Piero Bosio Social Web Site Personale

Hello sloth aficionados!This is a security announcement for an issue that was fixed in #GoToSocial releases v0.21.3 and v0.22.0. If you are running an earlier version of GoToSocial please find time to upgrade to one of these releases as soon as possible!The security vulnerability allows a remote attacker crafting (properly signed) ActivityPub activies to send Create, Update and Announce activities to a GtS instance that persist statuses / boosts as if they were written by a remote victim account. This happens due to our (previously) incorrect handling of multi-valued attributedTo and actor in the effected activities. We are not aware of anybody using this vulnerability in the wild, but it remains possible on all GtS versions v0.21.2 and below.This was kindly disclosed to us by Lain of the Pleroma project, thank you Lain!Timeline:June 23rd, Lain emailed admin@gotosocial.org with details of the issue.June 24th, a fix was merged.June 25th, versions v0.21.3 and v0.22.0-rc4 including the fix were released, along with a pre-disclosure warning of the security issue urging users to update.July 6th, security vulnerability publicly disclosed by this post.

@prinlu thank you ! 🙏  @kotking

@glitc_ the latest version of GoToSocial introduced relays. And it’s funny because I loved how small my audience was over there when I began - my little quiet corner of the Fediverse! Well, that quiet corner just surpassed the 4 thousand followers mark I think 😅 so you can have reach on GoToSocial too (whether you want it or not, LOL)

Back online! Upgraded to the 0.22 Shrubby Sloth!Now users can subscribe to Relays!#Bobadin#ThisIsTheWay#GoToSocial

@FediTips @gotosocial also they have a pride flag in the footer of their site which is extremely based (and has actively upset some queerphobes, which is lovely to see)https://codeberg.org/superseriousbusiness/gotosocial/releases/tag/v0.19.2#:~:text=Migration%20notes-,pride%20%2F%20trans%20flags,-This%20release%20includes

Hi everyone!! <3Over the last week your generous donations to #GoToSocial have brought our OpenCollective budget up from ~€450 per month to the current total estimate of €950 per month!! That's amazing, thank you so much to everyone who has donated, and boosted our fundraising posts (see thread above) That means we're a lot closer to our initial goal of getting an estimated monthly budget of €2,500 so that Tobi (writing this post) and Kim can pay themselves a supplementary wage of €1,000 each every month.Can you help us reach €2,500 a month, to make our work on GoToSocial less stressful and haphazard? We have yearly, monthly, and custom donations available:https://opencollective.com/gotosocial#category-CONTRIBUTEThank you again for reading, boosting, and/or donating, everything helps <3

Aggiornamento completato ✅snowtest.it è stato aggiornato correttamente all’ultima versione ufficiale stabile di GoToSocial.Come sempre, niente snapshot, niente release candidate, niente salti nel vuoto, solo manutenzione fatta con criterio, backup, controlli e un po’ di pazienza.L’istanza è di nuovo raggiungibile e sembra funzionare regolarmente. Ora la lasciamo lavorare un po’ tranquilla, così controlliamo che tutto continui a girare bene anche con la normale attività federata.Grazie per la pazienza e buon proseguimento a tutti 🙏

@_elena it does make sense now they chose the Bluesky codebase instead of Mastodon since Bluesky never really has been committed to open source in the way that Mastodon with its way stronger user protections from the license was.Truth social would have loved to take something with a permissive license like MIT/BSD too if it had existed way back when they were starting out.Note Eurosky isn't really that much more committed either though. They promote closed source ATproto apps like Flashes.

MastoBlaster Build 94 is now available on TestFlight.This is a major release that merges several different development branches I've been working on, bringing together a lot of moving parts into a single build. A long, sleepless night…Here is what changed:Full Drafts Support: A complete end-to-end draft flow. It includes auto-save, the ability to edit existing drafts, and a smart cancel confirmation that either discards a new draft or restores the original state if you were editing. It supports replies, quotes, polls, and media metadata.Trending Posts: Added a new trending timeline type with proper offset pagination support.Timeline Position Improvements: Added extra protection to stop SwiftUI from overwriting your saved scroll position when the view disappears or goes to the background. If a saved post can't be found in the cache, the app will now try a direct status fetch before giving up.UI & Navigation Fixes: Tapping Content Warnings (CW), "Show Filtered Post", or "Show More" now goes through an inline-action guard, fixing the bug where tapping them would accidentally trigger row navigation into the thread. Filtered posts also get proper bottom padding so the list separator doesn't sit on top of the button.Instance Compatibility & Tweaks: Added customizable timeout settings for slower instances (like snac on older hardware). I also fixed the 405 error when setting alt text on GoToSocial, and updated marker sync to strictly align with Mastodon’s documented form shape.Testing focus: I've implemented search fixes ensuring queries stay locked to the account you are searching from. If you are on GoToSocial, please test this thoroughly and let me know how it behaves. Since this build is the result of a massive merge, keep an eye out for any regressions.#MastoBlaster #MastoBlasterUpdates #iOS #Mastodon #snac #GoToSocial #Fediverse #Apple

@daj awesome! That's good to hear. Sorry for the flood!

@_elena 😂 I got cat-phished! https://mastodon.social/@meganmariehart/116477134196689127

@adele now also tested with snac, fwiw ;-) nice work!

@joel whaaaaaat?!? that's amazing to hear!!! 💗​

happy souls "i've got boss weapons" voice: We've got #GoToSocial BUGFIX RELEAAAASEhttps://codeberg.org/superseriousbusiness/gotosocial/releases/tag/v0.21.2Bugfixes and little chores! Check the commits at the link for specifics.Note that we bumped the Go version number to v1.25 for this release. Normally we wouldn't do this in a bugfix release, but a dependency update (including a bugfix) depended on it, so here we are. Practically speaking you probably won't notice a difference, but it's worth mentioning.If you're updating to this version from v0.21.x, it's a very easy update with no db migrations.If you're updating to this version from a version before v0.21.0, please follow the update instructions from v0.21.0, but replace 0.21.0 with 0.21.2 throughout. Be aware that the update to 0.21.x contains some database migrations. Please do read the notes carefully!

I can confirm that #Tuba is an excellent #Fediverse client for Linux and BSD users on #snac2. It's also great for Mastodon, #GoToSocial, etc.

@bryan@dusty.ninja it’s based on https://github.com/mastodon/webpush-apn-relay but I’ve patched it for proper GoToSocial notifications support.It will depend on how many push notifications it will have to handle. But being stateless, I can always fire up another one and round robin them at DNS level.

@hikingdude ooooooh got it! 😮​

@_elena I was experimenting with hosting GTS on an old smartphone. If this works, I can the local kids how to do it with the e-waste at home.

MastoBlaster is now available in public testing on TestFlight.It is a lightweight, privacy-first Fediverse client for iOS, built around a simple idea: fast, small, predictable behavior, and first-class support for snac.What makes it different:• snac-first by design, not "compatible by accident"• Works with all Mastodon API compatible software, including Mastodon, snac, GoToSocial, Akkoma, and others• EXIF stripping on upload (HDR and orientation preserved)• Optional on-device alt text generation via Apple Intelligence for your uploads and for images in your timeline• Markdown posting for snac• Granular notifications, grouping, multi-account• Blocking and moderation tools• Very small footprint, very low RAM usageAlt text generation happens entirely on device via Apple APIs on supported hardware. Nothing is sent to external services.It is built around my own workflow and priorities. It may not be for everyone, and that is perfectly fine.Important note:MastoBlaster will always be free for BSD Cafe users, illumos Cafe users, and for anyone connecting to a snac instance, including self-hosted ones.The app is already usable, but this is still a test phase. I am looking for feedback, bug reports, and real-world usage insights.TestFlight link:https://testflight.apple.com/join/Pkxa5R1kStay tuned.#MastoBlaster #iOS #Apple #Fediverse #Mastodon #snac #GoToSocial #Akkoma #ActivityPub

@joel @mastoblaster I think I fixed it. Both notification relay side and app side. I'll publish an updated beta (with other fixes, too) later today.