Notices by Terence Eden (edent@mastodon.social)

🆕 blog! “Book Review: ActivityPub by Evan Prodromou”
★★★★⯪

As part of my grant from NLnet to improve my Fediverse bot project, I'm spending time making sure I understand all the fundamentals of ActivityPub. The problem with Internet standards is they're scattered all over the place. Abandoned forums, half-maintained wikis, mailing lists with obscure rules, and…

👀 Read more: https://shkspr.mobi/blog/2026/09/book-review-activitypub-by-evan-prodromou/
⸻
#ActivityPub #BookReview

A weird #ActivityPub message from #Frendica.

Signed on 2026-09-01
Published on 2026-03-02

That's a skew of six months! The message type is "Undo" - so they're undoing a like they sent in March.

Is there *really* a worry about accepting requests like this? Given the message has been signed, what risk is there to replay attacks?

Bug report at https://github.com/friendica/friendica/issues/16150

@Profpatsch yeah, that's the question I'm asking. Is there any risk in accepting a message that old?
I don't think there is - but I wanted to check with wiser minds.

@evan Thanks - I had mine at two minutes.
I'm starting to see more exceeding 10 minutes.
I wonder what the actual risk is of accepting something with that long a delay?

I think the #RFC9421 HTTP Signature algorithm should be explicitly included in #Mastodon's requests.

Feedback welcome - especially those explaining politely why I'm a wrong about this.

https://github.com/mastodon/mastodon/issues/29905#issuecomment-5440336919

Next is slightly more trivial - a broken internal link in the Mastodon documentation.

https://github.com/mastodon/documentation/issues/1947

I'm going to try and keep a record of all the bugs, errors, and inconsistencies I've reported in #ActivityPub and #Mastodon documentation.

First up, how big are the limits on what you can federate?

Mastodon lists some limits in KB/MB, but others are just raw numbers. That might make sense for an ASCII world - but emoji complicate everything.

https://github.com/mastodon/mastodon/issues/40290

Woo! It's now official 😊

I'm getting some grant funding to further develop #ActivityBot.

If you have any feature requests or suggestions - or just want to build your own ActivityPub bot - check out https://gitlab.com/edent/activity-bot

Hey, #Mastodon and #ActivityPub developers.

How much skew do you allow before rejecting a message?

I've just received something where the header is signed:
Mon, 31 Aug 2026 20:09:54 GMT

But the ActivityPub message was published:
Mon, 31 Aug 2026 19:58:36 GMT

That's a little over 10 minutes. Is that too much? Should I not care as long as the signature validates?

Even more HTTP Message Signature weirdness.

My server receives a lot of "Delete" requests from #Mastodon server.

Those requests are signed.

I try to validate the signature but… the user is deleted!

So I try to retrieve the user's Public Key at, for example, https://nrw.social/@Faxy.json#main-key but get an error.

I suppose an HTTP 410 is a pretty good indication that the user has been deleted. And I *might* have previously cached the key. But it does feel a *little* bit pointless.

So, if I've got this right about HTTP Signatures.

➡ You send me a request.
🔍 I check the digest matches the contents.
📆 I check the date is roughly correct.
⬅ I request your public key.
🖊 That requires me to sign a request with my private key.
🔑 I get your public key.
🕵 I validate your request by checking the signature matches the entire request - including digest.

But…! When I request your public key, you have to validate my public key. Which leads us into a loop?

Once again doing battle with http signatures.

They work when I POST, but fail to be validated when I GET.

I'm sure there's a simple explanation...

OK! Today I'm going to attempt battle with RFC9421 HTTP Signatures.

Just validating them - I'm not brave enough to send them yet 😆

#ActivityBot #ActivityPub

Hmmmm. Some #ActivityPub headers have:

digest => sha-256=…

But others have

content-digest => sha-256=…

Looks like I need to update my code, and a bunch of tutorials need to update their documentation!

https://github.com/social-web-foundation/tags.pub/issues/22

@annika @example
Oooh! Could you send a screenshot to me please?
It hasn't updated on my server yet :-)

For those mourning the loss of #XCancel and #Nitter - I've written a guide to retrieving Tweets without using the Twitter API.

https://shkspr.mobi/blog/2025/04/you-dont-need-an-api-key-to-archive-twitter-data/

You can use that to get individual posts + whatever they were in reply to.

Enjoy!

Huge thanks to @evan for making his book available as a DRM free ePub!

https://www.kobo.com/gb/en/ebook/activitypub

Now to find the time to read it 😊

I know you all hate the emergency alert about disposable barbeques.

But yesterday I watched a man at our hotel breakfast set fire to a toaster by trying to toast a croissant - despite multiple signs telling him not to.

Today he tried again.

So, you know, calibrate for the average person.

🆕 blog! “Book Review: Dungeon Crawler Carl by Matt Dinniman”
★★⯪☆☆

To call this derivative is an understatement. But that's what this genre demands; rehash all your favourite media properties into something new. It's the literary equivalent of having your Transformers™ fight your He-Man© toys.

The plot, such as it is, features the Vogon Constructor Fleet destroying Ea…

👀 Read more: https://shkspr.mobi/blog/2026/07/book-review-dungeon-crawler-carl-by-matt-dinniman/
⸻
#BookReview

Hey #UK friends. Do you get annoyed by fireworks? Do your pets find them distressing? Do you think anyone should be able to buy them?

The UK Government is running a consultation and want your views.

https://www.gov.uk/government/consultations/fireworks-and-pyrotechnics-in-the-uk/fireworks-and-pyrotechnics-in-the-uk

(Please don't reply to me. This isn't my consultation. Click the link and fill in the survey.)