a first draft of this in squidcity, and I’m excited to try it out with other small servers to see what works.

Read more →
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
Horologram @horologram.bsky.social@bsky.brid.gy
Public

국가 사이를 완전히 서로 불간섭으로 지낼수 있는 샌드박스로 분리해두면 괜찮겠지만 현실은 그럴수가 없는것 ㅠㅠ 사실 이건 국가 이전에 사람 조직에게도 그렇고... 그냥 다 같이 섞여사는 진흙탕이라서 문제... (뭔가 먼미래에 행성간 이주가 가능하면 분리가 가능할지도 모르겠지만) 현실은 본의아니게 다 엉겨서 사는 지옥의 조별과제를 하는 ...

0
0
0
Mark Wyner Won’t Comply :vm: @markwyner@mas.to
Public

RE: dair-community.social/@emilymb

Men. Do better.

It sucks when someone feels like they want to abandon a community because of waves of ignorance. We all lose when that happens.

It’s okay to make mistakes IF your intentions are genuine and kind. And if it happens you apologize, learn, and move on.

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
Helen @hlseward@mstdn.social
Public

Following the recent heated discussion re: Marmite, I saw this today. I'd seen pictures, but look, it really exists and half price no less. I wonder why that might be. Reader: I did not buy it. I wouldn't even know what to do with it. They suggest over ice cream, or churros. Or popcorn or savoury veg?? But, even as a superfan, I couldn't bring myself to buy. I might regret that: I doubt they're making more...

Plastic squeezy containers of "Caramel Sauce with Marmite" on M&S shelves advertised with a red sticker as half price. £1.50 instead of the original £3. Next to some classic, elixir of life, Marmite.
0
0
0
0
0
0
OSNews @osnews@mstdn.social
Public
Shared by mcc

Wayback 0.3 released

Wayback, the tool that will allow you to run a legacy X11 desktop environment on top of Wayland, released a new version just before the Christmas. Wayback 0.3 overhauls its custom command line option parser to allow for more X.org options to be supported, and its manual pages have been cleaned up. Other fixes merely include fixing some small typos and similar small changes. Wayback is now also

osnews.com/story/144066/waybac

Wayback 0.3 released – OSnews

www.osnews.com

0
0
0
Heidi Li Feldman @heidilifeldman@mastodon.social
Public
Shared by Frédéric Jacobs

An excellent in-depth on the dangerous, unlawful U.S. attack on Venezuela. justsecurity.org/127981/intern 1/

“[S]triking Venezuela and abducting its president, is clearly a violation of the prohibition on the use of force in Article 2(4) of the UN Charter. That prohibition is the bedrock rule of the international system that separates the rule of law from anarchy, safeguards small States from their more powerful neighbors, and protects civilians from the devastation of war.”

International Law and the U.S. Military and Law Enforcement Operations in Venezuela

Experts survey the international law issues of Operation Absolute Resolve.

www.justsecurity.org · Just Security

0
0
0
0
0
0
Paris Marx @parismarx@mastodon.online
Public
Shared by Frédéric Jacobs

Given everything happening right now, I updated this article with options for weather apps, web forms, and translation services — along with some tweaks to existing categories.

I hope it helps your transition off US tech!

disconnect.blog/getting-off-us

Getting off US tech: a guide

I’m in the process of dropping US tech services. Here’s how I did it, and options you should consider.

disconnect.blog · Disconnect

0
0
0
0
0
0
0
6
0
0
0
1
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
FediFollows @FediFollows@social.growyourown.services
Public

accounts to follow:

➡️ @wikipedia - Official account for Wikipedia
➡️ @mediawiki - Free open software that powers Wikipedia
➡️ @kiwix - Free open app to browse & search Wikipedia offline
➡️ @WikiSignpostThe Signpost - Independent news site covering Wikipedia & Wikimedia
➡️ @wikiresearch - Latest academic research about Wikipedia, Wikidata, Wikimedia
➡️ @wmlgbtWikimedia LGBT+ - Improving LGBTQIA+ history articles on Wikipedia
➡️ @WikimediaIEWikimedia Community Ireland - Irish Wikipedia user group

1/2

0
0
0
datarama @datarama@hachyderm.io
Public

@inthehandsPaul Cantrell I live in Denmark. Last year, after Trump started talking about taking over Greenland, JD Vance said that Denmark was "not a good ally" - and I actually agree with him. Because we're a vassal state, not an ally.

Not only is there a US military presence in Greenland, an agreement to permanently establish three US military bases in mainland Denmark, where the US troops stationed there *cannot be prosecuted under Danish law for any crime they may commit in Denmark* was finalized *after* Trump started threatening with using military force to seize Greenland. Our leaders have chosen to buy extremely expensive US fighter planes (which require permanent ongoing US support to maintain) rather than the much cheaper Swedish interceptors we'd be able to maintain ourselves - and the latter are at least as good for the specific purpose of air defense. Nearly our entire public sector runs on US-owned IT. Some critical systems that were developed locally have subsequently been sold to US firms.

I've gone to protests, I've talked to people, I've advised avoiding procuring US tech when alternatives exist, and nobody of any importance really seems to care. (Because *I'm* nobody of any importance, obviously.)

Paul Cantrell @inthehands@hachyderm.io
Public
Shared by Paul Cantrell

@datarama
Please keep doing what you are doing!! This is exactly the kind of pressure-building we need. And yes, it will feel like it has no effect; changing popular political sentiment •always• feels like blowing into the wind for a very long time, even while, quietly and out of sight, minds are changing and attention is shifting.

It won’t ever work…until it does. Keep it up!

0
0
0
Paul Khuong @pkhuong@discuss.systems
Public

It's a bit funny to me that non deterministic black boxes and even seed optimisation are just accepted as normal in FPGA design...

I think a key difference compared to software is that acceptance criteria are a lot clearer (some of it due to nature of the substrate, but others because the culture seems to more readily accept performance trade-offs upfront).

0
0
0
Marco Arment @marcoarment@mastodon.social
Public

Anyone else use Gandi.net (the domain registrar)?

WTF happened to their pricing recently?

Most of my domains there are renewing at 2X+ what they last charged me a few years ago.

(.FMs are especially egregious… $200/year now, while Hover is $100 and Cloudflare is $80)

0
0
0
1
0
0
0
0
0
Stephen Bannasch (316 ppm) @stepheneb@ruby.social
Public

@Em0nM4stodonEm :official_verified:

Of course women aren’t treated equally.

There are so many ways women are not treated equally throughout society and this occurs from personal to large scale structural domains A great deal of this appears to be mostly invisible to men unless they are wired/socialized to be interested in how other folks experience the world and paid attention.

I’m curious about the thinking and perspectives of the 6% of men that answered YES.

0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0