Conversation

Notices

1. Embed this notice
   Terence Eden (edent@mastodon.social)'s status on Tuesday, 01-Sep-2026 05:41:14 JST Terence Eden

   Woo! It's now official 😊

   I'm getting some grant funding to further develop #ActivityBot.

   If you have any feature requests or suggestions - or just want to build your own ActivityPub bot - check out https://gitlab.com/edent/activity-bot

   • Embed this notice
     Terence Eden (edent@mastodon.social)'s status on Tuesday, 01-Sep-2026 05:41:13 JST Terence Eden

     in reply to

     Hey, #Mastodon and #ActivityPub developers.

     How much skew do you allow before rejecting a message?

     I've just received something where the header is signed:
     Mon, 31 Aug 2026 20:09:54 GMT

     But the ActivityPub message was published:
     Mon, 31 Aug 2026 19:58:36 GMT

     That's a little over 10 minutes. Is that too much? Should I not care as long as the signature validates?

   • Embed this notice
     Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸 (evan@cosocial.ca)'s status on Tuesday, 01-Sep-2026 05:41:13 JST Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸

     in reply to

     @Edent activitypub.bot gives a tolerance of 5 minutes.

     https://github.com/evanp/activitypub-bot/blob/main/lib%2Fhttpsignatureauthenticator.js#L8

   • Embed this notice
     Terence Eden (edent@mastodon.social)'s status on Tuesday, 01-Sep-2026 05:41:14 JST Terence Eden

     in reply to

     I'm going to try and keep a record of all the bugs, errors, and inconsistencies I've reported in #ActivityPub and #Mastodon documentation.

     First up, how big are the limits on what you can federate?

     Mastodon lists some limits in KB/MB, but others are just raw numbers. That might make sense for an ASCII world - but emoji complicate everything.

     https://github.com/mastodon/mastodon/issues/40290

   • Embed this notice
     Terence Eden (edent@mastodon.social)'s status on Tuesday, 01-Sep-2026 05:41:14 JST Terence Eden

     in reply to

     Next is slightly more trivial - a broken internal link in the Mastodon documentation.

     https://github.com/mastodon/documentation/issues/1947

   • Embed this notice
     Terence Eden (edent@mastodon.social)'s status on Tuesday, 01-Sep-2026 05:41:14 JST Terence Eden

     in reply to

     I think the #RFC9421 HTTP Signature algorithm should be explicitly included in #Mastodon's requests.

     Feedback welcome - especially those explaining politely why I'm a wrong about this.

     https://github.com/mastodon/mastodon/issues/29905#issuecomment-5440336919

   • Embed this notice
     Terence Eden (edent@mastodon.social)'s status on Tuesday, 01-Sep-2026 06:08:08 JST Terence Eden

     in reply to

     • Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸

     @evan Thanks - I had mine at two minutes.
     I'm starting to see more exceeding 10 minutes.
     I wonder what the actual risk is of accepting something with that long a delay?

   • Embed this notice
     Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸 (evan@cosocial.ca)'s status on Tuesday, 01-Sep-2026 06:08:08 JST Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸

     in reply to

     @Edent replay attacks, I'd guess.

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Wednesday, 02-Sep-2026 02:47:12 JST silverpill

     in reply to

     • Beady Belle Fanchannel

     @Profpatsch @Edent

     An HTTP signature proves that an activity exists on the originating server - it's substitute for fetching activity by its ID. The originating server has full control over the activity JSON and the request headers, so the date of publishing doesn't matter.

     What may matter is the date when the signature itself was created. If you receive a request signed several days ago, that might indicate a replay attack... Or a broken clock on the sender side.

   • Embed this notice
     Beady Belle Fanchannel (profpatsch@mastodon.xyz)'s status on Wednesday, 02-Sep-2026 02:47:13 JST Beady Belle Fanchannel

     in reply to

     • silverpill

     @Edent personally I think it's healthy for the network to accept these, but @silverpill knows best

   • Embed this notice
     Terence Eden (edent@mastodon.social)'s status on Wednesday, 02-Sep-2026 02:47:14 JST Terence Eden

     in reply to

     • Beady Belle Fanchannel

     @Profpatsch yeah, that's the question I'm asking. Is there any risk in accepting a message that old?
     I don't think there is - but I wanted to check with wiser minds.

   • Embed this notice
     Beady Belle Fanchannel (profpatsch@mastodon.xyz)'s status on Wednesday, 02-Sep-2026 02:47:15 JST Beady Belle Fanchannel

     in reply to

     @Edent wait, why would you even care if the publish date and the signature date are skewed? They are two different pieces of information that don't have to match.

     For example your server could have been down for a day and a task queue might have been retrying to send you the message which was created by a different part of the sending pipeline

   • Embed this notice
     Terence Eden (edent@mastodon.social)'s status on Wednesday, 02-Sep-2026 02:47:16 JST Terence Eden

     in reply to

     A weird #ActivityPub message from #Frendica.

     Signed on 2026-09-01
     Published on 2026-03-02

     That's a skew of six months! The message type is "Undo" - so they're undoing a like they sent in March.

     Is there *really* a worry about accepting requests like this? Given the message has been signed, what risk is there to replay attacks?

     Bug report at https://github.com/friendica/friendica/issues/16150

   • Embed this notice
     Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸 (evan@cosocial.ca)'s status on Wednesday, 02-Sep-2026 11:44:44 JST Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸

     in reply to

     • django
     • silverpill
     • Beady Belle Fanchannel

     @django it could be on exponential backoff.

     @Edent @silverpill @Profpatsch

   • Embed this notice
     django (django@social.coop)'s status on Wednesday, 02-Sep-2026 11:44:45 JST django

     in reply to

     • silverpill
     • Beady Belle Fanchannel

     @Edent @silverpill @Profpatsch yeah, the Activity could have been in a low priority queue. Either way this type of activity isnt always fetchable so I’d accept!