Tag
This article describes using fuzzing to discover an unauthenticated denial-of-service vulnerability in snac2's JSON parser, allowing remote crashes via crafted inputs.
The article details the remaining technical work needed to implement end-to-end encryption (E2EE) for ActivityPub, breaking it down into fundamental messaging, security, and authenticity goals, and explains how key transparency and MLS protocols fit into the effort.
This article proposes running ActivityPub on top of the AT Protocol's PDS, arguing that combining the two architectures could offer better user agency and credible exit while maintaining compatibility with existing federated social media.
The article explains the complexities of implementing the ActivityPub protocol, such as handling multiple HTTP signature standards and JSON-LD contexts, and introduces Fedify, a TypeScript framework designed to simplify building ActivityPub applications.
Explains why the concept of 'instances' from Mastodon/ActivityPub does not apply to ATProto (Bluesky's protocol), clarifying that hosting and aggregation are separate in ATProto's architecture.
A critical vulnerability in Fediverse software (Mastodon, Misskey, and forks) related to Linked Data Signatures was discovered by Anthropic via Doyensec. The vulnerability allows property reordering via JSON-LD expansion, enabling attackers to exploit signed objects.
The author describes using HAProxy caching to reduce unnecessary load on snac threads in the FediMeteo service, following previous similar optimizations with nginx. The approach aims to keep the lightweight ActivityPub server efficient by having the reverse proxy absorb repeated public requests.
Spritely Institute releases Mandy, a prototype implementing ActivityPub on top of the Goblins actor model framework, making ActivityPub actors available over HTTP.