← Feed

Posts

• NodeBB v4.14.0 — Federation regression fixes, security fixes, and more!

  With temperatures reaching well into the 30s (in celsius of course :sunglasses:) in the Toronto area, we're all firmly in summer mode :swimmer: :beach_with_umbrella: , but that won't stop us from forging on ahead with new features and fixes for NodeBB! There are improvements across ActivityPub federation, administrative tooling, and security hardening. Our ActivityPub integration receives bug fixes including duplicate handling, configurable rate limiting, and better error reporting, al...

• Feature Highlight for v4.12.0 — Activity Intents

  A new feature silently dropped in v4.12.0. NodeBB now supports Activity Intents! Huh? What's an Activity Intent? It is a proposal by @benpate@mastodon.social that aims to "extend the capabilities of an ActivityPub server beyond a user's outbox, and enable direct interactions with content on the wider social web." In other words, it allows you to more seamlessly use your fediverse account on other sites without having to register a new account just to contribute. In even s...

• NodeBB v4.11.0 Release Notes

  Hi everybody — late last week we released v4.11.0, which contains the following changes: ActivityPub Specific Fixes :rotating_light: AP analytics and error pages New pages have been added to the control panel to display analytics (send/receive counts) and error counts. There is also a new error page that will show error received within the last 24 hours, and their respective payloads. This will aid in debugging federation issues. :writing_hand: Article vs. Note distinction updated Prior to t...

• Updates to NodeBB's Bug Bounty Program

  Since 2017, we've maintained a bug bounty program that awarded responsible disclosure of security vulnerabilities on a sliding scale of $64 to $512 based on severity. Throughout the years we've made some unpublished changes to this bounty program, mostly related to the format (no videos, text only, allowed testing endpoints) and in some cases expanding the scope of covered plugins (e.g. 2factor, web-push). With the rise of LLMs and the corresponding drop in ability needed to analyze...

• BSD Cafe launches hybrid forum and Fediverse platform called Billboard

  Stoked to see BSD Cafe has a new site... Running NodeBB :sunglasses: https://billboard.bsd.cafe/ Considering they don't run just anything, we're in good company! Their other instances run Mastodon (of course) and snac2, arguably one of the most lightweight ActivityPub services.[...] Designed as a hybrid space, it functions as a classic discussion forum with persistent threads while also supporting ActivityPub federation, enabling cross-platform interactions without algorithmic cur...

• NodeBB v4.10.0 — Alt text, more /world, bugfixes

  Hi everybody, With spring around the corner (it is currently a balmy 5°C here right now), it's time to get crackin' on a new release of NodeBB! We focused on a lot of user experience updates this time around, along with tweaking the new /world page that was introduced in v4.9.0. In the backend, lots of optimizations were implemented, which make federation processing (and day-to-day maintenance) faster. Here's what you can expect from v4.10.0...[...] :globe_with_meridians: Upd...

• Notice: Breaking change in v4.5.0 (requests to internal IP addresses disallowed)

  We are publishing a notice today to bring to attention an unintentional breaking change that could affect some users of NodeBB. v4.5.0 contained an update to src/request.js that calls a DNS resolver to ensure that the destination address is not a reserved IP address (e.g. 192.168..., 127.0..) This change was introduced in order to close off any potential for Server-Side Request Forgery for any calls made within the NodeBB codebase. [...] In the vast majority of installations, this has no u...

• ActivityPub user and category outboxes coming soon

  Up until today, when you queried a NodeBB user or category's outbox, you would receive an empty OrderedCollection. This was done because the property's inclusion in the actor object was required, but it was not immediately apparent in 2024 how many people utilised this property. Thus it was easier to just send the empty outbox and pursue more urgent functionality. While sending that empty outbox has not broken any implementations, but it has come to my attention that a few (read: more...

• Federation: What is it and how does it work?

  It is possible for NodeBBs to talk with each other. In fact, not only can two NodeBB forums see and share conversations, you can also connect with other websites that can federate. This article is part of the NodeBB Answers category, where you can learn more about setting up, maintaining, and using your NodeBB forum. [...] How does it work? Under the hood, NodeBB uses a protocol called ActivityPub to exchange messages and activities between different websites and apps. Each user, category,...