Staff group

julian

NodeBB is gearing up for a major release this month that brings full two way federation and content discoverability to forums as well!

We've been working on it all last year!

@activitypub

julian

Thanks all;

@[email protected] I wasn't actually sure which spec this was a part of (although to be honest I also wasn't planning on reading through a spec to find out)
@[email protected] this is for verification on receipt of activity, not for an unsolicited GET from me. Didn't think it was a link to the actor id, but that makes sense!
@[email protected] yeah origin based security deems it safe, but I don't happen to like that security model, personally. I suppose that is the tradeoff... Plus someone could just assign the same pubkey to every user, rendering the whole exercise moot.

julian

As part of security checking for incoming events, we check that the keyId sent in the HTTP signature is actually owned by the actor that the activity came from. This is to guard against activity spoofing from separate users at the same server (e.g. user B@server pretends to send a Create(Note) from user A@server).

Our check is pretty simple, the keyId matched against the public key id as retrieved from the actor.

Except it fails for PeerTube because:

PeerTube's actors all have the #main-key suffix on their public key IDs (e.g. https://tilvids.com/accounts/thelinuxexperiment#main-key)
The HTTP Signature's keyId does not include the #main-key suffix (e.g. https://tilvids.com/accounts/thelinuxexperiment)

So the key ownership cross-check fails.

I could adjust the logic to strip out the URL's hash, but I was wondering if that was actually secure. I assume this is what is already done since PeerTube successfully federates with other softwares.

julian

Ah, I had to dig through your topic history to see whether you posted some stuff about FOSDEM.

I was wondering when the Social Web talks would be confirmed, I haven't heard anything since I submitted (except for potentially being in the overflow space!)

<baris>

Try nodejs 18/20 or 22.

julian

@bh4-tech the screenshot you posted shows that your follow request to @[email protected] was not approved, which is why you didn't receive any content from them.

I will double-check Peertube federation. I have not looked into it before.

julian

I can't even be mad, though. Mastodon said "if you build it they will come", and then someone came and built something that consumed that exported data. So, it worked.

and... "if you build it they will come" has been NodeBB's MO for the better part of a decade, so I guess I'm even being a little hypocritical here.

@[email protected] @[email protected]

julian

@[email protected] @[email protected]'s Posty is funny... because it references the phrase “readable by any compliant software” that is in Mastodon's UI, but it's a completely tongue-in-cheek statement because there are probably zero softwares capable of doing anything meaningful with the exported data.

(Well, one now, Posty, heh.)

So it's a rewording of "PRs welcome"... or "we are meeting you halfway, you have to do the other half".

Perhaps there's no ill intent behind it, but I find it just a bit pretentious to say it's in a common format when there realistically weren't any for a good long while.

It's like me saying NodeBB plugins are "compatible with any compliant software", knowing full well they're only really compatible with NodeBB.

julian

Hi @interested, can you give us an example of what you mean by a custom field for a category?

julian

@[email protected] , and to be fair, the forum and threaded discussions working group is making inroads on dealing with points two and three.

A lot of other existing software already handles some of these things, so it's a matter of Mastodon playing catch up, ironically.

Staff

Posts

Member List