A small fix it seems: https://github.com/NodeBB/NodeBB/commit/6c62ba63e8e9dd35f007b2a11414515491a2c1fe

@misskey-dev/node-http-message-signatures now v1

It seems that this past week @aqz@p1.a9z.dev released @misskey-dev/node-http-message-signatures, which contains some breaking changes.

At this time I am unsure what the difference is between joinmisskey/node-http-message-signatures and misskey-dev/node-http-message-signatures.

The latter is still dormant, but the former has received quite a bit of work as of this past week.

NodeBB has its RFC 9421 implementation built using v0.0.11 of this package.

https://activitypub.space/post/2542

Anthropic is out with new nonsense about Claude (or the collection of models called Claude) deserving moral consideration and/or being able to feel distress, so my inbox is filling up with journos asking me to comment.

I've also got a day job, so here is a brief set of public comments on this:

[Note to the mansplainers of Mastodon: This is a thread, so please read the whole thing before replying. Please also know that I am aware of things beyond what's in this thread...]

>>

Thanks Johannes and Anca!

Thanks @j12t@j12t.social and @anca@mastodon.xyz for hosting yet another successful FediForum!

Great to see all the friendly faces and many new ones as well.

One of these days I'll scrape together another demo :smirk_cat:

https://activitypub.space/post/2530

How many syllables in the word 'fire'?

Settle an argument for me, will ya?

This FEP is provides an optional mechanism for detecting and repairing blocks between accounts across servers, inspired by the Follow Sync FEP.

https://codeberg.org/fediverse/fep/src/commit/3bf303c2d32e4e870a75dbf3fb5e0bf67964c7af/fep/070c/fep-070c.md

FediForum, the online unconference for the people who move the Open Social Web forward, is coming up again in a few days. Consider joining your peers in exploring, creating, and collaborating on better ways of interacting online than what the closed platforms give us.

https://fediforum.org

It's going to be fun! 😆

Music player (mp3s) for Android

Anyone have suggestions on a good music player on android for mp3 files?

I have decent (if proprietary) options for podcasts and streaming music, but I have some mp3s that I'd like to listen to as well.

I've tried VLC, and it's kind of meh. I'd like to be able to jump back 5-10 seconds at the press of a button if possible. Bonus points if it integrates with notification tray and android auto ...

https://activitypub.space/post/2494

Poll support in NodeBB landing soon...

Part of the NLNet grant work was to bring polls to NodeBB. I've been missing out on #EvanPoll this entire time!

https://activitypub.space/post/2484

Seeing all these vibe-coded entrants to the Fediverse makes me feel antiquated, but at the same time it's a god damn renaissance injecting fresh blood sweat and tears into the AP scene.

I wonder how ostracised I'll be if I host a fedi forum session about AI and AP :imp:

The FEP has been updated to remove references to an unneeded Unlock activity. Undo(Lock) is the preferred form.

FEP-c0d0: Context Locking

This is the main discussion thread for the draft FEP-c0d0: Context Locking

Summary

Context locking (and its inverse, unlocking) refer to the action whereby a topic no longer accepts new replies.

This proposal introduces a locked property on the context object, and a new activity type, Lock, to signal changes to a topic's locked state across the fediverse. Unlocking is expressed with the standard ActivityStreams Undo activity, applied to the original Lock. [...]

https://activitypub.space/post/2464

Additional points:

1. I know of no situation where an AP-compliant server POSTs another server without an HTTP Signature. Pretty sure any attempt to do so would just mean the activity is dropped.

So why does 8b32 allow for dropping the HTTP signature? My best guess is that the wording is vague and the intention is that an object integrity proof at top level means an HTTP signature can be discarded.

1. Cross-origin activity-object combos are common. FEP 1b12 is built upon this, as are standard Mastodon Announce/boosts. To give up HTTP signature checks because an embedded object contains a proof means the wrapping activity is spoofable.

So I think the local LLM took that line very literally.

Dismissing HTTP Signature on presence of Object Integrity Proof

I have a question for implementors pursuing object integrity proofs.

I am implementing the ability to serve these proofs in NodeBB with the assistance of an LLM. It is adhering to @silverpill@mitra.social's FEP-8b32: Object Integrity Proofs.

As part of its work, it implemented a quirk I thought was curious. If the proof was present in an embedded object, the activity's HTTP signature was ignored/not-checked.

I challenged the model and it pointed to this line from the FEP... [...]

https://activitypub.space/post/2459

Detecting duplicate activities

How does one go about detecting duplicate activities, and what is the best practice for senders?

I ask because following a hashtag served by relay.fedi.buzz responds with an Accept with id https://relay.fedi.buzz/activity/accept/{actor}/{requesterInbox}

Because that URL does not have a random/time-based component, an unfollow followed by a refollow will lead to an Accept with the exact same id.

In NodeBB's case, it detects this as "already seen" and silently drops it.

https://activitypub.space/post/2440

FediBuzz webfinger backreference failure

Hi @astro@c3d2.social, I think I found a bug with FediBuzz and how it does its Webfinger responses.

In a nutshell, FediBuzz tag actors have preferredUsername set to tag-whatever, but the corresponding webfinger lookup ?resource=acct:tag-whatever@relay.fedi.buzz fails with a 404, but whatever@relay.fedi.buzz works fine.

cc @evan@cosocial.ca

AI slop explanation follows (feel free to ignore!):

tags.pub does it correctly:

{ "id": "https://tags.pub/user/nodebb", "preferredUsername": "nodebb" } 

[...]

https://activitypub.space/post/2430

Okay, NodeBB can now be configured to send out EmojiReact (default) or Like.

Of note, Misskey seems to assume it is :heart:, possibly missing support for EmojiReact.

EmojiReact vs. Like w/ content?

Hm... FEP-c0e0: Emoji reactions details two ways to federate an Emoji reaction:

1. EmojiReact activity
2. Like with content (as opposed to a regular Like, which has no content)

In testing, I noticed that misskey (or at least, the site I was testing with, birb.space) sends the latter. I don't know what sends the former, and if NodeBB were to start federating out EmojiReact, would it be broadly understood?

Perhaps I should federate out both at once.

cc @silverpill@mitra.social

https://activitypub.space/post/2414

RFC 9421 Testing endpoints?

Is there a service or implementation that can test RFC 9421 implementations? I'm running a branch of NodeBB here on activitypub.space that sends and receives RFC 9421 HTTP Signatures and I'd like to test against someone :smiley:

@silverpill@mitra.social perhaps?

https://activitypub.space/post/2399

@liaizon@social.wake.st I'm testing my split domain setup but it can't seem to resolve your webfinger properly. BrowserPub suggests it's a content-type issue in your webfinger :smiley: