← Feed

Posts

• Post #4356443

  The biggest problem for peer to peer ActivityPub is the fact that ActivityPub is primarily a "pull" protocol. You need to fetch a remote actor before interacting with it. This is not feasible in the environment where nodes are intermittently online. What if we used a special activity to request objects? I've described this idea in more detail in Asynchronous object retrieval: https://codeberg.org/silverpill/feps/src/branch/main/aef6/fep-aef6.md I think this mechanism, if combine...

• Post #4349258

  I added a list of recommended libraries to the ActivityPub developer guide: https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md#libraries - activity (Go, used in GoToSocial) - Fedify (JavaScript, used in Hollo and Ghost) - Fedipub (Ruby, used in Manyfold) - activitypub_federation (Rust, used in Lemmy) - APx (Rust, used in Mitra) This list only includes libraries that are actually used somewhere. Libraries that are not used, or used in projects with too few users are not included. #...

• Post #4290096

  Private groups Lately, I've been seeing various people claiming that fediverse doesn't have private groups. They often point to some task force at w3c that is supposedly working to fill the gap. However, fediverse has had private groups for a very long time: - Hubzilla channels. This project probably had private groups before ActivityPub. The implementation was later adapted for ActivityPub and refined in subsequent forks, Streams and Forte. It is now partially documented in FEP-171b:...

• Post #4149354

  FEP-0806: Simple client-side encryption https://codeberg.org/silverpill/feps/src/branch/main/0806/fep-0806.md The FEP now includes the recommended algorithm parameters. I consider it finished but I don't plan to continue working on my implementation or publishing to the main FEP repository. It would be better to focus on group messaging with forward secrecy (MLS or similar). #fep_0806 #e2ee

• Post #4133524

  Setting up a Forgejo instance: https://code.mitra.social/silverpill/mitra It will be mirroring repositories related to the #Mitra project. I don't plan to migrate from Codeberg right now, but it wouldn't hurt to have a self-hosted instance in case they decide to enforce the new anti-crypto policy. This will also allow me to test the implementation of federation in Forgejo.

• Post #4017466

  Proposal: Replace gateways query parameter in 'ap' URIs with @gateway, which can be used multiple times https://codeberg.org/fediverse/fep/pulls/890 Before: ?gateways=https%3A%2F%2Fserver1.example,https%3A%2F%2Fserver2.example After: ?@gateway=https%3A%2F%2Fserver1.example&@gateway=https%3A%2F%2Fserver2.example Query parameters are often used to specify collection filters. The @ prefix will make it clear that gateway parameter is special. #fep_ef61

• Post #4012192

  Codeberg is banning "cryptocurrency projects": https://codeberg.org/Codeberg/org/pulls/1254#issuecomment-19820413 I don't know if Mitra qualifies as such, but I guess it is time to move to a self-hosted forge.

• Post #3968528

  I finally got around to trying #iroh It nicely complements FEP-ef61, because it allows you to connect to another actor by its did:key. In theory, we can completely replace the federation of HTTP servers with a federation of iroh nodes. However, I'm not convinced that iroh is the best solution. The most obvious problem is a lack of anonymity. Newer versions of iroh support custom transports, and Tor transport is among them, though still experimental. The work on I2P transport has not starte...

• Post #3892328

  The NomadPub intro page now includes a "Research" section: https://codeberg.org/ap-next/ap-next/src/branch/main/nomadpub.md#research I listed the most important open research problems there: key management (alt-DIDs), alternative transports, E2EE and generic servers. #NomadicIdentity

• Post #3889834

  I managed to send an encrypted message from one Mitra Mini account to another. The gateway should run the latest development version of Mitra. Spec: https://codeberg.org/silverpill/feps/src/branch/main/0806/fep-0806.md

• Post #3755855

  Updating FEP-ef61: Portable Objects: https://codeberg.org/fediverse/fep/pulls/883 I added a section about key management. This part of nomadic identity was often misunderstood - some people thought that secret keys need to be managed by servers, and that servers could impersonate users. No, there are 3 options: - Server-side signing: secret keys are managed by a server (gateway). Activities are generated and immediately signed by a server. - Delegated signing: secret keys are managed by a sep...

• Post #3636164

  Finally implemented FEP-0806: Simple client-side encryption in Mitra Mini. Right now it only does encryption-decryption. No delivery yet - because gateways don't support EncryptedActivity activities. The scheme was changed to HPKE (RFC 9180 Hybrid Public Key Encryption). #fep_0806

• Post #3630688

  Minor FEP-5219 update: https://codeberg.org/fediverse/fep/pulls/880 I started implementing this FEP in Mitra, here's how an affiliations collection looks like: https://mitra.social/ap/actors/019f0e0d-b949-7600-aa86-0df8e275c291/affiliations #fep_5219

• Post #3587439

  I've got a report about Mastodon v4.7.0-alpha.1 not federating with Mitra. Can anybody confirm this? They recently merged FEP-8b32 signature verification, that might be relevant. All Mitra activities are signed

• Post #3558924

  New @minimitra release: 0.4.2 This version supports post edits. There are also some big changes under the hood that will allow me to copy features from Mitra to Mini with less effort in the future. RE: https://mitra.social/.well-known/apgateway/did:key:z6MkumzpDj1cYZD2GrBbVT86xL6CfPuyqWZAEXMfSqN9j3hf/objects/019f2891-61e1-77b1-8638-10f33b4d4df9

• Post #3542326

  Regarding the validity of at:// URIs in atproto: https://bnewbold.leaflet.pub/3mph4hzvbdc2v We have a similar problem with FEP-ef61 'ap' URIs. In their canonical form, they are not valid RFC-3986 URIs. I think if atproto devs decide to move away from ://did:.. syntax, we'll have to do that as well. #fep_ef61

• Post #3542325

  FEP-8b32 update: https://codeberg.org/fediverse/fep/pulls/874 - Recommendation for expired proofs: try other authentication methods. - Added a link to Quantum-Resistant Cryptosuites v1.0 - Added Mastodon to the implementation list (verification only for now) #fep_8b32

• Post #3542324

  I'm requesting final comments on FEP-7628: Move actor #fep_7628 #fep #activitypub

• Post #3449466

  FEP-ef61: Portable Objects has been updated: https://codeberg.org/fediverse/fep/pulls/872 The ap+ef61 URI scheme is now allowed, while ap remains the recommended one. This is to ensure compatibility with @fedify@hollo.social whose maintainers decided to use the ap+ef61 scheme until the specification is finalized. #fep_ef61 #nomadicidentity

• Post #3296608

  FEP-5219: Groups and permissions has been added to the FEP repository. #fep #fep_5219 RE: https://mitra.social/objects/019e87e9-62a6-71d1-8edc-3a8a63e96c9f

• Post #3262351

  I tried to implement the "standard" ActivityPub #C2S API in Mitra. It's an interesting exercise, but I am not sure if I'll ever enable it by default. Permitting clients to publish arbitrary JSON is equivalent to allowing them to publish unsanitized HTML. This may be acceptable if you're an admin on a single-user instance, but it is a really stupid thing to do when there are multiple users. Although it might be possible to validate activities using strict JSON schemas, tha...

• Post #3243585

  FEP-f228: Backfilling conversations has been updated: https://codeberg.org/fediverse/fep/pulls/853 I added tootik and Lemmy to the implementation list and did a little cleanup. This FEP feels complete, so I am requesting final comments. Full text: https://fediverse.codeberg.page/fep/fep/f228/ #fep_f228 #fep #fedidev

• Post #2927932

  @swetland@chaos.social FEP-8b32 implementations use Ed25519: https://codeberg.org/fediverse/fep/src/branch/main/fep/8b32/fep-8b32.md#implementations But for HTTP signatures everyone still uses RSA because dominant implementations don't support Ed25519

• Post #2891884

  @morph2@morph.todon.de >'invalid access token' This is because some clients don't support OAuth tokens with limited lifetime. I suggest opening an issue in the respective issue trackers. Logging out may help. Alternatively, you can change the authentication_token_lifetime parameter in your configuration file to a bigger number: https://codeberg.org/silverpill/mitra/src/commit/37eebd0e308f047612de433b6286a3f2ec731058/config.example.yaml#L63-L64 >Sengi never worked with Mitr...

• Post #2792212

  FEP-fe34 (Origin-based security model) update : https://codeberg.org/fediverse/fep/pulls/849 I tried to better explain the assumptions on which the model is based, and clarified how exactly origins should enforce boundaries between actors: Servers MUST ensure that activities published by a client do not represent unauthorized actions. This includes activities embedded within other activities and objects. Servers MUST NOT allow clients to publish activities where embedded objects are owned by...

• Post #2766494

  @billstatler @fediversereport@mastodon.social @Mastodon@mastodon.social @matrix@mastodon.matrix.org And ActivityPub is not public-by-default. One could say that about Mastodon where the default post visibility is "public", but ActivityPub is private by default. If an ActivityPub object is not addressed to anyone via to and cc, it is literally invisible.

• Post #2723090

  - https://github.com/mastodon/mastodon/releases/tag/v4.5.10 - https://hollo.social/@fedify/019e4675-05bc-7725-bcf4-aa51d6af70a0 - https://shrimp.meow.company/notes/amhmis327j0wve4w - https://shrimp.meow.company/notes/amhmiqtsbwgmt158 - https://activitypub.software/TransFem-org/Sharkey/-/releases/2025.4.7 - https://hubzilla.org/item/53f3509f-d63d-494c-a431-ac84df9c6a57 - https://w.on-t.work/activitypub/may-2026-vulnerability >Fix Linked-Data Signature bypass through JSON-LD graph restructurin...

• Post #2722051

  @0461fcbecc4c3374439932d6b8f11269ccdb7cc973ad7a50ae362db135a474dd@mostr.pub This is one of the reasons I don't build on Nostr. It's full of delusional bitcoin cultists

• Post #2721972

  @mischievoustomato@tsundere.love @tadano@mt.watamelon.win I figured out how to do CI, so now we can build packages automatically on Codeberg

• Post #2696267

  @BPFreeSpeech@mastodon.social Did you build that platform? Are there plans to open source it? Or make it available to more projects? @torproject@mastodon.social @ooni@mastodon.social @OpenArchive@mstdn.social @unredacted@unredacted.social @securedrop@social.freedom.press