Nostr notes by silverpill

>dockerslop For interpretable programming languages (e.g. ...

2026-10-24T14:31:50Z

In reply to nevent1q…hz65
_________________________

>dockerslop

For interpretable programming languages (e.g. Python), non-docker setups may be too difficult to maintain so developers simply don't bother. Any OS update on the user side may break their setup. Any library update on the maintainer side may break some user's setup. It never ends.

Isn't it a feature of all Discourse forums?

2026-10-16T17:56:39Z

In reply to nevent1q…k8p0
_________________________

Isn't it a feature of all Discourse forums?

Huh? ActivityPub already supports private groups

2026-10-16T08:36:48Z

In reply to nevent1q…vx75
_________________________

Huh? ActivityPub already supports private groups

I think the most straightforward way to do this is to make an ...

2026-10-02T17:51:22Z

In reply to nevent1q…ayxk
_________________________

I think the most straightforward way to do this is to make an anonymous group. This is what they did at FChan.

A board is an actor. All messages on board are attributed to the board actor, real authors are hidden.

Nostr event nevent1qqs97xwgms7lpjejgure5xw9ctjp3pvye2gfmwfs35nkf74tmgtdqhszyq53rmwzuq434d3nrw57p3e78rvt9mnxkt3rftraw0lx7ync76u2jthrz7e

2026-10-01T20:19:17Z

https://ipshipyard.com/blog/2026-the-end-of-ipfs-at-shipyard/

> Projects maintained by Shipyard will no longer have dedicated maintainers responsible for new features, bug fixes, releases, or long-term stewardship. These include: Kubo, Helia, Boxo, Rainbow, IPFS Desktop, IPFS Companion, Someguy, Service Worker Gateway, IPFS Check, and others.

🥀

This will be my excuse for removing the IPFS integration from Mitra in 6.0 release

I am not sure if I understood your example correctly, but here is ...

2026-09-30T13:03:43Z

In reply to nevent1q…kgvf
_________________________

I am not sure if I understood your example correctly, but here is how it all works with FEP-171b / Conversation Containers:

- A follows B
- C comments on B's post (Create activity)
- B generates Add<Create> activity and sends it to A
- A receives Add and adds C's comment to their copy of the conversation

If C is banned for spam (and their comment removed):

- B removes C's comment (Delete activity)
- B generates Add<Delete> activity and sends it to A
- A receives activity and removes C's comment from the conversation

I concur, but what capabilities you're interested in? Almost ...

2026-09-30T10:59:33Z

In reply to nevent1q…ah8y
_________________________

I concur, but what capabilities you're interested in?
Almost everything in ActivityPub could be done peer to peer, without a relay in the middle.

This can be done with inbox forwarding or special activities ...

2026-09-30T08:38:51Z

In reply to nevent1q…494l
_________________________

This can be done with inbox forwarding or special activities ([FEP-171b](https://codeberg.org/fediverse/fep/src/branch/main/fep/171b/fep-171b.md ) or [FEP-1b12](https://codeberg.org/fediverse/fep/src/branch/main/fep/171b/fep-171b.md )).

Selective relays may be used for other things though. There is https://github.com/dtp-mstdn-jp/selective-relay that apparently can filter activities by hashtags, domains and number of attachments

Private groups? Some fedi apps have had them for a long time ...

2026-09-27T15:41:54Z

In reply to nevent1q…r4fk
_________________________

Private groups? Some fedi apps have had them for a long time (e.g. Hubzilla), but the work on interoperable solutions didn't start until recently, when support for private communities was added to Lemmy.

Here's another cool project: https://github.com/maddyunderstars/shoot

There are many interesting apps being built that are based on ...

2026-09-26T22:24:38Z

In reply to nevent1q…dkx3
_________________________

There are many interesting apps being built that are based on federated groups, I want to make mitra compatible with them. For example this matrix bridge: https://github.com/Haven-Organization/matrix-appservice-activitypub

Yes, I plan to implement private groups where only members can ...

2026-09-26T22:20:06Z

In reply to nevent1q…j9eg
_________________________

Yes, I plan to implement private groups where only members can create posts. One idea I had is a group for mitra admins where we can discuss new features. Idk what else, this is a building block, maybe people will create alt frontends that work as forums or chat apps.

> a FEP

I am writing one about groups:

https://codeberg.org/fediverse/fep/src/branch/main/fep/5219/fep-5219.md

> All hashes and public keys are cached by the client[s] The ...

2026-09-24T20:28:16Z

In reply to nevent1q…35lu
_________________________

> All hashes and public keys are cached by the client[s]

The cache of a hosted web client can easily be manipulated by an instance admin. But if clients are independent, this might be a good solution (depends on your security requirements).

> public auditing

Bluesky's [did:plc](https://github.com/did-method-plc/did-method-plc ) is a good example of this. It's a centralized server but anyone can view and audit the ledger.

So, what kind of forum do you imagine? If there is a single ...

2026-09-24T19:47:46Z

In reply to nevent1q…57vn
_________________________

So, what kind of forum do you imagine? If there is a single instance, then there would be no peers who replicate the hashchain and do the verification. This means an admin can rewrite history

> (A delete or an edit is a visible break in the hash chain) I ...

2026-09-24T16:59:09Z

In reply to nevent1q…ht3c
_________________________

> (A delete or an edit is a visible break in the hash chain)

I didn't notice that yesterday.

A traditional hash chain can't have breaks, e.g. you can't remove a commit from git history without changing all subsequent commit hashes.

Mitra now can host federated groups - in the same way Lemmy, ...

2026-09-23T14:51:42Z

In reply to nevent1q…e0td
_________________________

Mitra now can host federated groups - in the same way Lemmy, PieFed, NodeBB and other forums do. The mechanism we all use is compatible with my nomadic identity proposals.

However, nomadic identity doesn't use hashchains, it relies solely on signatures. I considered content-addressing early on but decided against it because in my opinion social data should not be immutable.

What kind of forum do you want to build? Centralized forum with a fully verifiable history is an unusual requirement.

But only .onion and .i2p are truly unstoppable.

2026-09-08T14:05:20Z

In reply to nevent1q…x0na
_________________________

But only .onion and .i2p are truly unstoppable.

The most censored sites use .cc and .st

2026-09-08T13:57:13Z

In reply to nevent1q…xewm
_________________________

The most censored sites use .cc and .st

Those who use the right tools certainly have higher chances of ...

2026-09-06T09:23:13Z

In reply to nevent1q…c85h
_________________________

Those who use the right tools certainly have higher chances of making it than those who just complaining

> Autistici/Inventati’s Press Release, 5 September 2026 > ...

2026-09-05T22:46:53Z

> Autistici/Inventati’s Press Release, 5 September 2026
> **Banca etica shuts down A/I funds**

-- https://keepitfree.ai/announcements/banca-etica-shuts-down-a/i-funds/

This is not surprising. Sanctions make you toxic - nobody wants to be accused of terrorism financing or money laudnering. Your bank accounts are frozen and centralized services deplatform you (some may remember [TornadoCash](https://home.treasury.gov/news/press-releases/jy0916 ) and other similar cases).

There are two solutions to this problem: physical cash and decentralized digital currencies. Physical cash only works at small scale, and in some places it is gradually being phased out. The second solution is better. However, [A/I donation page](https://www.inventati.org/donate ) says "Sorry, but we don’t accept Bitcoin" and links to a [post](https://cavallette.noblogs.org/2013/07/8333#eng ) from 2013 explaining that bitcoins "do not give any specific advantage compared to a normal bank account" and is a "pump & dump done to dupe the ultra-libertarian anarco-capitalists".

Well, fortunately, *ultra-libertarian anarco-capitalists* didn't see it that way and have spent all these years studying the blade building a parallel financial system which nobody can shut down - even US.

Bitcoin is not perfect but it is much better than a bank because no one can shut down your account. You shouldn't be accepting donations in Bitcoin, though - that would put donors at risk. The chain is transparent and the privacy tricks that exist in Bitcoin (e.g. mixers) are generally counter-productive when you're facing a powerful adversary because they make you stand out of the crowd. The real purpose of Bitcoin is to be a bridge between fiat money and Monero, where everything remains hidden: the sender, the recipient and the transcation amount. Besides meeting in person, it is the only safe way to buy a coffee for a Specially Designated Global Terrorist cavallette (npub1vs3…kl0n)

If I am not mistaken, it was a static site generator before. Not ...

2026-09-05T21:58:35Z

In reply to nevent1q…tlhr
_________________________

If I am not mistaken, it was a static site generator before. Not sure why they call it a web framework now

I haven't and their website makes me want to close the tab ...

2026-09-05T21:51:00Z

In reply to nevent1q…y9le
_________________________

I haven't and their website makes me want to close the tab https://astro.build

Can you quote me?

2026-09-03T22:18:23Z

In reply to nevent1q…y83c
_________________________

Can you quote me?

Is there anyone from Mastodon? Do you see the quote? (I'm ...

2026-09-03T22:11:05Z

Is there anyone from Mastodon? Do you see the quote?

(I'm testing [stateless mastodon quote approvals](https://codeberg.org/silverpill/mitra/pulls/257 ))

RE: https://mitra.social/objects/01a04a26-eede-72b0-a5e9-f244c3ff2142

quoting
note1rjp…ygrm

#

Week in Fediverse 2026-08-28**Servers**

- [Hollo v0.9.13](https://github.com/fedify-dev/hollo/releases/tag/0.9.13 )
- [gush! v0.0.41](https://gush.taks.garden/note/b0538de9-e791-4908-9d61-85af4ecbaf25 )
- [tootik v0.25.0](https://github.com/dimkr/tootik/releases/tag/v0.25.0 )
- [Mitra v5.10.0](https://mitra.social/objects/01a03596-55ae-7562-96a7-830312413610 )
- [Pixelfed v0.12.9](https://mastodon.social/@pixelfed/117151119680920999 )
- [Hollo v0.9.15](https://github.com/fedify-dev/hollo/releases/tag/0.9.15 )
- [Funkwhale v2.0.10](https://social.funkwhale.audio/@funkwhale/117166745628942469 )
- [PieFed v1.7.13](https://piefed.social/c/piefed_meta@piefed.social/p/2321285/piefed-1-7-13-is-released-with-knights-of-new-mode )
- [tootik v0.25.1](https://github.com/dimkr/tootik/releases/tag/v0.25.1 )
- [NeoDB v0.17.8](https://github.com/neodb-social/neodb/releases/tag/0.17.8 )

**Clients**

- [Pachli v3.8.1](https://mastodon.social/@pachli/117158059641727238 )
- [Fedilab v3.43.2](https://toot.fedilab.app/@apps/117174081802575922 )
- [RaccoonForFriendica v1.1.0](https://github.com/LiveFastEatTrashRaccoon/RaccoonForFriendica/releases/tag/1.1.0 )

**For developers**

- [Fedify v2.3.6](https://hackers.pub/@fedify/2026/CVE-2026-69132 )

**Protocol**

- [FEP-49eb: Batched Inbox Delivery](https://fediverse.codeberg.page/fep/fep/49eb/ )

**Articles**

- [A crawler wanted to know who talks to whom on our server](https://www.martinmuc.de/blog/crawler-who-follows-whom/ )
- [The Problems and Successes of Fediverse Comments on my blog](https://stuff.interfree.ca/2026/08/23/fediverse-comments.html )
- [The Fediverse is Throwing a Music Festival](https://wedistribute.org/2026/08/the-fediverse-is-throwing-a-music-festival/ )

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/01a0269e-d9e5-7a03-a62d-6ef77099e4a7

EmojiReact is used by Pleroma. Idk about others, I started with ...

2026-09-03T19:29:22Z

In reply to nevent1q…7upn
_________________________

EmojiReact is used by Pleroma.

Idk about others, I started with EmojiReact but then switched to Like - Mastodon users can see a "favorite" that way.

There link was there before you removed it. And I have better ...

2026-08-30T19:30:35Z

In reply to nevent1q…n958
_________________________

There link was there before you removed it. And I have better things to do than opening tickets

#APx v0.27.0 https://docs.rs/apx_sdk/0.27.0/apx_sdk/index.html ...

2026-08-29T15:44:27Z

#APx v0.27.0

https://docs.rs/apx_sdk/0.27.0/apx_sdk/index.html

Starting with this version, all DID methods are allowed in the authority component of an 'ap' URI. This change was made to enable experiments with DID methods other than did:key.

Full changelog: https://codeberg.org/silverpill/mitra/src/tag/apx-v0.27.0/apx_sdk/CHANGELOG.md

I probably already said that - I don't like the idea of ...

2026-08-25T18:38:29Z

In reply to nevent1q…2yne
_________________________

I probably already said that - I don't like the idea of 3-stage process. This proposal was accepted and now reflects how SocialWG operates in practice:

https://swicg.github.io/charters/stage-process

According to the document, FEPs are at the same level as blog posts. Even a successful and widely implemented FEP needs a "champion" who will sign [CLA](https://socialhub.activitypub.rocks/t/fep-5219-groups-and-permissions/8855/8 ) and will present the FEP to the community group, which will bikeshed it to death. Even if it passes the initial filter of the community group, the document still needs to be reviewed by the working group, which is invite-only.

This is a ridiculous amount of red tape.

Compare this to the promise of the FEP process: you publish a FEP -> you convince other developers -> it becomes a de-facto standard.

Rimu (npub1vwf…95aa) elle (npub17fh…fvlu)

I think the real reason is the association with another thing I ...

2026-08-25T12:45:51Z

In reply to nevent1q…a8pn
_________________________

I think the real reason is the association with another thing I am working on: nomadic identity. [Some people don't like it](https://github.com/w3c/activitypub/issues/573 ), although it is not clear why. It is an optional protocol extension, and similar features in ATProto protocol don't cause any controversy.

This guide is just a summary of what I have learned while working ...

2026-08-23T17:14:22Z

In reply to nevent1q…j07z
_________________________

This guide is just a summary of what I have learned while working on my ActivityPub project.

The [ap-next developer ...

2026-08-23T15:57:35Z

The [ap-next developer guide](https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md ) was removed from the https://activitypub.rocks website: https://github.com/swicg/activitypub.rocks/issues/63 (by *the father of the Fediverse*, no less).

The reason:

> It's a fork outside the SocialCG.

This is utter nonsense. The guide refers to the original ActivityPub specification and even to SocialCG reports covering Webfinger and HTTP signatures. The other ap-next project is [NomadPub](https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md ) - a collection of FEPs that significantly expand the capabilities of the protocol but don't diverge from the original spec.

However, since dissenting opinions about the present and the future of ActivityPub are now openly censored, a fork may indeed be necessary.

# Say goodbye to Linked Data ...

2026-08-22T00:02:55Z

#

Say goodbye to Linked Data Signatureshttps://blog.joinmastodon.org/2026/08/mastodon-4.7/

> We now support verifying FEP-8b32 Object Integrity Proofs using either eddsa-jcs-2022 or mldsa44-jcs-2024.

The latest version of Mastodon can verify [FEP-8b32](https://fediverse.codeberg.page/fep/fep/8b32/ ) integrity proofs, which replace outdated Linked Data Signatures.

Docs: https://docs.joinmastodon.org/spec/security/#fep-8b32

#activitypub #fedidev #fep_8b32

Because being a node operator is not an easy job. This is true ...

2026-08-20T14:32:20Z

In reply to nevent1q…x9us
_________________________

Because being a node operator is not an easy job. This is true for any complex network, and social networks are probably the most complex.

My point, however, is that you don't need a new protocol if you want to run your own node. It's already possible with ActivityPub.

I thought it's all about friend to friend and webs of trust.

2026-08-20T13:43:43Z

In reply to nevent1q…hw2q
_________________________

I thought it's all about friend to friend and webs of trust.

This simply means that everyone is an admin. Sounds good in ...

2026-08-20T13:37:04Z

In reply to nevent1q…4677
_________________________

This simply means that everyone is an admin. Sounds good in theory but doesn't work at scale.

Friend-to-friend networks can be built on ActivityPub too.

2026-08-20T13:34:38Z

In reply to nevent1q…9z0m
_________________________

Friend-to-friend networks can be built on ActivityPub too.

>Freenet is a peer-to-peer platform for apps that no company ...

2026-08-20T13:31:31Z

In reply to nevent1q…ydgc
_________________________

>Freenet is a peer-to-peer platform for apps that no company controls.

In general, I think the world doesn't need more protocols. Everything can be built on top of ActivityPub.

I remember Freenet from the 2000s, it was an interesting project. ...

2026-08-20T13:28:45Z

In reply to nevent1q…qn8t
_________________________

I remember Freenet from the 2000s, it was an interesting project. I tried it once but didn't keep using it.

This Freenet looks like a vibe-rewrite in Rust, even whitepaper is vibe-slopped: https://github.com/freenet/paper-1/commits/main/. Apparently, the project maintainer went completely bananas.

It may feel like too much white space on a big screen but simple ...

2026-08-19T08:03:25Z

In reply to nevent1q…07ax
_________________________

It may feel like too much white space on a big screen but simple interfaces work better on small screens.

Do you still use mitra-web or switched to another app?

I think Mastodon's new UI design is good. It appears to be ...

2026-08-18T23:09:19Z

I think Mastodon's new UI design is good. It appears to be evolving in the same direction as #Mitra. For example, our "Lists" are already called "Custom feeds" and there is a hidden "Explore" page which will soon be added to the sidebar, replacing "Local", "Federated" and "Profile directory" (this is to free some space for new features such as groups)

RE: https://mastodon.social/users/Mastodon/statuses/117117221397911074

quoting
note1w53…4t5m

After publishing the results of Discovery Week, we can now give you a first sneak peak at Mastodon 5.0, our next big version. It will bring a new visual look to your screens, a refreshed and calmer layout, as well as a new composer.

https://blog.joinmastodon.org/2026/08/5.0-laying-the-foundation/

#mastodon #mastodon5.0

Mitra can verify signatures on incoming requests (FEP-844e is ...

2026-08-18T21:14:24Z

In reply to nevent1q…cqc3
_________________________

Mitra can verify signatures on incoming requests (FEP-844e is used to advertise this capability), but it doesn't use RFC-9421 when it signs outgoing requests.

Yes, I think we can just ignore joinRealtimeChannel. It is marked ...

2026-08-14T21:05:35Z

In reply to nevent1q…lsw9
_________________________

Yes, I think we can just ignore joinRealtimeChannel. It is marked as "experimental" in the docs, anyway

So, I think the biggest problem with this proposal is that it ...

2026-08-14T20:28:03Z

In reply to nevent1q…u5nd
_________________________

So, I think the biggest problem with this proposal is that it requires a publicly accessible HTTP server. Is there a good reason for that?

WebXDC, for example, is designed for offline first apps. I am reading WebXDC docs right now and it seems to be compatible with ActivityPub. Maybe we should work on this instead?

It depends on the terms of the agreement. No agreement should be ...

2026-08-13T16:58:22Z

In reply to nevent1q…csnn
_________________________

It depends on the terms of the agreement.

No agreement should be necessary, though - FEPs are in public domain, they can be implemented by anyone and can be included in other documents without restrictions.

Also, it is not clear what is the benefit of submitting a FEP to W3C. I already submitted it to the FEP repository, and this was always enough for everybody, including major players like Mastodon and Lemmy. These task forces look like totally unnecessary bureaucracy, I don't really have time for that.

julian (npub1mlk…nu5a)

The last time I checked, not much progress had been made there. ...

2026-08-13T15:06:32Z

In reply to nevent1q…xfrz
_________________________

The last time I checked, not much progress had been made there. However, they are welcome to provide feedback on this FEP.

>I nominate everybody in this thread. I am completely serious ...

2026-08-12T18:19:59Z

In reply to nevent1q…fckf
_________________________

>I nominate everybody in this thread.

I am completely serious - only Dark Fedi people can be trusted with maintenance of the most important communication protocol of the 21th century.

I nominate everybody in this thread. I agree that gatekeeping is ...

2026-08-12T18:15:50Z

In reply to nevent1q…gmyq
_________________________

I nominate everybody in this thread.

I agree that gatekeeping is necessary, but it should be done with care. In my opinion "the culture" is not worth preserving, the network should consist of hundreds of bubbles separated by language, geography and political preferences.

Yes, and you can just ignore all of this. The part on the network ...

2026-08-12T17:59:42Z

In reply to nevent1q…wvda
_________________________

Yes, and you can just ignore all of this. The part on the network that is free of blocklists is big enough to be interesting. What this part of the network doesn't have, apparently, is people who will be interested in growing it.

I think there is a big difference between being defederated and ...

2026-08-12T17:46:49Z

In reply to nevent1q…np3h
_________________________

I think there is a big difference between being defederated and being deplatformed. In fediverse you don't need to start from scratch, you can move between servers and you can start your own.

Some people may not like you and be very loud about it, but ultimately they only have as much power as others give them. The best strategy is to ignore the haters and keep doing your own thing.

Mitra doesn't support scopes, but I can start adding them if ...

2026-08-12T13:22:32Z

In reply to nevent1q…fd22
_________________________

Mitra doesn't support scopes, but I can start adding them if needed.

I saw your FEP draft, by the way. Is it ready for review?

Awesome, thank you!

2026-08-12T13:05:08Z

In reply to nevent1q…07d4
_________________________

Awesome, thank you!

It still returns 401 for any activity

2026-08-12T12:18:17Z

In reply to nevent1q…8atj
_________________________

It still returns 401 for any activity

It doesn't require authorized fetch

2026-08-12T11:43:20Z

In reply to nevent1q…6vqn
_________________________

It doesn't require authorized fetch

No, I think it is a useful feature - you can see when a new ...

2026-08-12T11:19:14Z

In reply to nevent1q…8gv7
_________________________

No, I think it is a useful feature - you can see when a new market is created.

I can't follow @npub15ce…50pt, the server returns 401 ...

2026-08-12T11:06:12Z

In reply to nevent1q…8cg4
_________________________

I can't follow Haruspex (npub15ce…50pt), the server returns 401

[@pernia](https://cum.salon/users/pernia )

Correct - the censorship infrastructure has not been dismantled ...

2026-08-11T18:59:26Z

In reply to nevent1q…ssgk
_________________________

Correct - the censorship infrastructure has not been dismantled and another major wave is likely coming. The author even recognizes that LLMs will make it much worse than the previous one.

But everyone is still using centralized platforms like there is no tomorrow.

I know but it should also display a link. If "post ...

2026-08-11T08:13:03Z

In reply to nevent1q…3hfc
_________________________

I know but it should also display a link.

If "post pending" is confusing I can remove it.

Mastodon 4.7 beta supports [FEP-521a: Representing actor's ...

2026-08-10T21:07:26Z

Mastodon 4.7 beta supports [FEP-521a: Representing actor's public keys](https://fediverse.codeberg.page/fep/fep/521a/ ) and [FEP-8b32: Object Integrity Proofs](https://fediverse.codeberg.page/fep/fep/8b32/ ) (inbound only for now)

I also see [FEP-8967: Generating link previews for attached links](https://fediverse.codeberg.page/fep/fep/8967/ ) in the changelog.

It looks like FEP process is actually working?

RE: https://mastodon.social/users/MastodonEngineering/statuses/117071692327950548

quoting
note1e2e…egsn

We released the first beta for Mastodon 4.7 today. It contains very few user-facing changes, but contains significant reworks of the backend code to improve security and support new protocol features.

This update includes substantial database migrations that might take up to a couple of hours on very large servers, but will not cause downtime if the upgrade instructions are followed.

Release notes and upgrade instructions are available here: https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1

#mastoadmin

Yes, not everyone wants to be on a global public square. Small ...

2026-08-03T09:49:05Z

In reply to nevent1q…eklh
_________________________

Yes, not everyone wants to be on a global public square. Small private zero-cost friend-to-friend networks should also exist, and for those p2p is a good architecture.

The biggest problem for peer to peer ActivityPub is the fact that ...

2026-08-03T08:46:17Z

The biggest problem for peer to peer ActivityPub is the fact that ActivityPub is primarily a "pull" protocol. You need to fetch a remote actor before interacting with it. This is not feasible in the environment where nodes are intermittently online.

What if we used a special activity to request objects? I've described this idea in more detail in **Asynchronous object retrieval**:

https://codeberg.org/silverpill/feps/src/branch/main/aef6/fep-aef6.md

I think this mechanism, if combined with [self-authenticating](https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md ) objects, should make ActivityPub compatible with [store and forward](https://en.wikipedia.org/wiki/Store_and_forward ) protocols.

#p2p #dtn #fep_ef61

I added a list of recommended libraries to the ActivityPub ...

2026-08-02T21:56:12Z

I added a list of recommended libraries to the ActivityPub developer guide:

https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md#libraries

- [activity](https://codeberg.org/superseriousbusiness/activity ) (Go, used in GoToSocial)
- [Fedify](https://fedify.dev/ ) (JavaScript, used in Hollo and Ghost)
- [Fedipub](https://gitlab.com/fedipub/fedipub ) (Ruby, used in Manyfold)
- [activitypub_federation](https://github.com/LemmyNet/activitypub-federation-rust ) (Rust, used in Lemmy)
- [APx](https://docs.rs/apx_sdk/latest/apx_sdk/ ) (Rust, used in Mitra)

This list only includes libraries that are actually used somewhere. Libraries that are not used, or used in projects with too few users are not included.

#fedidev #activitypub

# Private groupsLately, I've been seeing various people ...

2026-07-31T20:17:28Z

#

Private groupsLately, I've been seeing various people claiming that fediverse doesn't have private groups. They often point to some task force at w3c that is supposedly working to fill the gap.

However, fediverse has had private groups for a very long time:

- [Hubzilla](https://info.hubzilla.hu/en/GroupsForumsCommunities.html ) channels. This project probably had private groups before ActivityPub. The implementation was later adapted for ActivityPub and refined in subsequent forks, [Streams](https://codeberg.org/streams/streams ) and [Forte](https://codeberg.org/fortified/forte ). It is now partially documented in [FEP-171b: Conversation Containers](https://codeberg.org/fediverse/fep/src/branch/main/fep/171b/fep-171b.md ).
- [Smithereen](https://smithereen.software/ ) groups. This implementation is documented in [FEP-400e: Publicly-appendable ActivityPub collections](https://codeberg.org/fediverse/fep/src/branch/main/fep/400e/fep-400e.md ) (published in 2021) and [FEP-db0e: Authentication mechanism for non-public groups](https://codeberg.org/fediverse/fep/src/branch/main/fep/db0e/fep-db0e.md ).
- [Lemmy](https://join-lemmy.org/ ) communities. Private groups were proposed in [Lemmy RFC 0005](https://github.com/LemmyNet/rfcs/blob/main/0005-private-communities.md ) and have been implemented in the development version. There is a test instance running this version (Lemmy v1.0b) at https://voyager.lemmy.ml/

There are probably other implementations that I am not aware of.

#Hubzilla #Smithereen #Lemmy

I think the cost of my audit will be at least half of what ...

2026-07-28T15:36:25Z

In reply to nevent1q…u0nf
_________________________

I think the cost of my audit will be at least half of what Sovereign Tech Agency (npub1yng…nhrk) offered for this work (€246,521.00):

https://www.sovereign.tech/tech/activity-pub

In XMR, of course.At the current rate, it's 418 XMR.

Special offer! 399.9 XMR until the end of July.

Grey Area (npub1hnh…gxx0)

Yes, but I don't like it. The specification is incomplete and ...

2026-07-27T22:37:40Z

In reply to nevent1q…rjes
_________________________

Yes, but I don't like it. The specification is incomplete and has some serious flaws.

Thanks a lot for reviewing it. Now that I understand the basics, ...

2026-07-27T22:09:14Z

In reply to nevent1q…qqhq
_________________________

Thanks a lot for reviewing it.

Now that I understand the basics, it's time to explore more complex schemes with perfect forward secrecy. I'll probably start with MLS and its "decentralized" variants.

Setting up a Forgejo instance: ...

2026-07-26T17:23:14Z

Setting up a Forgejo instance: https://code.mitra.social/silverpill/mitra

It will be mirroring repositories related to the #Mitra project. I don't plan to migrate from Codeberg right now, but it wouldn't hurt to have a self-hosted instance in case they decide to enforce the new anti-crypto policy.

This will also allow me to test the implementation of federation in Forgejo.

I can think of two scenarios where HPKE-level sender ...

2026-07-26T08:22:03Z

In reply to nevent1q…z6qg
_________________________

I can think of two scenarios where HPKE-level sender authentication or aad binding might be important:

1. The sender creates an activity that is attributed to somebody else, encrypts it, and sends to the recipient. This shouldn't be a problem, because the inner activity MUST be portable, and therefore required to have an integrity proof. A compliant recipient can't be fooled into thinking that misattributed activity is real.
2. Somebody (e.g. server operator) takes the fep0806:cipherText out of EncryptedActivity, and creates a new activity with the same fep0806:cipherText but different id, actor and/or to. This shouldn't be a problem either. In the worst case, the activity will be delivered to somebody else who will not be able to decrypt it. Replacing id and actor may be even a good thing (obfuscation).

> it was a giant mess of w3c specs.

It's an ever-expanding mess of W3C specs, RFCs and FEPs.

Integrity proofs are relatively new, they are described in Data Integrity W3C spec: https://www.w3.org/TR/vc-data-integrity/

Alright, I implemented the auth mode. It's not difficult, but ...

2026-07-25T19:44:26Z

In reply to nevent1q…d8yz
_________________________

Alright, I implemented the auth mode. It's not difficult, but it requires the actor of outer activity to be the same as the actor of inner (plaintext) activity. With base mode (5.1.1), the actor of outer activity could be different, which means we can hide the real sender.

Do you think it's worth doing this?

I think authentication of the sender at the HPKE level shouldn't be necessary because the inner activity is self-authenticating (includes integrity proof).

The documentation is incomprehensible. Meaningless ...

2026-07-24T18:58:31Z

In reply to nevent1q…wx8h
_________________________

The documentation is incomprehensible. Meaningless machine-generated walls of text.

As far as I can tell, "open social web" is what ...

2026-07-23T19:55:23Z

In reply to nevent1q…3at6
_________________________

As far as I can tell, "open social web" is what commercial platforms like WordPress and Ghost use instead of "fediverse".

Yes, proof covers all properties of the activity. But I can't ...

2026-07-23T19:30:59Z

In reply to nevent1q…pdt4
_________________________

Yes, proof covers all properties of the activity. But I can't omit encap_key, it is required by SetupBaseR function defined in section [5.1.1](https://www.rfc-editor.org/rfc/rfc9180.html#name-encryption-to-a-public-key )

I've read a bit more about DHKEM and now I am even more confused. Isn't encap_key an ephemeral key? The library I am using describes it as such:

https://docs.rs/hpke/latest/hpke/trait.Kem.html#tymethod.encap_with_rng

> Derives a shared secret and an ephemeral pubkey that the owner of the reciepint’s pubkey can use to derive the same shared secret.

This "ephemeral pubkey" is what I labeled as encap_key. It is later included in fep0806:cipherData

-----

I think it's okay to have no forward secrecy, the goal of this FEP is to describe a simple encryption mechanism that anyone can implement. I'll just warn readers about its weakness.

I assume this is "Authentication Using an Asymmetric Key" ...

2026-07-23T10:22:19Z

In reply to nevent1q…78qg
_________________________

I assume this is "Authentication Using an Asymmetric Key" (https://www.rfc-editor.org/rfc/rfc9180.html#name-authentication-using-an-asy)?

Because in "Encryption to a Public Key" mode, sender's key is not used.

If I understand the idea correctly, the ephemeral key would need to be added to fep0806:cipherData. That is, instead of encap_key | ciphertext it will be ephemeral_key_pub | encap_key | ciphertext.

> having the sender generate an ephemeral keypair (include the ...

2026-07-22T21:06:53Z

In reply to nevent1q…cq6q
_________________________

> having the sender generate an ephemeral keypair (include the public key envelope)

So the recipient will need to encrypt to this ephemeral key when replying?

A dedicated button for quoting is also an option. I just ...

2026-07-22T14:15:20Z

In reply to nevent1q…6kyt
_________________________

A dedicated button for quoting is also an option.

I just don't want to do this thing with drop down, it's horrible UX. I remember wasting a lot of time trying to find a button for quote posting in Soapbox. Somehow Mastodon made the same mistake (or maybe they both copied it from Twitter? Idk)

This is not going to happen, the button will stay in the menu. ...

2026-07-22T14:07:42Z

In reply to nevent1q…66zf
_________________________

This is not going to happen, the button will stay in the menu. But I may consider allowing quote posting from the home timeline.

No, I mean what should happen when you click on "Repost with ...

2026-07-22T13:53:06Z

In reply to nevent1q…cvs4
_________________________

No, I mean what should happen when you click on "Repost with comment" button.

How it should work? A popup window?

2026-07-22T13:35:03Z

In reply to nevent1q…sh4y
_________________________

How it should work? A popup window?

No, I think only members of Codeberg organization can vote. I ...

2026-07-22T13:27:46Z

In reply to nevent1q…2lq6
_________________________

No, I think only members of Codeberg organization can vote. I didn't even know this is being considered

> We also > explicitly> do not tolerate: > ... > ...

2026-07-22T12:28:41Z

In reply to nevent1q…67fw
_________________________

> We also > *explicitly*> do not tolerate:
> ...
> Content that harms the reputation of Codeberg, such as cryptocurrency related projects.

That's particularly funny. Nothing harms your reputation as much as policies inspired by stupid ragebait like web3isgoinggreat.com

Codeberg is banning "cryptocurrency projects": ...

2026-07-22T12:21:08Z

Codeberg is banning "cryptocurrency projects":

https://codeberg.org/Codeberg/org/pulls/1254#issuecomment-19820413

I don't know if Mitra qualifies as such, but I guess it is time to move to a self-hosted forge.

>If the proof covers all of that then it's not strictly ...

2026-07-22T07:23:37Z

In reply to nevent1q…n0dm
_________________________

>If the proof covers all of that then it's not strictly needed, but it's cheap paranoia.

Do you mean id/actor/to of a plaintext activity, or of an envelope (EncryptedActivity)?

My understanding is that the properties of an envelope have no effect on security. It can even have a different actor.

I added an example of a plaintext activity: https://codeberg.org/silverpill/feps/src/branch/main/0806/fep-0806.md#plaintext-activity

Also added HPKE mode to the parameter list - mode_base.

If you want a fully connected I2P instance, run ...

2026-07-21T11:54:17Z

In reply to nevent1q…yer8
_________________________

If you want a fully connected I2P instance, run [minimitra](https://codeberg.org/silverpill/minimitra ) as an I2P service and talk to clearnet instances via a gateway. I still don't understand why you want to devise a different solution for that problem.

http://mastodon.i2p

2026-07-21T10:22:37Z

In reply to nevent1q…yjfx
_________________________

http://mastodon.i2p

I added HPKE algorithm parameters to the FEP: ...

2026-07-21T10:18:29Z

In reply to nevent1q…myw6
_________________________

I added HPKE algorithm parameters to the FEP:

https://codeberg.org/silverpill/feps/src/branch/main/0806/fep-0806.md#algorithms

> KEM: DHKEM(X25519, HKDF-SHA256)
> AEAD: ChaCha20Poly1305
> KDF: HKDF-SHA256
> "info" string: fep-0806-info
> "aad" string: fep-0806-aad

Does it look right?

KEM/AEAD/KDF choices are not my preferences, I just copied them from another HPKE+ed25519 implementation.

Use PoW! Fediblock all onions except those where hostname starts ...

2026-07-20T21:04:36Z

In reply to nevent1q…lzcg
_________________________

Use PoW! Fediblock all onions except those where hostname starts with fedi1337

From a user's perspective, gateways are the same as ...

2026-07-20T20:01:01Z

In reply to nevent1q…j7va
_________________________

From a user's perspective, gateways are the same as today's instances. You can run your own, or you can find a community/admin that fits you.

The difference is that content is not glued to it.

>Then I gather minimitra would have a different name depending ...

2026-07-20T19:03:42Z

In reply to nevent1q…85qf
_________________________

>Then I gather minimitra would have a different name depending on which gateway it reached me from (?)

Currently I require handles to be constructed from the address of actor's primary gateway (the first address in the Actor.gateways array). This is for compatibility with Mastadon.

If you're willing to break ties with Mastadon, then multiple handles shouldn't be a problem, I think. One for each gateway.

>Also I suppose you kind of have to register your name at each gateway because if someone wants to tunnel a name called cjd, and through my instance, that's a collision...

Yes, there's a registration process: https://codeberg.org/fediverse/fep/src/branch/main/fep/ae97/fep-ae97.md

>in your proposal everybody needs to convince one or more ...

2026-07-20T18:32:27Z

In reply to nevent1q…ne7s
_________________________

>in your proposal everybody needs to convince one or more gateways (who have HTTPS / ICANN domains) to host for them.

Relays can be onion services, eepsites, etc.

I think they don't even need to talk HTTP, although this HTTP servers are the most well-understood.

>If I'm not mistaken, you cannot just tag @somebody@someinstance.i2p and have that work, unless you've seen some message from them before which provides their gateways...

You can (example: minimitra (npub1a4k…u309) ), but normally webfinger address belongs to the primary gateway.

>Actually on second thought, I suppose names cannot be @name@instance.tld because there's no way to verify someone isn't lying about owning instance.tld,

Gateways are advertised via actor object, which servers can't tamper with. Verification of a handle is done by checking:

- Actor.gateways contains hostname
- acct:username@hostname resolves to Actor

>so names need to be key-like, like names in Nostr (?)

The canonical identifier of minimitra (npub1a4k…u309) is

ap://did:key:z6MkumzpDj1cYZD2GrBbVT86xL6CfPuyqWZAEXMfSqN9j3hf/actors/019c4320-5a91-59c3-0092-16976328fd80

> The problem: While numerous network transports exist (cjdns, ...

2026-07-20T17:52:04Z

In reply to nevent1q…fsen
_________________________

> The problem: While numerous network transports exist (cjdns, Yggdrasil, I2P, Tor, etc), and numerous name services exist (Namecoin, ENS, Unstoppable Domains, PKT, etc), almost all federation takes place over ICANN+IP because we currently have no way to federate across network boundaries, and ICANN+IP is the only thing that everybody has.

I already solved that problem: https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md

It is a transport-agnostic federation protocol that is backwards compatible with ActivityPub.

</thread>

Is there anything built on top of Noise for group messaging? As ...

2026-07-17T17:25:06Z

In reply to nevent1q…uq7t
_________________________

Is there anything built on top of Noise for group messaging?

As far as I can tell, HPKE is used in MLS

Hi, I tried to implement the mechanism described in the FEP and ...

2026-07-17T16:29:52Z

In reply to nevent1q…suut
_________________________

Hi, I tried to implement the mechanism described in the FEP and decided to use HPKE ([RFC-9180](https://www.rfc-editor.org/rfc/rfc9180.html )). What do you think of it?

HPKE seems to address the issue you pointed out back then: https://www.rfc-editor.org/rfc/rfc9180.html#name-forward-secrecy.

At least if used properly. The library I am using hard-codes "info" and "aad" strings: https://github.com/rustonbsd/ed25519-dalek-hpke/blob/27b010a9ae25ba4ce051510eadfd103a179dd715/src/lib.rs#L98-L104

Anyway, here's an updated FEP: https://codeberg.org/silverpill/feps/src/branch/main/0806/fep-0806.md

Râu Cao ⚡ (npub1z6g…3yt9) lain (npub134r…xq57) Sozialwelten (npub1va6…rdnr) Magical Cat (npub19n4…7fx8)

:vitalik: I need to tell him that Fediverse is better than ...

2026-07-10T10:58:51Z

In reply to nevent1q…8e9h
_________________________

:vitalik:

I need to tell him that Fediverse is better than Farcaster

Yes, Mastodon doesn't support normal quotes.

2026-07-03T17:48:28Z

In reply to nevent1q…ru07
_________________________

Yes, Mastodon doesn't support normal quotes.

New @npub1a4k…u309 release: ...

2026-07-03T15:29:56Z

New minimitra (npub1a4k…u309) release: [0.4.2](https://codeberg.org/silverpill/minimitra/releases/tag/v0.4.2 )

This version supports post edits. There are also some big changes under the hood that will allow me to copy features from Mitra to Mini with less effort in the future.

RE: https://mitra.social/.well-known/apgateway/did:key:z6MkumzpDj1cYZD2GrBbVT86xL6CfPuyqWZAEXMfSqN9j3hf/objects/019f2891-61e1-77b1-8638-10f33b4d4df9

quoting
note1edz…lrnc

Mitra Mini v0.4.2

https://codeberg.org/silverpill/minimitra/releases/tag/v0.4.2

- Post edits are supported.

I'm requesting final comments on [FEP-7628: Move ...

2026-07-02T10:30:52Z

I'm requesting final comments on [FEP-7628: Move actor](https://codeberg.org/fediverse/fep/src/branch/main/fep/7628/fep-7628.md )

#fep_7628 #fep #activitypub

>Who is a diehard BTC fan in 2026? The entirety of Nostr 😆 ...

2026-06-30T19:12:21Z

In reply to nevent1q…07l6
_________________________

>Who is a diehard BTC fan in 2026?

The entirety of Nostr 😆

>that this was probably the last "hype cycle".

I disagreed with that, and I still don't think that it was the last hype cycle. Grey/black markets, tax evasion, sanction evasion - none of this is going to disappear.

Discourse has an ActivityPub plugin: ...

2026-06-30T15:26:30Z

In reply to nevent1q…r5xc
_________________________

Discourse has an ActivityPub plugin: https://discourse.org/plugins/activitypub

This plugin, for example, is enabled on SocialHub https://socialhub.activitypub.rocks/ap/about (it's a forum for fediverse developers)

Discourse doesn't support following individual users. Only ...

2026-06-28T12:08:24Z

In reply to nevent1q…seyf
_________________________

Discourse doesn't support following individual users. Only categories can be followed.

[@angus](https://socialhub.activitypub.rocks/u/angus ) was against adding such feature but maybe this will be re-considered in the future.

>running the latest version of the AP Discourse plugin?

Yes, it was updated recently. I was also granted admin rights so now I can tweak federation settings if necessary.

>Is that still being worked on?

Yes, but the development has slowed down.

It looks like Mastodon is becoming more open to improvements now

2026-06-24T18:31:58Z

In reply to nevent1q…9qv2
_________________________

It looks like Mastodon is becoming more open to improvements now

Fun fact: this FEP was written after @npub1xsv…q6he said that ...

2026-06-16T19:09:19Z

In reply to nevent1q…zndd
_________________________

Fun fact: this FEP was written after Daniel Supernault (npub1xsv…q6he) said that he wants to implement payment links in Pixelfed. The second example ("payment link attached to an object") shows how it could be done.

ActivityPub's Follow activity is intended to be used on ...

2026-06-12T21:52:13Z

In reply to nevent1q…7r69
_________________________

ActivityPub's Follow activity is intended to be used on actors: https://www.w3.org/TR/activitypub/#follow-activity-outbox.

This is one of the reasons I proposed that "observer" actor. Another option is to use a custom activity (e.g. Watch).