Skip to content

Piero Bosio Social Web Site Personale Logo Fediverso

Social Forum federato con il resto del mondo. Non contano le istanze, contano le persone

Quanti di voi utilizzano #Friendica

General Discussion
18 7 67

Gli ultimi otto messaggi ricevuti dalla Federazione
Post suggeriti
  • 0 Votes
    4 Posts
    16 Views
    We're not currently doing anything around spam because it's not really a specification issue. There has been a few projects in this space, but when I've tested them they've left a lot to be desired. I can't remember specific names off top of head now though because it's been at least 6 months since I did that reaearch
  • 0 Votes
    3 Posts
    17 Views
    セキュリティアップデート: Hollo 0.6.19 リリース FedifyのHTMLパースコードにおけるセキュリティ脆弱性に対応したHollo 0.6.19をリリースしました。 この脆弱性 (CVE-2025-68475) は ReDoS (正規表現によるサービス拒否) の問題であり、攻撃者がフェデレーション操作中に特別に細工されたHTMLレスポンスを送信することで、サービス停止を引き起こす可能性があります。悪意のあるペイロードは小さい (約170バイト) ですが、Node.jsのイベントループを長時間ブロックする可能性があります。 すべてのHollo運営者の皆様には、直ちにバージョン 0.6.19 へのアップグレードを強くお勧めします。 項目 詳細 CVE CVE-2025-68475 深刻度 高 (CVSS 7.5) 対応 Hollo 0.6.19 にアップグレード #Hollo #セキュリティ #fediverse #ActivityPub
  • `keyId` is a problem.

    General Discussion activitypub
    8
    0 Votes
    8 Posts
    10 Views
    @eyeinthesky@mastodon.social Thanks. In your description, does "primary resource" refer to https://enigmatick.social/user/jdt#main-key or https://enigmatick.social/user/jdt? That matters since the latter is not known as accurate until the resolution is complete. Practically speaking, it's clear that I can retrieve the Actor resource using the fragment ID (https://enigmatick.social/user/jdt#main-key) and then retrieve the owner field from the publicKey field of that object to arrive at the Actor ID. Although since the leap to look in the publicKey field doesn't seem like it's specified by LD-JSON, I suppose just pulling the id from the returned Actor object directly might be as valid.
  • 0 Votes
    1 Posts
    18 Views
    Mastodon has a concept called "pinned statuses", which is a special collection attached to a Person actor. https://docs.joinmastodon.org/spec/activitypub/#featured It wasn't readily known how this collection is updated and federated (not without code achaeology), but claire@social.sitedethib.com recently shared some additional info :smiley: The actor itself will issue an Add activity targeting the collection with the status in object. This activity is sent to all followers of the actor. No activity is sent if the actor has no remote followers. A Remove is sent when a pinned post is unpinned. This is what the Add looks like: { "@context": "https://www.w3.org/ns/activitystreams", "type": "Add", "actor": "https://example.org/users/testUser", "target": "https://example.org/users/testUser/collections/featured", "object": "https://example.org/users/testUser/statuses/115266412340579560" } The corresponding Remove is identical except for type, which is of course, Remove.