Nostr notes by silverpill

> We also > explicitly> do not tolerate: > ... > ...

2026-07-22T12:28:41Z

In reply to nevent1q…67fw
_________________________

> We also > *explicitly*> do not tolerate:
> ...
> Content that harms the reputation of Codeberg, such as cryptocurrency related projects.

That's particularly funny. Nothing harms your reputation as much as policies inspired by stupid ragebait like web3isgoinggreat.com

Codeberg is banning "cryptocurrency projects": ...

2026-07-22T12:21:08Z

Codeberg is banning "cryptocurrency projects":

https://codeberg.org/Codeberg/org/pulls/1254#issuecomment-19820413

I don't know if Mitra qualifies as such, but I guess it is time to move to a self-hosted forge.

>Then I gather minimitra would have a different name depending ...

2026-07-20T19:03:42Z

In reply to nevent1q…85qf
_________________________

>Then I gather minimitra would have a different name depending on which gateway it reached me from (?)

Currently I require handles to be constructed from the address of actor's primary gateway (the first address in the Actor.gateways array). This is for compatibility with Mastadon.

If you're willing to break ties with Mastadon, then multiple handles shouldn't be a problem, I think. One for each gateway.

>Also I suppose you kind of have to register your name at each gateway because if someone wants to tunnel a name called cjd, and through my instance, that's a collision...

Yes, there's a registration process: https://codeberg.org/fediverse/fep/src/branch/main/fep/ae97/fep-ae97.md

>in your proposal everybody needs to convince one or more ...

2026-07-20T18:32:27Z

In reply to nevent1q…ne7s
_________________________

>in your proposal everybody needs to convince one or more gateways (who have HTTPS / ICANN domains) to host for them.

Relays can be onion services, eepsites, etc.

I think they don't even need to talk HTTP, although this HTTP servers are the most well-understood.

>If I'm not mistaken, you cannot just tag @somebody@someinstance.i2p and have that work, unless you've seen some message from them before which provides their gateways...

You can (example: minimitra (npub1a4k…u309) ), but normally webfinger address belongs to the primary gateway.

>Actually on second thought, I suppose names cannot be @name@instance.tld because there's no way to verify someone isn't lying about owning instance.tld,

Gateways are advertised via actor object, which servers can't tamper with. Verification of a handle is done by checking:

- Actor.gateways contains hostname
- acct:username@hostname resolves to Actor

>so names need to be key-like, like names in Nostr (?)

The canonical identifier of minimitra (npub1a4k…u309) is

ap://did:key:z6MkumzpDj1cYZD2GrBbVT86xL6CfPuyqWZAEXMfSqN9j3hf/actors/019c4320-5a91-59c3-0092-16976328fd80

> The problem: While numerous network transports exist (cjdns, ...

2026-07-20T17:52:04Z

In reply to nevent1q…fsen
_________________________

> The problem: While numerous network transports exist (cjdns, Yggdrasil, I2P, Tor, etc), and numerous name services exist (Namecoin, ENS, Unstoppable Domains, PKT, etc), almost all federation takes place over ICANN+IP because we currently have no way to federate across network boundaries, and ICANN+IP is the only thing that everybody has.

I already solved that problem: https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md

It is a transport-agnostic federation protocol that is backwards compatible with ActivityPub.

</thread>

It is not final yet, but the author did a good job at raising ...

2026-05-16T21:02:25Z

In reply to nevent1q…l8d7
_________________________

It is not final yet, but the author did a good job at raising awareness among developers:

https://event-federation.eu/2025/04/23/progress-on-the-fep-for-event-objects/

It's written in Rust and uses Postgresql as a database. You ...

2026-05-07T18:30:22Z

In reply to nevent1q…mwex
_________________________

It's written in Rust and uses Postgresql as a database.

You can read about the installation process and hardware requirements in the readme:

https://codeberg.org/silverpill/mitra#requirements

Correct, FEPs could be about anything related to Fediverse. And ...

2026-04-15T19:30:11Z

In reply to nevent1q…n3uw
_________________________

Correct, FEPs could be about anything related to Fediverse.

And personally, I would be happy to see a FEP about multi-domain setups.

Announcing Mitra Mini v0.1.0 Mitra Mini is an ActivityPub ...

2026-03-29T17:18:42Z

**Announcing Mitra Mini v0.1.0**

Mitra Mini is an ActivityPub client that implements [nomadic identity](https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md ). It has become stable enough that I decided to cut the first release.

The basic features have been implemented: posts, reposts, likes. For more information, check the project's readme:

https://codeberg.org/silverpill/minimitra

It all started nearly four years ago with a vague idea that linking cryptographic keys to #ActivityPub actors could unlock decentralized identity in Fediverse. Eventually, the solution was discovered, and implemented by several projects, but these implementations were servers, not clients. Now there is finally a client, and the design has been proven to work well.

#NomadicIdentity

I am already facing this problem in @npub1kqg…a7t4. I think ...

2026-03-26T21:45:43Z

In reply to nevent1q…xgka
_________________________

I am already facing this problem in Week in Fediverse :fediverse_light: (npub1kqg…a7t4).

I think vibe-coded projects will be de-prioritized because most of them are not newsworthy and immediately abandoned by their authors. A project will be featured only if it survives and gets some traction.

> What hasn’t been considered is the ability of multiple ...

2026-03-25T21:31:20Z

In reply to nevent1q…zp60
_________________________

> What hasn’t been considered is the ability of multiple people to speak with “one voice” yet.

Imageboards?

There was one that federated using ActivityPub: https://github.com/FChannel0/FChannel-Server

> 2. Activity-Level Origin Checks > Same-origin is checked ...

2026-03-25T19:39:41Z

In reply to nevent1q…p8vm
_________________________

> 2. Activity-Level Origin Checks
> Same-origin is checked rather than exact equality so that servers with multiple actors can sign on behalf of any of their actors — a common legitimate pattern.

For incoming activities, consider checking exact equality. See FEP-fe34, section "Signatures":

> In order to minimize damage in the event of a key compromise or insufficient validation, consumers MUST verify that the signing key has the same owner as the signed object. Consumers MUST also confirm the ownership of the key by verifying a reciprocal claim.

This is not strictly necessary, but would help if the origin server does poor job at validating user input.

> 3. Embedded Object Origin Checks
> Owner origin: the object's owner (actor for Activity subtypes, attributedTo for Notes/Objects) must be same-origin as the signing actor. Anonymous objects (no owner field) are accepted.

In this case I also recommend checking owner ID equality, as a rule of thumb. Because origin servers implementing C2S API may fail to validate all embedded objects (which can be deeply nested).

> Response body size limits

You may also need to limit the number of redirects and set a timeout. Some HTTP libraries have bad defaults.

By the way, I collect such recommendations in this guide: https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md#network. Contributions are welcome!

wakest ⁂ (npub1xse…lgk3)

Mitra 4.20 will add context property to replies. Among other ...

2026-03-19T16:52:03Z

Mitra 4.20 will add context property to replies. Among other things, this should help Pleroma re-construct threads when some posts are not available.

cc Phantasm (npub1shv…rctv)

RE: https://mitra.social/objects/019d06ec-3768-06df-99b6-61bb71a86d45

quoting
note1fwl…vjdh

#Mitra v4.20.0

https://codeberg.org/silverpill/mitra/releases/tag/v4.20.0
https://codeberg.org/silverpill/mitra-web/releases/tag/v4.20.0

- Replies inherit context from the top-level post.
- Added /api/v1/conversations API endpoint (used by Mastodon API clients to display chat list).

In your curl command, the closing quote (") is missing after ...

2026-03-10T18:50:14Z

In reply to nevent1q…7x6y
_________________________

In your curl command, the closing quote (") is missing after https://www.w3.org/ns/activitystreams. When I make a request with the full media type string, the server still returns text/html

Will it also work with profile parameter? We have to specify the ...

2026-03-10T18:13:50Z

In reply to nevent1q…mmk8
_________________________

Will it also work with profile parameter? We have to specify the profile because ActivityPub specification requires it:

https://www.w3.org/TR/activitypub/#retrieving-objects

This request returns an HTML page instead of ActivityPub ...

2026-03-10T14:13:04Z

In reply to nevent1q…68ja
_________________________

This request returns an HTML page instead of ActivityPub object:<code>curl -H 'Accept: application/ld+json; profile="https://www.w3.org/ns/activitystreams"'; https://blog.fabiomanganiello.com/article/Madblog-federated-blogging-from-markdown
</code>

https://www.openwall.com/lists/oss-security/2026/03/09/7 > ...

2026-03-09T21:01:39Z

https://www.openwall.com/lists/oss-security/2026/03/09/7

> Misskey and Sharkey, ActivityPub-based social network services (similar to Mastodon), have released updates to patch vulnerabilities Sharkey maintainers describe as "extremely severe".

Details have not been not published yet but "missing permission checks" and "authentication bypass" sound like vulnerabilities that could be prevented by following recommendations from [FEP-fe34: Origin-based security model](https://codeberg.org/fediverse/fep/src/branch/main/fep/fe34/fep-fe34.md ).

<code>curl -H 'Accept: application/ld+json; ...

2026-03-07T17:43:34Z

In reply to nevent1q…9rmw
_________________________

<code>curl -H 'Accept: application/ld+json; profile="https://www.w3.org/ns/activitystreams"'; https://hacker.makeup/users/lorendb/statuses/47287792000
</code>

This returns an HTML document and status 500:<code><h2 class="text-danger">An error occurred while processing your request.</h2>

<p>
<strong>Request ID:</strong> <code>00-d3d74c2ccd32f9ea714faa9aaa1cec25-5b77500b4a1fa1b9-01</code>
</p>

</code>

It doesn't work for me. Every time my server attempts to ...

2026-03-07T17:09:51Z

In reply to nevent1q…672h
_________________________

It doesn't work for me. Every time my server attempts to fetch an announced post, hacker.makeup returns 500.

I would appreciate that! @npub1xse…lgk3 @npub1zj7…lc9y

2026-03-06T23:32:25Z

In reply to nevent1q…aarn
_________________________

I would appreciate that!

wakest ⁂ (npub1xse…lgk3) Sean Tilley (npub1zj7…lc9y)

What could we do to make it more accessible? @npub1zj7…lc9y

2026-03-06T17:10:00Z

In reply to nevent1q…dvgp
_________________________

What could we do to make it more accessible?

Sean Tilley (npub1zj7…lc9y)

Hosted copies of an object may diverge, but the latest version of ...

2026-03-02T13:52:14Z

In reply to nevent1q…gtzc
_________________________

Hosted copies of an object may diverge, but the latest version of it is always available on the client side, because servers can't sign objects (unless server and client are a single application).

How those annotations work? I think instance actor could propose a change, which the author may later accept (and publish an Update activity, for example).

Recently, there was a discussion about generic #ActivityPub ...

2026-02-27T13:32:08Z

Recently, there was a discussion about generic #ActivityPub servers. Several people claimed that they were working on one, but it turned out that their "generic" servers only support activities defined in the ActivityPub specification. Such a server shouldn't be called generic. It is not difficult to build, neither it is an interesting concept because competing protocols (e.g. Nostr) already offer much more.

I've been writing a #FEP that describes how to build a real generic server. It is not finished yet, but I feel like now is a good time to publish it:

[FEP-fc48: Generic ActivityPub server](https://codeberg.org/fediverse/fep/src/branch/main/fep/fc48/fep-fc48.md )

This kind of server:

- Can process any object type, and can process non-standard activities like EmojiReact.
- Compatible with FEP-ae97 clients.
- Does not require JSON-LD.

I attempted to implement it when I was researching security properties of FEP-ae97 API: https://codeberg.org/silverpill/fep-ae97-server. Back then I didn't know what to do with side effects, but now I think that we can simply force clients to specify them.

Special thanks to marius (npub1xze…wwdj) and infinite love ⴳ (npub1t5c…ppw4) for their input.

#C2S

In previous years, I published two "fediverse tech ...

2026-02-18T20:26:59Z

In previous years, I published two "fediverse tech roadmap" posts:

- [Fediverse tech roadmap 2024](https://mitra.social/objects/018ccbfc-6b7e-1490-086c-d41bff6efb71 )
- [Fediverse tech roadmap 2025](https://mitra.social/objects/019437a2-a2e5-ed6f-ebff-dcbb6bc6aba4 )

However, I didn't publish such post this year because not much has happened in 2025. Many problems I talked about require complex solutions, but unfortunately proposed solutions are often very limited or lead to centralization. Or worse, there is no solution but only an imitation of work. I don't want to write about that.

I saw a thread today where ATProto ecosystem was compared to #ActivityPub. Things are happening in the Atmosphere, but not in Fediverse. MAU graphs are flat. What's going on?

There are multiple factors at play, but I think fake activity may be the biggest contributor. Trivial developments presented as breakthroughs. Features that already exist somewhere in Fediverse presented as new inventions. Vaporware. Specs written by people who have no idea how to implement them. Working groups that do nothing but meetings.

Real work is ignored, competent developers see that and quit.

We need to fix this.

For my part, I will continue to document #Fediverse development at Week in Fediverse :fediverse_light: (npub1kqg…a7t4). But this newsletter doesn't have much impact.

This is also interesting. I want to support hats in Mitra, ...

2026-02-11T17:05:03Z

In reply to nevent1q…qya4
_________________________

This is also interesting. I want to support hats in Mitra, it's a cool idea [@graf](https://poa.st/users/graf )

I would love to see this in the FEP repository

2026-02-11T16:40:57Z

In reply to nevent1q…et0d
_________________________

I would love to see this in the FEP repository

Not sure what is Mastodon's role in this, but yeah. It's ...

2026-02-04T21:00:24Z

In reply to nevent1q…2ppn
_________________________

Not sure what is Mastodon's role in this, but yeah. It's always Mastodon

[Ripple/XRP](https://en.wikipedia.org/wiki/Ripple_Labs ) (a ...

2026-02-04T20:23:16Z

[Ripple/XRP](https://en.wikipedia.org/wiki/Ripple_Labs ) (a cryptocurrency company) just granted 200k USD to Social Web Foundation, "...to research sustainable revenue and operating models for digital publishers and community-run platforms":

https://interledger.org/news/interledger-foundation-awards-200000-social-web-foundation-support-decentralized-social-media

This means they will be able to influence the development of the ActivityPub specification at W3C.

For those who don't know: Interledger, WebMonetization and OpenPayments are basically the same thing, these projects were created by Ripple ~10 years ago in order to insert their cryptocurrency and related payment services into web standards. These projects are sometimes presented as independent, but this is a lie, they are not (not in [2019](https://xrpl.org/blog/2019/interledger-checkin ), not in [2025](https://timestabloid.com/new-document-ripple-interledger-protocol-and-xrp-work-together/ )).

Needless to say, Ripple itself is a borderline scam: https://www.forbes.com/sites/jasonbloomberg/2019/03/01/is-ripple-a-scam/. It's not even a cryptocurrency really, their infrastructure is completely centralized and no one in cryptocurrency space takes them seriously. But they have [a lot of money](https://www.mozillafoundation.org/en/blog/100-million-investment-reshape-economics-web/ ) to bribe people, so I am sure that we will hear more about their adventures soon.

RE: https://socialwebfoundation.org/?p=99982

quoting
note1s7v…4202

Thanks to the [Interledger Foundation](https://interledger.org/ ) for their generous Grant for the Web to the Social Web Foundation. With the help of ILF, we are launching a new program area focused on economic issues on the Social Web. In particular, we’ll be producing three reports: one on sustainability for social web instances; one for the Fediverse and the creator economy; and one for cooperatives on the Social Web. In addition, we’ll be engaging multimedia Fediverse apps for using the Web Monetization standard. You can read more about grant on our shared announcement: [Interledger Foundation awards $200,000 to Social Web Foundation to support decentralized social media](https://interledger.org/news/interledger-foundation-awards-200000-social-web-foundation-support-decentralized-social-media ).

> No Friendica and Lemmy and Piefed do not have what is needed ...

2026-02-04T17:30:04Z

In reply to nevent1q…vwr7
_________________________

> No Friendica and Lemmy and Piefed do not have what is needed implemented yet.

What they don't have?

You can expose public keys with [FEP-c390: Identity ...

2026-01-31T21:07:45Z

In reply to nevent1q…zrer
_________________________

You can expose public keys with [FEP-c390: Identity Proofs](https://codeberg.org/fediverse/fep/src/branch/main/fep/c390/fep-c390.md ). Identity proofs are more secure than simple public key profile fields because they make it harder for a malicious server operator to replace a client-generated key with his own key.

Smithereen was one of the first fedi platforms to implement a ...

2026-01-19T10:45:33Z

In reply to nevent1q…kcmg
_________________________

Smithereen was one of the first fedi platforms to implement a wall. The mechanism was described in [FEP-400e: Publicly-appendable ActivityPub collections](https://codeberg.org/fediverse/fep/src/branch/main/fep/400e/fep-400e.md ).

As far as I know, Mike Macgirvin tried to implement a similar feature in one of his projects, but found FEP-400e too limited, changed a couple of things there and called it Conversation Containers. The original Conversation Containers documentation says that it is based on FEP-400e:

https://codeberg.org/streams/streams/src/commit/e3c83c46376f446013cd95f97381e8a146a09810/doc/develop/en/Containers.mc

[FEP-171b: Conversation Containers](https://codeberg.org/fediverse/fep/src/branch/main/fep/171b/fep-171b.md ) is a more complete specification, you can also read there about how Containers compare to other proposals. I think it's a good solution for channels / circles / additional timelines, I already use it in Mitra for followers-only and premium subscribers-only conversations.

Markdown or its subset is supported by almost every platform ...

2025-12-15T21:02:22Z

In reply to nevent1q…l7qf
_________________________

Markdown or its subset is supported by almost every platform except Mastodon.
But PeerTube is the only software I know that puts markdown in content instead of HTML.

I don't have such plans. I will continue packaging mitra for ...

2025-12-15T20:55:34Z

In reply to nevent1q…afd3
_________________________

I don't have such plans. I will continue packaging mitra for debian/amd64, but I think other kinds of packages should be provided by people who use respective distros and environments.

The list of community-maintained packages is kept in readme:

https://codeberg.org/silverpill/mitra#other-installation-methods

>nodeinfo, which is a great place to put capabilities like ...

2025-12-12T04:57:13Z

In reply to nevent1q…3m0n
_________________________

>nodeinfo, which is a great place to put capabilities like that

NodeInfo is a protocol for publishing instance stats, it shouldn't be used for S2S capability negotiation. The best place for server metadata in ActivityPub is instance actor.

There are two methods: - "Double knocking". You try ...

2025-12-11T19:43:59Z

In reply to nevent1q…gs89
_________________________

There are two methods:

- "Double knocking". You try elliptic curve first, and then RSA if the server returns 401. The number of attempts increases as more signature types are added.
- Capability negotiation ([FEP-844e](https://fediverse.codeberg.page/fep/fep/844e/ )). Less wasteful, but doesn't work well for GET requests (authorized fetch).

Nostr event nevent1qqs2lnmcncq3xjpkvevu4ehkc2nx93qsam6qrqt46e2qkk5qcfpjygczyq53rmwzuq434d3nrw57p3e78rvt9mnxkt3rftraw0lx7ync76u2j8cg34d

2025-11-26T15:37:39Z

In reply to nevent1q…qph6
_________________________

https://cointelegraph.com/explained/what-is-the-interledger-protocol-and-how-does-it-work
https://coinpaper.com/12553/iso-20022-s-nod-puts-ripple-s-interledger-on-swift-radar-a-new-era-set-to-begin
https://xrpl.org/blog/2019/interledger-checkin

Interledger, OpenPayments and WebMonetization, it's all the same thing. They deliberately hide that fact to appeal to people who don't like cryptocurrencies.

>is there a better alternative?

Depends on what you're looking for.

Subscriptions can be implemented in ActivityPub, that doesn't require any special fiat transfer protocol.

If cryptocurrency is not desirable, then something like Stripe could be used. There is also Taler system which is fiat-based but is partially open source.

>interledger Why Interledger, though? It is tied to XRP ...

2025-11-25T22:44:19Z

In reply to nevent1q…2l8u
_________________________

>interledger

Why Interledger, though? It is tied to XRP cryptocurrency.

What kind of bridge? Like this one? ...

2025-11-19T14:19:42Z

In reply to nevent1q…vv64
_________________________

What kind of bridge?

Like this one? https://codeberg.org/silverpill/activity-connect

Does it use ActivityPub C2S API?

2025-11-18T22:14:01Z

In reply to nevent1q…uhk2
_________________________

Does it use ActivityPub C2S API?

Absolutely disgusting. It's not just Pleroma. He just tagged ...

2025-11-18T19:46:20Z

In reply to nevent1q…sk0w
_________________________

Absolutely disgusting.

It's not just Pleroma. He just tagged projects that are either commercial or actively seek funding, and ignored everyone else.

>But in practice the blocklists fracture the network. Yes, ...

2025-11-17T22:51:15Z

In reply to nevent1q…55e0
_________________________

>But in practice the blocklists fracture the network.

Yes, hence my original question: why would anyone want a monoculture? Some people don't want to talk to each other, and I think that is totally fine.

But we do have people from many different ideologies. It's ...

2025-11-17T22:12:12Z

In reply to nevent1q…0t22
_________________________

But we do have people from many different ideologies. It's already possible.

I think Fedi could be as big as Email. But "Big tent ...

2025-11-17T21:48:50Z

In reply to nevent1q…ueqr
_________________________

I think Fedi could be as big as Email.

But "Big tent Fedi"? Why would anyone want such a thing?

>SMTP by default essentially has no authentication and allows ...

2025-11-16T20:00:14Z

>SMTP by default essentially has no authentication and allows spoofing the MAIL FROM header.

Wow, it's just like W3C ActivityPub.

RE: https://mastodon.neat.computer/users/privacyguides/statuses/115559989358002050
nostr:note16ur30gv8etf2asqsmqudmpjq7y586e08k9gav6v88m8pnlvc7tuqc52tg5

#APx v0.20.0 https://docs.rs/apx_sdk/0.20.0/apx_sdk/index.html ...

2025-11-05T22:58:32Z

#APx v0.20.0

https://docs.rs/apx_sdk/0.20.0/apx_sdk/index.html

This release comes after the recent updates to [FEP-fe34](https://mitra.social/objects/019a36da-bc58-8f2c-57b6-2b4caa967317 ) and [FEP-ef61](https://mitra.social/objects/019a5391-a71f-e71d-f7f1-5dfceaa9f34d ):

- Implemented the algorithm for determining owner of an object (ownership::get_owner).
- Updated the URI canonicalizer implementation (CanonicalUri type).
- Updated the implementation of the algorithm for computing URI origins.

Full changelog: https://codeberg.org/silverpill/mitra/src/tag/apx-v0.20.0/apx_sdk/CHANGELOG.md

quoting
note1vgx…tnnl

FEP-fe34 update: https://codeberg.org/fediverse/fep/pulls/711

This is a follow-up to the FEP-2277 update. I added the algorithm for determining the owner of any object:

1. Run the duck typing algorithm specified in FEP-2277.
2. If the type is Link, return error.
3. If the type is neither Object nor Collection, and the object has an attributedTo property, return error.
4. If the type is Actor, return the value of the id property.
5. If the type is VerificationMethod, return the value of the controller property.
6. If the type is PublicKey, return the value of the owner property.
7. If the type is Activity, return the value of the actor property.
8. If the type is Object or Collection, return the value of the attributedTo property.

#fep_fe34

RE: https://mitra.social/objects/019a362e-7109-11ad-864a-495e4e42b12c
note187w…2gdt

Ah, thanks. https://git.shipoclu.com/moon/bleromofw When I click ...

2025-11-01T20:25:26Z

In reply to nevent1q…93g9
_________________________

Ah, thanks.

https://git.shipoclu.com/moon/bleromofw

When I click on any file there it redirects me to login page, but the source can be fetched with git so we're good.

Wow, this is awesome. And it actually works with Mitra, I was ...

2025-11-01T18:06:56Z

In reply to nevent1q…kfgu
_________________________

Wow, this is awesome. And it actually works with Mitra, I was able to log in and publish a post, view timelines etc

Is it open source?

FEP-fe34 update: https://codeberg.org/fediverse/fep/pulls/711 ...

2025-10-30T20:41:36Z

FEP-fe34 update: https://codeberg.org/fediverse/fep/pulls/711

This is a follow-up to the FEP-2277 update. I added the algorithm for determining the owner of any object:

1. Run the duck typing algorithm specified in FEP-2277.
2. If the type is Link, return error.
3. If the type is neither Object nor Collection, and the object has an attributedTo property, return error.
4. If the type is Actor, return the value of the id property.
5. If the type is VerificationMethod, return the value of the controller property.
6. If the type is PublicKey, return the value of the owner property.
7. If the type is Activity, return the value of the actor property.
8. If the type is Object or Collection, return the value of the attributedTo property.

#fep_fe34

RE: https://mitra.social/objects/019a362e-7109-11ad-864a-495e4e42b12c

quoting
note187w…2gdt

FEP-2277 update: https://codeberg.org/fediverse/fep/pulls/708

- The Actor class now has the highest priority.
- Verification methods and public keys are treated as different classes.

This is needed because I discovered a way to bypass the same-owner check where attacker creates an ambiguous object (e.g. a Note with inbox property).

FEP-fe34 will be updated too, it will have a precise algorithm for determining the owner of an object.

#fep_2277

FEP-2277 update: https://codeberg.org/fediverse/fep/pulls/708 - ...

2025-10-30T17:33:24Z

FEP-2277 update: https://codeberg.org/fediverse/fep/pulls/708

- The Actor class now has the highest priority.
- Verification methods and public keys are treated as different classes.

This is needed because I discovered a way to bypass the same-owner check where attacker creates an ambiguous object (e.g. a Note with inbox property).

FEP-fe34 will be updated too, it will have a precise algorithm for determining the owner of an object.

#fep_2277

Latest additions to the list of FEDERATION.md implementers: Loops ...

2025-10-28T20:41:53Z

Latest additions to the list of FEDERATION.md implementers: Loops and snac.

There are more than 30 projects in total.

https://codeberg.org/fediverse/fep/src/branch/main/fep/67ff/fep-67ff.md#implementations

Yes, that's the primary goal of my work: ...

2025-10-06T23:14:43Z

In reply to nevent1q…5tm2
_________________________

Yes, that's the primary goal of my work:

https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md

I think #tootik and #Forte already allow full migrations, but something akin to ATProto PDS or Nostr Relay will take more time to build.

Nostr event nevent1qqsr7yh6nj5dgmj7xx769dw4xydjc3nxv0q2k3t8vtvlcas5mqh7k9szyq53rmwzuq434d3nrw57p3e78rvt9mnxkt3rftraw0lx7ync76u2jms20gl

2025-10-02T20:08:13Z

https://lists.w3.org/Archives/Public/public-swicg/2025Oct/0001.html

SocialCG people want to make their own FEP repository on GitHub where authors will be required to sign a CLA.

I'd like to make it clear: this is not associated with the original [FEP repository](https://codeberg.org/fediverse/fep ). The #FEP process is meant to be open to everyone, and I will do everything I can to stop any attempts to introduce CLAs there.

FEP-e3e9 (Actor-Relative URLs) is not my FEP. I wrote FEP-ef61 ...

2025-10-02T17:29:02Z

In reply to nevent1q…vux6
_________________________

FEP-e3e9 (Actor-Relative URLs) is not my FEP.

I wrote FEP-ef61 (Portable objects):

https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md

It currently has 3 independent implementations.

ActivityPub servers can run as onion services on your own ...

2025-09-30T21:09:32Z

In reply to nevent1q…lg6s
_________________________

ActivityPub servers can run as onion services on your own hardware. Without any clouds, domains and certificates.

ActivityPub has a similar problem, but instead of centralized ...

2025-09-23T17:20:01Z

In reply to nevent1q…n7xv
_________________________

ActivityPub has a similar problem, but instead of centralized did:plc thingy it relies on Domain Name System.

I started this https://codeberg.org/ap-next/ap-next

2025-09-18T14:58:25Z

In reply to nevent1q…gtjy
_________________________

I started this https://codeberg.org/ap-next/ap-next

Yes, and ActivityPub-enabled software that produces these ...

2025-09-17T20:01:25Z

In reply to nevent1q…nks9
_________________________

Yes, and ActivityPub-enabled software that produces these documents already exists. I'll quote a Video and an Article here:

[quote 1](https://spectra.video/videos/watch/b19447b3-148e-4edd-a485-69da9f46674b )

[quote 2](https://activitypub.blog/?p=1864 )

Quotes won't be displayed in Mastodon, but you can view them on my site.

Videos and articles can be boosted and quoted... Unless ...

2025-09-17T19:29:13Z

In reply to nevent1q…cfwg
_________________________

Videos and articles can be boosted and quoted... Unless you're on Mastodon.

Nostr event nevent1qqsv7fnjddhvhxw7vugsshu4t8gn7kl2kpn37tlkv832wpjvrp5hgeczyq53rmwzuq434d3nrw57p3e78rvt9mnxkt3rftraw0lx7ync76u2j049up7

2025-09-14T00:58:12Z

In reply to nevent1q…czgl
_________________________

Soon.

https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md

(although "this is the new domain, automatically re-subscribe please" doesn't require true nomadic protocol and many actively maintained fedi services already support it)

I know that podcastindex.org is connected to Fediverse For ...

2025-09-10T22:34:35Z

In reply to nevent1q…rl2e
_________________________

I know that podcastindex.org is connected to Fediverse

For example: [@920666](https://podcastindex.org/podcast/920666 )

Still, I think it would be nice to deprecate Delete and slowly ...

2025-09-06T23:11:38Z

In reply to nevent1q…f49c
_________________________

Still, I think it would be nice to deprecate Delete and slowly migrate to Remove(target: context), since both PieFed and Lemmy implement the context collection now.

My server rejects Delete if its actor is different from object's owner, and I have to treat Announce(Delete) as a special case where the normal processing logic doesn't apply.

Fixed in version 4.9.0

2025-08-31T02:13:53Z

In reply to nevent1q…weud
_________________________

Fixed in version 4.9.0

This pig is fabulous and doesn't fit into the lightbox on ...

2025-08-29T09:18:41Z

In reply to nevent1q…gch5
_________________________

This pig is fabulous and doesn't fit into the lightbox on Firefox. I'll fix that.

Indeed, there were changes that might cause this. But I tested ...

2025-08-28T16:00:18Z

In reply to nevent1q…n69t
_________________________

Indeed, there were changes that might cause this. But I tested those changes in all major browsers and didn't find any issues. Could you provide an example of such image?

Good thread: https://mastodon.social/@Gargron/115074631868019158 ...

2025-08-27T14:51:44Z

Good thread: https://mastodon.social/@Gargron/115074631868019158

Eugen Rochko (npub1vl7…f6g0) was dogpiled by Bluesky shills but he's right about everything.

Imagine claiming that you're a decentralized network and then adding a geoblock because of some draconian "law" in some random country.

Mitra implements different kind of C2S API, it won't work ...

2025-08-27T09:59:06Z

In reply to nevent1q…xrx7
_________________________

Mitra implements different kind of C2S API, it won't work with standard ActivityPub clients.
I think [Oni](https://git.sr.ht/~mariusor/oni ) should work (it is developed by marius (npub1xze…wwdj)).

Steve Bate (npub1p9l…l05x)

In the JSON-LD playground, a property that is not defined in ...

2025-08-25T22:15:24Z

In reply to nevent1q…6yjw
_________________________

In the JSON-LD playground, a property that is not defined in @context results in a "blank node". I don't know how bad that is, but at least it doesn't throw an error.

The state property is not necessary. I send regular Follow and ...

2025-08-25T21:34:34Z

In reply to nevent1q…hlga
_________________________

The state property is not necessary. I send regular Follow and Undo activities, that works.

> May I ask why this FEP is finalized? There haven’t been any implementors (except for Fedify, above?) who have submitted comments about this.

There were no objections. FEP process doesn't require implementations, a rough consensus is enough for finalization.

With the latest release of #Mitra, the media proxy feature has ...

2025-08-18T22:45:43Z

With the latest release of #Mitra, the media proxy feature has stabilized and is ready to use.
When enabled, it significantly reduces storage requirements because the remote media is not saved to disk. It also guarantees that you don't accidentally store anything illegal.
However, since it is a proxy, the media is not loaded directly from remote hosts, so they won't learn your IP address and browser fingerprint, only the time when you're online.

Media proxy can be enabled for all hosts or only for selected ones (it is a part of the [federation filter](https://codeberg.org/silverpill/mitra/src/tag/v4.8.0/docs/filter.md ) system):<code>mitra add-filter-rule proxy-media '*'
mitra add-filter-rule proxy-media pawoo.net
</code>

RE: https://mitra.social/objects/0198be5c-dfef-8dca-3ac4-b370a79d372f

quoting
note1sm5…8ns8

#Mitra v4.8.0

https://codeberg.org/silverpill/mitra/releases/tag/v4.8.0
https://codeberg.org/silverpill/mitra-web/releases/tag/v4.8.0

- Media proxy won't proxy arbitrary URLs anymore. It is safer to use, and the endpoint is enabled by default now.
- Improved mitra-web navigation for unauthenticated users. Exposure to remote content is reduced, and visitors are redirected to remote sites whenever possible.
- Activities delivered to FEP-ef61 inboxes are forwarded to actor's clones.

>Mastodon In the latest version they added an option to set a ...

2025-08-11T22:25:39Z

In reply to nevent1q…qkyu
_________________________

>Mastodon

In the latest version they added an option to set a minimum age requirement for user sign-up:

https://blog.joinmastodon.org/2025/05/legal-features-updates/#setting-age-requirements

This is not age verification, but they don't look opposed to adding it later.

I don't expect this to have a big effect on Fediverse, though. What they are going to do? Block all instances that don't implement age verification?

# Long-form articlesI was reading the [Fediverse Report – ...

2025-08-08T18:33:31Z

#

Long-form articlesI was reading the [Fediverse Report – #128](https://connectedplaces.online/?p=2949 ) post by Laurens Hof (npub17m8…rsw8) and several sentences caught my attention:

> Ghost’s connection to the fediverse currently means that following a Ghost blog from your fediverse account results in seeing a post with the article headline and a URL

That's how Mastodon displays Article objects: only a headline and a URL (see issue #24079). However, **Mastodon is the only fediverse platform that removes content from articles**. According to funfedi.dev data, others don't remove content:

https://funfedi.dev/support_tables/generated/object_types/

GoToSocial, Hollo, Misskey, Mitra, Pleroma. These platforms either have full support for long form content or use graceful degradation. The dataset doesn't include some other popular platforms like Friendica, but I am sure they also display long form content just fine. So this really has nothing to do with Fediverse or #ActivityPub.

> Fediverse platform developers (including Mastodon, Ghost, WordPress, WriteFreely and more) are collaborating on creating a space on the fediverse that suites the need of blogging and articles well

I keep seeing this again and again, it increasingly looks like an attempt to take credit for solving the problem with articles in ActivityPub. But the problem doesn't exist, it is literally a flaw in a single implementation that can be fixed with a single line of code.

There are, of course, real problems with rich content. How to prevent tracking when remote media is embedded in the page? What to do with CSS? What about interactive content? Unfortunately, I haven't seen anyone talking about these problems.

This is a long form article, by the way. You can read it from Mastodon.

I think they should be displayed as replies by an automated ...

2025-08-03T18:45:10Z

In reply to nevent1q…csv5
_________________________

I think they should be displayed as replies by an automated actor.

Good, that's better than 400 (although Mitra will still ...

2025-08-02T09:27:07Z

In reply to nevent1q…9car
_________________________

Good, that's better than 400 (although Mitra will still deliver messages to those inboxes, because the user might get re-activated later).

Mastodon can't do this but FEP-e232 implementations can embed ...

2025-07-10T00:11:29Z

In reply to nevent1q…vxe9
_________________________

Mastodon can't do this but FEP-e232 implementations can embed multiple objects. I'll try to make two links here

[Video](https://spectra.video/videos/watch/b19447b3-148e-4edd-a485-69da9f46674b )

[Poll](https://graz.social/users/linos/statuses/114824779322828879 )

quoting
note1apl…l7vt

A question for all non-Note focused #ActivityPub developers and thinkers:

Should we ever think of a way how to embed ActivityPub objects into others (in the content)? E.g. embedding a Question object within a long Article?

Moved to @bonfire@bonfire.cafe (npub1lzd…urpr) Matthias Pfefferle (npub1jwr…7v3w) 🫧 Social coding commons (npub12sq…6w0r) Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸 (npub1764…nuj0)

Feel free to tag more people in replies!

I don't know, but such implementations may exist. Why do you ...

2025-07-09T21:54:58Z

In reply to nevent1q…vy4p
_________________________

I don't know, but such implementations may exist. Why do you want to remove FEP-e232 representation? It is a standard, implemented by many apps.

You can remove quoteUri and _misskey_quote, though. quoteUrl should be enough for compatibility with older software.

> Treating ActivityPub messages as plain JSON undermines ...

2025-07-06T12:55:52Z

In reply to nevent1q…j72u
_________________________

> Treating ActivityPub messages as plain JSON undermines extensibility because it prevents the use of JSON-LD features like context definitions, leading to potential property name collisions and making it difficult for implementations to reliably interpret or extend messages.

No, treating ActivityPub as JSON doesn't undermine extensibility. ActivityPub is extended by adding new properties to JSON objects, and if you want to avoid collisions you can use URLs or reverse-DNS strings for property names. JSON-LD is not needed for that, it only complicates things for no reason.

[FEP-9098: Custom ...

2025-07-05T22:10:50Z

[FEP-9098: Custom emojis](https://codeberg.org/fediverse/fep/src/branch/main/fep/9098/fep-9098.md ) has been published.

#FEP #ActivityPub

SocialHub has been the most prominent place for cross-project ...

2025-07-03T00:22:56Z

In reply to nevent1q…hlrf
_________________________

SocialHub has been the most prominent place for cross-project collaboration for years. This is where the FEP process was born, after all. I suspect that the need to create an account there was a major barrier to entry, but this is no longer the case as the forum supports ActivityPub.

> Cross-project forums like SocialHub can then have a dedicated category for each software they know about

There is such category already: https://socialhub.activitypub.rocks/c/software/14

It appears to be not federated, though.

-----

Aside:

> For the size of the group [working on federating long form articles], which as you say is not large

I wonder what they meant by this. There are lots of projects that support long form content.

There was a minor issue on my side, which I fixed. It was caused ...

2025-07-02T22:32:48Z

In reply to nevent1q…8xcp
_________________________

There was a minor issue on my side, which I fixed. It was caused by a difference between quoteUrl and Link.href (the value of quoteUrl seems to be object's "url" instead of ID).

Now everything works as expected 👍

The mediaType property is missing in the FEP-e232 link. Its value ...

2025-07-01T20:07:57Z

In reply to nevent1q…tcxa
_________________________

The mediaType property is missing in the FEP-e232 link. Its value should be application/ld+json; profile="https://www.w3.org/ns/activitystreams";: https://codeberg.org/fediverse/fep/src/branch/main/fep/e232/fep-e232.md#object-links

You might also want to add quoteUrl property, because some platforms don't support FEP-e232 links yet (e.g. Misskey).

Added Nomadic ActivityPub page to the ap-next repository: ...

2025-06-30T19:53:20Z

Added **Nomadic ActivityPub** page to the ap-next repository:

https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md

This is a brief summary of the work we've done. Feedback is welcome!

#NomadicIdentity #fep_ef61

Yes, I replied to a Wafrn user: ...

2025-06-29T19:41:54Z

In reply to nevent1q…jjtm
_________________________

Yes, I replied to a Wafrn user: https://is.lonewolf.zone/fediverse/post/337336db-f3e6-40d2-a00f-d7144f1245bb

This is probably because Mitra sends Accept(Follow) activity ...

2025-06-29T00:55:05Z

In reply to nevent1q…j4ne
_________________________

This is probably because Mitra sends Accept(Follow) activity where object is the ID of the Follow activity. I don't know why, but some applications expect it to be something else.

Are you on Wafrn? Test.

2025-06-28T18:04:37Z

In reply to nevent1q…nxpa
_________________________

Are you on Wafrn? Test.

My #ActivityPub developer guide moved to another repository: ...

2025-06-27T23:40:25Z

My #ActivityPub developer guide moved to another repository: https://codeberg.org/silverpill/ap-next/src/branch/main/guide.md

It started as a [FEP](https://codeberg.org/silverpill/feps/commits/branch/main/d85d ), but has evolved into something bigger.

About the repository:

As stated in the readme, **ActivityPub Next** is a project dedicated to evolving the ActivityPub protocol.

Currently it only contains the developer guide, but I think that more content will be added over time.

Published a post: ...

2025-06-19T20:55:16Z

In reply to nevent1q…nz93
_________________________

Published a post: https://mitra.social/.well-known/apgateway/did:key:z6MknVmyPtQmD2SaGnqyGgTVEqfqkkJJnY3YVKBmbzSUNCcX/objects/019789f7-e35f-6b3b-b316-07f13788c32e

Starting with version 4.5.0, Mitra expands collections when it ...

2025-06-19T20:30:03Z

Starting with version 4.5.0, Mitra expands collections when it distributes activities submitted to FEP-ae97 outboxes. That means portable actors like NomadPub (npub1akg…ycjf) can create public posts, and they will be delivered to all their followers.

#fep_ae97

RE: https://mitra.social/objects/019784da-f56f-c1ee-b0f5-79f2dd9cb5de

quoting
note1rdr…0let

#Mitra v4.5.0

https://codeberg.org/silverpill/mitra/releases/tag/v4.5.0
https://codeberg.org/silverpill/mitra-web/releases/tag/v4.5.0

- FEP-ae97 activities targeted at followers collection are delivered to all known followers (previously only direct addressing was supported).
- Compatibility with [Tusky](https://tusky.app/ ) client.
- Compatibility with [Fedi Circles](https://data.natty.sh/fedi-circles ).
- Mentions, hashtags and quote links lead to local pages, even when opened in a new tab.
- New translation: [Vietnamese](https://translate.codeberg.org/projects/mitra-web/main/vi/ ).

I made a post for you too @npub1akg…ycjf @npub1xse…lgk3

2025-06-15T22:53:57Z

In reply to nevent1q…938y
_________________________

I made a post for you too

NomadPub (npub1akg…ycjf) wakest ⁂ (npub1xse…lgk3)

It might be showing a cached version. @npub1akg…ycjf just made ...

2025-06-15T22:15:47Z

In reply to nevent1q…a66u
_________________________

It might be showing a cached version.

NomadPub (npub1akg…ycjf) just made a public post mentioning you, do you see it?

Which Fediverse services can see this actor? @npub1akg…ycjf It ...

2025-06-15T22:00:15Z

Which Fediverse services can see this actor? NomadPub (npub1akg…ycjf)

It looks like Mastodon can't parse it, what about others?

That's fine, my posts were not about any particular services. ...

2025-06-14T19:34:42Z

In reply to nevent1q…ww8q
_________________________

That's fine, my posts were not about any particular services. I am concerned with false statements in widely shared articles.

Fediverse (npub1lda…94jz)

>Mastodon will begin displaying quote posts from other servers ...

2025-06-14T14:30:30Z

>Mastodon will begin displaying quote posts from other servers and software

Anyone knows what it really means?

Initial version of their FEP was based on [FEP-e232](https://codeberg.org/fediverse/fep/src/branch/main/fep/e232/fep-e232.md ), but in the end they decided to drop it and introduce a new property, quote. I guess "other servers" actually means "other Mastodon servers".

The reason for introducing a new property, by the way, was

> We believe each of those to have significant drawbacks, such as re-using a namespace that has no definition for them, implying the value is an URL or URI, or using an unusual naming scheme

-- https://codeberg.org/fediverse/fep/src/commit/23e40d1459155af2a1160d57904bd7c6da2f63f7/fep/044f/fep-044f.md#compatibility-with-other-quote-implementations

So now we all need to support an additional representation because the color of the bikeshed was wrong.

RE: https://mastodon.social/users/Gargron/statuses/114625891198289108

quoting
note1x5n…pd43

When we released post editing for #Mastodon, we first released a version that supported processing and displaying edits incoming from other servers, before releasing a version that flipped a switch allowing anyone to make edits. We're taking an identical approach with quote posts, as the upcoming 4.4 version of Mastodon will begin displaying quote posts from other servers and software. Once this is widely deployed on the network, 4.5 will bring the long awaited ability to quote posts.

>the Fediverse today lacks any kind of commerce This is not ...

2025-06-11T16:29:48Z

In reply to nevent1q…4uy9
_________________________

>the Fediverse today lacks any kind of commerce

This is not true. I already [told](https://lemmy.ml/comment/13660763 ) you about that when you published a promotional post about [subclub](https://wedistribute.org/2024/09/subclub-paid-subscriptions/ ) (which didn't last), but now you're saying it again. Why?

Fediverse (npub1lda…94jz)

Did you consider any other technologies besides Flutter and React ...

2025-06-11T14:55:34Z

In reply to nevent1q…qkkz
_________________________

Did you consider any other technologies besides Flutter and React Native?

APx is finally available on crates.io / docs.rs ...

2025-06-08T17:45:42Z

APx is finally available on crates.io / docs.rs

https://docs.rs/apx_sdk/latest/apx_sdk/

This is an ActivityPub library used internally in Mitra and in other my projects.

Unlike some other ActivityPub libraries, this library is low-level. It doesn't restrict what databases or frameworks could be used, and doesn't care about object types or properties. There are only URIs, keys, signatures, JSON documents and HTTP requests.
It also contains primitives for building nomadic applications ([FEP-ef61](https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md )).

The license is AGPL-3, but I might consider changing it to a more permissive one.

#apx #activitypub #rust

It's working, thanks

2025-06-08T17:09:14Z

In reply to nevent1q…6hhn
_________________________

It's working, thanks

Something is wrong with this Video. It has a https ID, but ...

2025-06-07T12:33:10Z

In reply to nevent1q…qrpf
_________________________

Something is wrong with this Video. It has a https ID, but attributed to http actors:<code> "attributedTo": [
{
"id": "http://bengo.tube/accounts/bengo";,
"type": "Person"
},
{
"id": "http://bengo.tube/video-channels/bengo.tube";,
"type": "Group"
}
],
</code>

Fedi devs should keep in mind that ...

2025-06-02T12:55:11Z

In reply to nevent1q…e76e
_________________________

Fedi devs should keep in mind that [FEP-0837](https://codeberg.org/fediverse/fep/src/branch/main/fep/0837/fep-0837.md ) exists, which is basically the same protocol but built on top of ActivityPub instead of HTTP.
It is also not limited to paywalling.

This reminds me of media access control mechanism in ...

2025-06-01T20:50:03Z

In reply to nevent1q…erkv
_________________________

This reminds me of media access control mechanism in [streams](https://codeberg.org/streams/streams ).

I don't remember how it is implemented (it has something to do with access tokens), maybe Mike Macgirvin 🖥️ (npub1k90…q43y) could chime in.

Do you need it for a fediverse application? ...

2025-06-01T18:45:22Z

In reply to nevent1q…xuku
_________________________

Do you need it for a fediverse application?

[FEP-0837](https://codeberg.org/fediverse/fep/src/branch/main/fep/0837/fep-0837.md ) can be used for federated payments, and it is provider agnostic.