Drafting a proposal to add API support in #Fedify for the ActivityPub Media Upload extension, the SocialCG-incubated #C2S companion that lets clients upload media via a dedicated endpoints.uploadMedia endpoint, separate from the outbox.
If you’d like to preview the #tutorial I’m writing on building a small federated image sharing service, similar to @pixelfed@mastodon.social, with @fedify@hollo.social and @nuxt@webtoo.ls, here it is:
Just had to add a workaround to #Fedify for http://joinmastodon.org/ns, a JSON-LD context URL that has never actually served a JSON-LD document. Mastodon has always inlined the term definitions, but some implementations put it as a bare URL in their @context, so Fedify’s JSON-LD processor tries to fetch it and gets a 404 Not Found. Now Fedify ships a bundled copy of a context that never existed in the first place.
When I first started working with #ActivityPub, before #Fedify existed, it felt like writing web apps in Perl and CGI in the late ‘90s. Interesting, even exciting—but never comfortable. That era where your business logic and your protocol plumbing were just… the same thing:
Started laying out a rough plan for implementing FEP-ef61: Portable Objects in #Fedify—server-independent #ActivityPub identities backed by #DIDs, multi-server replication, and client-side signing. It’s going to be a long road (13 tasks across 5 phases, with a few open questions that need answering before we even begin), but I think it’s worth doing right.
While working on #Fedify, I noticed something about how #Misskey handles #ActivityPub object access. When a remote server requests a followers-only post or DM with a valid HTTP Signatures (draft-cavage) from an authorized actor, Misskey still returns 404 instead of the content. It seems Misskey only checks the visibility field (public/home) without verifying the signature at all.
[Fedify] is a #TypeScript framework for building #ActivityPub servers that participate in the #fediverse. It reduces the complexity and boilerplate typically required for ActivityPub implementation while providing comprehensive federation capabilities.
A ReDoS (Regular Expression Denial of Service) vulnerability has been discovered in Fedify’s HTML parsing code. This vulnerability could allow a malicious federated server to cause denial of service by sending specially crafted HTML responses.
A while back I mentioned the idea of “Fedify Studio”—a web-based toolkit for #ActivityPub debugging and development. I’ve been quietly working on shaping that idea into something more concrete.
p3x.de
洪 民憙 (Hong Minhee) :nonbinary:
Fedify: ActivityPub server framework