Home | Notifications | New Note | Local | Federated | Search | Logout
silverpill@silverpill@mitra.social
Developer of ActivityPub-based micro-blogging and content subscription platform Mitra. I help maintain the FEP repository and write my own FEPs too. Currently working on ActivityPub Next.
Code: https://codeberg.org/silverpill/
Matrix: @silverpill:unredacted.org
XMPP: silverpill@were.chat
$XMR: 48YM8jwJqDkeUvD38vepSXFeMZH1zsjbvGwTTuaNSSq6Q5GyeWaeiheAZUsSmNn72YdyLpw8geb4FL3opZfGbguJLUj8Mi9
XMR subscription: https://mitra.social/@silverpill/subscription
PGP: 0541 49E3 0F91 C6D7 8FFA C49C 955F 5A6E 2123 25F0
OMEMO fingerprint: 689a2fb0ec87a9481fb45cb7d8870da6aeb4d8247bd69a39017701133b901f04
Matrix (backup): @silverpill:poa.st
Joined: 2026-01-05 16:03:27
435 notes, 1 following, 0 followers
silverpill@silverpill@mitra.social (2026-05-17 05:27:42)
ActivityPub developer guide is available on Codeberg Pages:
https://ap-next.codeberg.page/ap-next/guide.html
I did that mainly to experiment with the stack:
- Marmite, a static site generator written in Rust. Not perfect, but it's the only one that just worked and didn't make me change the directory layout or add extra information to markdown files.
- New Codeberg Pages service, which uses git-pages instead of the deprecated pages-server.
- Forgejo Actions, which came out of beta recently. Unlike Woodpecker CI, actions didn't require extra configuration steps. Deployment from an action to Codeberg Pages is very easy: https://docs.codeberg.org/codeberg-pages/forgejo-actions/
#Forgejo
Reply to @caohuak@moon.lonewolf.zone
silverpill@silverpill@mitra.social (2026-05-16 03:23:47)
@caohuak @ozoramore_dev What kind of component?
Reply to @dansup@mastodon.social
silverpill@silverpill@mitra.social (2026-05-16 03:08:28)
@dansup These Nostr fanboys are always lying
Reply to @ozoramore_dev@social.t2arc.net
silverpill@silverpill@mitra.social (2026-05-16 02:27:56)
@ozoramore_dev This is an indicator of the last read message in the timeline
Reply to @julian@activitypub.space
silverpill@silverpill@mitra.social (2026-05-15 05:10:17)
@julian @reiver DIDs are not really hard to implement. However, to get the most out of them, a different application architecture is required, where you generate activities on the client side (this is similar to an ActivityPub client described in the spec).
No easy upgrade path for most fedi projects.
Reply to @evan@cosocial.ca
silverpill@silverpill@mitra.social (2026-05-15 04:22:32)
@evan @julian @reiver Cryptographic identity is also not a new technology, PGP was developed more than 30 years ago, and a lot has happened since then. Hardware keys, HSMs in smartphones, etc. And DIDs.
DID is an abstraction that allows key rotation and delegation of key management to a trusted 3rd party. Bluesky uses DIDs for identities but most of its users never touch a secret key.
Anyway, in Fediverse we don't need to choose between domain names and DIDs. We have both, because FEP-ef61 is a backward compatible protocol upgrade.
Reply to @silverpill@mitra.social
silverpill@silverpill@mitra.social (2026-05-15 03:54:46)
Also updating the AP-Next developer guide:
At the very least, requests to localhost, private and unspecified IPv4 and IPv6 addresses must be blocked. Note that IPv6 addresses can be mapped to IPv4 addresses.
Some people also recommend blocking requests to multicast addresses, but I was not able to find any information on how to use them for SSRF (apart from a couple of slop CVEs).
silverpill@silverpill@mitra.social (2026-05-14 04:21:56)
#APx v0.24.0
https://docs.rs/apx_sdk/0.24.0/apx_sdk/index.html
This release includes fixes for vulnerabilities relating to SSRF protection, similar to ones that were recently discovered in @fedify:
https://hollo.social/@fedify/019e123c-57eb-781d-aa51-ca7dfc190ce7
As it turned out, http://[::ffff:7f00:1]/ is equivalent to http://127.0.0.1/
Full changelog: https://codeberg.org/silverpill/mitra/src/tag/apx-v0.24.0/apx_sdk/CHANGELOG.md
Reply to @silverpill@mitra.social
silverpill@silverpill@mitra.social (2026-05-14 04:05:20)
@phnt Woodpecker has been enabled. I am already using it to build Mitra Mini binaries, we can build docker images too. @fox If you're interested, feel free to submit a PR.
Reply to @astro@c3d2.social
silverpill@silverpill@mitra.social (2026-05-14 02:28:26)
@astro public.mitra.social
Normally, fedibuzz relays tagged posts originating from this instance.
Reply to @astro@c3d2.social
silverpill@silverpill@mitra.social (2026-05-14 02:14:17)
@astro I tried to send an Announce from another instance that is not blocked by fedibuzz, but the result is the same. The announced post is not relayed.
Reply to @silverpill@mitra.social
silverpill@silverpill@mitra.social (2026-05-14 01:57:12)
@caohuak @frost @caohuak @caohuak It's available in Mitra v5.3.0
mitra create-activity bite <your-username> <recipient-id>
mitra send-activity '<activity-json>' <recipient-id>
Reply to @trwnh@socialhub.activitypub.rocks
silverpill@silverpill@mitra.social (2026-05-12 23:13:23)
The inherent assumption is that any id will have an AS2 representation, but this isn't a valid assumption, because non-AS2 resources exist on the Web (and in fact vastly outnumber AS2 resources).
Every id value is expected to be an identifier of an ActivityPub object. When it resolves to something else, like an HTML document, we conclude that the identifier is not valid.
Fediverse != Web
Hong Minhee, who develops the Fedify library, indicated that overriding the term definition of "href" to be a literal string instead of a URI reference was intended to avoid dereferencing ids that don't have AS2 representations.
@hongminhee So, Fedify returns a string and delegates the decision to the user?
Sounds reasonable. By default, hrefs do not point to ActivityPub objects.
Reply to @Profpatsch@mastodon.xyz
silverpill@silverpill@mitra.social (2026-05-12 22:22:22)
@Profpatsch
Several options have been discussed in this fediverse-ideas issue:
https://codeberg.org/fediverse/fediverse-ideas/issues/23
@mbajur
i'm currently using @domain.com@domain.com as a solution someone suggested to me a year ago but i find it a bit hacky and looking for a proper solution
It's not a bad solution IMO.
Maybe @snarfed.org has some ideas on how to do it better because domain handles are popular on Bluesky
Reply to @mkljczk@pl.fediverse.pl
silverpill@silverpill@mitra.social (2026-05-12 17:32:46)
@mkljczk Do you use /api/v1/timelines/public endpoint with the instance parameter?
Adding the parameter instance=lain.com to the public timeline will show only statuses originating from lain.com (or any remote instance).
I want to implement this in mitra
Reply to @mkljczk@pl.fediverse.pl
silverpill@silverpill@mitra.social (2026-05-12 05:12:46)
@mkljczk How it works? Just a timeline of known federated posts but filtered by instance?
Reply to @caohuak@moon.lonewolf.zone
silverpill@silverpill@mitra.social (2026-05-12 04:53:48)
@caohuak @frost @caohuak @caohuak Cool. I am not adding it to UI yet, but there will be a CLI command for testing some activities - including the Bite activity.
Reply to @caohuak@moon.lonewolf.zone
silverpill@silverpill@mitra.social (2026-05-12 03:05:59)
@caohuak Sent
@frost @caohuak @caohuak
Reply to @caohuak@moon.lonewolf.zone
silverpill@silverpill@mitra.social (2026-05-11 19:03:09)
@caohuak @frost I've sent a Bite activity to your Wafrn account: @caohuak
Do you see it?
Reply to @deutrino@mstdn.io
silverpill@silverpill@mitra.social (2026-05-11 18:51:16)
@deutrino @liaizon
Mastodon devs: starter packs, FASP, E2EE...
Meanwhile, most upvoted Mastodon feature requests:
https://github.com/mastodon/mastodon/issues?q=is%3Aissue%20state%3Aopen%20sort%3Areactions-%2B1-desc
Reply to @japananon@mitra.anon-kenkai.com
silverpill@silverpill@mitra.social (2026-05-11 18:35:59)
@japananon @coin 10 years after the initial OpenBazaar release and we still don't have a proper decentralized marketplace.
I can build it, but is there really a demand for such thing?
silverpill@silverpill@mitra.social (2026-05-11 18:29:55)
It's being developed: https://github.com/MaddyUnderStars/shoot
Reply to @evan@activitypub.space
silverpill@silverpill@mitra.social (2026-05-10 02:04:31)
It's a LitePub relay actor, located at /relay. Announces all public posts if relaying is enabled in config.
Reply to @silverpill@mitra.social
silverpill@silverpill@mitra.social (2026-05-09 17:19:46)
@mariusor
RSA secret key: 3082013b020100024100e221e7c6506e8e3932e66fbf59cc580cd3ccdf688213426f1264144143d58e3d2c478d1cc93a1ab3c1c94cfc927e32f077fa6eb6fe0d59bb656e1c7613b1d53b020301000102404394a271f023ba3979eec842c5917e57070d594f2060a52010bcfc18ad2f2b7ca8b39e75179bd5abb3d161c8c0fe9053cd8de87ae84dd9dc3a84a2749040c261022100e3fd1ddb28613f9ead9869b392fa1f9d91bef1ab625605c968c72f5312ac77b3022100fdea673212cf6da2b1277b736a3b9f04662bb993d8754b1516e9a03010b6e85902205f1a54fbf8aa2869beac575b6b321f42116bff4fa8a38da268acbe16ff31267502210096da64650377e912f75d15a3044257bf2d545cf4d16d1e26716e6b9522d90841022100a960c9d14d424fb58de781aa700d8a838a46e5978cc74dcfdfb9dc16edfcf1ee
request method: POST
request body: {}
request URI: https://verifier.example/inbox
created: 1778314593
content-digest header: sha-256=:RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o=:
signature base:
"@method": POST
"@target-uri": https://verifier.example/inbox
"content-digest": sha-256=:RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o=:
"@signature-params": ("@method" "@target-uri" "content-digest");keyid="https://signer.example/actor#main-key";created=1778314593;alg="rsa-v1_5-sha256"
signature header: sig1=:gJWUQjvkEcdXc86ZC+kEWKhUyiExKQomXxWd9q8mzDSm9fE6XjsA+HCoNE9LP4RRCdwAHWZ6Zeou4WPjhxpPwQ==:
signature-input header: sig1=("@method" "@target-uri" "content-digest");keyid="https://signer.example/actor#main-key";created=1778314593;alg="rsa-v1_5-sha256"
Reply to @mike@macgirvin.com
silverpill@silverpill@mitra.social (2026-05-09 15:54:58)
A similar feature exists in Pleroma. I actually find it useful, my server follows a couple of Pleroma instances in addition to relays
Reply to @fedi@m.thefedi.town
silverpill@silverpill@mitra.social (2026-05-09 15:35:01)
@fedi What photo?
No, you don't need an upload service
Reply to @julian@activitypub.space
silverpill@silverpill@mitra.social (2026-05-09 15:32:16)
@julian @i According to RFC-9110: HTTP Semantics, this is a valid value for content type:
aPPlicAtiOn/lD+jSOn;Charset=utf-8; Profile="https://www.w3.org/ns/activitystreams"
Reply to @mariusor@metalhead.club
silverpill@silverpill@mitra.social (2026-05-09 04:37:59)
@mariusor Sure, I'll prepare an example.
@Marius @marius
Reply to @caohuak@moon.lonewolf.zone
silverpill@silverpill@mitra.social (2026-05-09 02:25:05)
@caohuak @xaetacore @Saorsa Maybe nobody asked for the outbox format. I only found this issue about importing posts https://github.com/misskey-dev/misskey/issues/11422
Reply to @caohuak@moon.lonewolf.zone
silverpill@silverpill@mitra.social (2026-05-09 02:04:41)
@caohuak @xaetacore @Saorsa I already have it somewhere. They really should support exporting into standard ActivityPub outbox format.
Older Notes