Pawb.Social Reports @transparency

34 posts33 participants1 post today

@reiver ⊼ (Charles) :batman:Previews in ActivityPub / ActivityStreams is what should bind the disparate software and user-experiences on the Fediverse.Not the ActivityStreams 'Note'....Previews using 'icon', 'image', 'name', 'summary', etc.<a href="https://mastodon.social/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> <a href="https://mastodon.social/tags/ActivityStreams" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityStreams</a> <a href="https://mastodon.social/tags/DeSo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DeSo</a> <a href="https://mastodon.social/tags/FediDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FediDev</a> <a href="https://mastodon.social/tags/FediDevs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FediDevs</a> <a href="https://mastodon.social/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://mastodon.social/tags/MastodonInTheRoom" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MastodonInTheRoom</a> <a href="https://mastodon.social/tags/SocialWeb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SocialWeb</a>

scyOh, great. <a href="https://chaos.social/tags/Pixelfed" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pixelfed</a> had a broken implementation of "follower-only" posts, _and_ fucked up the disclosure / bugfix release process.<a href="https://fokus.cool/2025/03/25/pixelfed-vulnerability.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fokus.cool/2025/03/25/pixelfed-vulnerability.html</a>Summary of the bug: If you have a protected account (on Pixelfed, Mastodon, GTS, whatever) and a Pixelfed user followed you and got approved by you, _all_ users on that instance were now able to see your followers-only posts, not just the one you approved.<a href="https://chaos.social/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://chaos.social/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> <a href="https://chaos.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://chaos.social/tags/fail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fail</a>

AI6YR BenHmm, looks like a general "followers only" problem with the ActivityPub protocol. IMHO. This is not so much a Pixelfed issue, as any software can ignore the request to wait for a follow and just follow a user anyway. 🤔 (ie if a bad actor wants to track "follower only" posts, they can build something to subscribe to followers only) <a href="https://m.ai6yr.org/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> <a href="https://fokus.cool/2025/03/25/pixelfed-vulnerability.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fokus.cool/2025/03/25/pixelfed-vulnerability.html</a>

Steffo :steffo:HOLY FUCK!Stay the fuck away from loops.video! (<a href="https://bajsicki.com/blog/loops-video-terms/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://bajsicki.com/blog/loops-video-terms/</a>) (Edit: Apparently the TOS have been changed. You might wanna stay cautious, though.)Also, if you have any followers from an unpatched Pixelfed server, you might want to know that your follower-only posts can be easily read by people who aren't following you. (<a href="https://fokus.cool/2025/03/25/pixelfed-vulnerability.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fokus.cool/2025/03/25/pixelfed-vulnerability.html</a>)If you're hosting a Pixelfed instance: Good luck updating! 🫡<a href="https://fellies.social/tags/pixelfed" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pixelfed</a> <a href="https://fellies.social/tags/loops" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#loops</a> <a href="https://fellies.social/tags/dansup" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dansup</a> <a href="https://fellies.social/tags/gdpr" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gdpr</a> <a href="https://fellies.social/tags/activitypub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#activitypub</a>

Linux Is BestA reminder, the Fediverse cost money.Yes, it is free for YOU to use, but your local administrator pays for domain registration, web hosting, storage space, CDN, and of course, bandwidth. The busier and more active your Fedi site, the most it cost.If you are able, consider reaching out to your admin, and asking how you can help. Even small contributions add up and make a difference.<a href="https://mastodon.au/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://mastodon.au/tags/Fedi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fedi</a> <a href="https://mastodon.au/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> <a href="https://mastodon.au/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a> <a href="https://mastodon.au/tags/Misskey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Misskey</a>

Linux Is BestA reminder, the Fediverse cost money. Yes, it is free for YOU to use, but your local administrator pays for domain registration, web hosting, storage space, CDN, and of course, bandwidth. The busier and more active your Fedi site, the most it cost. If you are able, consider reaching out to your admin, and asking how you can help. Even small contributions add up and make a difference. <a href="https://mk.absturztau.be/tags/Fediverse" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://mk.absturztau.be/tags/Fedi" rel="nofollow noopener noreferrer" target="_blank">#Fedi</a> <a href="https://mk.absturztau.be/tags/ActivityPub" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> <a href="https://mk.absturztau.be/tags/Mastodon" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a> <a href="https://mk.absturztau.be/tags/Misskey" rel="nofollow noopener noreferrer" target="_blank">#Misskey</a>

fiona :loading:Pixelfed before v0.12.5 has a vulnerability where it could leak your private posts, regardless of whether you are a Pixelfed user or not. Admins should update ASAP.When following someone from a different server on the Fediverse, the remote server decides whether you are allowed to do that. This enables features like locked accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. If a legitimate user from a Pixelfed instance follows you on your locked account, anyone on that Pixelfed instance can read your private posts.I wrote a blog post about how I found the vulnerability, how disclosure coordination went and general ramblings about Fediverse safety: <a href="https://fokus.cool/2025/03/25/pixelfed-vulnerability.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fokus.cool/2025/03/25/pixelfed-vulnerability.html</a><a href="https://mystical.garden/tags/pixelfed" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pixelfed</a> <a href="https://mystical.garden/tags/fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fediverse</a> <a href="https://mystical.garden/tags/activitypub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#activitypub</a>

洪民憙 (Hong Minhee)I just discovered why some of my followers from larger <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/Mastodon" target="_blank">#Mastodon</a> instances (like mastodon.social) would mysteriously unfollow me after a while!<a href="https://github.com/mastodon/mastodon/pull/34272" rel="nofollow noopener noreferrer" target="_blank">A pull request was just merged in Mastodon that fixes a critical bug in their follower synchronization mechanism.</a>Turns out Mastodon implements the <a href="https://w3id.org/fep/8fcf" rel="nofollow noopener noreferrer" target="_blank">FEP-8fcf</a> specification (Followers collection synchronization across servers), but it expected all followers to be in a single page collection. When followers were split across multiple pages, it would only see the first page and incorrectly remove all followers from subsequent pages!This explains so much about the strange behavior I've been seeing with <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/Hollo" target="_blank">#Hollo</a> and other <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/Fedify" target="_blank">#Fedify</a>-based servers over the past few months. Some people would follow me from large instances, then mysteriously unfollow later without any action on their part.Thankfully this fix has been marked for backporting, so it should appear in an upcoming patch release rather than waiting for the next major version. Great news for all of us building on <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/ActivityPub" target="_blank">#ActivityPub</a>!This is why I love open source—we can identify, understand, and fix these kinds of interoperability issues together. 😊<a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/fediverse" target="_blank">#fediverse</a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/fedidev" target="_blank">#fedidev</a>

julianHappy Tuesday! Today we've updated the NodeBB community forum onto the <code>remote-categories</code> testing branch, which means that users on the open social web that identify themselves as "Groups" will be rendered in NodeBB as categories. Prior to this, they looked like users. Here are some examples of remote categories: <ul> <li><a href="https://community.nodebb.org/category/comicstrips@lemmy.world" rel="nofollow noopener noreferrer" target="_blank">Comic Strips (on lemmy.ml)</a></li> <li><a href="https://community.nodebb.org/category/startrek@startrek.website" rel="nofollow noopener noreferrer" target="_blank">Star Trek Social Club (on startrek.website)</a></li> <li><a href="https://community.nodebb.org/category/swf@socialwebfoundation.org" rel="nofollow noopener noreferrer" target="_blank">Social Web Foundation (a WordPress blog)</a></li> </ul> ActivityPub "groups" and forum categories have quite a few things in common — they don't usually post topic themselves, they "contain" topics, and they are usually administered by a separate group of users (moderators!) In many ways, these groups lend themselves to categories much more easily than they do as users. <h3>Notes:</h3> <ul> <li>We will likely be releasing this as v4.3.0-alpha this Wednesday. Probably this means you don't want this on a live forum just yet.</li> <li>A lot of the backend logic is complete, but a lot of the frontend UX will be worked on.</li> <li>You can "search" for categories (via <a href="https://community.nodebb.org/search?in=categories" rel="nofollow noopener noreferrer" target="_blank">"in categories" in the search page</a>), paste the full handle in order to instruct NodeBB to pull a new category in.</li> <li>You can now no longer mention a remote category. Instead, create your topic right in that category itself. As it should be :smirk_cat: .</li> <li>Remote content coming in that is slotted into a remote category will still show up in <a href="https://community.nodebb.org/world" rel="nofollow noopener noreferrer" target="_blank">your "world" feed</a>. That is still intended to be where discovery of content outside the local NodeBB instance will take place.</li> <li>Report any bugs or confusing behaviours (and there will be some) here.</li> </ul> <h3>Screenshots</h3> <a href="https://community.nodebb.org/assets/uploads/files/1742850163476-4872fc8c-a679-4968-9daf-84bedb8bf237-image.png" rel="nofollow noopener noreferrer" target="_blank">[🖼 4872fc8c-a679-4968-9daf-84bedb8bf237-image.png]</a> <a href="https://community.nodebb.org/assets/uploads/files/1742850238059-08c3972a-6c7e-4cef-937c-0c4830770a8a-image.png" rel="nofollow noopener noreferrer" target="_blank">[🖼 08c3972a-6c7e-4cef-937c-0c4830770a8a-image.png]</a>

Maho Pacheco 🦝🍻Badges on the Fediverse?! Yep, it’s happening! 🎉 I’ve got a working prototype for issuing badges with ActivityPub! It's a bit rough around the edges, but I need some help to make it awesome! 💜 Check it out the teaser video and let me know what you think! 🦝✨ <a href="https://hachyderm.io/tags/Collaboration" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Collaboration</a> <a href="https://hachyderm.io/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://hachyderm.io/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> <a href="https://hachyderm.io/tags/Badges" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Badges</a> <a href="https://hachyderm.io/tags/HelpWanted" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HelpWanted</a><a href="https://www.youtube.com/watch?v=Ot0egwtbRgc" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.youtube.com/watch?v=Ot0egwtbRgc</a>

Chris MessinaHad a great conversation with <a href="https://flipboard.social/@mike" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mike</a> on the history of the hashtag, why Elon is wrong about it, the future of social networks (vis a vis <a href="https://mastodon.xyz/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>, <a href="https://mastodon.xyz/tags/ATProto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ATProto</a>, etc), and how LLMs may intersect with social media moderation.This was a good one.<a href="https://dot-social.simplecast.com/episodes/chris-messina" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dot-social.simplecast.com/episodes/chris-messina</a>

foxyoreos (🔞)ActivityPub/Mastodon question: I have a supporter-only Pixelfed account I've been playing with - posts can't be viewed without requesting a follow.If somepony on another server follows the account and I grant them follower access - how do they fetch older posts that I've made?They can't navigate to the instance directly because none of the posts can be viewed logged out.Is there a way for them to get the older posts federated to their instance?<a href="https://gulp.cafe/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastodon</a> <a href="https://gulp.cafe/tags/question" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#question</a> <a href="https://gulp.cafe/tags/FediAsk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FediAsk</a> <a href="https://gulp.cafe/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>

Robert KingettHow to use the social web in Ghost <a href="https://ghost.org/help/social-web/?ref=activitypub.ghost.org" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ghost.org/help/social-web/?ref=activitypub.ghost.org</a> <a href="https://caneandable.social/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> <a href="https://caneandable.social/tags/IndieWeb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IndieWeb</a> <a href="https://caneandable.social/tags/OpenWeb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenWeb</a> <a href="https://caneandable.social/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a>

seungjin<a href="https://mstdn.social/@stux" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@stux</a> This can work temporarily - perhaps for a couple of years or at most 10 to 20 years. Unfortunately, it can never be a permanent solution. Nothing is free, and if you don’t pay, it comes out of someone else’s pocket. Some groundbreaking method is needed for an independent <a href="https://mstd.seungjin.net/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a> server to run financially independently without compromising its core values. Thank you for your work <a href="https://mstdn.social/@stux" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@stux</a>

Jared NormanTempted to build ActivityPub-powered Words With Friends/Scrabble just because I can. <a href="https://ruby.social/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>

Thor A. HoplandI always gush about <a href="https://fediscience.org/@ZLabe" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ZLabe</a> and his account, because for one thing it makes the data he works with more accessible (via <a href="https://snabelen.no/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>), but secondly because the <a href="https://snabelen.no/tags/infographics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infographics</a> he stares are very informative - and consistent.Are there any other <a href="https://snabelen.no/tags/science" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#science</a>, <a href="https://snabelen.no/tags/edutainment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#edutainment</a> and <a href="https://snabelen.no/tags/infographic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infographic</a> accounts on the <a href="https://snabelen.no/tags/fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fediverse</a> that has similar consistent and qualify of posts? Think content that is fairly easily digestible during a scroll.We're looking for the accounts that <a href="https://snabelen.no/tags/TeachTheFediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TeachTheFediverse</a>.

Ben Pate 🤘🏻This search engine treats the whole web as a unified ecosystem where I can navigate as a single unit, not simply a federation of separate servers. I strongly believe that this kind of thinking is the future of the <a href="https://mastodon.social/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> and <a href="https://mastodon.social/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>. If anyone else is doing work like this, please let me know. So far, I believe this search feature of <a href="https://mastodon.social/tags/Emissary" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Emissary</a> is the only one of its kind, and we should build a community that works to push this forward.

Linux Is BestWhy do I use 2 Fedi sites?1) The Fediverse is, unfortunately, becoming fragmented. You want to follow, like, and share "random" user? That's too bad, because the admin on your site or the other site, blocked a whole server with everyone on it, likely because of 1 person, 1x, that likely left long ago. 🙄2) In case something happens to the Fedi site I am on. 👀<a href="https://mk.absturztau.be/@Linux" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Linux@mk.absturztau.be</a> and <a href="https://mastodon.au/@Linux" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Linux</a> <a href="https://mastodon.au/tags/Fedi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fedi</a> <a href="https://mastodon.au/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://mastodon.au/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>

Linux Is BestThinking of creating a Fedi site? 🤔The domain extensions Dot Com, Net, Org, Info, Us, and Edu are all governed by the United States of America. 😮The word-based domain extensions, for example, Dot Social, managed by corporations based in the United States of America. 😮To escape America's rule of law, you not only want hosting outside the United States, but you want a country level domain name to be safe. 😉<a href="https://mastodon.au/tags/Fedi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fedi</a> <a href="https://mastodon.au/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> <a href="https://mastodon.au/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a> <a href="https://mastodon.au/tags/Misskey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Misskey</a> <a href="https://mastodon.au/tags/ActivityPub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>

Pony LarkSurprised I haven't heard of a single person going out of their way to promote <a href="https://mstdn.party/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastodon</a> at the anti- <a href="https://mstdn.party/tags/Tesla" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tesla</a> protests.Not everything is about the <a href="https://mstdn.party/tags/fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fediverse</a>, but this is pretty relevant, low-hanging fruit, right?I'd love to see some signs with messages like "JOIN THE X-ODUS! JOINMASTODON.ORG" maybe with a QR code.<a href="https://mstdn.party/tags/MUSK" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MUSK</a> <a href="https://mstdn.party/tags/elonmusk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#elonmusk</a> <a href="https://mstdn.party/tags/uspol" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#uspol</a> <a href="https://mstdn.party/tags/uspolitics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#uspolitics</a> <a href="https://mstdn.party/tags/socialmedia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#socialmedia</a> <a href="https://mstdn.party/tags/activitypub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#activitypub</a>

Recent searches

Search options

Administered by:

Server stats:

#activitypub