Login
You're viewing the federate.social public feed.
  • Micr0bytemicr0@wetdry.world
    Aug 4, 2026, 12:16 PM

    A year ago I made Wellness Ping because someone I care about went silent and it took too long for anyone to notice.

    v2.0 is now out.

    It now works entirely over Signal, usernames or phone numbers, both for your check-ins and for your emergency contacts. Email isn't safe for everyone to use, but it's still there.

    Three new security modules, all optional, stack as many as you want: PIN, authenticator 2FA, and passkeys.

    The PIN has a duress option. Enter that one instead and your contacts get alerted immediately, while your screen says everything went fine. (really proud of this one. tweaked to the point of obsession so that response time for a duress PIN matches a normal one. nothing on your screen or in the timing gives it away.)

    Also added vacation pause and custom alert messages, both of which people asked for.

    v2.0 got a full security review before release. The check-in path is much harder to spoof now. Details in the release PR.

    Free forever (as long as I'm alive) and open source.

    wellness-p.ing

    oh and btw, the person who went missing, for whom I made this originally, turned out to be okay. It took a lot of time and a lot of effort to find them, but I did actually find them. I thought you might want to know that.

    💬 22🔄 368⭐ 323

Replies

  • Micr0bytemicr0@wetdry.world
    Aug 4, 2026, 12:16 PM

    For the infosec peeps, what the security pass actually fixed:

    Inbound email replies are now sender authenticated (DKIM/SPF with domain alignment) and have to quote a per-cycle code. Before, a spoofed From header could disarm anyone's switch, indefinitely, if you knew their address.

    Check-ins need an explicit POST now. Mail link scanners could fetch the confirm URL and check people in automatically.

    PINs are argon2id instead of one round of SHA-256. Rate limits on every auth path. CSRF tokens, strict CSP, Secure cookies, no more data races.

    And as mentioned, the duress PIN is also indistinguishable from a normal check-in now, same pages, same timing, so nobody watching your screen learns anything.

    If you self-host this or run a fork, update. Everything above applies to older versions.

    💬 0🔄 6⭐ 19
  • Micr0bytemicr0@wetdry.world
    Aug 4, 2026, 12:17 PM

    If you already use Wellness Ping, two things changed for you.

    The check-in link now takes one extra click to confirm. Mail scanners could follow the link and check people in automatically, which is bad in a fairly obvious way.

    And replying PONG now needs the short code printed in your check-in message. Your next one will have it.

    Nothing else changes. Your settings and contacts are untouched.

    💬 0🔄 5⭐ 10
  • 💬 1🔄 0⭐ 15
  • Micr0bytemicr0@wetdry.world
    Aug 4, 2026, 12:24 PM

    i keep wanna saying things i am proud of here but i am proud of all of it lol, but by far the security modules are the coolest... signal support is cool too but it was kinda like expected for v2.0 yk?

    💬 0🔄 2⭐ 9
  • Micr0bytemicr0@wetdry.world
    Aug 4, 2026, 11:26 PM

    Patched the bug where Signal usernames were limited to 2 discriminators, added an extra step in signup to hopefully make less ratelimit issues.

    Since there is still a big signup wave know service can be patchy, but for those who have already signed up signal rate limits don't affect you so everything works! Once you've signed up.

    Did the update on my pc right after I woke up, and now typing this as I walk to uni, will try to get to any other issues after uni

    💬 0🔄 3⭐ 0
  • 💬 0🔄 0⭐ 1
  • Dagnabbit, Pascaline ! 💥pascaline@mastodon.nl
    Aug 4, 2026, 12:58 PM

    @micr0

    Great!
    And funny, because early this century if my Future Ex sent me a message to check in on me, he would write 'Ping' and if I was okay and available, I would reply 'Pong' 😺

    💬 0🔄 0⭐ 4
  • [ASTRL] Lynalynastral@catgirl.center
    Aug 4, 2026, 1:00 PM

    @micr0@wetdry.world I like this a lot, always in to help micr0, very cool, you're awesome!

    just one little nitpick, looks like the username validation only expects 2 digits, but signal allows for more. Mine has 5 digits

    💬 0🔄 0⭐ 0
  • 0xC0DEC0DE07EAc0dec0dec0de@hachyderm.io
    Aug 4, 2026, 1:11 PM

    @micr0 first thing I’ve followed to GitHub in too long that didn’t have the “A user you have blocked [claude] has contributed to this repository.” banner on it.
    🎉

    💬 0🔄 1⭐ 6
  • Spiralynspiralyn@mstdn.social
    Aug 4, 2026, 1:21 PM

    @micr0 what a thoughtful and beautiful way to promote humans caring for humans ❤️

    💬 0🔄 0⭐ 3
  • 💬 0🔄 0⭐ 1
  • Androcatandrocat@toot.cat
    Aug 4, 2026, 1:42 PM

    @micr0
    Thanks!

    And thanks for letting us know they were OK, as well.

    💬 0🔄 1⭐ 3
  • 💬 0🔄 0⭐ 1
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 1🔄 1⭐ 0
  • Micr0bytemicr0@wetdry.world
    Aug 4, 2026, 10:27 PM

    @justbob when it comes to community projects I have thought about switching to forgejo, but have not since that would require every person who want to make an issue or pr to make a new account.

    As for xmpp I don't use it, but feel free to make a PR

    💬 1🔄 0⭐ 1
  • Just Bobjustbob@kolektiva.social
    Aug 4, 2026, 10:46 PM

    @micr0

    Im sorry. I do hope you understand that MicroShit is stealing your work to train their AI.

    💬 1🔄 1⭐ 0
  • Micr0bytemicr0@wetdry.world
    Aug 4, 2026, 11:55 PM

    @justbob Any open source project, anything that is publicly available, is already being trained on no matter if you consent or not, its a matter of private projects where that would matter.

    💬 0🔄 0⭐ 0
  • 💬 1🔄 1⭐ 0
  • 💬 0🔄 0⭐ 1
  • Just Bobjustbob@kolektiva.social
    Aug 5, 2026, 2:15 AM

    @micr0 no idea what you mean but we use Gitea and it seems good.

    Its currently only hosting 3 parts of our systems. Mostly for the #TidySearch system but like I said, anyone can host code.

    It has a bunch of users but none are using it yet. Just ran the program update today too 😋

    💬 1🔄 1⭐ 0
  • Micr0bytemicr0@wetdry.world
    Aug 5, 2026, 8:19 AM

    @justbob I meant how scalable is the server? Would it hold up to thousands of people going onto the repo at once and looking at it, and people making accounts and stuff

    Anyhow I am interested will prolly make an account some time soon if I remember

    💬 0🔄 0⭐ 1
  • Just Bobjustbob@kolektiva.social
    Aug 5, 2026, 2:37 PM

    @micr0

    We've never had that much traffic on our sites even with the big list of services we run. We have a fiber connecting that has been keeping up with all these.

    vcs.mpaq.org (Me)
    //beamship.mpaq.org (Me) out of order
    frequency.mpaq.org
    mail.mpaq.org
    news.mpaq.org (Me)
    ojrock.mpaq.org (Me)
    radio.mpaq.org
    search.mpaq.org (Me)
    truthbrary.mpaq.org
    voip.mpaq.org
    weather.mpaq.org (Me)
    XMPP bob@mpaq.org (Me)

    💬 0🔄 1⭐ 0
  • 💬 0🔄 0⭐ 2
  • 💬 1🔄 1⭐ 0
  • Claudiusclaudius@darmstadt.social
    Aug 7, 2026, 3:58 PM

    @justbob @micr0 @Codeberg perfectly valid :-) we should also not replace that one centralised huge single point of failure with a different huge single point of failure. I'm glad we're seeing more options in that space.

    💬 0🔄 0⭐ 1
  • 💬 0🔄 1⭐ 0
  • Cal Q Alaera :HeartNonbinary:Cal@kind.social
    Aug 4, 2026, 3:43 PM

    @micr0 This is a really cool service, thanks for offering it.

    I tried to sign up, it says my username (Cal.130) is invalid, so I gave it my phone number and no messages came through?

    I'm guessing you're getting an awful lot of folk signing up for it right now though. :)

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 2
  • scumbag fatherjeff@my0.net
    Aug 4, 2026, 4:18 PM

    @micr0 odd. I'm not receiving the code. I use a privacy email though. do you have splunk

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Ari "Two Elements" Jacksonarisummerland@beige.party
    Aug 4, 2026, 10:38 PM

    @micr0

    I love this. I am pretty sure that I signed up pretty close to when it first came out, just to see how it worked.

    I did it with two email addresses, but then the people who would be notified if I didn't check were still all myself. I've been faithfully ping ponging ever since! ha ha

    But now that it is on Signal, I think I'm actually going to add a "real" version for myself where if I don't check in, a friend in real life gets a text or email (or whatever).

    It's been flawless the entire time I've used it with email, so I look forward to digging into the Signal integration.

    Thanks so much for doing this! I am also glad to hear that the person who sparked you creating it ended up okay.

    💬 0🔄 3⭐ 5
  • 💬 0🔄 0⭐ 0