Big news for the #Fediverse!
General Discussion
31
Posts
10
Posters
0
Views
-
RE: https://socialwebfoundation.org/2025/12/19/implementing-encrypted-messaging-over-activitypub/
Big news for the #Fediverse! End-to-end encryption is coming to #ActivityPub.
@swf with support from @sovtechfund is coordinating two interoperable implementations.
Bonfire is proud to be one of these first two projects, alongside #Emissary by @benpate
We think #E2EE should simply be the default for any private communications, and we’re especially thrilled to bring private, trusted collaboration to the fediverse.
-
Keys will be encrypted on the browser, locked with a separate password that’s not shared with the server.
There are some other synchronization issues we’re going to work out, but not before our first sets of code are due.
There’s more here than I can cover in 500char toots. But I’d be happy to chat some time to hear your thoughts
@benpate @bonfire @swf @sovtechfund Another thought before I'll catch up on sleep:
If the code that handles the key material comes from the webserver, that does not stop a government that's hostile from ordering the website owner to run malicious code that'll also encrypt messages for their people... That's what I worry mainly about in terms of security.
-
I am woefully ignorant here. Spare a link for this poor lad?
-
@benpate @bonfire @swf @sovtechfund Another thought before I'll catch up on sleep:
If the code that handles the key material comes from the webserver, that does not stop a government that's hostile from ordering the website owner to run malicious code that'll also encrypt messages for their people... That's what I worry mainly about in terms of security.
Yes. There has to be trust somewhere along the path.
You could host your own server, but you’d still have to trust the developers to not install a back door. Or a supply chain hack. Or…
-
@benpate @bonfire @swf @sovtechfund Another thought before I'll catch up on sleep:
If the code that handles the key material comes from the webserver, that does not stop a government that's hostile from ordering the website owner to run malicious code that'll also encrypt messages for their people... That's what I worry mainly about in terms of security.
One goal is to make this an interoperable standard, so that you could make your own client app, then use your ActivityPub server as only a dumb pipe.
I think that would instill trust.
More in the AM.
-
undefined oblomov@sociale.network shared this topic on
undefined notizie@poliverso.org shared this topic on
-
@bonfire @swf @sovtechfund @benpate Ooof, just another instant messenger..?
We've already had XMPP since the 90s... and since then it's become pretty reliable.
i hope there'll at least be interoperability. I'm so tired of new ways to communicate that are not interoperable with what's already there.
@erebion @bonfire @swf @sovtechfund @benpate @evanprodromou
There is room for more instant messagers:
https://mov.im/blog/debacle/76bf90a4-5f59-4962-92db-6cd859f42ec9
-
Yes. There has to be trust somewhere along the path.
You could host your own server, but you’d still have to trust the developers to not install a back door. Or a supply chain hack. Or…
@benpate @bonfire @swf @sovtechfund The weak point will be wherever you host the webserver. If a court or corrupt official orders them to install something bad, perhaps a backdoor, that is an issue.
-
@benpate @bonfire @swf @sovtechfund The weak point will be wherever you host the webserver. If a court or corrupt official orders them to install something bad, perhaps a backdoor, that is an issue.
Yes, agreed. I know I said this before, but can't find it:
One important goal is to make a solid, consistent client-side API - something like what C2S was intended to be. That would enable interchangeable clients for mobile/desktop/etc that work with any server.. and greatly increase the trust factor.
I'm only good at making web apps, so that's what Emissary's first client will be. But there will be space for others to build on top of this work.
-
@erebion @bonfire @swf @sovtechfund @benpate @evanprodromou
There is room for more instant messagers:
https://mov.im/blog/debacle/76bf90a4-5f59-4962-92db-6cd859f42ec9
I feel like this is the right time to mention https://xkcd.com/927/
You're very right here. There are tons of IM services. "Why introduce another one?" is a reasonable question
But I don't see it in those terms because we're not creating a new network. This is adding features to network we already have
I'll still use Signal. And Apple Messages
And I'd also like to talk privately with people here, as well. There is room for both.
-
RE: https://socialwebfoundation.org/2025/12/19/implementing-encrypted-messaging-over-activitypub/
Big news for the #Fediverse! End-to-end encryption is coming to #ActivityPub.
@swf with support from @sovtechfund is coordinating two interoperable implementations.
Bonfire is proud to be one of these first two projects, alongside #Emissary by @benpate
We think #E2EE should simply be the default for any private communications, and we’re especially thrilled to bring private, trusted collaboration to the fediverse.
-
Our initial clients will be built in JavaScript, so you’d need to enable JS on your browser to use it (for now)
And, it will require special features on your server, so this won’t work on Mastodon (for now)
Download the road, things will change. We’re defining a standard API that anyone can build in. So hopefully someone can built installable clients (iOS, Android, desktop) that work separate from your browser.
Feed RSS
Gli ultimi otto messaggi ricevuti dalla Federazione
-
Our initial clients will be built in JavaScript, so you’d need to enable JS on your browser to use it (for now)
And, it will require special features on your server, so this won’t work on Mastodon (for now)
Download the road, things will change. We’re defining a standard API that anyone can build in. So hopefully someone can built installable clients (iOS, Android, desktop) that work separate from your browser.
-
@bonfire
How will this work for clients of servers with no JavaScript, like #snac2 and #honk? Well the server be doing the decryption as surely that breaks the point of it being "end-to-end"?
@swf @sovtechfund @benpate
-
@daniel@gultsch.social The Lemmy developers have added a user profile field where you can enter a Matrix account. It would certainly be better to also add a link to XMPP, and I believe this would be the most viable way to immediately achieve secure communication in the Fediverse.
However, it's always helpful for someone to try to "reinvent the wheel": diversity is a very prolific mother of solutions to problems that don't yet exist.
-
@julian said in New Fediverse features that actually aren't new:
> Don't forget NodeBB is also based off of groups! We've increased support for it in 2025 and it's continuing to be our core focus into 2026.No one familiar with the Fediverse can ignore it! In my opinion, NodeBB represents the most complete implementation of Activitypub groups today, adding the ergonomics of Lemmy and the versatility of Kbin to the great flexibility of Friendica!
NodeBB forum categories function as excellent Activitypub groups, perfectly compatible for Mastodon users.
Unfortunately, while users Lemmy/Piefed, Mbin, and Friendica can easily view NodeBB groups, Mastodon users lack a valid interface for managing groups, and almost no one is familiar with the Raccoon app, which is the only app that can recognize Activitypub groups and group discussions by topic.
For me, NodeBB was the best surprise in the Fediverse of this amazing 2025, and I thank the entire development team again for this wonderful gift!
-
Latest FOSS Academic post is -- you guessed it -- a 2025 year in review post. Thrill to the fact that I'm using much of the same FOSS to do my work as I always have! Feel the chills as I talk about #generativeAI and how terrible it is! Above all, join me in living the FOSS Academic Lifestyle Dream!
https://fossacademic.tech/2025/12/21/year-in-review.html
Replies to this post will appear as comments on the blog thanks to the magic of #ActivityPub!
-
@mariusor hey I haven’t published it yet, I’ll be doing so in the next couple of weeks
-
@django is the code available anywhere, I'd like to have a look if possible.
-
to be clear there are more issues than being able to represent an actor alongside a post
but the short version is that not having a proxyUrl endpoint means your client will hit CORS everywhere!
