Nate reshared this.

pleroma - Link to source

Trusting Trust in the Fediverse

A very long blog post about the various "safety and privacy" features that got added over the years to ActivityPub and how useless they can be in the eyes of users unaware of the inner workings.

There's nothing really new I talk about, but it is a long explanation of my reasoning behind why I don't take "features" such as signed fetches and interaction consent seriously. What can be considered "new" to most, is the last section of bypassing signed fetch enforcement without impersonation, which I talked about probably twice over the years.

evilmaid.net/blog/trusting-tru…

(If there are styling issue, tell me. I've written the CSS from scratch, and I suck at it.)

Trusting Trust in the Fediverse

Implied trust and how easy it is to break it
evilmaid.net

Nate reshared this.

in reply to Phantasm

pleroma - Link to source

a

small corrections re: addressing and post scopes

> For example differentiating between Public and Unlisted is simply done based on where the as:Public special URI is. If it is in cc, the post can be considered Public, and if it is in to, it can be considered Unlisted

this is backwards -- to:Public = "public", cc:Public = "unlisted"

> If cc is empty and to has the Actor's followers Collection and the Actors mentioned in the post, the post can be considered Locked.

generally it doesn't matter if to/cc is used for the followers collection. what actually matters is that to/cc does not contain Public

> And lastly if cc is empty and to only lists Actors mentioned in the post without the followers Collection, the post can be considered a DM.

again to/cc doesn't matter here, a "direct" post is simply one where every audience member can be mapped to an account instead of a collection or unknown

friendica (DFRN) - Link to source

nate.mecca1.net/posts/2026-02-…

A new blog post about daily driving an (almost comically) outdated laptop.

#blog #linux

The RAM wars: mini penguin to the rescue

Originally, I was drafting this in September, planning on dedicating it to Windows 10 Home becoming EOL. I also figured I’d share a meme that contained …
nate.mecca1.net
#Linux #blog

reshared this

Nate reshared this.

mastodon - Link to source

We made so many improvements with #HolosSocial, an ActivityPub server running on your phone. Big thanks to our beta testers who help us identify issues and suggest enhancements.

For tech folks: imagine pointing your domain with a CNAME to a relay and having your own ActivityPub identity with keys and data on your phone. The relay becomes just infrastructure, and you're free to move to another relay whenever you want.

That's the crazy bet we're working on!

More are at @HolosSocial

#holossocial @Holos Social

reshared this

Nate reshared this.

writefreely - Link to source

Holos Is Adding Custom Domain Support


 [img]https://media4.giphy.com/media/v1.Y2lkPTc5MGI3NjExanE2ZDV5NWVkODc0Z2RkZGprdWliOHFqZXczYWUyMDMxa2VkOHgzaCZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/3zFcbgHoIXzykQc7vU/giphy.gif[/img] [...]
The media in this post is not displayed to visitors. To view it, please go to the original post.
The media in this post is not displayed to visitors. To view it, please go to the original post.

Nate reshared this.

Nate reshared this.

mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.
Custom domain support for #Holos is in development and coming along nicely! Use @user@your-domain.com instead of @user@holos.social, just point your DNS to a relay (changeable anytime). Actor URIs and post URIs stay stable forever, so switching relays requires no migration. Your RSA keys + domain = portable identity. Optional feature for users wanting relay independence.
#holos

reshared this

Nate reshared this.

mastodon - Link to source
Every day, #Holos proves you can run your own ActivityPub server on your phone. We approached the problem differently: instead of copying existing platforms, you're in control. No imposed style - not Twitter-like, Instagram-like, or YouTube-like. Enjoy everything the Fediverse offers and contribute your way.
#holos

reshared this

Nate reshared this.

mastodon - Link to source

"Kirill Ilin's construction company Amcrete constructed the concrete walls of their ground-breaking new four-bedroom prototype 'layer by layer by layer' right on its Waiuku site.

He says houses made with concrete poured by a computer-controlled 3D printer are energy-efficient, quick to construct, and, because of their durability and recyclability, also sustainable."

rnz.co.nz/life/lifestyle/home/…

Minor edit: Fixed quote formatting.

#housing #construction #3DPrinting #Amcrete

NZ's first onsite 3D-printed home

Homeowners get a much better deal with a 3D-printed concrete house than a standard weatherboard build, says Auckland master builder Kirill Ilin.
RNZ
#housing #3dprinting #construction #amcrete
This entry was edited (1 month ago)

Nate reshared this.

Nate reshared this.

mastodon - Link to source

"Every Activity Pub server duplicates content. Without it there'd be no seeing posts from anybody on servers other than their home server. It's literally the thing that makes the protocol work. If being on a protocol that specifically is designed to duplicate content isn't permission enough to duplicate content then the Fediverse goes poof. Zilch. Zero. Nada."

@nate, 2024

primal.net/e/nevent1qqsp85429n…

Well put. Found via a link here;

nate.mecca1.net/pages/follow/

#fediverse #ActivityPub

Nate

So a thing happened and I'm kinda flabbergasted. There appears to be a campaign to shut down the Mostr (Nostr <> ActivityPub bridge). Dunno how big it is, but apparently at least one DMCA complaint has been filed.
primal.net
#ActivityPub #fediverse @Nate
This entry was edited (2 months ago)

reshared this

in reply to Strypey

mastodon - Link to source

lj·rk

Yes and no. From a legal or technical standpoint, all this is true. It is legally allowed, technically necessary. But this doesn't mean it's ethical and that it doesn't violate consent.

I can walk up to two people speaking in "public" to eavesdrop on their conversation. But just because I can, doesn't mean it's right. I can scrape endless pfp images from WhatsApp through their contacts API. But doesn't mean it's right.

So no, just because it's possible it doesn't mean "permission enough". It' just means that it's necessary and people have accepted the risk. Explicit permission is something different entirely. This is about consent, a human property, not about technological or legal constructs.

in reply to lj·rk

friendica (DFRN) - Link to source

Nate

Bridges are a bit different than scraping content or listening into a conversation. A bridge that bridges Activity Pub to AT/Nostr acts like any other ActivityPub instance, requesting a copy of the bridged user's profile in the same way another ActivityPub native server would. Same with Friendica (that I'm using right now to reply), it requested a copy of your post over Activity Pub, despite being native to DFRN (although, unlike Bridgy Fed/Mostr, Freindica bridges internally via plugin instead of using a dedicated standalone bridge). I'd argue that using a protocol designed for federation, on a server that defaults to federating with any instance not proactively blocked, is rather explicit permission to federate.

However, since it's just federating normally, it's easy to stop. If you block the bridges (at the user level or instance wide) they won't federate, just like any other Activity Pub instance. While I think bridges are important for the ecosystem, the beauty of something that's not centralized is that you can choose exactly what you do and don't want to interact with.

in reply to lj·rk

mastodon - Link to source

Strypey

(1/3)

@ljrk
> I can walk up to two people speaking in "public" to eavesdrop on their conversation

That's not a valid metaphor for Public posts on a federated network. It's more like 2 people speaking on a stage using microphones, connected to a global livestream.

If you don't want strangers to listen to your conversation, that's easy! Just get off the stage. If you want to have a private conversation in a public space that people won't eavesdrop on, that's what Direct posts are for.

@nate

@lj·rk @Nate
This entry was edited (2 months ago)
in reply to Strypey

mastodon - Link to source

Strypey

(2/?)

@ljrk
> it can only be consensual if whatever happens is somewhat "expected"

That's like saying that striking up a conversation with someone at a speed dating event isn't consensual, if that person didn't expect to be spoken to at the event. If people choose to go into a situation, not expecting things that can be reasonably expected, that's on them. Not on everyone else for not being mindreaders.

in reply to Strypey

mastodon - Link to source

Strypey

(3/3)

I think there is UX work that can be done to make it clearer what level of visibility a post has, and to give people more granular control;

codeberg.org/fediverse/fediver…

But none of that will help if people refuse to learn about the options available and how to use them. Or insist that everyone else magically know what they intended, even if their app usage choices suggest the opposite.

Mapping all possible posting scopes

We need to define pan-fediverse posting scopes, that map the various social expectations onto the technical realities.
Codeberg.org
This entry was edited (2 months ago)
in reply to Strypey

mastodon - Link to source

Strypey

Coda: If I stand in the street wearing a "free hugs" sign, it's reasonable for people to expect a free hug. Say someone hugs me, and I claim it was non-consensual because I only expected my friends to take up the offer made on the "free hugs" sign. Is that reasonable on my part?

When you post something as "Public" (instead of "Followers only", or "Private mention", to use the current Mastodon app terms), that's like the "free hugs" sign. People can reasonably expect to take that literally.

This entry was edited (2 months ago)
in reply to Nate

mastodon - Link to source

Strypey

> unlike Bridgy Fed/Mostr, Freindica bridges internally via plugin instead of using a dedicated standalone bridge

At the risk of splitting hairs, I think you're stretching the definition of "bridge" beyond breaking point there.

A bridge connects any instance to any instance (of whatever it is they bridge). An AP plugin adds native federation to a single instance, allowing it to connect directly with any remote service federating over AP. Two quite different things.

@ljrk

@lj·rk

friendica (DFRN) - Link to source

nate.mecca1.net/posts/2025-12-…

New blog post, a bit of an addendum to my older microblogging protocols comparison post(s) until I do an updated version at some point. It mostly just goes over a handful of big events and shifts I've personally noticed since my last post in the summer of 2024.

#activitypub #fediverse #nostr #at #bluesky

This is Fine: an Interim Microblogging Protocols Update

As is customary on my microblogging posts, let’s get us started with an original meme. Also, if you’d like to read my previous Microblogging …
nate.mecca1.net
#ActivityPub #fediverse #at #bluesky #nostr

reshared this

friendica (DFRN) - Link to source

@Holos Social @Fedilab Apps

Hi, I was going to be writing a blog post mentioning Holos, and was hoping I could bug you guys with a couple questions. First, are there any plans to/consideration of adding support for custom domains? E.g. I setup a Holos server, but a buddy who registers on my server could use a separate custom domain they own for their handle?

Also, I noticed that the source code link on holos.social 404s. Is that intentional (e.g. relocation, I'm sure things are sort of in flux with it being new), or is there a working link to the repo?

Anyway, project looks cool. Thanks!

@Fedilab Apps @Holos Social
Nate reshared this.

momostr - Link to source
Toying around with trying to create a "standard" social media style app on Nostr, focused on posts shared within circles instead of the fully public microblogging that most stuff is focused on.
Made a custom NIP
nostrhub.io/naddr1qvzqqqrcvypz…And vibe coded a proof if concept (beware mobile users, the mobile view is not good atm)
npub1nj7tj7wr2zl69mdc02x24j2js…Just a proof of concept, posts there aren't private since they're custom events but are being publicly broadcast (would need a custom relay setup). But it seems to be working.
Could use advice from people who know what they're doing, if there's any issues with the formatting of the custom NIP or a better way about going about things I'd greatly appreciate feedback.
#asknostr #nostr #vibestr #vibecoding

NostrHub | Discover and Publish Nostr Implementation Possibilities

Discover official Nostr Implementation Possibilities (NIPs) and publish your own custom NIPs on the Nostr network. Browse, search, and contribute to the Nostr protocol ecosystem.
NostrHub
#nostr #asknostr #vibecoding #vibestr

Nate reshared this.

friendica (DFRN) - Link to source

nate.mecca1.net/posts/2025-06-…

Made a #blog post about different non standard ways to host a website or content. Touches on:
* #I2P
* #Tor
* #ipfs
* Decentralized Domains
+ the microblogging protocols

NFTs and Dark Web Shenanagins

A based design that makes a web that’s true ICANNs and NATs embrace shall be no more Behind a Pi or in the cloud for you We use that tool be I2P or Tor …
nate.mecca1.net
#blog #tor #I2P #ipfs
in reply to Nate

mastodon - Link to source

dcatoffm

If I may add to footnote 4, i2p outproxies are also statically defined in your configuration, vs tor which has automatically dynamic exit nodes. The typical advice if you're going to host an outproxy is to bridge it into tor to maintain anonymity.

Plus, a neat effect of bridging i2p into tor is you can use both eepsites and onion sites, as well as anonymous browsing the clearweb from the same browser without having to swap proxy configurations. Of course this comes with its own cautions.

Nate reshared this.

mastodon - Link to source

Dear Fedi friends, I need your help!

We are working on motion graphics for the Fediverse promotional video... and we would love to do a sequence at the end with a mosaic of people's profile photos. For that, I need your consent.

If you'd like to have a small cameo in our video, can you let us know if we can use your profile pic?

Thanks! 🙏

Can you please boost this?

#EleFediVideos #AskFedi

#askfedi #elefedivideos
Nate reshared this.

momostr - Link to source
#microsoft #firefox #Edge #fennec

reshared this

Nate reshared this.

mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.
Wait it's actually real, O'Reilly has a Vibe Coding book coming out oreilly.com/library/view/vibe-…

Vibe Coding: The Future of Programming

AI is transforming software development, shifting programmers from writing code to collaborating with AI in an intent-driven workflow—this is vibe coding.
O’Reilly Online Learning

reshared this

in reply to Brodie Robertson

mastodon - Link to source

Steve Scott

OK, so the book isn't complete and sections are missing, but I've read through the preview and I'm not as mad as I thought I might be

There is definitely a bias that LLMs will have to be adopted by developers, and it's just a question of how. With citations from those selling LLM solutions about how effective it is, of course (Github say it'll make you 55% more efficent, just send us $39 a month please!) 1/4

Nate reshared this.

momostr - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.
Got some fresh air and a few photos yesterday.
raw.githubusercontent.com/0n4t…raw.githubusercontent.com/0n4t…raw.githubusercontent.com/0n4t…None of them were edited after taking, though no. 2 & 3 were taken with a lower exposure and daylight white balance as the sun was just starting to set to give them the darker yellow look.
#photography
#Photography

Nate reshared this.

⇧