I know that title might seem controversial, so let's dive in. Right now, here’s the landscape of federated protocols:

• ActivityPub - The shining star of this article.
• OStatus - Mostly deprecated in favour of ActivityPub.
• Diaspora - Exclusive to Diaspora, limiting interoperability.
• Nostr - Infamous due to problematic user behaviour, unlikely to achieve significant interoperability.
• Matrix - Could theoretically support social media use-cases but currently doesn't.
• ATProto - Technically promising, yet hampered by corporate handling and mistrust from the open-source community.

Ultimately, that leaves us with ActivityPub. Everything else either lacks widespread adoption, doesn’t support common social media scenarios, or is effectively proprietary despite being open-source. For those who prioritize open-source solutions, ActivityPub is essentially the only viable option.

The Good

While I’m about to critique ActivityPub extensively, it undeniably has strong points:

• Interoperability: The core idea is genuinely powerful. Using your Mastodon account to comment on a Lemmy post—or even reading this blog post on your preferred instance—is genuinely amazing. Different instances can display content uniquely, allowing users to interact in a way tailored to their platform.
• Human-readable JSON: While some might underestimate this, JSON's human readability makes debugging and understanding ActivityPub interactions straightforward.
• Extensible: Custom properties and types can extend functionality beyond initial design limitations, ensuring future flexibility.

The Bad

Most issues with ActivityPub stem from one critical flaw: much of its behaviour is undefined. The core types and activities allow interactions that make little practical sense. For instance, the Like activity should be simple—you like something. But, in ActivityPub, you can "like" another Like activity, creating infinite loops of nonsensical interactions.

This flexibility leads to a significant problem: no two implementations behave identically. Developers resort to hacks and guesswork to interpret undefined behaviour. Ideally, ActivityPub would strictly define interactions for core types, enabling implementations (Mastodon, Lemmy, Pleroma, etc.) to focus solely on presentation or extending functionality, knowing basic interactions remain consistent across platforms.

A practical example is the confusion around private messages. Two competing methods have emerged: a custom ChatMessage type not officially supported by ActivityPub (used by Lemmy, Pleroma and others), and an alternate "standard" using a Note object that excludes the public audience but explicitly mentions recipients (used by Mastodon and others). This ambiguity creates compatibility nightmares.

Another example I personally encountered was a frustrating issue while implementing ActivityPub for this blog: updating a post propagated to Lemmy but not Mastodon. Despite the Update activity being accepted, Mastodon silently rejected it unless the updated timestamp changed—a logical but unofficial requirement. Developers must track down subtle implementation details that aren't formally documented, significantly complicating adoption and usage.

The Ugly

Privacy is virtually non-existent. When another server federates with yours, it receives all public activities, which might seem harmless initially. However, what happens if you mistakenly share sensitive information publicly? In theory, deleting a post propagates across the network, but real-world scenarios vary greatly—from technical glitches to outright malicious actors ignoring delete requests. Ensuring robust privacy requires substantial protocol-level changes, such as introducing end-to-end encryption—something notoriously complex to implement, as evidenced by Matrix’s struggles.

Another significant flaw is impersonation vulnerability. ActivityPub itself has no built-in authentication mechanism, meaning anyone could theoretically impersonate any user. Although most implementations use the HTTP Signatures standard to address this, ActivityPub itself remains incomplete in terms of essential security features. The standard openly acknowledges:

Unfortunately at the time of standardization, there are no strongly agreed upon mechanisms for authentication.

Conclusion

ActivityPub, particularly its vocabulary rules (ActivityStreams), remains a half-finished protocol. Its effectiveness depends heavily on individual implementation choices, creating problematic discrepancies—such as the inability to reliably send private messages between Mastodon and Lemmy users. Moreover, simple human errors or software oversights can unintentionally expose private information, as recently demonstrated when new Fediverse software mishandled Mastodon-style private messages and displayed them publicly.

The solution? ActivityPub needs a clearly defined second iteration—an ActivityPub v2—that eliminates ambiguity, standardizes behaviour strictly, and provides essential security measures. Certain issues, especially privacy, may never be fully resolved within the protocol, but increased clarity and stricter rules would significantly mitigate existing risks.

This doesn’t mean we should abandon ActivityPub, but rather, we must work collectively to standardize it further, making it more secure and less error-prone.

What are your thoughts on ActivityPub? Have you developed something using it? Are you planning to? Let me know in the comments!

For those of you on Fosstodon (UPDATED)

UPDATE, April 30: there are some encouraging changes happening at Fosstodon. That's good! So, I've updated this post accordingly -- and added a new reply about the Nazi bar analogy

Still, even though things are much more hopeful now than a week ago, it's still too early to know how things will work out. So here's a few thoughts for people who are on Fosstodon ...

1) let your new admins know what direction you want to see the instance moving in -- and, if you've got the time, consider offering to help!

2) if you're still considering potentially moving, now's a good time to start exploring. It really is hard to pick a compatible instance, and you'll want to take the time to scope things out. Don't feel like your next choice is necessarily your permanent new home -- you can always treat it as an interim and move again if necessary. Asking friends for recommendations is a great place to start but not bulletproof (would you have recommended fosstodon if somebody had asked you about it a month ago?) ...Resources for choosing the right fediverse instances has links to directories and instance catalogs that can help you find out more

3) You can set up new accounts on other instances without moving -- so this is a good way to explore. One option is to export the list of people you're following (on the Preferences / Import and Export tab ), and import it on your new account. Or, if you feel like you're following too many people, this can also be a good time to experiment -- either start from scratch, or edit the CSV file before importing. You'll probably also want to export-and-import your blocklists, mutelists, domain blocks, and lists if you have any. Unfortunately there isn't any way to export and import your filters, so you'll need to recreate those manually.

4) If you're planning on "migrating" your account, make sure to read Cutie City's guide to Migrating Servers and Erin Kissane's Notes From a Mastodon Migration first to avoid unpleaant surprises.

It really sucks that Mastodon migration doesn't let you move your posts, but things are getting better. Check out Posty and Slurp

5) if you're up for having your own instance, it's really worth checking out GoToSocial. My experience with gotosocial.thenexus.today: setup and configuration were straightforward and well-documented, and upgrades have been smooth. There are also hosted options available. And, Slurp works really well with GoToSocial! If you decide to stay on Fosstodon, you can either keep it around as a secondary account ... or just view it as an interesting experiment and delete it.

#fosstodon #fediverse

Resources for choosing the right fediverse instance

A daunting choice -- but not irrevocable!

^{Jon (The Nexus Of Privacy)}

The Oliphant

2024-12-23 00:40:34

writefreely

Posty: This is How You Take Your Posts With You

Mastodon gives you this funny export option, including this funny little phrase about how it's in ActivityPub format, and “readable by any compliant software.” An early question I had was “What compliant software, exactly?” “Readable by any compliant software?” Hey, it's talking about Posty!

There are a few tools that will more or less let you view archives, or create static sites out of them, but I had a few very specific ideas about what I wanted such an app to do, and it was a good learning experience, after all, reading through a bunch of ActivityPub json data, so Posty was born.

Posty Principles and Features

I knew basically what I wanted it to do off the bat.

1. Generates a static HTML/CSS site that can be cheaply hosted anywhere, or simply browsed from your local computer.
2. Posty provides static site generation, along with a zip download of all generated assets, followed by the option of a complete purge of all data, uploaded, generated, or otherwise, from the service.
3. Uses a simple CSS framework, semantic, responsive, and easily-customized after export by updating a single (small) CSS file. main.css
4. Stays light on javascript in the generated site, and loaded only where necessary. The site should still be able to function without javascript support.
5. Keep hashtag links internal and link to 'hashtag index pages' that display all posts by hashtag, along with a main hashtag cloud.
6. Be responsible about data. Uploaded data includes private mentions and other personal details. Not only should those be ignored, but that data is thrown away as soon as the static site is generated and access to post data is no longer necessary.
7. Run the Posty app locally or as a hosted service. If hosted, allow it to act as a public archiving service.
8. If used as a public archiving service, optionally allow it to replace a retired Mastodon instance with a static HTML archive of only posts from members of that instance.
9. Support custom routes for static HTML pages, so that pages can support their old status references. Here's an example

Host your Static HTML Site...

There are a few ways to run the HTML once generated, use whatever works for you.

...On Your Local Computer

Extract the downloaded .zip file from Posty, and then drag the index.html from that folder directly into your web browser. Boom. There's your entire archive, audience of one.

...On A Potato

It's a static site, you can run it on a very underpowered instance, on Github Pages, or any of a number of other free HTML hosting options.

...On Posty

Once you review the archive, if you like what you see and your Posty instance is already public and taking requests (such as at posty.1sland.social) then you may choose to leave the archive there, calling that your public hosting location for your archive.

Here's an example of just such an archive:

posty.1sland.social/%40kaleb@s…

It's still recommended you download and keep a backup for yourself somewhere safe after generating the site, however.

Hosting the Archive Service Yourself

You're best off reviewing the README for details if you want to host this service for others.

Note that Posty is intended for any uploaded archive, but there's the option for a “Dedicated” hosted archive, which means the archive uploads are limited to archives for a single domain.

In that mode, archives will be saved on generation with shortened handles (ie., user rather than user@server.social) and SES urls will be defaulted. This is the mode intended for a Mastodon instance that wants to allow those leaving their instance a place to permanently host their old statuses from their retiring instance, as it preserves the status URLs.

Posty itself can convert from an uploader and static site generator to a simple HTML host via configuration once you're done collecting archives, at which point you should be able to downscale the instance it's running on significantly.

If you have any questions about Posty, or find any bugs, be sure to hit the Issues on codeberg, or drop me a line @oliphant@oliphant.social.

Note you can now import your Pixelfed archives, too, which provided several unique challenges.

— @oli 🐘
— @oli 🐘

Static Site Hosting for free

Static Site Hosting for free Lightning fast websites deployed directly to the edge Sign up and use for free The core of your composable architecture We love and support modern web development practices.

^{Jeremy Holcombe (Kinsta)}

Leute überlegt Euch mal ob es nicht sinnvoll wäre so manchen Eurer Beiträge in einer Lemmy Gruppe zu posten

Ich selbst mache das einfach deshalb weil man bei Lemmy eine richtig große Menge an Menschen erreicht, aber auch weil das den Menschen hilft Beiträge thematisch zuzuordnen. Wenn ich z. B. etwas über Heidelberg einstelle, erwähne ich die Gruppe @Heidelberg Stelle ich etwas zum Thema Klimawandel ein, dann erwähne ich die Gruppe @Klimawandel . Eine Auflistung der Gruppen findet ihr z. B. bei feddit.org hier:

feddit.org/communities

Bei Friendica und Mastodon könnt Ihr der betreffenden Gruppe ganz einfach folgen und sie dann später erwähnen. Bei Mastodon so das sie Euren Beitrag zusätzlich zum direkten Versand verteilt, bei Friendica bei Erwähnung mit ! anstatt @ auch exklusiv über die Gruppe.

Bei Mastodon findet Ihr die Gruppen via @gruppenname@server.tld, also z. B. @heidelberg@feddit.org. Bei Friendica geht es am schnellsten und einfachsten mit der URL, also beim Beispiel mit https://feddit.org/c/heidelberg.

Macht mit! Das trägt massiv zur Vernetzung innerhalb des Fediverse bei. 😀

#Fediverse #Gruppen #Feddit #Lemmy #Aufruf #Beiträge #2025-04-27

🏀 🏑 ⚽ 🏓 ⚾ 🤿 🏐 🛹 Das sind die Sportvereine mit Fediverse -Präsenz (die mir bislang begegnet sind). Gibt es noch mehr?

@psvhd@rheinneckar.social @Tauchclub@troet.cafe @BSV_Wedding_Reinickendorf@troet.cafe @tsvbordesholm@social.schleswig-holstein.de @tsgoberradtt@mastodon.social @mtvlecktt@mastodon.social @floorball@uhc-elster.de @unihockeyclub_elster@tube.tchncs.de @golf@crossgolf.uhc-elster.de @greenbears@norden.social @skatehub@troet.cafe

Sportarten u.a. : #Tauchen #Tischtennis #Floorball #Unihockey #Crossgolf #Baseball #Breitensport #Inklusionssport #Skateboard
Davon sind aber m.W. noch keine Accounts bei #Friendica oder #Pixelfed , sondern v.a. #Mastodon #Peertube #Sharkey .
Pixelfed wäre sicher für Vereine interessant, die in erster Linie Fotos posten möchten, Friendica könnte noch ein paar weitere Funktionen abdecken wie Terminkalender, interne Gruppen, Fotogalerie, Pinnwand usw.

Wäre schön, wenn die Vereine sich bei Interesse untereinander vernetzen und austauschen!

Für regionale Vernetzung und Auffindbarkeit vielleicht auch noch interessant: Tragt Euch doch auch auf der Fedikarte ein
@sport@feddit.org #Fediverse #Sport

Linux communities beware of #PewDiePie fans

Regardless of PewDiePie’s personal #politics (which clearly, at the very least are problematic), it is fairly well known by anyone who has been following him for any number of years that the vast majority of his fan base are enthusiastic fascists.

Now #PewDiePie , who’s content centers around PC gaming and Windows, has decided to switch to #Linux and published a video encouraging his followers to do the same. This means a very large number of his #fascist fan base is going to be switching to Linux.

Now many Linux communities are going to be forced to more explicitly choose their politics. Like the parable of the Nazi bar, if the community remains politically neutral, it will become fascist in short order.

A few things to be wary of:

• People asking you not to be “too political” or to “focus on the technology, not the politics” is a classic and highly effective fascist ruse to get moderators to lighten up on fascist elements posting in their community.
• People complaining about free speech rights. The #Internet and the #Fediverse is already a domain where people can speak freely about their politics by running their own server and building their own community with few to no government constraints. You don’t need to compromise on whether fascists have the right to free speech in your community.
• Arguments over your code of conduct (CC) and “safe spaces.” Keep them up-to-date. Research other people’s CCs, learn about the history of why these CCs came to be, learn about what the function of each clause of the code is included and phrased the way it is. These were usually designed to make explicit the fact that a community wants to be a safe space where underprivileged people can feel comfortable expressing themselves, and it is very easy to make people afraid to express themselves. Fascists understand these CCs and the concept of “safe spaces” were explicitly designed to exclude them, and often attack these ideas.

#GutenMorgen liebe #Mastodonier und #Fediverser,

es ist Sonntag, der 27. April 2025. Wir befinden uns auf der #Mastodon #Instanz lsbt.me. Wir haben aktuell 217 User. Diese haben bisher 37907 Tröts geschrieben. Das sind 174.69 Tröts pro Rüssel.

#WetterDeutschland: Heute 9-13°C, überwiegend Klarer Himmel.
Regional: Berlin: 10°C, Klarer Himmel | Hamburg: 9°C, Klarer Himmel | Köln: 13°C, Klarer Himmel | München: 10°C, Bedeckt | Stuttgart: 12°C, Klarer Himmel | Dresden: 9°C, Klarer Himmel

Es folgt die Weisheit des Tages:

"Einen Weißen? ... Aber das ist fürchterlich!"
"Nicht fürchterlicher, als wenn man einen Schwarzen verkauft. Mensch
ist Mensch."
-- Karl May (Waldröschen)

#mastodon #fediverse #stats #statistics #lsbt #lgbt #weisheit #weisheiten #weisheitdestages #trans #gay #schwul #lesbian #lesbisch #homo #transsexualität #transsexuell #transgeschlecht #transgeschlechtlich #safeplace #adminpost #morningpost #wetter #deutschland

#Hallo Ihr Lieben auf lsbt.me ,

Unsere #Instanz wächst und wächst. Kürzlich hatten wir unser zwei-jähriges Jubiläum. Wir haben aktuell 217 trötende #Rüssel hier auf unserer Instanz und das bedeutet, dass unsere Instanz mit eine der erfolgreichen Instanzen im #deutsch sprachigen Raum geworden ist.

Das bedeutet aber auch, dass der Instanz #Server einiges zu leisten hat. Er muss performant bleiben und er muss groß genug sein, um die ganzen #Tröts mit ihren #Medien wie #Bilder und #Videos zu speichern. Auch der #Backup-Server muss entsprechend dimensioniert sein. Das alles kostet viel #Geld im #Monat, das ich vollständig aus der eigenen #Tasche bezahle.

Wenn es Dir hier bei uns also gefällt und Du nicht möchtest, dass diese Instanz irgendwann in der Versenkung verschwindet, wie so viele andere kleine und große Instanzen auch, dann denke doch einmal drüber nach, ob Du mich dabei nicht ein kleines bisschen #unterstützen möchtest.

Spenden kannst du entweder per #Bitcoin, Paypal oder Banküberweisung. Alle Informationen dazu findest du unter #Spendenmöglichkeiten auf der "About" Seite dieser Instanz ganz unten: lsbt.me/about#spenden
Am meisten freue ich mich natürlich, wenn Du die Möglichkeit der regelmäßigen #Spende per #PayPal oder #Dauerauftrag nutzen würdest.

Vielen Dank und weiterhin ganz viel Spaß bei uns, wünscht Dir Eure #Admina
Christin

#mastodon #fediverse #stats #statistics #lsbt #lgbt #trans #gay #schwul #lesbian #lesbisch #homo #transsexualität #transsexuell #transgeschlecht #transgeschlechtlich #safeplace #adminpost