ActivityPub client development is coming along!
General Discussion
21
Posts
6
Posters
24
Views
-
@django There has been some talk about it around the 2.9.1 release months ago iirc, but nothing since. One of the Akkoma maintainers also disclosed recently some information disclosure issues that might affect c2s, so the subject might come up again. But if someone is willing to maintain it and fix issues, it will probably likely stay.
Not sure if Akkoma still has support for it enabled since they have a habit of removing features and options from BE.@phnt I asked about C2S support in their issue queue, and they said they had more or less ripped everything C2S out of the codebase. The vulnerability was reported to Pleroma a few days later 🫤
-
@phnt I asked about C2S support in their issue queue, and they said they had more or less ripped everything C2S out of the codebase. The vulnerability was reported to Pleroma a few days later 🫤
@django Apparently the vulnerability is exactly what I found months ago and never investigated until two days ago :D -
@django
>c2s
But why though? Basically nothing uses that besides an android app that probably hasn't been update in 5+ years.phnt@fluffytail.org fwiw some of us AP devs have identified that end user applications may not be the ideal (or even the only) use case for C2S.
A more interesting approach would be to pair it with OAuth2 authentication and use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
A more traditional API (e.g. Mastodon API) would be used to communicate with end user apps/sessions etc.
-
Yeah a few of us had a good chat about that approach at the last #fediforum and we're now prototyping that in Bonfire at the moment, as a way to easily add federation capability to non-federated webapps (eg. for an events/calendar app to publish events by just POSTing a JSON with the event info via C2S to a bonfire server).
-
Yeah a few of us had a good chat about that approach at the last #fediforum and we're now prototyping that in Bonfire at the moment, as a way to easily add federation capability to non-federated webapps (eg. for an events/calendar app to publish events by just POSTing a JSON with the event info via C2S to a bonfire server).
mayel@sunbeam.city yessss! That's amazing to hear. NodeBB doesn't support the OAuth2 piece yet, but I am looking forward to getting started!
-
@django Apparently the vulnerability is exactly what I found months ago and never investigated until two days ago :D@django AP C2S has been disabled in Pleroma since 2.9.0, commit: https://git.pleroma.social/pleroma/pleroma/-/commit/d6a136f823c6e749e6d2c4a0f80202f0d7c5a960
Also I've noticed that it doesn't like Content-Type: activity/activity+json and can be quirky with cc/to so I'm not really a fan. I couldn't make a reply to a thread that would properly show up in FE. The parent was always not visible in the thread view, but visible when hovering over the "Replying to <user>" UI element. Probably something weird with addressing I'm missing. -
@julian @django
>use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
Incredibly cursed and another case of "I can doesn't mean I should". I don't think that pretending to be a user should ever be done unless necessary (such as the case of automatic follow acceptance). Especially when it requires external authentication like OAuth2. At least with S2S you can use actor keys, but such concept does not exist in C2S. Not to mention that now none of the big ActivityPub server implementations support C2S (Mastodon, Pleroma, Misskey), so you are stuck in a bubble you are creating yourself.
Honestly, I would appreciate if the work that is being done to create toys around AP was instead focused on fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy. -
@django AP C2S has been disabled in Pleroma since 2.9.0, commit: https://git.pleroma.social/pleroma/pleroma/-/commit/d6a136f823c6e749e6d2c4a0f80202f0d7c5a960
Also I've noticed that it doesn't like Content-Type: activity/activity+json and can be quirky with cc/to so I'm not really a fan. I couldn't make a reply to a thread that would properly show up in FE. The parent was always not visible in the thread view, but visible when hovering over the "Replying to <user>" UI element. Probably something weird with addressing I'm missing.@phnt no me gusta, but it explains why it didn’t work on one instance I tested.
-
@julian @django
>use the C2S API as a transport layer in a server to server context. Performing actions on behalf of another user.
Incredibly cursed and another case of "I can doesn't mean I should". I don't think that pretending to be a user should ever be done unless necessary (such as the case of automatic follow acceptance). Especially when it requires external authentication like OAuth2. At least with S2S you can use actor keys, but such concept does not exist in C2S. Not to mention that now none of the big ActivityPub server implementations support C2S (Mastodon, Pleroma, Misskey), so you are stuck in a bubble you are creating yourself.
Honestly, I would appreciate if the work that is being done to create toys around AP was instead focused on fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy.@phnt C2S API has always been a solution looking for a problem, but it is similar enough to FEP-ae97 API, so I have no issue with people devoting their time to fixing C2S.
However, almost nobody actually works on it. There is a lot of cheap talk, but anyone who actually tries to implement C2S quickly realizes how broken it is and gives up. Most progress so far has been made by a single developer (btw: I began to document some aspects of his implementation in FEP-9f9f: Collections).
>fixing the complete mess of a specification and making a v2 spec that isn't ambiguous and open-ended as a typical corporate privacy policy
The working group is too busy renaming
https://www.w3.org/ns/activitystreams#Publictoas:Public -
@django AP C2S has been disabled in Pleroma since 2.9.0, commit: https://git.pleroma.social/pleroma/pleroma/-/commit/d6a136f823c6e749e6d2c4a0f80202f0d7c5a960
Also I've noticed that it doesn't like Content-Type: activity/activity+json and can be quirky with cc/to so I'm not really a fan. I couldn't make a reply to a thread that would properly show up in FE. The parent was always not visible in the thread view, but visible when hovering over the "Replying to <user>" UI element. Probably something weird with addressing I'm missing.@phnt can be enabled by an admin via ui?
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@phnt can be enabled by an admin via ui?
-
@lqdev@lqdev.me indeed, now I no longer see raw markdown 😁
-
Since I use custom markdown blocks for media posts, the raw markdown blocks were being rendered in Mastodon. That's now fixed and working as expected. Here's what that a media post (note with attachment) looks like.
I'm feeling really good about my implementation. I'll keep testing other post types but I'm feeling confident about deprovisioning my instance and moving entirely to my website soon.
-
@lqdev@lqdev.me hey, welcome to the Fediverse!
Couple smol things...
When I try to resolve your post by URL, I get a Person back, whoops! Not sure why on NodeBB, I see raw markdown. Was going to inspect source.content, but see #1 :sweat:
-
I could use some help. I'm trying to make a list of all the websites that list ActivityPub 1) software 2) instances and whose content isn't too out of date. Here are some I know:
https://fedidb.com
https://fediverse.observer/stats
https://the-federation.info
https://delightful.coding.socialWhat else is there? Which is your go-to list?
-
I just wrapped up the MVP to [connect my website to the Fediverse by implementing a small subset of ActivityPub](/notes/website-now-natively-posts-to-the-fediverse-2026-01-22/). [Nostr](https://nostr.com/) is a protocol I've heard about but hadn't dipped my toes into, until today. I downloaded the [Amethyst client from F-Droid](https://amethyst.social/). The following are my off-the-cuff initial impressions of Nostr. ## The Good - Creating an account was easy. I just provided a username and was immediately taken to the feed. - The protocol seems simple. It's "just keys and events". In some ways, this simplifies account creation and enables building simple relays that are event / task-specific (search, outbox, DM). - Amethyst is preconfigured with a set of default relays so it solves the empty feed problem. You just create an account, pull up the global feed, and immediately start receiving posts. - Live video? Given Nostr stands for (Notes and Other Stuff Transmitted by Relays), live video is covered under other stuff. Still I was pleasantly surprised to see it. ## Not Ideal? - The global feed is chaos. It's like drinking from a fire hose. There's so many posts coming in all at once it's hard to keep track. - Tons of DeFi content. From what I've read, there's a large DeFi community presence on Nostr. Personally, I don't care for DeFi and Bitcoin content. Building a curated feed over time though should address this issue and reduce the amount of this content I see on my personal feed. Overall, I like what I'm seeing and curating my feed is relatively simple to do so I'm not constantly bombarded with posts from the global feed. 😔just like with ActivityPub and the Fediverse, I already know I'm going to end up running my own relay and start cross-posting content from my site to Nostr. It's just a matter of time. First I want to get my ActivityPub implementation in a more stable state where it manages itself and I can feel comfortable directing folks to subscribe to my Fediverse content through my website instead of the instance I'm currently running. Once that's done, I'll take the lessons and patterns from my ActivityPub implementation and build something similar for Nostr.
-
@3rdi@mastodon.social @stevejb@beige.party I don't think it is a social network, Dan just made a landing page showcasing (his) Canadian alternatives.
-
@dansup I don't see any way to join on the page
