Nostr notes by julian

I'm happy to announce that I have tagged the latest commit in ...

2024-06-21T17:35:18Z

I'm happy to announce that I have tagged the latest commit in the activitypub branch as v4.0.0-alpha. That designation means (mostly symbolically) that we have moved past the "proof-of-concept" stage of ActivityPub research and development, and into the alpha phase.

This release has been a long time in coming. Work on the ActivityPub integration back in late 2023, although work accelerated around February of this year. The initial idea was to create a proof-of-concept build of NodeBB that could communicate with other fediverse apps, and federate local content outwards for other applications to consume.

As it turns out, it is difficult to temper your expectations when using a protocol with implementations that expect richer compatibility than one can provide! It seemed like a disservice to only offer a minimal subset of expected features, and so we started a deeper integration into ActivityPub with the aims of providing full user-to-user following, notifications, and two-way communication.

In the interim, [FediForum](https://fediforum.org/ ) happened, causing us to once again re-evaluate our short-to-medium term plans. Devs from NodeBB and Discourse, along with many other interested parties, formed the SWICG Forum and Threaded Discussions Task Force, which aims to promote the use and broader acceptance of threaded discussions as a modality of communication, as opposed to the expected "microblogging" format.

##

What this release contains
The alpha build contains a fully-capable ActivityPub server instance, including:

<li>Two-way follow relationships between local and remote users</li>
<li>Two-way communication with fediverse content</li>
<li>A dedicated page (<code>/world</code>) to view remote content that is not organized into local categories</li>
<li>Categories followable from the fediverse (via FEP 1b12)</li>
<li>Integration with local flagging tools (reports sent to originating server)</li>
<li>Server-wide domain blocks (allow/deny list capability)</li>

##

What this release does not contain

<li>Support for emoji (images are federated out, which are sometimes stripped)</li>
<li>Support for non-public notes, as NodeBB does not currently have the facility to maintain or display them. Research on this problem is ongoing.</li>

##

Roadmap
Now that the alpha has been tagged and released, I will be making our working roadmap public → [you can take a look at it here](https://github.com/orgs/NodeBB/projects/1/views/1 )

I will be starting a new backlog/roadmap for beta items, and existing backlogged items will be carried over.

##

Final Thoughts
We wouldn't have even thought to implement ActivityPub if it were not for the funding granted to us by the NLNet foundation. They allowed us the runway to pursue the necessary R&D work, and we're pleased that everything has been pointing positively so far!

This entire time, it has been particularly satisfying to continually see the integration working on this instance (the NodeBB support forum). Expanding the reach of NodeBB beyond the confines of the "local" mindset and into the "global fediverse" mindset has been daunting, but is well worth the price of admission.

I'm happy to also say that now that we've proceeded to the alpha stage, it signifies a commitment toward a beta phase, then an RC, and then towards the release of NodeBB v4. ActivityPub has legs, and we're invested in making it work!

<li>This is a list</li> Some text <li>This is ...

2024-06-21T14:30:47Z

<li>This is a list</li>

Some text

<li>This is another list item
<ul>
<li>Oddly</li>
<li>test</li>
</ul>
</li>
<li>A third list item
<ul>
<li>hmm
<ul>
<li>what</li>
</ul>
</li>
</ul>
</li>

micro blogging = that crazy person screaming about Jesus on a ...

2024-06-21T12:23:34Z

In reply to nevent1q…7x6w
_________________________

micro blogging = that crazy person screaming about Jesus on a street corner

You are not wrong.. the current state of rejection handling in ...

2024-06-17T14:33:09Z

In reply to nevent1q…8yhf
_________________________

You are not wrong.. the current state of rejection handling in the fediverse is pretty abysmal.

Servers by-and-large in my experience send a 200-level HTTP response once the request is deemed processable (but before processing occurs). I imagine this is for throughput purposes (deferred processing, etc.) as well as to work around resource constraints and queued jobs for certain softwares.

But the really annoying part is if after the fact, the received object is not processable for any number of reasons, there's **literally no way to communicate this back**.

For example, let's say you send a non-public activity to NodeBB, which doesn't handle them. NodeBB sends you back a reject, but Mastodon will happily ignore it and you will be none the wiser.

NodeBB sends Reject activities, but I am pretty sure nobody listens to them.

Okay, so let's take this a step further and *not* send back the 200 right away... let's process it and reject with a 400 or 500... I don't know what would happen, but my pessimistic expectation is that I'll just be resent the same activity over and over again.

I've noticed that the software version is shown in the ...

2024-06-17T13:21:58Z

I've noticed that the software version is shown in the NodeInfo endpoint:

<li><a href="https://mastodon.online/nodeinfo/2.0">https://mastodon.online/nodeinfo/2.0</a></li>;
<li><a href="https://pixelfed.social/api/nodeinfo/2.0.json">https://pixelfed.social/api/nodeinfo/2.0.json</a></li>;

I've always believed that displaying the software version allowed malicious users to determine which vulnerabilities affect your software.

For example, NodeBB sends x-powered-by header, but only ever sets the value to NodeBB, this has been the case for many years.

The other line of thinking is that relying on security by obscurity is fallacious, but since it's only one *facet* of a broader security posture (the rest of it being keeping up with updates, writing as secure code as you can, reporting/bounty systems, audits, etc.), I honestly don't see a problem with transmitting as little information as I can.

The downside of hiding that information is that sites that gather statistics on fediverse software use wouldn't be able to discern software versions for NodeBB in their charts, but I don't think that's necessarily a problem.

that's huge news! Congrats @npub1vvk…83w8 ! Ah... also ...

2024-06-15T22:53:54Z

In reply to nevent1q…s7c0
_________________________

that's huge news! Congrats 洪民憙 (Hong Minhee) 🤏🏼 (npub1vvk…83w8) !

Ah... also hopefully there's a nice consultation fee involved.

well, if that was your concern then let me assuage your fear by ...

2024-06-13T19:10:27Z

In reply to nevent1q…7yek
_________________________

well, if that was your concern then let me assuage your fear by telling you that you won't need to sell or give away the laptop because if you need an upgrade you can just upgrade the internals and keep the shell!

yup. doitlive.gif ActivityPub Academy is also another resource.

2024-06-12T20:12:40Z

In reply to nevent1q…vp66
_________________________

yup. doitlive.gif

ActivityPub Academy is also another resource.

there was some talk about it awhile back which summarized reply ...

2024-06-12T15:46:54Z

In reply to nevent1q…w5wz
_________________________

there was some talk about it awhile back which summarized reply chain traversal as essentially being decently reliable but exploitable (infinite loops, etc.)

So chain traversal should have a hard cap for that reason, but ForumWG is also looking into recommending an alternative — resolvable context collections, in order to achieve backfill in a more performant manner.

The same security implications apply, however, so that's something that ought to be discussed as well.

<code>{ ... "inReplyTo": -9283747823, ... } ...

2024-06-12T15:35:49Z

In reply to nevent1q…phxd
_________________________

<code>{
...
"inReplyTo": -9283747823,
...
}
</code>

Actually, this gets me thinking... This might simultaneously ...

2024-06-12T15:35:00Z

In reply to nevent1q…lpgk
_________________________

Actually, this gets me thinking...

This might simultaneously amuse and/or horrify you, from an SRE perspective, but a "chaos monkey" type ActivityPub implementor that randomly shuffles through all possible permutations of data structures for any given object... would be good for the ecosystem.

Short term pain!!!

Is there a requirement that an activity ID be unique? Reason why ...

2024-06-12T15:30:10Z

Is there a requirement that an activity ID be unique?

Reason why I ask is it seems prudent to save a list of encountered activities, and drop those that have been seen before.

However that caused me to run head-first into a NodeBB regression because we ourselves don't actually send unique activity IDs.

For example, a Follow-Undo(Follow)-Follow chain would have the two Follows with the same ID, since we just construct them ad-hoc based on request data.

Easy fix is to throw in a timestamp there, but it got me wondering about whether there were uniqueness expectations at all, or whether I was being overzealous in checking for it.

just waiting for someone to totally abuse this by shoving all ...

2024-06-12T15:22:25Z

In reply to nevent1q…prqv
_________________________

just waiting for someone to totally abuse this by shoving all previous replies in the chain into inReplyTo

After all, the protocol doesn't forbid it, no? Haha

well, the funny thing about that is... if I request the user and ...

2024-06-10T20:24:29Z

In reply to nevent1q…yclx
_________________________

well, the funny thing about that is... if I request the user and get a 410 Gone, it doesn't mean they requested their account be deleted. It just means the account is no longer there; literally "Gone". It *is* a safe assumption, but the usual expectation would be I receive a Delete(Note) on all of their content and then Delete(User).

Whole thing could be a nothingburger, because I think almost all of the times I encounter a 410, the remote user never actually existed on my instance to begin with.

Sometimes when NodeBB attempts to retrieve a remote user, it will ...

2024-06-10T19:40:51Z

Sometimes when NodeBB attempts to retrieve a remote user, it will encounter the HTTP status code 410 Gone, which I take to mean that the user has been deleted from the origin server.

I mostly see it from spam accounts that were deleted, but I could potentially see that returned if users manually delete their own accounts.

The easy way forward here would be to see this and immediately delete all content I have locally for that user... all posts we have cached, the local profile, etc.

Downside is it could mean good conversations could suddenly have a hole in them when the account is deleted. We actually circumvent this in NodeBB by not allowing the user to one-click purge all of their content; an administrator is usually involved in the process.

But as always, different implementers might mean different things with 410 Gone, so I hesitate and wonder whether the simple path is the right path...

The other part of it is... unlike Mastodon, we're not looking ...

2024-06-10T19:23:32Z

In reply to nevent1q…tawe
_________________________

The other part of it is... unlike Mastodon, we're not looking for NodeBB to become **the** app to use to interact with the fediverse.

It's certainly something **I** want out of my use of NodeBB, but what forums are great for are cultivating niche communities based on shared interest. If I'm able to preserve that aspect all while allowing remote content to also interact with the forum, then it's win-win.

The other users on this NodeBB do not typically interact with ...

2024-06-10T19:13:06Z

In reply to nevent1q…s7sy
_________________________

The other users on this NodeBB do not typically interact with fedi content, but that's because it's still under development and not heavily marketed.

Plus there's that whole "what is the fediverse" thing we have to figure out how to teach, heh.

This week I sorted out a feature that I've been putting off ...

2024-06-10T18:20:41Z

This week I sorted out a feature that I've been putting off for far too long... content pruning!

ActivityPub had been enabled since March of this year, and in that time, the database had accumulated tens of thousands¹ of pieces of content from the fediverse. This was causing our database size to grow, but it was nothing entirely insurmountable, since it's mostly text.

However, the principle of the matter was that we were being pushed a mountain of content, most of which wasn't even consumed. For reference, when I ran the script against the data on this site:

2024-06-10T18:04:52.445Z [4567,4568/3631171] - info: [notes/prune] Found 32531 topics older than 30 days (since last activity).

We then take those topics and determine whether it received "engagement". Essentially whether a user reply to or liked a post within a topic.

Filtering for those, we get:

2024-06-10T18:07:31.860Z [4567,4568/3631171] - info: [notes/prune] 32252 topics eligible for pruning

... which essentially means ~99.14% of incoming content received zero engagement. That's not entirely surprising given that content streams in at all hours of the day, and I only reply or like a fraction of them.

In the backend, I'm allowing this value to be configurable, with the default being 30 days.

Next up, remote user pruning!

¹ Actually, the number ended up being closer to 116k pieces of content. In contrast, this forum has been running for about a decade and only recorded just under 100k posts!

that's because you're using AI as a tool, and doing so ...

2024-06-10T17:44:47Z

In reply to nevent1q…ktjt
_________________________

that's because you're using AI as a tool, and doing so transparently.

There's merit in AI generated art, sure. I do think some might find issues if you created something with AI and then claimed it as *entirely* your own effort

oh, and in case you weren't already aware, @npub15f7…m7wr ...

2024-06-08T13:19:43Z

In reply to nevent1q…wv94
_________________________

oh, and in case you weren't already aware, Framework :fedora: :ubuntu: (npub15f7…m7wr) is already on the fediverse!

thanks for sharing! I have the 13 and love using it daily. ...

2024-06-08T13:18:33Z

In reply to nevent1q…wp2f
_________________________

thanks for sharing! I have the 13 and love using it daily.

I'm sorry to hear that the Clevo didn't work out. I was interested in System76 for a time but couldn't get over that single hurdle — rebadged Clevo.

One thing I want to specifically call out is the quality of the trackpad! You only mentioned it a bit, but I've found the resolution on it to be much better than the Dells I've used in years past. It is closer to the level of detail I've seen on Apple trackpad.

For example, in my old Dell, if I were to scroll using my fingers, it would detect a "scroll event" or similar and scroll the page down three lines (or whatever was defined in the app settings).

On the Framework I can two-finger scroll at the pixel level. That's huge!

Just messing around to see what happens when you send Mastodon an ...

2024-06-08T02:15:00Z

Just messing around to see what happens when you send Mastodon an as:Article. Hoping to start a less informal discussion about it tomorrow/Monday.

As expected:

<li>The experience is degraded vs <code>as:Note</code></li>
<li><code>name</code> is read and prepended to the rendered content</li>
<li><code>url</code> is read and appended to the rendered content</li>

Noting now that...

<li><code>summary</code> is NOT treated like it is for <code>as:Note</code>, where it acts like a content warning teaser</li>
<li><code>summary</code> is read and displayed as-is in the rendered content</li>
<li><code>summary</code> is not parsed into HTML. All HTML tags are escaped.</li>

I also tested this by having activitypub.academy pull the note from NodeBB. Could be that service is running an older fork of Mastodon and summary parsing is different now.

Can anyone shed additional context?

then I suppose the protocol left these questions open as an ...

2024-06-08T01:49:38Z

In reply to nevent1q…tauh
_________________________

then I suppose the protocol left these questions open as an exercise for the reader LOL

I'd argue that *technically* a domain block blocking all instances hosted on subfolders is actually functioning exactly as described by the name. It *is* a "domain" block after all.

I'm not certain that's actually a major barrier, as a ...

2024-06-08T01:26:10Z

In reply to nevent1q…j4xj
_________________________

I'm not certain that's actually a major barrier, as a reverse proxy could be set up to route the requests based on path.

Interested in seeing if there are other potential barriers, and whether they can be talked through!

Please see below for minutes from today's *Forum and Threaded ...

2024-06-07T17:20:29Z

Please see below for minutes from today's *Forum and Threaded Discussions Task Force* monthly meeting.

*Apologies in advance if I misrepresented anybody or missed any crucial bits of information*

<li>
Housekeeping:
<ul>
<li>Neither Angus nor Julian have updated the WG fediverse handles yet. Sorry about that! Good start, pat on the back, let's try again next month.</li>
</ul>
</li>
<li>
Angus: question of what we want to do with survey reports?
<ul>
<li>Potential academic usage going forward</li>
<li>Use of spreadsheets has direct utility; no need to come up with anything more complicated at this time</li>
<li>Theoretically, one could develop an entire standard/knowledge graph for how the fediverse works</li>
</ul>
</li>
<li>
Group Federation among implementors (1b12/400e)
<ul>
<li>Angus: Disambiguation is an issue: is a remote implementor following 1b12 or 400e?
<ul>
<li>trwnh pointed out that it doesn't matter, you can differentiate based on behaviour</li>
<li>Angus: From an implementor perspective, I am reminded that it is worth supporting the actions described in 400e as well</li>
<li>Julian: If the FEPs don't directly conflict, what is the minimum set of 400e behaviour we need to support?</li>
<li>trwnh: just because a group announces, doesn't mean it is 1b12. Hubzilla/Friendica send out announces, but send out the object itself</li>
<li>Angus to follow up on that minimum set of behaviours to support</li>
</ul>
</li>
</ul>
</li>
<li>
Note vs. Article
<ul>
<li>Seems to be a plurality of implementers sending as:Note (given Mastodon's substandard treatment towards Article types)</li>
<li>If you deal with text, you'll almost always be sending out as:Note</li>
<li>Much time was spent last meeting discussing the nuances of determining Article vs. Note.</li>
<li>Evan P. had put it generally: A tweet is an as:Note, a blog post is an as:Article</li>
<li>Conclusion: exercise in futility to attempt to determine with complete certainty whether any given submission fits "Article" or "Note"</li>
<li>In the end may be best to let implementers send whatever they want, and others display it as they want.</li>
<li>HOWEVER, undue influence from Mastodon because as:Article is reduced down to title/url.
<ul>
<li>renchap has opened the door to working out some sort of compromise</li>
<li>We will likely not get full representation (inline images, more html tags, etc.) in Mastodon, but a good compromise or stopgap would be to have Mastodon use <code>summary</code> to populate the text
<ul>
<li>Note that this conflicts with existing use of summary as content warning. Discussion to continue via fediverse.</li>
</ul>
</li>
</ul>
</li>
<li>Angus: Open to facilitating a Mastodon PR if the team are open to one</li>
<li>Darius Kazemi:
<ul>
<li>"I am happy to support robust implementations for new content types in Hometown as a proving ground for Mastodon "</li>
<li>"Also Hometown supports Articles if anyone wants to do proof of concept"</li>
</ul>
</li>
</ul>
</li>
<li>
Use of context in objects
<ul>
<li>Angus: potential use case bulk importing conversations; if we could get a base implementation working, that would be a good first step</li>
<li>Julian: Given the results of the survey there is an opportunity here to trailblaze; there is no current observed standard of use for the <code>as:context</code> property</li>
<li>Angus: A report to SocialCG could come after test/base implementation between NodeBB and Discourse</li>
<li>Chris Moser: Feels like we've shoving forum/threaded discussions into an ActivityPub protocol
<ul>
<li>Should hash it out more instead of trying to fit it in</li>
</ul>
</li>
<li>Dmitri: We are talking about AS, not AP; could propose a forum-specific extension (see below re: extending AP/AS)</li>
<li>Dmitri: Additioanlly, we do have the affordance of interpreting the <code>context</code> field by using <code>as:type</code>.
<ul>
<li>e.g. If it is type Article, then it means root thread, vs. if it is type Note, then means something else, etc.</li>
</ul>
</li>
<li>trwnh: Partial agree - Doesn't really matter what type is. AS 2.0 was written around that; e.g. context is "put this thing in this bucket"
<ul>
<li>The base use of <code>as:context</code> is to group things together, e.g. Pleroma, <code>context</code> is a literal string match</li>
</ul>
</li>
<li>Aaron: We need to create a new context for a period of time, use it across some implementations, then add it to AS 3.0 or similar</li>
<li>Jennifer: Using context as grouping mechanism ; good first step
<ul>
<li>"The information I would hope to get out of a context collection is to know where to send that request to reply, or whether that would even be understood by the recipient"</li>
<li>e.g. managing reply control to a thread/topic</li>
<li>having an object there is a start, but reply controls would be great</li>
<li>trwnh: Some way to having an approval stamp; 0391 special collection proofs tries to describe this
<ul>
<li>we have two parallel paths, one with context collection, one with replies collection</li>
</ul>
</li>
</ul>
</li>
<li>Chris Moser: AS supports multiple types? That could be used to our advantage; many devs use collection in context, we want to use it as an actor, can they be combined?</li>
<li>trwnh: it is possible and I advocate for that; logical path is to have collections that can be followed. Actors don't have to be limited by type</li>
<li>Dmitri: Should we expand the concept of actor? For the purposes of being able to follow. Got into that in previous AP triage meeting.
<ul>
<li>Counter-proposal: instead of collection being an actor, divorce the concept of outboxes and actors</li>
</ul>
</li>
<li>Julian: Let's take this offline to forum for now, reconvene next month</li>
<li>Chris: Inbox/outbox not necessarily limited to actors</li>
<li>a: Yes to adding to next month's agenda; an activitypub actor is anything that has an inbox/outbox. AS specifies types, but this can be discussed later.</li>
</ul>
</li>
<li>
Re: extending AP/AS
<ul>
<li>Dmitri: A lot of devs would like to know how to extend the protocol
<ul>
<li>SocialCG is working on a "how do you add an extension" report, early draft is up</li>
<li>Super-basic and important question</li>
</ul>
</li>
<li>Jennifer: Extending can mean a couple diff. things; complication.
<ul>
<li>usually means adding a new term to the @context; that's trivial and permissionless</li>
<li>Alternatively, also FEP process, modifying AP/AS repo directly — much harder, whole w3c process</li>
<li>Dmitri: Adding to @context is easy</li>
</ul>
</li>
<li>Angus: Could be I or you (Julian) to write a standard</li>
<li>trwnh: Volunteering to help facilitate creation of note/report to CG</li>
</ul>
</li>
<li>
Open floor
<ul>
<li>Jennifer: Why the deference to Mastodon? Opportunity to go our own way.</li>
<li>Julian: Good question;
<ul>
<li>Likely a non-insignificant part of the ForumWG would be happy to turn the tables, but easier said than done.
<ul>
<li>Some software's users would not understand the full context and ask for a better experience from Mastodon.</li>
<li>e.g. WordPress federation, was originally as:Article but now as:Note after very quick feedback</li>
</ul>
</li>
<li>The ForumWG could play the card to let Mastodon play catch-up, and we might still, but given that they've signalled an interest in working towards a compromise, let's see where it goes (re: Note vs. Article)</li>
</ul>
</li>
<li>a: I would prefer to see other implementations go their own way, but mastodon CAN change, it will just take time
<ul>
<li>many users want something that works RIGHT NOW, not eventually</li>
</ul>
</li>
<li>Angus: viewing Mastodon compatibility as a starting point</li>
</ul>
</li>
<li>
Action items:
<ul>
<li>Angus to investigate the minimum set of behaviours required to support remote implementers adhering to 400e
<ul>
<li>Angus and Julian to work closely on proof-of-concept use of resolvable <code>context</code> between their softwares prior to a formal report</li>
</ul>
</li>
<li>Spin-off discussions:
<ul>
<li>If you <code>Announce(Object)</code> are you not following 1b12?</li>
<li>Article vs. Note; recommendations, article contains richer html, note CAN be stricter, post attachments? Summary, but conflicts with CWs?</li>
<li>Is renchap open to better treatment of as:Article; stopgap solution</li>
<li>Chris Moser/trwnh/Dmitri - What is an actor, can a collection be an actor? Dmitri summary of previous AP triage meeting</li>
</ul>
</li>
</ul>
</li>

what is a "regular" fediverse instance hehe snerk

2024-06-07T01:53:33Z

In reply to nevent1q…84zv
_________________________

what is a "regular" fediverse instance hehe

*snerk*

having Docker support doesn't mean it's "user ...

2024-06-07T01:52:49Z

In reply to nevent1q…ksk4
_________________________

having Docker support doesn't mean it's "user friendly" in my opinion. I know a lot of devs are whole hog on board the Docker train but I'm old school and prefer to know how to install my software straight on the server.

But I think I'm very firmly against the grain here.

This is a spin-off discussion from today's ForumWG meeting ...

2024-06-06T20:17:26Z

*This is a spin-off discussion from today's ForumWG meeting*

During today's ForumWG meeting an interesting side discussion cropped up regarding what constitutes an Actor, and whether other object types could be considered Actor-like.

ActivityStreams defines an Actor as being one of five types:

<li>Application</li>
<li>Group</li>
<li>Organization</li>
<li>Person</li>
<li>Service</li>

However, a looser definition of an Actor could simply be "if the resolved object contains an inbox and an outbox".

Such a definition opens up the possibility of having lots of things be followable, perhaps without direct user interaction. This was one possibility outlined by Chris Moser (npub1yns…57q2)

infinite love ⴳ (npub1t5c…ppw4) also mentioned that Mastodon does not consider an object as being an actor unless it is one of those five types.

Dmitri | 🇺🇦 (npub1a72…66ak) noted that this was a topic brought up at a previous AP issue triage meeting. Could you provide a summary?

Also cc Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸 (npub1764…nuj0) for his thoughts.

This is a spin-off discussion from today's ForumWG meeting ...

2024-06-06T20:04:19Z

*This is a spin-off discussion from today's ForumWG meeting*

At today's ForumWG meeting, infinite love ⴳ (npub1t5c…ppw4) mentioned that Announce(Object) is something that Hubzilla and Friendica do, but the proper FEP 1b12 behaviour is to send out Announce(Activity).

I noted that NodeBB actually announces the Note object itself, instead of the activity, and provided some context that Discourse (via Angus McLeod (npub1hk8…kreg)) originally expected Activities, but now also accepts objects (implicit create) for compatibility with NodeBB. Likewise, NodeBB also added some logic to handle Announce(Create(Note)) for compatibility.

Would Announce(Object) be considered a "variant" of 1b12, implemented within the spirit of the FEP, but not a technically compliant implementation?

Great job @npub1jwr…7v3w! Exciting to see fellow fedidevs ship!

2024-06-05T20:07:03Z

In reply to nevent1q…xh90
_________________________

Great job Matthias Pfefferle (npub1jwr…7v3w)! Exciting to see fellow fedidevs ship!

hi, sometimes we disallow posts because they may be spam. Might ...

2024-06-05T02:22:31Z

In reply to nevent1q…d9f9
_________________________

hi, sometimes we disallow posts because they may be spam. Might be we misclassified yours, sorry about that!

Feel free to repost.

my reading was that LD signatures supercede object ownership ...

2024-06-03T23:52:23Z

In reply to nevent1q…jgav
_________________________

my reading was that LD signatures supercede object ownership checks?

silverpill (npub19yg…wysk)

keep it simple, is my advice. The more SHOULDs you add to the ...

2024-06-03T03:34:57Z

In reply to nevent1q…tz3p
_________________________

keep it simple, is my advice.

The more *SHOULD*s you add to the FEP make it just that much harder to completely grok at first pass.

It's a really good start. And **yes**, I think this needs to be formalized.

PS I love how I can just see the open letter directly in my ...

2024-06-01T23:30:11Z

In reply to nevent1q…urgn
_________________________

PS I love how I can just see the open letter directly in my software!

wonderful, please include me, Julian L., of Burlington, Ontario. ...

2024-06-01T22:31:15Z

In reply to nevent1q…l2q6
_________________________

wonderful, please include me, Julian L., of Burlington, Ontario.

I tried replying to the fediverse post itself but I'm not sure if it worked!

signing!

2024-06-01T22:29:15Z

In reply to nevent1q…evad
_________________________

signing!

nah, it's not proprietary, it's just what they call it. ...

2024-05-31T19:21:44Z

In reply to nevent1q…aftn
_________________________

nah, it's not proprietary, it's just what they call it.

It's not "ActivityPub", I suppose, either, because HTTP Signatures are not explicitly defined in the spec.

It's like how NodeBB categories can follow other groups actors, and I call it "category syncing".

aside: I really hate that GitHub forced that little UX change on ...

2024-05-31T15:36:01Z

In reply to nevent1q…rt5z
_________________________

aside: I really hate that GitHub forced that little UX change on me.

It's not like **I** gave one iota of thought about which issues are "closed as completed" vs "not planned", but now they're making me choose when I just want to literally close out the issue.

It stinks of metrics gathering for a GitHub beancounter.

... except there's no guarantee either about whether the closed state was correct, so it's not even that reliable of a metric.

just clearing something up, Authorized Fetch is the Mastodon name ...

2024-05-31T15:27:03Z

In reply to nevent1q…t7ns
_________________________

just clearing something up, Authorized Fetch is the Mastodon name for requiring HTTP Signatures for retrieving content, even public content.

However, you *already* did the hard work once to sort out http signatures for *publishing* content, sending one to retrieve content is trivial by comparison. It took me 5 minutes.

Right now the rationale behind using it is mainly about protecting publicly visible content from being consumed by blocked servers, which is actually a side effect of the feature. There's more potential in supporting it because it then allows fine-grained access over who gets to see a resource (think private groups, DMs, etc.)

[Agenda preparation for the June ForumWG¹ meeting can be found ...

2024-05-30T15:44:06Z

[Agenda preparation for the June ForumWG¹ meeting can be found at this public link](https://docs.google.com/document/d/1fKt-HTcxQXeoD8vYX3L6Js2pDxNxQCN-x_PPjDu_zG4/edit ) (anyone can make comments for review.)

Monthly meetings are held on the first Thursday of each month, at 1700 to 1800 UTC. You can find them listed in the [SocialCG Calendar](https://www.w3.org/groups/cg/socialcg/calendar/ ). The next meeting will be held on 6 June 2024.

We will be continuing discussions regarding "Article vs. Note" and "Reconciling FEPs 1b12 and 400e", as well as discussing the usage of as:context among implementors. If you'd like to speak or inquire about a certain topic, comment in the agenda or reply here, the floor is open!

¹ ForumWG is the colloquial shorthand for the full name, which is as follows — **takes deep breath** —Social Web Incubator Community Group Forum and Threaded Discussions Task Force.

thanks!

2024-05-29T22:24:38Z

In reply to nevent1q…rx7t
_________________________

thanks!

one thing I thought Mastodon did well was support custom profile ...

2024-05-29T21:50:08Z

In reply to nevent1q…pzau
_________________________

one thing I thought Mastodon did well was support custom profile fields per user. They just expose them in the user actor I think, suppose you could do the same?

thanks for the shout-out, let me know if you run into issues!

2024-05-28T12:55:01Z

In reply to nevent1q…p9qn
_________________________

thanks for the shout-out, let me know if you run into issues!

follow-up question re: 7888... Right now when a post is made, the ...

2024-05-27T16:23:20Z

In reply to nevent1q…ntsl
_________________________

follow-up question re: 7888...

Right now when a post is made, the context is the topic. If I later on add the ability for NodeBB to send activites to contexts (and parse the resultant Add), is there an expectation that that context replaces my own local context?

Perhaps I could send an array of contexts, although I am not certain whether that is going to cause problems.

bahaha yes I believe I did this for NodeBB (not Mastodon, sorry) ...

2024-05-24T20:31:55Z

In reply to nevent1q…62m0
_________________________

bahaha yes I believe I did this for NodeBB (not Mastodon, sorry) years ago.

You could change the default notification sound in NodeBB to the ICQ "uh oh!".

I've been waiting for a C&D since, but nothing yet LOL

In the meantime we actually removed the sound altogether, so that didn't even last long.

I'm writing this because I'm unable to follow ...

2024-05-24T14:26:42Z

In reply to nevent1q…z5sf
_________________________

I'm writing this because I'm unable to follow Week in Fediverse :fediverse_light: (npub1kqg…a7t4), but I don't actually know whether it failed or is pending accept.

While I firmly believe any errors would be on my end, the problem is I don't actually know for sure, and this would also potentially provide guidance for new implementors.

cc silverpill (npub19yg…wysk)

Does anyone know if there are guidelines for the Follow/Accept ...

2024-05-24T14:24:09Z

Does anyone know if there are guidelines for the Follow/Accept flow outside of that prescribed in the AP protocol?

The reason why I ask is because there seems to be a little logical hole that people fall into where a Follow activity is sent, but the relationship then rests in an indeterminate state:

<li>The Follow is pending acceptance</li>
<li>The Follow was already seen and subsequently ignored</li>
<li>Something was wrong with the activity (e.g. signature failure, missing id, etc.) and it was ignored</li>

Receipt of an Accept is asynchronous, so the approach as seen in the wild is to assume a "pending" follow state. The problem is that if the flow doesn't follow that happy path (instant-accept or pending), then you don't know there is a problem.

Furthermore it seems that there are no existing recommendations regarding handling of a Follow to an Actor who believes you are already following them. Do you send back an Accept? Ignore the activity?

definitely would be open to supporting Valkey or some other ...

2024-05-24T00:16:16Z

In reply to nevent1q…4ldl
_________________________

definitely would be open to supporting Valkey or some other alternative, but do keep in mind that Mongo also uses SSPL, a similar license.

End of the day for people using the software it does not affect us, but if you object out of principle then there are alternatives.

The whole idea that "the fediverse failed [for me] because I ...

2024-05-24T00:14:31Z

The whole idea that "the fediverse failed [for me] because I didn't get any engagement" is always funny to me because I'm certain the people who say that are the ones least likely to engage via following or replying.

Funny how the social contract works, huh? You have to give to receive. No magic algorithm to artificially boost your content.

I think it's fantastic! It's quite difficult to convey ...

2024-05-22T23:51:59Z

In reply to nevent1q…7qtu
_________________________

I think it's fantastic! It's quite difficult to convey this kind of information effectively, and even deciding *what kind of explanation is needed* for end users is a debate in and of itself, around the fediverse.

Well done!

what about Duck? Should I have qualms about using it? N.B. ...

2024-05-22T22:29:46Z

In reply to nevent1q…y8yx
_________________________

what about Duck? Should I have qualms about using it?

N.B. I'm lazy as heck and probably won't change my search engine from DDG unless they do something completely egregious.

#are #you #sure? #I #think #it's #a #great #idea #to #spam ...

2024-05-22T13:01:39Z

In reply to nevent1q…8tk9
_________________________

#are #you #sure? #I #think #it's #a #great #idea #to #spam #hashtags

it certainly is a good thing that Mastodon handles username ...

2024-05-21T20:47:01Z

In reply to nevent1q…n2nf
_________________________

it certainly is a good thing that Mastodon handles username handle changes properly. It would be pretty unfortunate if that was not the case, still.

I just checked, Mastodon faithfully renders the link. However it ...

2024-05-21T15:39:48Z

In reply to nevent1q…lsvt
_________________________

I just checked, Mastodon faithfully renders the link. However it does do basic mitigation like adding nofollow noopener noreferrer to rel, which means search engines *shouldn't* assign them any credit.

Wrote a post today and ...

2024-05-21T15:32:12Z

Wrote a post today and [@mike@flipboard.com](https://flipboard.com/@mike )'s Flipboard.social sent this back LOL

2024-05-21T15:29:20.513Z [4567/3367934] - warn: [activitypub/send] Could not send Create to https://flipboard.social/inbox; error: I'm a teapot

Sorry Mike, I prefer coffee though. Trouble in ops-land today?

We've noticed in the past week that fairly innocuous looking ...

2024-05-21T15:28:53Z

We've noticed in the past week that fairly innocuous looking posts are coming in from brand-new users **containing spam links with no anchor text**. They're caught by the post queue but at face value, they could be accepted by a moderator as the link themselves were hidden from view.

It was only once you inspected the raw post content that the hidden link was revealed (e.g. innocuous text [](//malicious.org).

To combat this, NodeBB will now explicitly expose hidden links so that they can be easily seen and caught.

This is what it looks like: [](https://community.nodebb.org//community.nodebb.org )

If you are viewing this post from outside of NodeBB, you might not see anything! That means your software might be vulnerable to this kind of spam backlink injection. Best case, your software detects the empty link text and removes it completely. Worst case, you're allowing them in unknowingly.

Last thing, it's possible this has been around for ages and I only just noticed (thanks also to PitaJ (npub1hxp…n4ux) for pointing out the hidden links from an earlier post!) If you browse around the forum and see some of these hidden links scattered around some posts, flag it immediately so we can take a look.

Thank you!

there's nothing in the text itself that sets off red flags. ...

2024-05-21T14:32:07Z

In reply to nevent1q…a3f3
_________________________

there's nothing in the text itself that sets off red flags. Using pre-existing user-generated content to pass cursory checks has been just one tool in a spammer's toolbelt.

The link-hiding is a new one, at least for me, but I of course don't see the whole gamut of spammer behaviour.

Sometimes we get spam. It's always caught by our post queue ...

2024-05-21T04:09:27Z

Sometimes we get spam. It's *always* caught by our post queue because we're a relatively small community and new registrants always get their submissions queued for approval.

Almost always it's obvious. Either it's just a plain ad, or tons of word salad... more recently it's AI generated crap which all sounds the same.

This week we're starting to see posts come on with innocuous content, like "me too" posts with slightly more content. What did surprise me was that they contained hidden links. Up until now I was seeing actual text hyperlinked, so they turned blue. With no actual anchor text, the anchor still exists, but is just invisible.

So I think a good next step here is replacing all links with empty anchors with a bright red hidden link element.

whenever we fetch an actor, we also save the timestamp. Right now ...

2024-05-18T22:35:40Z

In reply to nevent1q…upqj
_________________________

whenever we fetch an actor, we also save the timestamp.

Right now we only update the actor if an update is received, but it would also make sense to also do an update after some pre-determined period, like 30 days, 1 year, etc.

But that's me, not Mastodon.

that's definitely a problem with the sidekiq configuration ...

2024-05-18T21:00:37Z

In reply to nevent1q…kmjl
_________________________

that's definitely a problem with the sidekiq configuration then. Keeping retries forever just clogs up the queue... I can't imagine they'd be kept forever!

rent free? How else are you going to extract wealth from the ...

2024-05-18T20:51:22Z

In reply to nevent1q…6xm5
_________________________

rent free? How else are you going to extract wealth from the working class?

/s

yes, categories can be followed, and they actike Guppe groups. ...

2024-05-18T19:22:09Z

In reply to nevent1q…5xfq
_________________________

yes, categories can be followed, and they actike Guppe groups. Right now you can't compose directly to a category but that's something I'll be working on soon!

Category actors in NodeBB can follow other actors too, just like regular users. Any content posted by followed users will be boosted by the category.

So if you have two categories that follow one another, which there are a couple between NodeBB and SocialHub (running Discourse), they're synced up!

what would you like to know? Both NodeBB and Discourse are ...

2024-05-18T11:59:11Z

In reply to nevent1q…5hw9
_________________________

what would you like to know? Both NodeBB and Discourse are federating now.

You may need to reach out to Zoho support to figure that one ...

2024-05-17T20:33:14Z

In reply to nevent1q…gj80
_________________________

You may need to reach out to Zoho support to figure that one out... if NodeBB reports that the email was sent.

Could be you need proper DKIM and SPF records.

Yes, that's certainly one use-case for the outbox... to ...

2024-05-17T20:26:13Z

In reply to nevent1q…sm55
_________________________

Yes, that's certainly one use-case for the outbox... to "catch up" on things you missed, on a per-user basis.

But as far as I am concerned they're separate APIs that pull from a common data source.

For example, reading the ActivityPub spec, one could draw the conclusion that the outbox is an ordered list of activities, likely read as-is from the database.. but that's not strictly defined, so it's possible to dynamically create outbox items on-demand based on user history stored elsewhere.

That would mean less duplication of content (and the syncing that is required), fewer bugs, etc... but the cost is the collection then has to be dynamically constructed.

no legitimate reason, we just don't use it, and basic ...

2024-05-17T19:54:15Z

In reply to nevent1q…rnnj
_________________________

no legitimate reason, we just don't use it, and basic federation doesn't break when it's not implemented, so it's just very low down on our to-do list!

personally, I'm still waiting for someone to call me out on ...

2024-05-17T17:49:39Z

In reply to nevent1q…djgg
_________________________

personally, I'm still waiting for someone to call me out on having actors whose outboxes resolve to an empty collection

*ducks*

I have [created a ...

2024-05-17T15:51:31Z

In reply to nevent1q…3zth
_________________________

I have [created a spreadsheet](https://docs.google.com/spreadsheets/d/1UAggu0UCITCWRF6QRRhATwkhX4_twXx1ZWsL8qCucyo/edit?usp=sharing ) with open editing permissions (for now) and invite implementors to add their implementations if applicable.

One thing I am noticing now (and should've expected) is that not every software has the concept of a discrete context, nor can you expect one from remote activities. In those scenarios, the fallback seems to be to point to the root-node Object and iterate via replies collection.

For example:

<li><a class="plugin-mentions-user plugin-mentions-a" href="https://metalhead.club/@mariusor">@mariusor@metalhead.club</a>'s FedBOX defines <code>context</code> as the root-node Object.</li>
<li><a class="plugin-mentions-user plugin-mentions-a" href="https://fediversity.site/channel/mikedev">@mikedev@fediversity.site</a>'s (streams) has a concept of conversation containers, and if <code>context</code> is received, inherits it, but otherwise, <code>context</code> becomes the root-node Object.</li>

infinite love ⴳ (npub1t5c…ppw4) does FEP-7888 account for this use-case?

said: > > Letterbook will. I'm flexible as to how, but ...

2024-05-17T15:25:09Z

In reply to nevent1q…g8r0
_________________________

said:

>
> Letterbook will. I'm flexible as to how, but my current plan is to duplicate the OP's replies collection into the context.

>

Good to know, I'll add your potential implementation into the table I'm creating... at present I'd want to know the current or potential usages of context. Hopefully there won't be too many disparate and incompatible implementations to reckon with...

Thanks for sharing this use-case, it's very helpful and quite ...

2024-05-17T15:23:30Z

In reply to nevent1q…t26c
_________________________

Thanks for sharing this use-case, it's very helpful and quite novel, I might add!

An inReplyTo array addresses the problem of backfill/ghost-replies with a bottom-up approach, vs a context collection which would be a top-down approach... though depending on what direction your tree grows, perhaps it's the other way around

A context collection would also provides the entire tree, which depending on size may or may not be preferred. Tradeoffs...

I think perhaps there is space for both, although I will admit that if my code encountered an Array in inReplyTo it might just terminate because it expects a single uri.

re: the original ask, specifically I was asking whether any other implementors specify context in an as:Note, resolvable to a Collection.

cc Jenniferplusplus (npub1a5g…ax95)

: > > Could you provide an example of such post? > I ...

2024-05-17T14:14:43Z

In reply to nevent1q…5z5l
_________________________

:

>
> Could you provide an example of such post?

>

I believe tallship (npub1s7u…qk5g) was referring to the fact that the software itself supports inline images locally. Well, *sure*, who doesn't? (Except for Mastodon lol)

The problem lies with everybody federating as:Note out because Mastodon doesn't render content otherwise, and also that all images are stripped out unless included as attachment, and only then, in reverse order with a cap at 4 images.

cc Mike Macgirvin 🖥️ (npub1k90…q43y)

said in [Part of my frustration with #ActivityPub and one of the ...

2024-05-17T04:22:35Z

In reply to nevent1q…3ntr
_________________________

said in [Part of my frustration with #ActivityPub and one of the things I find baffling giving everything else in it: the lack of tools for backpressure.](https://community.nodebb.org/post/https%3A%2F%2Ffediversity.site%2Fitem%2Fc6ec928d-cc25-422c-a14b-feecd705037f ):

>
> And of course as mentioned we use them for conversations so that everybody sees the same view of the discussion. It's a very under-utilised organisational mechanism and that seems odd. They're quite useful.

>

Ah yes, that was what I was referring to, a collection for a conversation. It certainly does seem under-utilised but I wasn't entirely sure whether that was true or not.

Are you aware of any other implementors that expose a collection for a collection of a topic's content?

At the last ForumWG meeting, [we discussed at length about ...

2024-05-16T20:53:35Z

At the last ForumWG meeting, [we discussed at length about Article vs. Note](https://community.nodebb.org/post/99385 ), and whether there was a desire to expand usage of as:Article. [You can review those minutes here](https://community.nodebb.org/topic/18012/minutes-from-2-may-2024-wg-meeting ).

One of the action items that came out was to collate the state of current implementations. Unfortunately, outside of implementations that federate non-textual content (e.g. Pixelfed Stories, Mobilizon Events, etc.), the majority of implementors just use as:Note, which is not surprising given Mastodon's treatment of non-Note objects.

You can see [the results of the summary here](https://docs.google.com/spreadsheets/d/1aWTLOEdNRkyxSccNFAuiCnITjJEbaUltcdJscmL-JHM/edit?usp=sharing ).

What is less clear is whether there is pent-up demand for use of a different data type for more richly forrmatted content. Mike Macgirvin 🖥️ (npub1k90…q43y) and Jupiter Rowland (npub1scy…khe4) provided some very illuminating history behind previous attempts to use as:Article, but importantly it seems that Mastodon (via Renaud Chaput (npub1zu5…pytj)) may be open to supporting this in some form as well.

While Mastodon has every reason to display as:Note as it sees fit, I'd like to hopefully address the undue influence towards using it especially in instances where as:Article were more appropriate. Mike (upthread) suggested a compromise:

<li>that <code>as:Note</code> be reserved for content with attachments (images or otherwise), perhaps with a limited subset of html</li>
<li>and <code>as:Article</code> be used for content with a richer set of html (e.g. tables), and including the ability to display inline images</li>

I explicitly did not specify that Note was for shorter content and Article for longer, because there exist plenty of examples of the reverse.

Does anybody see potential complications from such an arrangement?

Nostr notes by julian

I'm happy to announce that I have tagged the latest commit in ...

<li>This is a list</li> Some text <li>This is ...

micro blogging = that crazy person screaming about Jesus on a ...

You are not wrong.. the current state of rejection handling in ...

I've noticed that the software version is shown in the ...

that's huge news! Congrats @npub1vvk…83w8 ! Ah... also ...

well, if that was your concern then let me assuage your fear by ...

yup. doitlive.gif ActivityPub Academy is also another resource.

there was some talk about it awhile back which summarized reply ...

<code>{ ... "inReplyTo": -9283747823, ... } ...

Actually, this gets me thinking... This might simultaneously ...

Is there a requirement that an activity ID be unique? Reason why ...

just waiting for someone to totally abuse this by shoving all ...

well, the funny thing about that is... if I request the user and ...

Sometimes when NodeBB attempts to retrieve a remote user, it will ...

The other part of it is... unlike Mastodon, we're not looking ...

The other users on this NodeBB do not typically interact with ...

This week I sorted out a feature that I've been putting off ...

that's because you're using AI as a tool, and doing so ...

oh, and in case you weren't already aware, @npub15f7…m7wr ...

thanks for sharing! I have the 13 and love using it daily. ...

Just messing around to see what happens when you send Mastodon an ...

then I suppose the protocol left these questions open as an ...

I'm not certain that's actually a major barrier, as a ...

Please see below for minutes from today's *Forum and Threaded ...

what is a "regular" fediverse instance hehe *snerk*

having Docker support doesn't mean it's "user ...

*This is a spin-off discussion from today's ForumWG meeting* ...

*This is a spin-off discussion from today's ForumWG meeting* ...

Great job @npub1jwr…7v3w! Exciting to see fellow fedidevs ship!

hi, sometimes we disallow posts because they may be spam. Might ...

my reading was that LD signatures supercede object ownership ...

keep it simple, is my advice. The more *SHOULD*s you add to the ...

PS I love how I can just see the open letter directly in my ...

wonderful, please include me, Julian L., of Burlington, Ontario. ...

signing!

nah, it's not proprietary, it's just what they call it. ...

aside: I really hate that GitHub forced that little UX change on ...

just clearing something up, Authorized Fetch is the Mastodon name ...

[Agenda preparation for the June ForumWG¹ meeting can be found ...

thanks!

one thing I thought Mastodon did well was support custom profile ...

thanks for the shout-out, let me know if you run into issues!

follow-up question re: 7888... Right now when a post is made, the ...

bahaha yes I believe I did this for NodeBB (not Mastodon, sorry) ...

I'm writing this because I'm unable to follow ...

Does anyone know if there are guidelines for the Follow/Accept ...

definitely would be open to supporting Valkey or some other ...

The whole idea that "the fediverse failed [for me] because I ...

I think it's fantastic! It's quite difficult to convey ...

what about Duck? Should I have qualms about using it? N.B. ...

#are #you #sure? #I #think #it's #a #great #idea #to #spam ...

it certainly is a good thing that Mastodon handles username ...

I just checked, Mastodon faithfully renders the link. However it ...

Wrote a post today and ...

We've noticed in the past week that fairly innocuous looking ...

there's nothing in the text itself that sets off red flags. ...

Sometimes we get spam. It's *always* caught by our post queue ...

whenever we fetch an actor, we also save the timestamp. Right now ...

that's definitely a problem with the sidekiq configuration ...

rent free? How else are you going to extract wealth from the ...

yes, categories can be followed, and they actike Guppe groups. ...

what would you like to know? Both NodeBB and Discourse are ...

You may need to reach out to Zoho support to figure that one ...

Yes, that's certainly one use-case for the outbox... to ...

no legitimate reason, we just don't use it, and basic ...

personally, I'm still waiting for someone to call me out on ...

I have [created a ...

said: > > Letterbook will. I'm flexible as to how, but ...

Thanks for sharing this use-case, it's very helpful and quite ...

: > > Could you provide an example of such post? > I ...

said in [Part of my frustration with #ActivityPub and one of the ...

At the last ForumWG meeting, [we discussed at length about ...

what is a "regular" fediverse instance hehe snerk

This is a spin-off discussion from today's ForumWG meeting ...

This is a spin-off discussion from today's ForumWG meeting ...

keep it simple, is my advice. The more SHOULDs you add to the ...

Sometimes we get spam. It's always caught by our post queue ...