Skip to content

Piero Bosio Social Web Site Personale Logo Fediverso

Social Forum federato con il resto del mondo. Non contano le istanze, contano le persone
  1. Home
  2. Categories
  3. General Discussion
  4. I wonder if you could control a botnet with #ActivityPub.

I wonder if you could control a botnet with #ActivityPub.

General Discussion
3 2 21
Log in to reply

Feed RSS
I wonder if you could control a botnet with #ActivityPub.

Gli ultimi otto messaggi ricevuti dalla Federazione
@pierobosio@soc.bosio.info
Post suggeriti
  • fedify@hollo.socialundefined

    ### 🚨 Security Advisory: CVE-2025-68475

    Fediverso fedify fedidev security fediverse activitypub
    1
    1 Votes
    1 Posts
    6 Views
    fedify@hollo.socialundefined
    🚨 Security Advisory: CVE-2025-68475 A ReDoS (Regular Expression Denial of Service) vulnerability has been discovered in Fedify's HTML parsing code. This vulnerability could allow a malicious federated server to cause denial of service by sending specially crafted HTML responses. CVE ID CVE-2025-68475 Severity High (CVSS 7.5) Affected versions ≤1.9.1 Patched versions 1.6.13, 1.7.14, 1.8.15, 1.9.2 If you're running Fedify in production, please upgrade to one of the patched versions immediately. For full details, see the security advisory: https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93 Thank you to Yue (Knox) Liu for responsibly reporting this vulnerability. #Fedify #ActivityPub #security #fediverse #fedidev
  • blog@shkspr.mobiundefined

    Now witness the power of this fully operational Fediverse!

    General Discussion activitypub bluesky fediverse mastodon statistics
    1
    1
    0 Votes
    1 Posts
    8 Views
    blog@shkspr.mobiundefined
    Now witness the power of this fully operational Fediverse!https://shkspr.mobi/blog/2025/11/now-witness-the-power-of-this-fully-operational-fediverse/How can you measure the popularity of a social network site? Perhaps by counting the number of active accounts, or the quality of the discourse, or even how many people reply to your witty memes.Me? I prefer to look at how many people visit my blog from each site. It is an imperfect measure - and a vain one - but lets me know where I should be spending my time. No point posting on a network which is just bots talking to each other, right?Earlier this year I built a stats-counter for my blog. Every time someone clicks from a website which links to my blog, it records that visit in a database. I get to see which blog posts are doing numbers, and where those numbers came from.Until fairly recently, the Mastodon social network didn't send referer details. I thought that reduced the visibility of the network and lobbied for it to change. As various Mastodon servers upgrade, and admins opt-in, it is becoming more apparent just how much traffic originates from the Fediverse.Over the last few weeks, here's how many people have clicked from BlueSky and Mastodon to one of my blog posts.TotalSource1,607bsky.app752mastodon.socialAt first glance, it doesn't look good for our elephantine friends, does it? The butterfly sends over twice the traffic. Game over!But, of course, while Mastodon.social is the biggest instance - it is far from the only one. What happens if we slide down the long tail? Here's all the Mastodon-ish instances which sent me over 10 clicks.TotalSource193phanpy.social120 android-app://org.joinmastodon.android/106infosec.exchange62mas.to59mstdn.social55social.vivaldi.net49wandering.shop48fosstodon.org33mathstodon.xyz27mastodon.online26mastodon.scot24app.wafrn.net19indieweb.social18social.lol17tech.lgbt17toot.wales16en.osm.town16feditrends.com14mstdn.ca14piefed.social12wetdry.world11c.im11mastodon.nl51 Sites sending < 10 clicksAh! Add them all up and you get a grand total of 1,773 visitors from Mastodon-powered sites. That's more than BlueSky.Now, there are some obvious caveats to the data:I have a smaller follower count on BlueSky than I do on Mastodon.My posts may appeal more to one demographic than another.People may have strict privacy controls which suppress the true volume of visitors.There's no way to measure how long someone spends reading my posts.RSS and newsletter visitors aren't counted.Clicks from apps may not always show a referer.Some people may be on multiple services.Fediverse users can follow the post directly, so don't need to visit the site to read it.And yet… no matter how you slice it, Fediverse servers are sending as much traffic as BlueSky!I think this is brilliant. Web services should be able to scale from small to big - and each ActivityPub-powered site helps power the open Internet.Just for completeness, this is how Reddit, Facebook, LinkedIn, Twitter, and Lemmy do over the same period:TotalSource1,158reddit.com585 android-app://com.reddit.frontpage/76facebook.com76https://old.reddit.com/r/programming/56https://www.reddit.com/r/programming/52youtube.com41t.co38https://old.reddit.com/r/todayilearned/comments/1nsw7f4/til_in_mongolia_instead_of_a_street_address_a/31linkedin.com27 android-app://io.syncapps.lemmy_sync/27https://www.reddit.com/r/todayilearned/comments/1nsw7f4/til_in_mongolia_instead_of_a_street_address_a/22https://old.reddit.com/r/programming/comments/1n96ftn/40_years_later_are_bentleys_programming_pearls/22lemmy.ca17 android-app://com.linkedin.android/16lemmy.dbzer0.com14feddit.org11https://www.reddit.com/r/programming/comments/1n96ftn/40_years_later_are_bentleys_programming_pearls/10discuss.tchncs.de10l.instagram.com8lemmy.blahaj.zone6https://www.reddit.com/r/GrapheneOS/comments/1m2l84b/considering_making_the_switch_does_google_pay/6reddthat.comIf you add up all the Lemmy instances, they send about as much traffic as Facebook and LinkedIn combined. That's not a huge surprise - those platforms hate anyone clicking away to the wider web.Twitter is basically the Dead Internet. I'm no longer on there, but I do occasionally search it to see who is sharing my posts. The popular posts I write get shared a lot - sometimes by accounts with huge followers - yet there are no comments or retweets and barely and clicks.I don't do Instagram or Threads, and that might be reflected in their low numbers. But I'm not active on YouTube either - yet people there occasionally link back to me.Final ThoughtsFirstly, my stats only represent my site. Your site might be very different.Secondly, I've ignored search engine traffic, big blogs, newsletters, and other sources.Thirdly, and most importantly, this isn't a competition! The desire for a "winner-takes-all" service is dangerous and disturbing. An ecosystem is at its most vibrant when there are multiple participants each thriving in their own niche.I want a thousand sites, running a hundred different software stacks, some of which only serve a dozen people, or even a lone participant.Diversity is strength.#activitypub #bluesky #fediverse #mastodon #statistics
  • interesting@bookmarks.kvibber.comundefined

    honkA minimalist ActivityPub microblogging server.

    General Discussion honk activitypub servers
    1
    0 Votes
    1 Posts
    8 Views
    interesting@bookmarks.kvibber.comundefined
    honkA minimalist ActivityPub microblogging server. Like, really minimalist. And opinionated. HONK! "No attention mining. No likes, no faves, no polls, no stars, no claps, no counts."#honk #ActivityPub #servers
  • julian@community.nodebb.orgundefined

    Minutes from 4 September 2025 WG Meeting

    Forums and Threaded Discussions Task Force forumwg swicg activitypub
    1
    0 Votes
    1 Posts
    15 Views
    julian@community.nodebb.orgundefined
    Apologies in advance if I misrepresented anybody or missed any crucial bits of information. Jesse Karmani (jesseplusplus@mastodon.social), Ted Thibodeau Jr. (tallted@mastodon.social, and Julian Lam (julian@activitypub.space) in attendance Julian provided an update on adoption of FEP 7888 Both Piefed and Lemmy have adopted 7888, and will begin publishing resolvable context collections in their next release Jesse opened a PR to Mastodon, which received preliminary approval from Gargron@mastodon.social (ed. it was later merged, rolled back, updated, a new PR opened, which was then merged) This PR is the first of two planned pull requests. The first generates the outgoing context (the same as what Lemmy/Piefed have done recently) The seconds handles incoming contexts and backfills Jesse was asked whether it would conflict with existing reply-tree crawling methods, but the two are complementary. She expects additional discussion before the PR is opened. Julian noted that it would be helpful if statistics/analytics were gathered by the Mastodon team to see how conversation contexts and backfill works at scale; admits that existing implementations and testing has been small scale and may not reflect real-world usage. Julian noted that Lemmy's implementation (nutomic@lemmy.ml) does not paginate their resolvable context implementation. All objects are listed in one OrderedCollection Jesse noted that she followed Mastodon's pagination convention for collections. Context inheritance Julian asked for opinions on whether contexts were inherited in existing implementations. Notes that NodeBB inherits parent context, but checks further up the known parent chain for further contexts Julian admits that not everybody can and should do this, is also not sure anymore whether NodeBB actually does this. Julian notes the ideal implementation would be every object referencing their immediate parent, which would lead to the entire collection referring to the same context collection. Jesse: Decodon inherits immediate parent context only Ted: notes that this is a reinvention of inReplyTo Julian and Jesse note that there are marked differences between crawling the reply chain. A short discussion about how netnews and usenet handled reply chains was had. Julian notes that Lemmy will not inherit context. Every object will point back to its own server's context collection. This was a conscious decision by Nutomic as each instance is meant to consider its own representation of remote content as the canonical representation ActivityPub.Space Julian made a short shout-out to a new site called ActivityPub.Space, meant to be a hub for AP development discussions ("A federated space for ActivityPub discussions so that they don’t just get lost in ephemeral replies") A short double-back to NNTP and how they approach "eventual consistency" Ted: “Cloud of NNTP servers are all hosts of articles and replies.” Strictly speaking it’s not a reply tree as replies can be inReplyTo multiple parents