Search results

Why on earth was the #ActivityPub protocol even let out the door without a well-specified and mandatory graceful, non-destructive key rotation scheme?

Yes I know the privacy issues. Those are not valid reasons to not have such a mechanism; it's a valid reason to not enable or use one.

What we're stuck with now is a ton of instances with absurdly long, legacy-algorithm keys (RSA-4096) with no way to replace them with shorter/better keys without effectively losing everything ever posted on the instance.

The protocol is only 7 years old! EC crypto was well-established at the time, and should have been the default.

And what happens once everyone has to replace the keys, because RSA is broken by quantum computers (I know, probably 100 years to go)? The #Fediverse will be a wasteland, with no instances trusting anything from any other instance, so all #Federation breaks down.

Sorry if I got some details wrong about what the protocol says. If I get flamed to death for being wrong, then I'll consider that a Good Thing(TM). I've been trying to find a way to rotate/replace keys for a while and all my searching turns up is either 1) confirmation that most people don't know or care about cryptography, or 2) https://socialhub.activitypub.rocks/t/key-rotation-notification/562 - which really isn't helpful.

If it is possible to gracefully rotate the key(s) of an instance/user, there really has to exist some documentation that explains clearly how to implement this in a server and how to exercise it as a server operator.

#Cryptography #Rant #Mastodon

0
0

Concept for discussion: Replacing HTTP Signatures with Bearer Tokens for ActivityPub Federation

Curious what other people think about this idea. What if federation security was re-worked to use target-assigned
bearer tokens to authenticate GET/POST requests? This would remove the need for complicated signing schemes and reduce system load under heavy traffic bursts (as no cryptography is required).

A basic implementation could look like this:
1. When instance A (
a.example.com) first attempts to federate with instance B (b.example.com), a POST request is made to a dedicated registration endpoint. (for discussion, we'll say it's https://b.example.com/activity-pub/register-instance). This request includes fields necessary for verification, including the source domain name, target domain name, and a securely-generated verification token. Other metadata could be included to allow instance B to selectively allow/prohibit federation based on other criteria, but this is optional.
2. Instance B makes a POST request back to a dedicated verification endpoint on instance A (for discussion, we'll say it's
https://a.example.com/activity-pub/verify-registration). This request must include the target domain name and verification token provided in step 2.
3. Instance A checks the verification token (and verify that it matches the target domain name) and return a successful value.
The verification code must be invalidated after this call!
4. Instance B, after verifying instance A's request, returns a securely-generated
federation key back to instance A. This federation key is a bearer token used to authenticate all requests from instance A to instance B. This key must be unique to instance A!
5. Instance A completes the original request with the
Authorization header set to Bearer {federation_key}.
6. Instance B receives the request, detects the federation key, and checks it against the list of registered instances.
7. If the key does not exist or A has been defederated, then a
403 Forbidden error is returned.
8. If the key is expired or revoked, then
401 Unauthorized error is returned. Upon receiving a 401 error, instance A should start over from step 1 to re-authenticate and complete the request with a new token. This process should not be repeated for recursive failures!
9. If the key is approved, then a
200 OK response or 202 Accepted response is returned, and A can consider the request as successful.

Advantages versus HTTP Signatures:
- No cryptography requirements.
- Simple logic, no edge cases around HTTP query parameters or header order.
- Equally effective for all request types.
- Keys can be easily revoked or rotated.
- Supports authorized fetch and defederation use cases "by default".

Disadvantages versus HTTP Signatures:
- Breaks the actor model - instances are required as a first-class concept. (but really, the actor model is basically dead already. you can't even federate reliably without a WebFinger server, at minimum.)
- Requires multi-request "handshake" before communication. (but this is already required in practice, since a signature can't be validated without first requesting the signing actor.)
- Out-of-band protocol - communication can't happen over ActivityPub / ActivityStreams because this is a prerequisite to authenticate any request. (but again, we already require WebFinger and some software requires NodeInfo for full support.)

So, what are your thoughts? Good idea? Bad idea? Did I miss something? Please let me know, I welcome replies here!

0

Socialhome v0.22.0 released, with a completely new UI!

This is a massive milestone for the #Socialhome project, one that could not have been possible without the hard work of @alain@jase.socialAlain St-Denis. If you have followed the Socialhome project, you'll know that Alain has been responsible for most of the development of project in the recent years. This includes rewriting the #federation library to ensure #ActivityPub support is first class. More recently Alain has taken the challenge of rewriting the frontend, which has fallen into a rather poor state over the years.

The new UI work is actually a coordination of two people working many years apart. Way back years ago @lightone@mastodon.xyzlostinlight made some UI designs for a new Socialhome UI (thank you! <3). While the designs were not implemented for years, they were not forgotten. In 2023 Alain jumped to the challenge and started the full UI rewrite of the Socialhome frontend. This UI has now matured into a state that it is good for daily usage - which is the main focus of this release!

Currently, a Socialhome installation will still default to the old UI. If you do want to try out the new UI for example on socialhome.network, go to the account settings and toggle the "New UI" flag. Going back is also easy, should the new UI cause unforeseen issues (please do report!).

If you are a server admin, see the new UI installation instructions for how to add the new UI to your instance.

This is not all! The releases of v0.21.0 and v0.22.0 also contain a bunch of other changes and fixes. Most notably;

  • ActivityPub profiles are now richer, including bio and a larger picture, in addition to an avatar.
  • Many new API's to support the new UI, including session authentication, search, media upload, content fetching over uuid, profile organize and profile settings.
  • Whoosh has been replaced with Xapian as a search index backend.

See the full changelogs. Additionally, the federation library has received a ton of changes and fixes which can be found here.

Also, last but not least, we moved from GitLab to Codeberg. Check out the new repositories.

Installing and updating

We recommend using the Docker images (amd64/arm64).

Notes on how to use the Docker images can be found in the docs.

What is Socialhome?

Socialhome is best described as a federated personal profile with social networking functionality. Users can create rich content using Markdown. All content can be pinned to the user profile and all content will federate to contacts in the federated social web. Federation happens using the ActivityPub and Diaspora protocols.

Please check the official site for more information about features. Naturally, the official site is a Socialhome profile itself.

Try Socialhome?

If you want to try Socialhome first before trying to install it, register at https://socialhome.network and then ping us with a comment on the user name chosen to get the account approved. You can also request account approval in the chat room. This unfortunately approval step is due to spammers.

Contribute

Do you want to work on a Django and VueJS powered social network server? Join in the fun! We have easy to follow development environment setup documentation and a friendly chat room for questions.

#socialhome #federation #fediverse #activitypub #diaspora #django #vuejs

0

12.0.0 was just released!

Learn about it in detail in the blog post:
forgejo.org/2025-07-release-v1

We recommend that all installations are upgraded to the latest version.

Check out the release notes and download it at forgejo.org/releases/. If you experience any issues with this release, please report to codeberg.org/forgejo/forgejo/i.

@forgejo My personal highlight of this release: You can now use your handle in documents and it will be marked up as a link to your user profile (or group, etc.).
forgejo.org/2025-07-release-v1
I'm excited about the future, when mentioning fediverse handles will actually be federated and will send notifications everywhere!

0
0
0
0
0
0
0

Meine Deutsch-palestinischen Freunde (ich wusste nicht dass ich so viele habe) wechseln gerade alle zu upscrolled.com/, mit dem Versprechen freisprechen zu können. Ich mache mir Sorgen, dass sie nur in die nächste Falle laufen. Vielleicht kann man sie überreden, dass sie wenigstens Activity Pub einbinden.
-------------------------
My German-Palestinian friends (I didn't know I had so many) are all switching to upscrolled.com/, with the promise of being able to make free calls. I'm worried they're just walking into the next trap. Maybe we can persuade them to at least integrate Activity Pub.
--------------------------
أصدقائي الألمان الفلسطينيون (لم أكن أعلم أن لدي الكثير منهم) ينتقلون جميعًا إلى upscrolled.com/، مع وعد بإمكانية التحدث مجانًا. أنا قلق من أنهم يقعون في الفخ التالي. ربما يمكن إقناعهم على الأقل بدمج Activity Pub

0
0
0
0
0
0
0
0
0
0
0
0
0

If you are new here,

I've compiled this list of posts I wrote with tips for newcomers. I hope these can be helpful to you! Welcome! 🐘✨

Profile Page 👤
infosec.exchange/@Em0nM4stodon

Mastodon Features :mastodon:
infosec.exchange/@Em0nM4stodon

Content Warnings ⚠️
infosec.exchange/@Em0nM4stodon

Alt-Text 📝
infosec.exchange/@Em0nM4stodon

Filters 🚫
infosec.exchange/@Em0nM4stodon

Lists 🗂
infosec.exchange/@Em0nM4stodon

Culture :ablobsmile:
infosec.exchange/@Em0nM4stodon

Fediverse :geodesic:
infosec.exchange/@Em0nM4stodon

Questions ❓
infosec.exchange/@Em0nM4stodon

More Resources 👇

‣ Browse this hashtag to see more of my tips:

‣ Browse this hashtag to see more Mastodon and Fediverse tips:

‣ Follow this great account for regular Mastodon tips in your timeline: @FediTips

0

5/

So, not just Decentralized Social (DeSo), but instead —

Decentralized Social (DeSo), Federated Social (FeSo), Localized Social (LoSo)

The goal is 'social' that is simultaneously — 'Decentralized', 'Federated', and 'Localized', all at the same time.

RE: mastodon.social/@reiver/114551

0
0
0
0
0
0
0
0

If you’re having trouble visualising the power differentials designed into federated systems, think of this scenario:

You have an instance of 1 person. An instance of 1 million people decides to block your instance.

What have they done?

They’ve blocked 1 million people from interacting with you.

Now let’s reverse the scenario: You, with your instance of 1, decide to block an instance of 1 million.

What have you done?

You’ve blocked 1 million people from interacting with you.

0

We've got exciting news! We're federating more of the quality publishers we work with, so you can follow everything from news and tech to fashion and music across the UK, France, Spain, Italy, Germany and Brazil on the open social web!

Read more about it here: about.flipboard.com/fediverse/

If you're curious, here's our full list of federated accounts:
docs.google.com/spreadsheets/d

These are some of our UK publishers now available.

90min—the online leader in global football: @90min

British Vogue—fashion, beauty & celeb news, backstage photos, catwalk videos & supermodel interviews: @BritishVogue

The Evening Standard—London's award-winning newspaper: @EveningStandardThe Evening Standard

T3—gorgeous tech. Smarter living: @T3dotcomT3

What Hi-Fi?—The most trusted tech reviews in the world: @WhatHiFiWhat Hi-Fi?

0
0
0
0
1

At SXSW's Fediverse House, it didn't matter which platform or protocol you preferred — everyone was focused on the singular goal of building a better internet. We've uploaded videos and highlights of key conversations from the event and rounded them up in one post. Here you go:

about.flipboard.com/fediverse/

0

Congratulations to @johnonolanJohn O'Nolan and the team at Ghost on their 12th birthday! Here's John's post reflecting on the idea behind the product, some of the incredible indie publishers who have adopted it (including @404mediaco404 Media, @caseynewton's Platformer, and @drownedinsoundSean | Drowned in Sound) and what's next.

john.onolan.org/12/

1
0
0
0

Is the really open for ?

In the last weeks, I noticed more & more messages from different instances/admins about moderation, banning and de-federations. Initially, people told the Fediverse is more open, not blocking and deleting content compared to other social medias. However, I think it shifted to the opposite where a single instance admin decides for the whole user base (which might not even be aware of it).

0
0
0

Hey fedi, I need some help!

I am trying to connect an application I am making with the Fediverse. When I search for an actor I am successfully able to get to the profile (yay) but when I search for a post I cannot find it.

I am receiving the GET request and am sending the response with the content type ("application/activity+json") (for example):

{
"@context":"w3.org/ns/activitystreams",
"name":"New Note",
"type":"Note",
"id":"critters.jpleite.eu/posts/1",
"attributedTo":"critters.jpleite.eu/users/1",
"content":"Hello there!",
"to":[]
}

Why would Mastodon not display the post?
The on Mastodon’s side is returning 403 action not allowed.

Thank you

0

I've been wrestling with implementing content support in Hackers' Pub, our -powered platform for software engineers.

While ActivityPub theoretically supports multilingual content through the contentMap property, the reality is that most server implementations (Mastodon, Misskey, etc.) don't properly handle this content as of April 2025. This creates a significant challenge for us.

We want our users to share their knowledge in multiple languages, but we need to ensure compatibility with existing ActivityPub servers. I'm considering several approaches:

  1. Creating separate posts for each language with clear language indicators, linking them through inReplyTo relationships (so translations appear as replies to the original post)
  2. Using the primary language in content while storing translations in contentMap
  3. Adding "View in other languages" links at the bottom of each post
  4. Implementing inline language dividers that degrade gracefully on non-supporting servers, for example:
    <div lang="en">
      <h3>English</h3>
      <p>This is the English content…</p>
    </div>
    <hr>
    <div lang="ko">
      <h3>한국어</h3>
      <p>한국어 내용입니다…</p>
    </div>

I'm leaning toward a hybrid approach—showing content in the user's preferred language when possible while providing easy access to other language versions.

Has anyone tackled this problem effectively? I'd love to hear about your experiences or ideas for making multilingual content work well in the fediverse, especially when dealing with server implementations that don't fully support ActivityPub's multilingual features.

11
0
0

Considering this post is going viral here and boosted by Mastodon's ceo:

What is mastodon.social's policy if it had received the same takedown request?
Meaning if an account on mastodon.social was ordered to be taken down by a Turkish judge 'under Article 8/A of Law No. 5651, citing “national security and public order.”'

More context on the request: bianet.org/haber/x-users-in-tu

cc @GargronEugen Rochko @andypiper

mas.to/@osma/11434616689055247

0
0
0
0
0
0

Hi all, Roel he/him.

An artist and designer with an interest in computer networks, materiality of the internet, digital community infrastructure, DIY/DIWO approaches, FOSS culture.

You might know my work from the LowTech Mag's solar powered server project solar.lowtechmagazine.com

Currently pursuing a in Interaction and Participatory at Malmö University. As part of that research I work together with actors in the cultural sector to co-design alternative social media infrastructures with/for them. These are mostly based on fediverse applications, so I am also interested in aspects of and more generally how to transition to and improve alternatives together etc. This space is far from perfect and in some cases insufficient but we need to start somewhere??

I'm a founding member of varia.zone, and also part of lurk.org. With LURK we've been running a fediverse instance called post.lurk.org since 2018, for which I am happy to be one of the co-admins! As part of that I boost , calls and questions..

:drake_like: This is introduction is really long because post.lurk.org has a character limit of 1337

0

I am very happy to announce that the new issue of the Pervasive Labour Union zine, 'Fed Up!', is finally(!) out and can be consulted here: ilu.servus.at/category/13-fed-
Many thanks to contributors @eliotberriot@mastodon.eliotberriot.com, @GargronEugen Rochko , @decentral1se@chaos.social, @entreprecariatslwr (and indirectly @rra𝓻𝓻𝓪 and @fcr), @pipLa Interdimensional Pirata Julia Janssen, Inge Hoonte and Louisa Bufardeci, Gui Machiavelli, and Martin Schotten.

0

If they can’t see what we say, it’s not .

If they can’t follow us, it’s not federation.

If it requires account duplication, it’s not federation.

@mosseriAdam Mosseri and the rest of you. , , i’m talking to you. But you shut your ears, because all these tricks are ones you need... to continue your data-thieving business model!

The of 2024, that’s you. Trying to do it to us, candidly, but I pay my dues in money, not privacy.

, or don’t

0
0
0

Little known fact: @evanEvan Prodromou and I worked at a startup in 2020 that never launched. It wasn't a great experience for me, but I loved the team we had hired, including Evan. I didn't know much then about or the social web.

I went back to @Flipboard in 2021 and in 2023 I started to learn about because of @mikeMike McCue's vision. Fast forward to 2025, Flipboard + @surf are organizing 's first . Evan was one of the first people to sign on, which created a snowball from there, which helped the event be a success.

This week, we got to meet IRL for the first time! So when I think about "the purpose" of that hard 10 months at that startup, I now know what it was.

Picture of Mia Quagliarello and Evan Propromou smiling at SXSW
0

@newyorktimesThe New York Times's veteran tech reporter @MarkoffJohn Markoff interviewed some of including @GargronEugen Rochko, @reckless1280 and our CEO @mikeMike McCue for a feature on the rise of decentralized social media. “It goes back to the original principles where the internet started out as decentralized,” Eugen Rochko told Markoff. Here's the full story [may be paywalled].

We're so excited to develop these conversations further at SXSW this weekend — check out the itinerary and sign up to join us at at the second link.

flip.it/NcjhLL

lu.ma/xbve5fa0

0
0
0