I was really happy to see @benpate and @dansup exploring similar ideas at the last FediCon: reducing user friction and making onboarding to the Fediverse almost invisible.

I’ve been working along the same lines. Here’s a small example: a user can interact with a #BadgeFed instance by simply logging in with #LinkedIn or #GitHub.

They can comment, upload images, like, boost, etc. They don’t need to know what the Fediverse is, what an instance is, or what software is running underneath.

For them, it’s just a social app.

Of course, existing Fediverse users can still connect with their Mastodon account or use their preferred Fediverse software.

Under the hood, it’s a #GoToSocial account configured with LinkedIn/GitHub OIDC OAuth.

But to the user? Completely transparent.

I think this kind of invisible complexity is one of the ways we can make the Fediverse much more approachable without sacrificing interoperability.

#Fediverse #ActivityPub #Mastodon #OpenWeb #Decentralization #OAuth

#COSCUP continues with @evan from @swf talking about #ActivityPub 1.1

#COSCUP2026

Alt...

presenter superimposed on the slides

#ActivityPub people, we're failing at implementing the HTTP signatures necessary for interop, does anyone know how one would do this in #AspNet #dotnet 8?

Otherwise, could you check what's wrong with our implementation by looking at an example request, to see if anything jumps out?

https://codeberg.org/MinotaursAtWork/Dallawan/issues/1

Totally understand that troubleshooting and bughunting is work, I wish we could pay for this. Drop any donation/tip page you have and we'll try to donate what we can when we can <3

@mooooooo I think @mapache has implemented #ActivityPub on #DotNet? Maho, would you mind giving this team a review or some tips?

Do you like JSON-LD?

#EvanPoll #poll #ActivityPub #JSONLD

Great day at #Fedicon yesterday. I met lots of new people from the #ActivityPub community. I've always thought that #XMPP and the #Fediverse are ideologically well-aligned, and that our developer communities should talk to each other more. In that regard, it was a big success.

I had a (very) minor medical issue this morning so I arrived 2 minutes after the #FOSSY keynote began.

Fun part is I walked in just as The GOAT #Fediverse person, @evan, was listing his long résumé — his work is essential & a catalyst in many ways to what we now have in #ActivityPub, Fediverse, & #Mastodon.

I am so excited that #FediCon is cohosted with #FOSSY26 and I very much hope that continues for many years to come.

#FOSSY2026

👏👏👏👏

On the Fediverse panel, @evan just said on the #Fediverse panel at #FOSSY26 : “This may not be a popular thing to say at #FOSSY, but we have to welcome proprietary implementations of #ActivityPub.

You'll be surprised I applauded loudest.

This is a principle that Social Workers call “meet your client where they are”. You can't help them if you *never* meet them.

Early #USENET erred badly because it was a computer geek monoculture. We must not be that here.

👏👏👏👏

#Mastodon #FOSSY2026

Stefano Marinelli (creator of the excellent FediMeteo) is working on a new type of lightweight Fediverse server called "littleFedi".

It's still in its early days and under development, but the first test server is now open and Stefano is gathering feedback about it. More info in the quoted post at https://littleone.littlefedi.social/@stefano/a105002b-5749-437d-a3cd-da54dfa70395 and more detail at https://littleone.littlefedi.social/@stefano/4252ae6f-b949-42f8-a021-fd2b698f8b37

You can follow Stefano at @stefano@bsd.cafe or on his littleFedi account at @stefano@littleone.littlefedi.social

#LittleFedi #Fediverse #ActivityPub #SelfHosting

Week in Fediverse 2026-08-07

Servers

- Vernissage v1.42.0
- Loops v1.0.0-beta.14
- Socialhome v0.24.0
- Ktistec v3.10.0
- Mbin v1.10.1
- Mastodon v4.6.5
- Hubzilla v11.4
- snac v1.94
- ActivityPub for WordPress v9.2.1
- PeerTube v8.2.4
- tootik v0.24.0
- NodeBB v4.14.8
- Wafrn v2026.08.01
- PieFed v1.7.10
- appy v0.6.0
- Lemmy Development Update July 2026
- Discovery Week 2026: What we learned, and what we’re doing next (Mastodon)
- What PieFed’s “social credit system” actually does
- Prismo: Federated link aggregation powered by ActivityPub

Clients

- Fedilab v3.43.1
- chan-fe v0.2.0
- Rocinante v1.2.2

Tools and Plugins

- FediFetcher v8.0.0
- Polls for ActivityPub v1.0.11 (WordPress plugin)

For developers

- Mastodon.py v2.2.2

Protocol

- FEP-d471: Endorsements

Articles

- DrFed on reducing complexity and enabling more people to shape the Fediverse

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/019fba46-e7be-7ee0-ae8b-8a2a8daec431

The author of a replied post is no longer added to the CC: line, as it does not have much sense.

Fixed mentions for users with hyphens in their identifiers.

Unlisted replies to unknown posts were being skipped from the timeline, so don't do that.

If an actor marked as broken gets a post boosted (proving that is [back] functioning), it's unmarked as such.

Don't try (and fail) to parse non-UTC dates in posts (I'll provide a real fix eventually).

Fixed a redirection loop in the /users alias.

Mastodon API: fixed a bug that made changing the sensitive content string impossible, avatars and headers can be deleted (contributed by bm90).

Updated Czech and Italian translations (contributed by pmjv and fidiben).

https://comam.es/what-is-snac

If you find #snac useful, please consider buying grunfink a coffee or contributing via LiberaPay.

#snacAnnounces #FrugalFediverse

I migrated from my self-hosted Mastodon instance to mastodon.social. Of course, I couldn't move my posts so I created a small server to provide the archive of my post history without changing any #ActivityPub URIs or media URLs. It seems to be working well. RAM usage is down from 1.2GB to 45MB (-97%) and disk usage down from 160GB to 15MB (-99.99% drop) compared to keeping the old server running. I've been surprised how many "hits" I'm seeing for old posts, so I'm glad the archive is available.

Het is tijd om wat concreter te worden met mijn plannen voor een @nrc_nl server. Nu vraag ik me af: vinden jullie het minder autonoom / soeverein en dus 'goed' als een toekomstige NRC-server niet op eigen hardware draait, maar in een (verantwoord en lokaal) datacenter? Daar neig ik nu namelijk wel naar. Laat het me weten. #NRCServer #ActivityPub #Fediverse @NRCfediverse

If you run a WordPress-powered blog, either on wordpress.com or on an independent hosting service, you can turn it into a Fediverse account that people can follow from Mastodon etc. More info about how to do this (and lots of questions answered) at:

➡️ https://fedi.tips/wordpress-turning-your-blog-into-a-fediverse-server

You can follow the official account for the plugin that enables this at:

➡️ @activitypub.blog

You can also follow its lead developer at:

➡️ @pfefferle

#FediTips #WordPress #Fediverse #ActivityPub

If you're into photography, there is a free open Flickr-style photography platform which you can host yourself called Vernissage. It also has Fediverse compatibility so people can follow Vernissage accounts from Mastodon, Pixelfed etc. More info at:

🌱 https://joinvernissage.org

You can follow at:

🌱 @vernissage

For techy people who want to install their own Vernissage manually, docs are at:

🌱 https://docs.joinvernissage.org/documentation/vernissageserver

#SelfHosting #Fediverse #ActivityPub #Flickr #Alternatives #Photography

«Modern email can be built from borrowed parts»

What if we designed the successor to email on top of HTTP, fixing 40 years of SMTP design flaws using only technologies that already exist?

https://en.andros.dev/blog/d7ed8b07/modern-email-can-be-built-from-borrowed-parts/

#Email #ActivityPub #OpenWeb #Python

Mobilizon is a Fediverse-compatible free open source events platform, developed as a libre alternative to Facebook Events. You can find out more at:

🌱 https://mobilizon.org

You can follow the official account at:

🌱 @mobilizon

If you're a techy person there are manual installation instructions for self-hosting at:

🌱 https://docs.mobilizon.org/3.%20System%20administration/install

#SelfHosting #CommunityHosting #Fediverse #ActivityPub #FacebookEvents

Honored to be one of ten maintainers in the first @sovtechfund standards cohort.

I'll be representing #ActivityPub and the #fediverse at the w3c, bringing eight years of running Pixelfed and Loops at scale into the room where the spec gets written.

https://www.sovereign.tech/news/meet-the-first-sovereign-tech-standards-cohort

#SovereignTech

It's been said a lot that tech people tend to think that every problem can be solved with a tech solution, and that that is often a wrong approach that ignores social dynamics and systemic causes.

That's true, but I can think of at least one problem here on the Fediverse that really, really needs a tech solution!

That being hashtags.

The whole point of hashtags is that you can tag your content with concepts it relates to, so that others who are interested in said concepts can discover your content.

Ideally, a hashtag should therefore contain all posts relating to the concept, and should not contain any posts unrelated to the concept. This is not the case.

The problem is that hashtags are plain text only. This causes two kinds of issues:

• False positives: One hashtag is used for multiple separate concepts, grouping unrelated concepts together.
• False negatives: Multiple hashtags are used for the same concept, meaning you might miss posts of a concept you want to see.

Common examples for false positives are homonyms (seating bank vs. financial bank, video games vs. board games), abbreviations (CNC, BBC, MTF), and multilingual issues (German handy vs. English handy).

False negatives are much, much more common, even. You're missing out on synonyms (horses vs. equines), grammatical and regional variations (colouring vs. coloring, horse vs. horses) and scope issues (gaming vs. games vs. video games) at least. Also, the whole thing about 'dogsOfMastodon' versus 'dogs'.

If you add to it that the Fediverse is multi-lingual, this is getting exponentially worse. If a German account posts about dogs using the hashtag 'Hund' (or Hunde, Hundes, Hunds, Hundi, Wauwau, Köter, Welpe, Welpen...), someone subscribed to the English hashtag 'dogs' should probably also see that post.

Rather than plain text which has all of these issues, a hashtag should therefore point at an individual unique ID of a concept, unique and unambiguous across all languages and grammatical forms.

Someone should be able to subscribe to the concept of a horse – the equine animal – and not just the letters 'horse' in that order!

That might sound daunting – who has a database of all concepts in the world? – but structured data actually is a super old problem that has been talked about for ages! The semantic web has it figured out.

Wikidata is an open data source for unique concepts, doing exactly what we'd need. Obviously it's easier said than done, but 'all' that the Fediverse needs to do is replace or extend hashtags with a system that allows you to link a Wikidata concept by UUID. And figure out what to do with things that don't have such a UUID yet, and how to handle UX. But it would be a vast improvement over plain-text hashtags.

I don't really want this post to just die in the ether, tbh, as posts are wont to do. I'd like to actually make this a thing. Is there anyone out there who knows what an implementation of this would take? I'd love to help (computational linguist).

#tech #technology #Fediverse #activityPub #socialMedia #hashtags #semanticWeb #wikiData #mastodon #goToSocial #fediSoftware #fediDev #fediDevelopers #fediDeveloperVerse #accessibility

Good morning Fedi friends,

I have been feeling a rising anxiety over the state of the open web and the fediverse - after seeing efforts by politicians all over the world (in Europe too!) to introduce age verification laws for social media.

My way of coping?

Teaching people how to self-host their own Fediverse profile (using the superb #GoToSocial) via #YunoHost.

Chapter 1 in this series is available here:

🔗 : https://blog.elenarossini.com/a-newbies-guide-to-self-hosting-gotosocial-part-1-installation-and-set-up/

#resist #blog #ActivityPub #selfhosting

Want an update on the Weekend at Bernie’s clown show that is W Social? No? Me neither, but here we are…

So before we start, let’s recount the whole dystopian raison d’être of these Davosian clowns: to be a EU®opean “alternative to X” that ­– cue the 1984 theme tune – verifies your identity to ensure that only “real people” are on it (real is what your government says it is).

Now, let’s fast forward to last week, when TikTok set up an account on W Social.

That’s nice, isn’t it? One surveillance capitalist lending their support to another? Kumbaya and all that. The only problem? (spoiler alert), it wasn’t TikTok. (Shocking, I know.)

The account, Identity Verified™ by EU X – sorry, W Social, was a spam account and immediately labelled as such by BlueSky moderators. (Don’t you love a “decentralised” system where a post on an EU server, accessed from another EU server, is moderated by our benevolent Big Brother in Trumpland, by the way? I know it just warms the cockles of my heart. So much sovereignty! But I digress…)

So @_elena calls them out (someone has to while @EUCommission is busy preparing for their honeymoon after expressing their undying devotion to W Social recently on every social platform¹):

https://mu.social/profile/elenarossini.com/post/3mqob7shxks2t

Anna Zeiter – W CEO, Stanford’s own, and ex-eBay executive (such sovereignty) – replies with this absolute zinger:

> “We are just verifying if some [sic] is a human and at least 18 years old. Users are then free to choose their own user name. This (human) user apparently chose the name TikTok.“ (https://mu.social/profile/anna.wsocial.eu/post/3mqoepm7m2k2z)

Read that as many times as you like until it really sinks in.

These incompetent clowns (dangerous competent clowns but incompetent clowns nevertheless) make people go through a ridiculous 13-step identity verification stage² and then… umm… you get to choose whatever identity you want.

🤡🤡🤡

Don’t get me wrong, I’m glad they’re incompetent. It would be worse if they were competent, given they’re a closed-source venture-capital-funded startup determined to prove your identity.

> “Yes we have a business model, it’s not a philanthropy, we are not a B corp, we actually want to make money.”b – Anna Zeiter³

But, what I want to know is this: Why has @EUCommission embraced a proprietary, closed-source, corporate ghost town with 14,300 accounts, 90% of which have not posted even once (in other words, with only 1,259 accounts that have ever posted)⁴ when there is a thriving non-corporate fediverse with millions of active people on it.

Could it have anything to do with identity verification, surveillance, and control?

And if so, why can’t they even get that right?

Looking forward to seeing how long @EUCommission can drag the corpse of W Social around before people realise it’s dead.

Oh, and how does this make the whole “European alternatives” thing look? Not good. Not because there aren’t excellent European alternatives but because the folks at the commission are either too clueless or too corrupt to recognise and support them.

So, yeah, how’s your Monday going?

¹ e.g., https://mastodon.ar.al/@aral/116770333053823108, etc.

² https://aseachange.com/@elena/statuses/01KVD55YBYVM3B46ACQTECDMT2

³ https://blog.elenarossini.com/the-untold-story-about-w-social-unconventional-beginnings-strategic-pitches-conflicting-signals/ (from the YouTube video that they since deleted. Nice transparency there, clowns.)

⁴ Run this script in Node 18+ to reproduce the numbers from their PDS yourself: https://codeberg.org/aral/gists/src/branch/main/wsocial-pds-stats.js Also see https://blog.elenarossini.com/w-social-a-broken-ghost-town/ and https://blog.elenarossini.com/w-social-fictional-metrics-and-the-beauty-of-open-data/

#WSocial #EU #sovereignty #socialMedia #socialNetworking #mastodon #fediverse #activityPub #ATProto #startups #EUCommission

Week in Fediverse 2026-07-17

Servers

- flohmarkt v0.20.0
- Vernissage Server v1.40.0
- FitPub v1.2.0
- Wafrn v2026.07.02
- TinyAP v0.1.11
- NeoDB v0.16.5.0
- PieFed v1.7.6
- Catodon v26.7.0
- Trunk & Tidbits, June 2026 (Mastodon)
- matrix-appservice-activitypub: Turns your Matrix server into a fully functioning ActivityPub server
- Discord–Fediverse Bridge: A self-hosted bridge between Discord forum channels and ActivityPub community actors
- ~petersanchez/honk: Fork of honk

Clients

- PeerTube Mobile v2.2.0
- Photon v2.4.0
- Tesseract v1.5.5
- Aria v1.5.8
- Mitra Mini v0.5.0

Tools and Plugins

- Enable Mastodon Apps v1.6.1 (WordPress plugin)
- Polls for ActivityPub v1.0.9 (WordPress plugin)
- Telegram ↔️ Mastodon Bridge Bot: A Python bot that forwards text messages, photos, and albums from a Telegram chat to your Mastodon account

For developers

- @shootpub/activitypub-types: ActivityPub types package with support for FEP-2277 Activitypub core types (duck typing)

Articles

- The Long Tail of Work Left Until ActivityPub Has E2EE

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/019f4de5-e808-73f3-96d7-1c4948c2a47a

FitPub is a new fitness tracking platform for the Fediverse, sort of an alternative to Strava. You can follow their official account for more news:

➡️ @fitpub

There are also more details on FitPub's Codeberg page:

➡️ https://codeberg.org/fitpub/fitpub

(To avoid confusion, FitPub is a totally separate project to the Fediverse trail and journey tracker Wanderer, which you can find out more about at https://wanderer.to )

#Fitness #FitnessTracker #Fediverse #ActivityPub #FitPub #Strava #Alternatives

Preparing a new Loops release, possibly related to my upcoming FediCon talk!

I can't stop smiling. 😁

#Loops #FediCon #ActivityPub #W3C

The Long Tail of Work Left Until ActivityPub Has E2EE - Dhole Moments

#activitypub #e2ee #security #fediverse

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

#HolosSocial relay is confirmed to be very stable. I will officially tag it soon so admins can run their own relay with a script to easily install it on their VPS.
Using Holos with a custom domain and a cloud for media allows you to own your portable identity on the #Fediverse. Relays become only an infrastructure for it. Your device runs the #ActivityPub server and works as smoothly as any other app. Micro-blogging, media, and video, all from a single account. Switch with a simple tap.

Flohmarkt is a free open platform for small ads and selling things ("Flohmarkt" is the German for flea market). It's part of the Fediverse so the small ads can federate to other servers, and people can interact with Flohmarkt from Mastodon etc accounts.

If you want to post or browse adverts there is a server list:

🌱 https://codeberg.org/flohmarkt/flohmarkt/wiki/flohmarkt-instances

There is techy info on their Codeberg page:

🌱 https://codeberg.org/flohmarkt/flohmarkt

You can follow their lead dev's account at:

🌱 @grindhold

#Fediverse #ActivityPub

RE: https://mediaformat.org/2026/07/nuages-says-hello/

Announcing it here publicly for the first time!

I've been building a general purpose activitypub pwa.

Follow @nuages for official updates!

#activityPubAPI #ActivityPub

The ActivityPub API doesn't define a way to get all server known posts with a specific tag.

There are a few ways this could be done in an ActivityPub client

What behaviour would you prefer when clicking on a post Tag link?

(Any other ideas, comment)
#ActivityPub #c2s #activityPubAPI

Já o sabia, mas esquecera que existe Ibis, uma enciclopédia (wiki) federada 🫶

https://ibis.wiki/

#ibis #ActivityPub #fediverso #fediverse

@bmann.ca @cwebber @dholms.at at #dwebcamp talking about #activitypub and #atproto

Alt...

Boris Christine and Daniel

@cwebber @dweb yes! I am doing a workshop on programming with the #ActivityPubAPI, and another intro to #ActivityPub. I'm going to try to demo #tagspub too.

#DwebCamp

Are you into 3D printing, self-hosting and the Fediverse?

If so you might want to look into Manyfold, a FOSS Fediverse platform which lets you upload and share 3D print models:

🌱 https://manyfold.app

You can follow the official accounts at:

🌱 @manyfold@3dp.chat (main)
🌱 @manyfold@makertube.net (videos)

You can host your own Manyfold server using the instructions at https://manyfold.app/get-started/installation (be warned though, installation does require a bit of tech skill).

#3DPrinting #SelfHosting #Fediverse #ActivityPub

Week in Fediverse 2026-07-03

Servers

- TinyAP v0.1.10
- GoToSocial v0.22.0
- Mobilizon v5.2.4
- Bonfire v1.0.5
- PeerTube v8.2.2
- Ktistec v3.7.0
- PieFed v1.7.0
- Mastodon v4.6.3
- Hollo v0.9.6
- ActivityPub for WordPress v9.0.2
- NeoDB v0.16.3
- Wanderer v0.19.3
- Trunk & Tidbits, May 2026 (Mastodon)
- Lemmy Development Update June 2026 and 1.0.0-beta.1

Clients

- Fedilab v3.42.1
- Pachli v3.7.1
- Aria v1.5.5
- Rocinante v1.0.9
- Holos v1.12.0
- Mitra Mini v0.4.2

Tools and Plugins

- FediFetcher v7.1.21
- owncast-emojiwall v2.1.0
- Polls For ActivityPub (WordPress plugin)

For developers

- Why implementing ActivityPub is hard, and why it doesn't have to be (Fedify)

Protocol

- FEP-8c13: Context-Authority Routing with Object Integrity Proofs for Restricted Threads
- FEP-f228: Backfilling conversations (Final comments)
- FEP-7628: Move actor (Final comments)

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/019f058a-b456-7c32-a9ee-f6ef93e8ee55

RE: https://hackers.pub/@fedify/2026/why-activitypub-is-hard

This is a really great, technical overview of how the fediverse works behind the scenes. And really makes you appreciate that it works at all.

Massive props to @hongminhee for this write-up and all their work, and those of others that make fediverse possible.

#fediverse #activitypub

Mastodon Collections === Loops Starter Kits

https://joinloops.org/starter-kits

Search Loops Kits on Mastodon, and vice versa.

powered by #activityPub

When X, Meta and TikTok relaxed their rules on hate speech, racism and transphobia, they didn't undermine the open social web.

They proved why this needs to exist.

Safety and mental health come first here. They're the foundation everything else stands on.

Not optional. Not negotiable. The vulnerable come first, always.

I have a roadmap to improve this, and I'll soon be asking for your feedback to make these spaces safer for the people who need them most.

#safety #humanRights #activityPub

@brewsterkahle @internetarchiveeurope @dweb #DWebCamp #DWeb #ATProtocol #ActivityPub #Fediverse

I really need to dig into ActivityPub more, and specifically whatever #ActivityPub offers for a #Python SDK.

I'm writing a #Bluesky TUI client as a hand coded side project, and I must say ATProto is intriguing.

No matter what protocol they use though, this place is still my social media home :)

Record(
│   created_at='2026-07-01T00:18:32.944Z',
│   text='Millennium home ownership\n\nwww.zillow.com/homedetails/...',
│   embed=Main(
│   │   external=External(
│   │   │   description='',
│   │   │   title='',
│   │   │   uri='https://www.zillow.com/homedetails/1819-N-Jantzen-Ave-Portland-OR-97217/2139875141_zpid/?utm_source=nativeshare_activation_v1',
│   │   │   thumb=None,
│   │   │   py_type='app.bsky.embed.external#external'
│   │   ),
│   │   py_type='app.bsky.embed.external'
│   ),
│   entities=None,
│   facets=[
│   │   Main(
│   │   │   features=[
│   │   │   │   Link(
│   │   │   │   │   uri='https://www.zillow.com/homedetails/1819-N-Jantzen-Ave-Portland-OR-97217/2139875141_zpid/?utm_source=nativeshare_activation_v1',
│   │   │   │   │   py_type='app.bsky.richtext.facet#link'
│   │   │   │   )
│   │   │   ],
│   │   │   index=ByteSlice(byte_end=57, byte_start=27, py_type='app.bsky.richtext.facet#byteSlice'),
│   │   │   py_type='app.bsky.richtext.facet'
│   │   )
│   ],
│   labels=None,
│   langs=['en'],
│   reply=None,
│   tags=None,
│   py_type='app.bsky.feed.post'
)

build the future you wish to see.

I feel like a bee, pollinating for the next gen to be.

handing out blueprints so the whole swarm builds free.

🐝

#ActivityPub #ActivityPubSocial #soon

Alt...

ActivityPub.social preview, coming soon

FediCon 2026 website is now live, thanks to @reiver for organizing this!

https://fedicon.ca

#fedicon #activitypub #fediverse

Took a lil break from Pixelfed dev to update the fedicon.ca website, I hope @reiver approves and merges the PR!

https://dansup.github.io/fedicon-www/

It's much cleaner and informative, though it does need the final schedule and speakers.

I also added some logic to hide sections after certain dates 😎

#fedicon #fediverse #activitypub

Week in Fediverse 2026-06-26

Servers

- Vernissage Server v1.39.0
- Bookwyrm v0.9.0
- Mastodon v4.6.1
- GoToSocial v0.21.3
- Ktistec v3.6.0
- snac v2.93
- Mitra v5.6.0
- Misskey v2026.6.0
- NeoDB v0.16.2.1

Clients

- Fedilab v3.42.0
- Mastodon for Android v2.13.0
- Voyager 2.47.3
- Tesseract v1.5.4
- Holos v1.10.2
- Phanpy changelog
- Rocinante: A modern, open-source Android client for BookWyrm

For developers

- Fedify v2.3.0
- Masto.js v7.12.0

Articles

- FR#168 – LLMs Join The Fediverse

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/019ee1be-dd85-7353-beca-83c9a087b4fc

Added a new admirations entry point to the web UI, containing a timeline of liked, boosted and reacted posts. Please take note that, after installing the new version, it will start empty, and be filled with subsequent reactions (contributed by violette).

It's now possible to disable showing posts in a given set of languages.

Nested quoted posts are limited up to 3 levels.

New configuration knob: by setting keep_replies_posts to true in server.json, remote posts that a local user has replied to are retained in the public timeline, preventing them from being purged (contributed by hanchan).

New configuration knob: by setting keep_replied_me to true in server.json, remote replies to local posts are retained in the public timeline, preventing them from being purged (contributed by hanchan).

Ensure actors' public key PEM never includes anything after the end marker.

Fixed some memory leaks (contributed by inz).

Several additional keyId checks (many thanks to lainsoykaf for bringing this to my attention).

Fixed crash in the JSON parser (many thanks to nullenvk for bringing this to my attention).

Mastodon API: fixed lost custom emojis after edition (contributed by e0w0e).

Updated French, Brazilian Portuguese, German, Spanish translations (contributed by dragondaddy, daltux, zen).

https://comam.es/what-is-snac

If you find #snac useful, please consider buying grunfink a coffee or contributing via LiberaPay.

#snacAnnounces #FrugalFediverse

3/3 Participants will take part in talks, workshops, and hands-on collaboration exploring what a more resilient, open, and decentralised web could look like in practice.

DWeb Camp is a space for building, not just talking about, the web we want.

@brewsterkahle @internetarchiveeurope @dweb #DWebCamp #DWeb #ATProtocol #ActivityPub #Fediverse

Alt...

A large group of DWeb Camp attendees seated in a circle on a patterned rug inside a white open-sided tent, engaged in a structured group discussion, with a flipchart easel and sunny outdoor landscape visible behind them.

Alt...

DWeb Camp attendees relaxing and conversing in inflatable lounge chairs among tall redwood trees, with teal paper lanterns strung overhead and a hammock visible in the background.

Summer is here, and sadly it is peak season for pet abandonment.
#PawFed is a federated map for animal welfare built on #ActivityPub and #OSM.

It already shows shelters and vets near you. Found an abandoned animal or need help? Mention @PawFed from any #Fediverse account: a pin lands on the map, and your call is relayed across the #Fediverse, whatever your instance.

More: https://pawfed.org/how-it-works

Rocinante v1.0.4: Búsqueda de usuarios, libros federados y soporte para Obtainium
https://blog.forjalibre.eu/blog/rocinante-v104-busqueda-de-usuarios-libros-federados-y-soporte-para-obtainium/
#Android #SoftwareLibre #BookWyrm #Rocinante #Obtainium #ActivityPub

The #HolosSocial relay is now stable enough to be tagged and published in production.

If you're interested, there is an interactive installation script and full documentation to do all the steps yourself with Docker on the #Codeberg project.

Running a relay is not like running an instance. They provide infrastructure. People with custom domains and Cloud for their media don't depend on a relay to keep their account. That's the whole purpose of this project, owning an #ActivityPub identity.

Two things you can see here... It's pretty hot! That's why I stayed home and implemented a missing feature into snac. That's what you can also see - it finally sends push notifications to devices! In this case, we can see notifications coming from #MastoBlaster App for iPhone.

What we can also see, it's still a bit faulty and not the expected content, but a first success here at least ;) I'll make some further adjustments when there's time and get in touch with @grunfink@comam.es to check if we can get this upstream. Thanks to @stefano@bsd.cafe for testing with me :)

#fediverse #mastodon #fedi #activitypub #snac2 #c #programming #clang #MastoBlaster

Alt...

snac2 sending push notifications to a user via MastoBlaster App on iPhone

#Lazyweb When I want to spin up my own #Fediverse instance that supports #Markdown when composing a post and that can handle my significant amount of followers with a seamless migration from my current #Mastodon instance, which #ActivityPub Implementation would you use? Ideally it should be a simple rootless container setup that JustWorks™ with podman. Perfection would be a single, self-contained container without the need to spin up several ones for databases or other stuff.

The ActivityPub Trust and Safety Task Force is looking for a new co-lead with experience in Trust & Safety and moderation.

https://github.com/swicg/activitypub-trust-and-safety/issues/135

#SocialWeb #SWICG #TrustAndSafety #moderation #volunteer #activitypub #fediverse

En el #Fediverso, ese lugar aburrido, lo que más nos gusta es reírnos de todo.

#WSocial #Fediverse #Mastodon #activitypub

Alt...

Meme de dos perros Shiba Inu comparando el registro en dos redes sociales. A la izquierda aparece el perro musculoso bajo el título ‘Registro en WSocial’, recitando una larga lista de pasos absurdamente complejos: elegir usuario y contraseña, seleccionar intereses, descargar una app de identidad, escanear varios códigos QR, crear un PIN, verificar identidad con pasaporte, leer el chip NFC y hacerse un selfie. A la derecha, un perro pequeño y llorando bajo el título ‘Registro en el Fediverso’ dice: ‘Jooo, pero ¿qué server tengo que seleccionar? Ayy, qué complicado!’. El meme ironiza sobre cómo algunas personas consideran difícil elegir instancia en el Fediverso mientras aceptan procesos mucho más invasivos y complejos en redes centralizadas.”

@halfpress i'd like to follow this thread on following threads . There's an issue discussing how to implement that info @Bonfire and #activitypub

https://github.com/bonfire-networks/bonfire-app/issues/610

🔧 Además de las novedades visibles, Mastodon 4.6 incluye mejoras internas de rendimiento, compatibilidad con aplicaciones de terceros, federación ActivityPub y herramientas para administradores.

#Fediverso #ActivityPub #SoftwareLibre #OpenSource

¿TikTok pero federado?

Loops es un proyecto del creador de Pixelfed que intenta llevar los vídeos cortos al Fediverso usando ActivityPub. Vídeos verticales, código abierto, financiación comunitaria y una filosofía muy distinta a la de las grandes plataformas.

Todavía está creciendo y tiene camino por delante, pero ya se puede probar.

En FediPunk le hemos echado un vistazo:

https://fedipunk.com/que-es-loops-alternativa-tiktok-fediverso/

#Loops #Fediverso #Mastodon #Pixelfed #ActivityPub

I am working on my Laravel-Activitypub package, it will replace federation support in Pixelfed once all tests are passing!

To demonstrate and test it before we use it in Pixelfed, a small and simple single user photo sharing server will be published and I'll boost the first photo here.

#ActivityPub

Artikel door @Marloezovic over #Mastodon en #Bluesky in @nrc_nl.

„Je zult beleidsdiscussies krijgen die je nooit eerder had”, voorspelt hij... „Maar dat is ook goed. In plaats van die beslissingen in de handen leggen van een paar miljardairs, moeten mensen erover nadenken.”

https://www.nrc.nl/nieuws/2026/06/10/de-technologie-achter-mastodon-versus-bluesky-welke-past-beter-bij-het-sociale-medium-van-nrc-a4929641?utm_source=clipboard&utm_medium=clipboard&utm_campaign=share&utm_term=share-modal&gift_token=4929641~1781727324~bJWrFJ0IEeKfgABQVoV_mg~4Z4JkjS4j6v3htFz1xPaCMDuf3ogsUnnV6XPDxR_xhQ

#GiftLink

Zie ook deze eerdere thread:

https://mastodon.nl/@Marloezovic/116635382316202759

#socialmedia #fediverse #activitypub #ATprotocol

Linked Data in HTTP Headers rather than in JSON (i.e., JSON-LD), etc

⁂

Many Fediverse servers will give you different content depending on the "Accept" header in the HTTP request.

If "application/activity+json" you get ActivityPub/ActivityStreams JSON-LD metadata. If something else, you get actual file/payload.

If we encoded Linked Data as HTTP headers (key-value pairs), we could include the Linked Data with the actual file/payload.

#ActivityPub #ActivityStreams #FediDev #LinkedData #JSONLD

acct-URI like URI for content

⁂

We have acct-URI for referring to actors.

Ex: acct:bahmankas@example.com

We resolve this to an HTTP-URI using WebFinger.

⁂

We don't have an acct-URI like URI for referring to an actor's content.

Which would also be resolved with WebFinger.

Ex: obj:bahmankas@example.com/file.ext

⁂

I think there are many advantages to being able to refer to content separate from where it is stored.

#acctURI #ActivityPub #ActivityStreams #FediDev #objURI

You, the people, and NLnet, have funded a fully open TikTok alternative with web and mobile clients, ActivityPub federation and an opt-out For You feed algorithm that is privacy friendly.

Anyone can start their own Loops community, and we're working on an official hosting service to help fund development.

Join 🚀: https://joinloops.org/join-the-beta

Roadmap ✨: https://joinloops.org/roadmap

Donate 🙏: https://joinloops.org/donate

Source 🤖: http://github.com/joinloops

#Loops #TikTok #ActivityPub

Pues ea

He sobrevivido a la charla de #activitypub en el #commitconf

Y como he cerrado sin guardar seguramente no se haya guardado. Así que si no estuviste te lo perdiste

You know what's pretty cool?

@rabble, the developer of https://divine.video sent a pull request to Loops to improve federation between Divine and Loops.

This is the magic of the open social web.

Collaboration and connection, no matter where you are.

You love to see it ❤️

https://github.com/joinloops/loops-server/commit/fdb5cffd28e24e14221690331d63b41d561ebc5b

#Loops #Divine #ActivityPub #Collaboration

#AskFedi I remember using a service that allows hosting #events and can generate .ics files. It allowed sending #rsvp using mastodon. But I can't remember the domain now. Can anyone #help ?

Update: Thanks to @smallcircles I found it, I was looking for https://gath.io/

Its pretty neat tool, especially if you want to share calendar events via channels other than email, like #xmpp.

These days I don't usually need it as #loomio can generate ics for time polls.

#activitypub

Lovely #fediverse does anybody have a list of all the known user-agents for #activitypub software ?

I have some WAF rules to write to make sure my server can be seen behind a frontend that is only meant to battle AI crawlers and I rather not (knowingly) leave endpoints open to OpenAI

Camino de #commitconf , segundo día y llego tarde pero voy ilusionado

Recordatorio de que silencies este jastag porque puedo ponerme pesadito, teniendo en cuenta que hoy me subo al escenario a dar mi charla sobre #activitypub

Week in Fediverse 2026-06-05

Servers

- Mastodon v4.5.11
- Hollo v0.9.3
- Wafrn v2026.06.01
- Ktistec v3.4.1
- tootik v0.23.1
- NeoDB v0.15.2
- wanderer v0.19.2
- Lemmy Development Update May 2026
- FitPub: A self-hosted fitness tracking platform for the Fediverse
- Harmony: Discord-style servers and chat with ActivityPub
- Menuverse: A federated menu system for canteens and institutions
- LAUTI: A calendar software where one can publish events, groups and places

Clients

- Pachli v3.7.0
- Elk v1.0.0
- Fedilab v3.41.0
- tooi v0.26.0
- Pixelix v4.4.0
- Aria v1.5.3
- Tesseract v1.5.0
- Interstellar v0.11.4
- Holos v1.8.0
- P2Play v0.10.1

For developers

- APx v0.25.0

Protocol

- FEP-bebd: Follow Invites

Articles

- Prikbord: Federated calendar for events in Rotterdam
- small details in my mastodon client that i wanted more people to notice
- From simple afterthought to over-engineered software
- FR#165 – Fediverse News May 2026

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/019e7560-82be-7521-bbb4-2ca61a0d5ad8

Merging ActivityStreams Core & Vocabulary

It looks like there is an effort to try to merge the ActivityStreams Core specification with the ActivityStreams Vocabulary specification into a single specification 🎉

https://github.com/w3c/activitystreams/issues/707

...

(I think this merged specification should also rename "Activity Streams" (with a space) to "ActivityStreams" (without a space).)

#ActivityPub #ActivityStreams #FediDev

Nuevo post!:

El blog ya forma parte del fediverso

#internet #fediverso #ActivityPub #blog #enmiblog

https://thecheis.com/2026/06/02/el-blog-ya-forma-parte-del-fediverso/

Self-Hosting an ActivityPub Video Podcast Is Surprisingly Affordable

4/

When you look at the actual storage requirements, self-hosting a video podcast on the Fediverse starts to look a lot less intimidating — and a lot more realistic.

It is affordable — especially with your own HomeLab (where you buy your own hard drives rather than rent them).

#ActivityPub #FediDev #HomeLab #SelfHost #SelfHosting

Self-Hosting an ActivityPub Video Podcast Is Surprisingly Affordable

3/

A 2 TB hard drive is often available for around $50–$60, which is enough space for five years of weekly episodes.

Need more room?

4 TB, 8 TB, 12 TB, and even 16 TB drives are widely available and far more affordable than most people expect. (Ex: 8TB is about $130 to $170.)

...

#ActivityPub #FediDev #HomeLab #SelfHost #SelfHosting

Self-Hosting an ActivityPub Video Podcast Is Surprisingly Affordable

2/

A typical 1-hour podcast episode at 1080p 60 fps is around 5.4 GB.

At one episode per week, that's about 280 GB per year.

Even after 5 years, your entire podcast archive would only use about 1.4 TB of storage.

That is it.

...

#ActivityPub #FediDev #HomeLab #SelfHost #SelfHosting

Self-Hosting an ActivityPub Video Podcast Is Surprisingly Affordable

1/

Imagine this.

You want to launch your own video podcast.

A new episode every week.
Each episode is 1 hour long.
Full HD (1080p), 60 fps video.

What would it cost to host it yourself?

Before I ran the numbers, I assumed it would be expensive — maybe even impractical.

I was wrong.

The reality is surprisingly affordable.

Here is why.

...

#ActivityPub #FediDev #HomeLab #SelfHost #SelfHosting

Stable Outbox Collection Pages

5/

To me,, having the newest page of the collection be varying length one feels like a better strategy.

#ActivityPub #ActivityStreams #FediDev

Stable Outbox Collection Pages

4/

BUT, if instead — if the page with 3 items contains the 3 newest items, then —

Only the newest page would have to be recached. I.e., only 1 page churns not all.

All the other collection pages stay as is, and any cached copies of them are still valid.

Etc.

#ActivityPub #ActivityStreams #FediDev

Stable Outbox Collection Pages

3/

If the page with 3 items contains the 3 oldest items, then —

Every time a new items is added to the collection, then every single collection page will change. I.e., they all churn.

Which means that all cached copies of any collection pages will be invalidated.

Which means a static site generator will have to regenerate all of them again.

Etc.

BUT, if instead —

#ActivityPub #ActivityStreams #FediDev

Stable Outbox Collection Pages

2/

Let's say a collection has 23 items, and each page 10 items in length.

That means you will have 2 pages with 10 items and 1 page with 3 items.

Should that page with 3 items be the 3 newest items or the 3 oldest items.

The choice affects caching and static site ease quite a bit.

Here is the answer...

#ActivityPub #ActivityStreams #FediDev

Stable Outbox Collection Pages

1/

ActivityPub uses collections for a number of things:

• followers
• following
• inbox
• outbox

And, rather than dump everything in the collection into a single document, ActivityPub paginates using collection pages.

That's great.

But, how you divide up a collection into pages matters and affects things. Such as: caching.

I'll explain.

#ActivityPub #ActivityStreams #FediDev

Something missing from 'followers' and 'following' collections.

2/

I think this could be addressed by using the ActivityPub 'published' field:

https://www.w3.org/TR/activitystreams-vocabulary/#dfn-published

Such as what is shown in the (new) attached screen-shot.

So that the date-time when person A followed person B is included.

#ActivityPub #ActivityStreams #FediDev

Alt...

{"@context":"https://www.w3.org/ns/activitystreams","id":"https://mastodon.social/users/reiver/following?page=20","type":"OrderedCollectionPage","totalItems":1394,"next":"https://mastodon.social/users/reiver/following?page=21","prev":"https://mastodon.social/users/reiver/following?page=19","partOf":"https://mastodon.social/users/reiver/following","orderedItems":[{"url":"https://mastodon.social/users/georgiagemo","published":"2025-08-01T12:12:12Z"},{"url":"https://spectra.video/accounts/fedicon","published":"2025-07-25T13:04:12Z"},{"url":"https://indieweb.social/users/KarenKeiller","published":"2025-07-25T02:55:18Z"},{"url":"https://toot.wales/users/jaz","published":"2025-07-25T02:55:18Z"},{"url":"https://hachyderm.io/users/cyberlyra","published":"2025-07-23T17:20:02Z"},{"url":"https://mstdn.cool/users/fedijedi","published":"2025-07-23T17:20:02Z"},{"url":"https://thecanadian.social/users/mike","published":"2025-07-21T14:02:02Z"},{"url":"https://badges.fedicon.ca/actors/badges.fedicon.ca/fedicon","published":"2025-07-14T09:03:04Z"},{"url":"https://social.linux.pizza/users/chocodum","published":"2025-07-13T13:13:13Z"},{"url":"https://mastodon.social/users/pojntfx","published":"2025-07-11T19:20:21Z"},{"url":"https://cosocial.ca/users/kgw","published":"2025-07-10T11:12:13Z"},{"url":"https://social.anoxinon.de/users/Codeberg","published":"2025-07-09T10:11:12Z"}]}

Something missing from 'followers' and 'following' collections.

1/

ActivityPub 'followers' and 'following' collections tend to be missing an important piece of information —

The date-time when person A followed person B.

There are certain use-cases where this matters.

You can see an example of this information missing in what Mastodon includes in the attached screen-shot.

#ActivityPub #ActivityStreams #FediDev

Alt...

{ "@context": "https://www.w3.org/ns/activitystreams", "id": "https://mastodon.social/users/reiver/following?page=20", "type": "OrderedCollectionPage", "totalItems": 1394, "next": "https://mastodon.social/users/reiver/following?page=21", "prev": "https://mastodon.social/users/reiver/following?page=19", "partOf": "https://mastodon.social/users/reiver/following", "orderedItems": [ "https://mastodon.social/users/georgiagemo", "https://spectra.video/accounts/fedicon", "https://indieweb.social/users/KarenKeiller", "https://toot.wales/users/jaz", "https://hachyderm.io/users/cyberlyra", "https://mstdn.cool/users/fedijedi", "https://thecanadian.social/users/mike", "https://badges.fedicon.ca/actors/badges.fedicon.ca/fedicon", "https://social.linux.pizza/users/chocodum", "https://mastodon.social/users/pojntfx", "https://cosocial.ca/users/kgw", "https://social.anoxinon.de/users/Codeberg" ] }

I have seen the @Codeberg people say they don't want to be the only code-forge.

I.e., they don't want to replace GitHub. They want there to be many code-forges out there, including them.

I agree with this goal.

But — I think until we (at least) have federated pull-requests, this is less likely to happen.

And, I do know that there is an effort to add ActivityPub support to Forgejo, Gitea, and others.

https://forgefed.org

I think ForgeFed is important for this goal

#ActivityPub #Codeberg

RE: https://mastodon.social/@HolosSocial/116664862916238317

Today the #HolosSocial project takes a step forward by letting one account run on several devices.
It may sound minor, but each device runs its own #ActivityPub server, which made it a real challenge: avoiding duplicate actions sent to other instances and keeping everything in sync.
All of this stays transparent for the user: adding a device is as simple as scanning a QR code, and the whole transfer is end to end encrypted between the two devices, so the relay never sees it in clear.

A reminder to #ActivityPub developers and advocates: applications for the NLNet Open Social Fund close on June 1st (#BrookeVibberDay) at noon CEST. You should apply; you are doing important work and we need you to keep doing it.

https://nlnet.nl/opensocial/

Building #HolosSocial is by far my most ambitious project. It might only attract a niche of users, though at first it could seem strange to run an #ActivityPub server on a device.
But Holos' purpose is more than that: helping everyone have their own identity, host their media, and not depend on a server admin. Make everything accessible with views depending on your mood. One app, one identity, with all that the fediverse can offer.
That's the beginning, the way is still long but not unreachable.

Week in Fediverse 2026-05-29

Servers

- PeerTube v8.2.0
- Bookwyrm v0.8.6
- Gush! v0.0.38
- Hollo v0.9.2
- Mitra v5.4.0
- Ktistec v3.4.0
- Loops v1.0.0-beta.12
- tootik v0.23.0
- NeoDB v0.15.0
- NodeBB v4.12.0
- Catodon v26.5.0
- TinyAP v0.1.9

Clients

- Fedilab v3.40.2
- Nicolium v0.3.1
- Coho v1.2
- Interstellar v0.11.3
- Aria v1.5.2
- Loops Mobile App v1.0.2.2
- Mitra Mini v0.4.1

Tools and Plugins

- Event Bridge for ActivityPub v1.3.0 (WordPress plugin)
- hugo-ap-comments: Embed Mastodon / Fediverse replies as a comment section on your static Hugo site

Articles

- Stop Posting to Platforms — Turn Your Website into a Fediverse Node

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/019e5172-5f2e-7441-bf3a-2dbcf61dcd64

@activitypub Ping ping ping #ActivityPub

NodeBB is free open source forum software on the Fediverse. You can follow and interact with NodeBB forum members from Mastodon etc. More info:

🌱 https://nodebb.org
🌱 @nodebb

You can self-host free of charge using the installation instructions:

🌱 https://docs.nodebb.org

If you don't want to do techy stuff, you can create a NodeBB forum very easily through a paid hosting service:

🌱 https://nodebb.org/pricing

#SelfHosting #Forums #BulletinBoards #FOSS #Fediverse #ActivityPub

Updated: List of Helpful Mastodon Resources

- Fix Redirect Link

Handmade list of resources for the federated social network Mastodon covering, how to use, find an instance, find people, tools and more.

https://www.adamsdesk.com/posts/list-mastodon-resources/

#blog #mastodon #Fediverse #ActivityPub #100DaysToOffload

Run your own decentralized social platform on shared hosting or a tiny VPS WITHOUT Redis, PostgreSQL, or complex infrastructure.

What it makes so special to me? It looks awesome, comes with a great admin web interface and does not require a VPS instance where it can also be operated on a cheap shared hosting systems. By the given requirements, it also easily runs on a #RaspberryPI and all kind of systems, including #FreeBSD, #OpenBSD, #Illumos and more!

This all makes it perfect to everyone and even beginners to run their own instance. With relay support (e.g., fedi-relay.gyptazy.com) it even can consume and post content over non-directly connected instances in the #fediworld!

Kudos to the author of Starling: @df@s.dfaria.eu

More information:
GitHub project: https://github.com/dfaria-eu/Starling
My blog post: https://gyptazy.com/blog/starling-simple-fediverse-server/

#fedi #fediwall #opensource #decentralized #social #socialmedia #alternatives #mastodon

Alt...

Starling as a Fediverse/ActivityPub Server

When I interviewed @Gargron he said that education was key to @Mastodon and the fediverse growing. That, along with the algorithm-free approach of most ActivityPub-supporting platforms, inspired me to create https://algo.free

It covers the benefits of going algo-free, provides ActivityPub-powered alternatives to centralized, algo-driven platforms, and offers tips for getting started.

#Fediverse #ActivityPub #FediTips

This is cool as hell! https://ieeexplore.ieee.org/document/10361296 #ActivityPub #IOT #UPOD

This is the discussion thread for the draft FEP-baf5: Administrator Collection

This FEP introduces a mechanism for discovering the administrators of an ActivityPub instance. It extends the "Group Moderator" pattern from [FEP 1b12][1b12] and the "Application Actor" concept from [FEP 2677][2677] by defining an OrderedCollection of administrators referenced from the instance's application actor.

The full draft can be read here.

Week in Fediverse 2026-05-22

Servers

- Gush! v0.0.37
- Stegodon v1.8.5
- Iceshrimp.NET v2026.1.1-beta
- Iceshrimp v2026.5.1
- Hollo v0.9.0
- Mastodon v4.5.10
- PeerTube v8.1.6
- Sharkey v2025.4.7
- Hubzilla v11.2.1
- Friendica v2026.05
- Ktistec v3.3.9
- Smithereen v1.0.0
- Vernissage Server v1.38.0
- ActivityPub for WordPress v8.3.0
- Misskey v2026.5.4
- tootik v0.22.2
- NeoDB v0.14.4
- Open beta testing for Lemmy 1.0.0
- Trunk & Tidbits, April 2026
- XMPP/ActivityPub Bridge: Chat between XMPP and the Fediverse
- Cookifed: A free and federated recipes management app and cooking social network

Clients

- Nicolium v0.3.0
- Fedilab v3.40.1
- Aria v1.5.1
- Blorp v1.14.0
- Impressia v3.2.0
- Holos v1.6.0

Tools and Plugins

- Analytodon: Analytics for Mastodon

For developers

- Fedify v2.2.3
- BotKit v0.4.2

Protocol

- Basic Profile for Social API Servers
- FEP-baf5: Administrator Collection

Articles

- the may 2026 fedi software vulnerability
- Never Lose a Toot Again: Full-Text Search for Your Mastodon Feed

-----

#WeekInFediverse #Fediverse #ActivityPub

Previous edition: https://mitra.social/objects/019e2d21-c15d-7653-a6d5-f476dcc0559d

Started working on bringing ActivityPub Polls to NodeBB

First step is adding in separate handling of the Question object. Right now NodeBB treats it as a "Note-like" and renders it like a post 50% of the way there... will need to link it to nodebb-plugin-poll...

One complication... the plugin ties votes to users. This data isn't reflected over-the-wire in AP, only the aggregate voter counts are shared [...]

https://github.com/NodeBB/nodebb-plugin-poll/pull/157

I received a security vulnerability report regarding NodeBB's handling of Update and Delete activities.

tl;dr

• NodeBB implementes FEP fe34, and treats Update and Delete activities as valid if the activity's actor and the object's attributedTo differ but the origins are identical.
• e.g. @alice@example.org is allowed to federate Delete(Note) on @bob@example.org's Note.
• The origin-based security model allows for moderator-style actions (third-party post editing and deletions) in the absence of explicit moderator claims.
• The reporter disagrees that this should be allowed.

Are they right? [...]

I responded that FEP fe34 allows for this behaviour because we do not have ready access to an instance's admin or moderator list. By conducting same-origin checks and allowing Update and Delete through for same-origin (but different identifier), we allow for moderators to federate their actions across instances.

Their response:

I respectfully disagree that FEP-fe34 permits this behavior. Below are direct quotes from the specification that contradict your assessment.

1. ActivityPub spec (quoted in FEP-fe34 Rationale, Section 7.3 Update Activity):

▎ "The receiving server MUST take care to be sure that the Update is authorized to modify its object. At minimum, this may be done by ensuring that the Update and its object are of same origin."

Note: "at minimum" means same-origin is the floor, not the ceiling. Authorization must still be verified.
2. FEP-fe34 — Authorization > Ownership:

▎ "The actor that creates an object MUST be its owner."
▎ "The owner of an object is permitted to modify and delete it."
▎ "Update and Delete activities, and objects indicated by their object property are expected to have the same owner."

"Same owner" means the same specific actor — not any actor on the same domain.

I responded back with the following:

"The actor that creates an object MUST be its owner."

Correct, the creator must be an owner, no impersonation allowed.

"The owner of an object is permitted to modify and delete it."

A strict reading of this does not preclude the ability of a same-origin moderator to modify and delete the object. This is my argument.

"Update and Delete activities, and objects indicated by their object property are expected to have the same owner."

Again, "expected to" does not rise to the level of MUST.

I agree out of principle that the security implications exist, but if you follow through with the exploit, it requires a non-compliant server to allow users to publish Update and Delete for other users on the same instance, and even then the exposure is limited to users of that origin only (e.g. your server cannot arbitrarily delete my posts). This is the foundation of the Origin-based security model.

So we are at an impasse as to whether my strict reading of the FEP is adherent to the spirit of the FEP itself. Here's where you come in... do you agree with me, or the reporter?

Directly tagging @silverpill@mitra.social (as FEP author), @trwnh@mastodon.social and @evan@cosocial.ca (both subject matter experts) for their thoughts.

Here is my work-in-progress FEP for using JSON Resume with ActivityPub:

FEP-6158: ActivityPub 'Resume' Object: JSON Resume expressed as JSON-LD

https://codeberg.org/reiver/fep/src/branch/fep-6158/fep/6158/fep-6158.md

I prefer to write for clarity, so it still needs work.

#ActivityPub #ActivityStreams #FediDev #ProToGo #JSONLD #JSONResume #fep6158 #fep_6158

I've had this idea knocking around in my head for a while, and let's face it, I'm just never going to have the chops to implement it, but it's going to keep knocking around in there if I don't put it out into the universe, so here it is. Feel free to pick it up and run with it.

I call it Disperse. DIStributed PERsonal SEarch. Basically, federated search instances that relay and compile member-curated search results. Seems like a interesting use case for #ActivityPub.

Alt...

A flow chart showing the hypothetical structure of Disperse usage. At the center is a green database symbol labeled Disperse. Above it is a flow in black showing a webpage moving through a smartphone to the Disperse symbol, with the legend: "1. Alice has an account on a Disperse instance. When she comes across a useful webpage, she uses the app to post the link to her instance, where it’s stored in the local database." Under that is a flow in yellow showing a search bar with the query going to the Disperse instance, with the legend: "2. Disperse instances display a search bar as the front page of their web interface. Beth doesn’t have an Disperse account, but sometimes searches using the instance where Alice has an account." Yellow arrows indicate the query going out to two smaller, red database symbols representing "federated Disperse instances." Below them is another database in purple marked "Blocked instance" with a large purple "X" between it and the central Disperse server. Below that is the legend: "3. When the instance receives a search query, it sends a request out to any federated instances. They respond with any hits from their own databases. The originating instance combines those responses with hits from its own database, then displays them to Beth as a results page." The last step is represented by an arrow showing an orange document flowing back out to the search page.