Notices by Todd Sundsted (toddsundsted@epiktistes.com)

"We put the exploit in a picture. The AI code reviewer never opened it."

This line from the article:

#ai #infosec

@silverpill i don't know about anyone else, but the thing i'm personally bumping up against now is people trying to post about events without being able to properly model events in the fediverse.

@mariusor @silverpill

a good question! one and the same thing for me. i'm just tired of having to go "somewhere else" to interact with events. fwiw, my personal bar is pretty low, but i increasingly think this is a major missing piece.

how widely adopted/supported/implemented is FEP-8a8e? is that a safe direction to converge for federated events?

I’m working on handling OAuth token expiry as part of #ktistec Mastodon API support. Is my understanding that Mastodon issues OAuth tokens with no expiration correct?!?

@silverpill what's the entry point for trying this out? consuming portable objects?

Before creating and publishing FEDERATION.md for #ktistec I wanted to understand what existing practice looked like across the Fediverse.

FEP-67ff describes the requirements of the FEDERATION.md file in loose terms and provides a non-normative template. I scraped the URLs of FEDERATION.md files from FEP-67ff itself and confirmed I could fetch them. The FEP listed 30 accessible projects (31 total, but one project—FIRM—does not appear to exist).

If a file had a section with the heading "Supported FEPs" per the non-normative template, I only looked there for supported FEPs. Otherwise I scanned the entire document.

Implemented FEPs, ranked by the number of implementations that attest support, are:

There are obvious flaws in the methodology. Or maybe in the data. Only 18 out of the 30 projects I could access had a FEDERATION.md that attested FEDERATION.md support. Only 19 mentioned "FEDERATION.md". Only 21 mentioned "67ff". The remaining projects clearly did support FEP-67ff—the file itself was evidence. (FEDERATION.md is not meant to be machine readable—there's an issue about that).

It was more difficult to rank implemented federation protocols. I extracted keywords from documents with a  "Supported federation protocols and standards" section and created a dictionary of terms. If a file had a section with the heading "Supported federation protocols and standards", I only looked there. Otherwise I scanned the entire document.

If time allows, I'm going to try to rank these documents by "utility", though I haven't yet determined the exact metric. These documents clearly provide valuable information, but their lack of standardization makes them harder to analyze systematically.

#ActivityPub #Fediverse #Fep67ff #fep

sometimes i wish #activitypub and servers/clients supported both Like and Love activities, for when liking something  isn't strong enough...!

I wonder if you could use/abuse Mastodon polls (FEP-9967) to distribute posts that provide near-real-time status updates (I'm thinking about severe weather alerts but I'm sure there are other use cases)?

Create a poll with an expiry far in the future and a token set of options (ideally just one—"Do you opt in?"—but poll implementations seem to require at least two).

Nothing seems to prevent the content of a poll from changing—and this is the key insight. The FEP says, "The type of a poll (single choice / multiple choices) and its options might be changed at any time. In that case the author of the poll MUST reset the vote counts." So broadcast updates via the content.

It would be a lightweight way to follow a single item without following the actor, built on top of implementations that already exist. 

#ActivityPub #Fep9967

With the addition of the @ktistec account, Ktistec (the server) now supports multiple users.

I still have a few rough edges to fix, but there's a good chance official multi-user support will be included in the next release.

#ktistec #fediverse #activitypub #crystallang

I've been thinking about the demise of botsin.space. Running a site for bots is hard (and expensive) but writing and running an ActivityPub-based bot should be easy.

To prove this was the case I added experimental support for bots/automations to Ktistec in the form of scripts that the server periodically runs. These scripts can be in a programming language of your choice. The server provides credentials for its API in the process environment (if you can use curl you can publish posts), simple interaction happens via stdin/stdout/stderr, and the complexity of using ActivityPub is abstracted away.

The code is only available on the following branch for the moment:

    https://github.com/toddsundsted/ktistec/commits/run-scripts/

There are a couple example shell scripts here:

    https://github.com/toddsundsted/ktistec/commit/4982925a...

I have a few enhancements in mind, but it's already proven useful as a means to periodically log data from my server host, and I'll use it, when finished, to publish release notes.

#ktistec #activitypub #fediverse #bots

sometimes the world is just breathtaking...

#photo #morning #fog