Skip to content

Piero Bosio Social Web Site Personale Logo Fediverso

Social Forum federato con il resto del mondo. Non contano le istanze, contano le persone

Minutes from 4 December 2025 WG Meeting

  • Apologies in advance if I misrepresented anybody or missed any crucial bits of information.


    Attendees

    Agenda

    1. Mastodon context issues (backfill not possible at the moment)
    2. Context (topic/thread) deletion and moving between audiences (communities/categories)
      • Draft FEP for the above
    3. Deleting entire tree vs. one post. with_replies or Remove(Context)?
    4. Cross-posting (stalled?)

    Mastodon context issues

    • Backfill not possible, context remains null
    • Claire and David are aware, can this be reproduced locally? @jesseplusplus
    • Mastodon keeps track of the conversation, but not what the root-level ID is; Frequency keeps track of the parents. This was new to Mastodon codebase (all internally)
      • Possibly the code shared for this is not working
      • Jesse will take a look (diff b/w Decodon and Mastodon)
      • Ted: in-reply-to tracking is akin to parent tracking
      • Jesse: Not quite; Mastodon now tracks root-level ID (that's the piece that might not be working.)

    Mastodon reading context?

    • The other (harder) half: FEP f228
    • Jesse made David aware of the possibility of using f228 to backfill
    • Asked whether this would conflict with existing reply tree crawling — suspect it will not.
    • Expected 6–12 months out (or more)
    • tl;dr — no update available, but none was expected either.

    Context Relocation and Removal

    • Pre-Draft FEP
    • ActivityPub.Space Discussion
    • Genesis of this FEP from needs of ActivityPub.Space. It bridges Microblogiverse and Threadiverse by importing discussions by hashtag (#activitypub among others)
      • Lots of curation needed as people tend to use the #activitypub hashtag when discussing non-AP things
      • Also non-English content, etc. (ActivityPub.Space is English-focused as we have two mods, Julian and another temporary mod from toot.wales/IFTAS)
    • Pre-draft shared with Rimu (rimu@piefed.social) and Felix (nutomic@lemmy.ml) for their thoughts, discussion (linked above) started last night for some additional input.
    • No opposition to Move(Context) as it is not a functionality that is implemented by anybody at the moment
      • Hooray for greenfield AP dev!

    Out-of-band discussion

    • Remove(Context) received some pushback from Lemmy. This was expected as both Lemmy and Piefed currently use Delete(Object)
    • Felix is recommending that Delete(Object) can supply with_replies property to explicitly denote that the entire reply tree is to be deleted.
    • Julian is recommending that Remove(Context) be used to explicitly denote that the reply-tree/container itself is removed, context can be resolved to determine which exact object IDs to delete if needed, Remove also tells you which audience/community it was removed from.
    • Rimu OK with either approach.
    • Felix raised objection to the wording that Delete(Post) is shown under "backwards compatibility" — Julian will update to reflect equal priority on both approaches.

    ForumWG discussion

    • Julian admits that it is likely much much easier for Lemmy to update their handling of Delete vs. creating a new handler for Remove.
    • Julian notes disconnect with current behaviour (Delete(Object)) and new behaviour (same, but with_replies) and the actual effect (removal from the community); you cannot actually delete someone else's content because it does not satisfy same-origin constraint (yes, sometimes, but not always.)
    • Currently at an impasse as to how to proceed, but Julian encourages parties present to contribute to the discussion and review the FEP.
    • Would prefer alignment as opposed to supporting both Remove and Delete(Object) w/ replies given that it is unlikely both will be implemented widely.

    Action Items

    • [ ] Jesse: investigate null context issue; Mastodon
    • [ ] Julian: Revise and publish FEP f15d

    Relevant Mentions

    melroy@kbin.melroy.org bentigorlich@gehirneimer.de

  • @julian

    FEP-f15d: Context Relocation and Removal

    I have two objections to this proposal. We discussed them before in Moving topics/contexts between communities:

    1. It assumes that a context always belongs to one group.

    As I suggested in the aforementioned thread, an Update activity is a better solution because it works when relationship between a context and a group is many-to-many. It is also semantically cleaner: "update collection audience" instead of "move collection from actor 1 to actor 2" and "remove collection from actor" (at least if ActivityStreams terminology is used).

    2. Treating collections (dynamic views) as static objects that can be moved, deleted etc is not compatible with client-side signing.

    One possible solution is to separate context (an object) and its contents (a collection).

    @jesseplusplus @rimu @nutomic @melroy @BentiGorlich

  • @julian

    FEP-f15d: Context Relocation and Removal

    I have two objections to this proposal. We discussed them before in Moving topics/contexts between communities:

    1. It assumes that a context always belongs to one group.

    As I suggested in the aforementioned thread, an Update activity is a better solution because it works when relationship between a context and a group is many-to-many. It is also semantically cleaner: "update collection audience" instead of "move collection from actor 1 to actor 2" and "remove collection from actor" (at least if ActivityStreams terminology is used).

    2. Treating collections (dynamic views) as static objects that can be moved, deleted etc is not compatible with client-side signing.

    One possible solution is to separate context (an object) and its contents (a collection).

    @jesseplusplus @rimu @nutomic @melroy @BentiGorlich

    silverpill@mitra.social said in Minutes from 4 December 2025 WG Meeting:
    > 1. It assumes that a context always belongs to one group.

    Yes that's correct. There was the potential for a context to belong to multiple audiences but social issues preclude further research.

    Specifically, moderation gets very messy when contexts are cross posted to diametrically opposing audiences, and so that's not something I am equipped to work through right now.

    Secondly, the assumption is already there that a context only belongs to one audience. We will not change that expectation.

  • @julian

    FEP-f15d: Context Relocation and Removal

    I have two objections to this proposal. We discussed them before in Moving topics/contexts between communities:

    1. It assumes that a context always belongs to one group.

    As I suggested in the aforementioned thread, an Update activity is a better solution because it works when relationship between a context and a group is many-to-many. It is also semantically cleaner: "update collection audience" instead of "move collection from actor 1 to actor 2" and "remove collection from actor" (at least if ActivityStreams terminology is used).

    2. Treating collections (dynamic views) as static objects that can be moved, deleted etc is not compatible with client-side signing.

    One possible solution is to separate context (an object) and its contents (a collection).

    @jesseplusplus @rimu @nutomic @melroy @BentiGorlich

    silverpill@mitra.social said in Minutes from 4 December 2025 WG Meeting:
    > 2. Treating collections (dynamic views) as static objects that can be moved, deleted etc is not compatible with client-side signing.

    You mentioned this before, but I am not sure what you are referring to. Do you mind elaborating?

  • >the assumption is already there

    Where, in Lemmy? Even if some implementations don't support cross-posting I don't see a reason to block it at the protocol level.

    And Update is simpler, that's one activity instead of two (Move and Remove).

  • Collections are dynamic objects because they can be paginated and filtered. It's not possible to sign a dynamic object, because some of its properties are constantly changing (items, totalItems and others). This means collections need to be always server-managed. Therefore, clients shouldn't be allowed to directly create, update or delete them.

    I think the proposed Move activity is an obfuscated Update because it changes the collection directly.

  • Collections are dynamic objects because they can be paginated and filtered. It's not possible to sign a dynamic object, because some of its properties are constantly changing (items, totalItems and others). This means collections need to be always server-managed. Therefore, clients shouldn't be allowed to directly create, update or delete them.

    I think the proposed Move activity is an obfuscated Update because it changes the collection directly.

    Sorry it took so long to respond to this —

    Re: assumption of a context belonging to one audience
    > Where, in Lemmy? Even if some implementations don't support cross-posting I don't see a reason to block it at the protocol level.

    This FEP doesn't block cross-posting at the protocol level. Move just explicitly states that a context was Removed from one and Added to another. You could achieve this just fine with Remove followed by Add, but this just reduces it down to a single activity and eliminates any side-effects (e.g. a Remove without corresponding Add might mean content is purged from the db)

    So in theory, a context can belong to multiple audiences, and it can be moved from one to another, or removed from one.

  • Collections are dynamic objects because they can be paginated and filtered. It's not possible to sign a dynamic object, because some of its properties are constantly changing (items, totalItems and others). This means collections need to be always server-managed. Therefore, clients shouldn't be allowed to directly create, update or delete them.

    I think the proposed Move activity is an obfuscated Update because it changes the collection directly.

    @silverpill@mitra.social said in Minutes from 4 December 2025 WG Meeting:
    > It's not possible to sign a dynamic object, because some of its properties are constantly changing (items, totalItems and others). This means collections need to be always server-managed. Therefore, clients shouldn't be allowed to directly create, update or delete them.

    Mmm, signing doesn't guarantee data correctness, it only guarantees that the data presented is correct as of sending, per the sender's point of view.

    Just like how signing a Create(Note) only guarantees that the note's data is what it is at the time of the Create, a Move(Context) only guarantees the validity of the context's data at the time of the Move.

    That said, this FEP doesn't have you including the entire object in, just the URI, so this is moot........ no?


Gli ultimi otto messaggi ricevuti dalla Federazione
  • @silverpill@mitra.social said in Minutes from 4 December 2025 WG Meeting:
    > It's not possible to sign a dynamic object, because some of its properties are constantly changing (items, totalItems and others). This means collections need to be always server-managed. Therefore, clients shouldn't be allowed to directly create, update or delete them.

    Mmm, signing doesn't guarantee data correctness, it only guarantees that the data presented is correct as of sending, per the sender's point of view.

    Just like how signing a Create(Note) only guarantees that the note's data is what it is at the time of the Create, a Move(Context) only guarantees the validity of the context's data at the time of the Move.

    That said, this FEP doesn't have you including the entire object in, just the URI, so this is moot........ no?

    read more

  • Sorry it took so long to respond to this —

    Re: assumption of a context belonging to one audience
    > Where, in Lemmy? Even if some implementations don't support cross-posting I don't see a reason to block it at the protocol level.

    This FEP doesn't block cross-posting at the protocol level. Move just explicitly states that a context was Removed from one and Added to another. You could achieve this just fine with Remove followed by Add, but this just reduces it down to a single activity and eliminates any side-effects (e.g. a Remove without corresponding Add might mean content is purged from the db)

    So in theory, a context can belong to multiple audiences, and it can be moved from one to another, or removed from one.

    read more

  • Collections are dynamic objects because they can be paginated and filtered. It's not possible to sign a dynamic object, because some of its properties are constantly changing (items, totalItems and others). This means collections need to be always server-managed. Therefore, clients shouldn't be allowed to directly create, update or delete them.

    I think the proposed Move activity is an obfuscated Update because it changes the collection directly.

    read more

  • >the assumption is already there

    Where, in Lemmy? Even if some implementations don't support cross-posting I don't see a reason to block it at the protocol level.

    And Update is simpler, that's one activity instead of two (Move and Remove).

    read more

  • silverpill@mitra.social said in Minutes from 4 December 2025 WG Meeting:
    > 2. Treating collections (dynamic views) as static objects that can be moved, deleted etc is not compatible with client-side signing.

    You mentioned this before, but I am not sure what you are referring to. Do you mind elaborating?

    read more

  • silverpill@mitra.social said in Minutes from 4 December 2025 WG Meeting:
    > 1. It assumes that a context always belongs to one group.

    Yes that's correct. There was the potential for a context to belong to multiple audiences but social issues preclude further research.

    Specifically, moderation gets very messy when contexts are cross posted to diametrically opposing audiences, and so that's not something I am equipped to work through right now.

    Secondly, the assumption is already there that a context only belongs to one audience. We will not change that expectation.

    read more

  • @julian

    FEP-f15d: Context Relocation and Removal

    I have two objections to this proposal. We discussed them before in Moving topics/contexts between communities:

    1. It assumes that a context always belongs to one group.

    As I suggested in the aforementioned thread, an Update activity is a better solution because it works when relationship between a context and a group is many-to-many. It is also semantically cleaner: "update collection audience" instead of "move collection from actor 1 to actor 2" and "remove collection from actor" (at least if ActivityStreams terminology is used).

    2. Treating collections (dynamic views) as static objects that can be moved, deleted etc is not compatible with client-side signing.

    One possible solution is to separate context (an object) and its contents (a collection).

    @jesseplusplus @rimu @nutomic @melroy @BentiGorlich

    read more

  • Apologies in advance if I misrepresented anybody or missed any crucial bits of information.

    Attendees Julian (@julian@activitypub.space) Ted Thibodeau Jr (he/him) (OpenLinkSw.com) // GitHub:@TallTed // Mastodon:@TallTed Jesse Karmani (jesseplusplus@mastodon.social) Agenda Mastodon context issues (backfill not possible at the moment) Context (topic/thread) deletion and moving between audiences (communities/categories) Draft FEP for the above Deleting entire tree vs. one post. with_replies or Remove(Context)? Cross-posting (stalled?) Mastodon context issues Backfill not possible, context remains null Claire and David are aware, can this be reproduced locally? @jesseplusplus Mastodon keeps track of the conversation, but not what the root-level ID is; Frequency keeps track of the parents. This was new to Mastodon codebase (all internally) Possibly the code shared for this is not working Jesse will take a look (diff b/w Decodon and Mastodon) Ted: in-reply-to tracking is akin to parent tracking Jesse: Not quite; Mastodon now tracks root-level ID (that's the piece that might not be working.) Mastodon reading context? The other (harder) half: FEP f228 Jesse made David aware of the possibility of using f228 to backfill Asked whether this would conflict with existing reply tree crawling — suspect it will not. Expected 6–12 months out (or more) tl;dr — no update available, but none was expected either. Context Relocation and Removal Pre-Draft FEP ActivityPub.Space Discussion Genesis of this FEP from needs of ActivityPub.Space. It bridges Microblogiverse and Threadiverse by importing discussions by hashtag (#activitypub among others) Lots of curation needed as people tend to use the #activitypub hashtag when discussing non-AP things Also non-English content, etc. (ActivityPub.Space is English-focused as we have two mods, Julian and another temporary mod from toot.wales/IFTAS) Pre-draft shared with Rimu (rimu@piefed.social) and Felix (nutomic@lemmy.ml) for their thoughts, discussion (linked above) started last night for some additional input. No opposition to Move(Context) as it is not a functionality that is implemented by anybody at the moment Hooray for greenfield AP dev! Out-of-band discussion Remove(Context) received some pushback from Lemmy. This was expected as both Lemmy and Piefed currently use Delete(Object) Felix is recommending that Delete(Object) can supply with_replies property to explicitly denote that the entire reply tree is to be deleted. Julian is recommending that Remove(Context) be used to explicitly denote that the reply-tree/container itself is removed, context can be resolved to determine which exact object IDs to delete if needed, Remove also tells you which audience/community it was removed from. Rimu OK with either approach. Felix raised objection to the wording that Delete(Post) is shown under "backwards compatibility" — Julian will update to reflect equal priority on both approaches. ForumWG discussion Julian admits that it is likely much much easier for Lemmy to update their handling of Delete vs. creating a new handler for Remove. Julian notes disconnect with current behaviour (Delete(Object)) and new behaviour (same, but with_replies) and the actual effect (removal from the community); you cannot actually delete someone else's content because it does not satisfy same-origin constraint (yes, sometimes, but not always.) Currently at an impasse as to how to proceed, but Julian encourages parties present to contribute to the discussion and review the FEP. Would prefer alignment as opposed to supporting both Remove and Delete(Object) w/ replies given that it is unlikely both will be implemented widely. Action Items [ ] Jesse: investigate null context issue; Mastodon [ ] Julian: Revise and publish FEP f15d

    Relevant Mentions

    melroy@kbin.melroy.org bentigorlich@gehirneimer.de

    read more
Post suggeriti
  • 0 Votes
    1 Posts
    5 Views
    Week in Fediverse 2025-12-05Servers- stegodon v1.3.0- Ktistec v3.2.2- ActivityPub for WordPress v7.7.0- snac v2.85- tootik v0.20.3- shops v0.1.6- PieFed v1.3.6- Forgejo monthly report - November 2025- Lemmy Development Update November 2025Clients- Pachli v3.2.0- Mastodon for iOS v2025.08- Tusker v2025.3- Voyager v2.41.0Tools and Plugins- Poduptime v5.6.1- FIRES Server v0.8.0Articles- Mastodon creator shares what went wrong with Threads and ponders the future of the fediverse- Why the #OMN works with #ActivityPub – And why we need a bridge to #p2p- The Fediverse and Content Creation: Monetization- Alt Text Health Check image accessibility report #3- Is Pixelfed sawing off the branch that the Fediverse is sitting on?- #OurFedi2025 - Fediverse Year in Review- A review of Exit coolness I overlooked from the world of ActivityPub- Fediverse Report – #145-----#WeekInFediverse #Fediverse #ActivityPubPrevious edition: https://mitra.social/objects/019acbca-9a56-6825-a6da-5469fd8a40fd
  • 0 Votes
    1 Posts
    12 Views
    Destroying Autocracy – November 13, 2025Welcome to this week’s “Destroying Autocracy”.It’s your source for curated news affecting democracy in the cyber arena with a focus on protecting it. That necessitates an opinionated Butlerian jihad against big tech as well as evangelizing for open-source and the Fediverse. Since big media’s journalism wing is flailing and failing in its core duty to democracy, this is also a collection of alternative reporting on the eternal battle between autocracy and democracy. We also cover the cybersecurity world. You can’t be free without safety and privacy.FYI, my opinions will be in bold. And will often involve cursing. Because humans. Especially tech bros. And fascists. Fuck ’em.The Programmer’s Fulcrum is the future (and smaller) home for a fusion of Symfony Station and Battalion. Its tagline is Devs Defending Democracy, Developing the OMN.You can sign up now and for 2025 get an email with links to and featured articles for each week’s Symfony Station Communiqué and Battalion “Destroying Autocracy” post along with their featured articles. And you’ll be set with TPF after the fusing.We are posting on the Fediverse now at @thefulcrum @thefulcrum.dev and original website content will start in 2026.Featured Item(s)Wrekage/Salvage writes:Once you’ve seized the tools of political life to build communal power, it’s hard to forget what a hammer feels like in your hand.Bonfire Networks is a tiny software org that has spent the past couple of years building a framework for communities on the open social web. At the end of last week, they released Bonfire Social, a microblogging app.Like Mastodon, Bonfire Social runs on ActivityPub, but it takes differently opinionated approach to sociability.(It has) features I (and many others) have been advocating for in Fediverse software for years, often while people explained at length that such things simply could not be implemented.Most exhilarating to me, though, is that they aren’t just building another microblogging app. They’re making a toolkit for internet community software that is healthy and good and designed around real human needs from the start.As they put it in their crowdfunding campaign, they’re making building blocks for communities on the open social web.Sparks fly upTotal awesomeness that needs to blow up. We will cover (and support) Bonfire extensively on The Programmer’s Fulcrum.We start and end with good news to make the middle bearable.The response to Russia’s War Crimes, Techno Feudalism, and other douchebaggeryThe Kyiv Independent reports:Ukraine slaps new sanctions on Putin’s team and propagandist publishersRadio Free Europe reports:EU ‘Democracy Shield’ Aims To Counter Russian DisinformationOpen Web Advocacy has:Tim Berners-Lee On Apple’s Browser Engine Ban and Web AppsHeise reports:Office alternative from Germany by Ionos and Nextcloud is now availableGreat.Speaking of Germany, The Guardian reports:ChatGPT violated copyright law by ‘learning’ from song lyrics, German court rulesMeta could face millions in fines for not signing content deals in AustraliaDigital Rights Bytes asks:Can the government read my text messages?404 Media reports:Judge Rules Flock Surveillance Images Are Public Records That Can Be Requested By AnyoneTechCrunch reports:Wikipedia urges AI companies to use its paid API, and stop scrapingBrookings says:We should all be LudditesPreach brother.Poynter reports:As independent newspapers disappear, a secretive alliance fights to save themNeutralOpen Knowledge shares:Open letter: Harnessing open source AI to advance digital sovereigntyThe Ringer has:How Catastrophic Is It If the AI Bubble Bursts? An FAQ.The Evil Empire (AKA Autocracy) Strikes Back404 Media reports:DHS Gives Local Cops a Facial Recognition App To Find ImmigrantsTechCrunch reports:Why a lot of people are getting hacked with government spywareLawmakers warn Democratic governors that states are sharing drivers’ data with ICEEuractiv reports:EU’s red tape bonfire puts AI ahead of privacy protectionNOYB reports:EU Commission internal draft would wreck core principles of the GDPRThe Guardian reports:The EU has let US tech giants run riot. Diluting our data law will only entrench their power.Tech giants vow to defend users in US as spyware companies make inroads with Trump administrationFreedom of the Press Foundation reports:Kansas county pays $3M for forgetting the First AmendmentPariah StatesBleepingComputer reports:APT37 hackers abuse Google Find Hub in Android data-wiping attacksBitDefender reports:Russian hacker admits helping Yanluowang ransomware infect companiesThe Register reports:UK asks cyberspies to probe whether Chinese buses can be switched off remotelyKrebs on Security reports:Google Sues to Disrupt Chinese SMS Phishing TriadBig MediaThe Columbia Journalism Review has:Editorial Independence Means Technological IndependenceThe Open Media Network peeps.The Guardian reports:EU investigates Google over ‘demotion’ of commercial content from news mediaBig TechAnd:Big Tech’s control freak era is breaking itself apartThe Techno Anarchist Manifesto lists tools to help you avoid most of this AI horseshit.Lies, damned lies and AI: the newest way to influence elections may be here to stayJesus.Digital colonialism: the new frontier of Latin American dependency.A side effect of techno feudalism.PC Mag reports:Asking ChatGPT About Affairs or Abortion? Be Careful, Marketers Are Peeking at Your PromptsCybersecurity/PrivacyThe Register reports:OWASP Top 10: Broken access control still tops app security listIEEE Spectrum reports:Your AI Agent Is Now a Target for Email Phishing. New tools can help thwart the attacks.Like bitcoin, if you use this shit you deserve what you get.DarkReading reports:Orgs Move to SSO, Passkeys to Solve Bad Password HabitsGlassWorm Returns, Slices Back into VS Code ExtensionsCheck out VS Codium friends.BleepingComputer reports:Police disrupts Rhadamanthys, VenomRAT, and Elysium malware operationsFediverseElena Rossini shares:The rebellion will be federated – 2025 editionA New Social has:Bonfire and A New SocialBonfire explains:Matters of care – why Bonfire maintenance comes first.Comciencia has:A comunicação da ciência no FediversoLaura Hargreves shares:Growing My Own Little Fediverse: The Joy of Going Further Down the Rabbit HoleInside My Matrix: How I Reclaimed Messaging from the CloudTechCrunch reports:Threads targets podcasters with new features, aiming to become the home for show discussionsBTW, fuck Threads.Slightly Decentralized Social MediaThe Dabbler has:Chicken Caesars: they’re messing with your Bluesky feedTechCrunch reports:Jack Dorsey funds diVine, a Vine reboot that includes Vine’s video archiveHmm, this is built with Nostr.CTAs (aka show us some free love)That’s it for this week. Please share this edition of Destroying Autocracy.Follow me on the Fediverse. Or this site via the button in the footer. Or via RSS. Or even our future home in 2026, if you want a head start.Keep fighting!Ringleader, BattalionReuben Walker Follow me on the Fediverse#activitypub #ai #autocracy #bigJournalism #bigTech #bluesky #bonfire #bridgyfed #democracy #fascism #fediverse #matrix #stopChina #stopIsrael #stopRedAmerica #stopRussia #supportUkraine #technoanarchism #technofeudalism #threads #xmpphttps://battalion.mobileatom.net/?p=3838
  • 0 Votes
    9 Posts
    29 Views
    @micke no. But many of the standards that we depend on, like Webfinger, HTTP Signature, OAuth and now MLS are at IETF. There is a lot to see and do here for people working on Fediverse standards.
  • 0 Votes
    5 Posts
    21 Views
    @blainsmith @rimu @jwildeboer there is a forthcoming FEP from the AP T&S taskforce that introduces the idea of a Moderation Actor for Actors, so like "Moderated By", which would be a Group or Service actor probably, but it would not be required to disclose it's members.