silverpill / is on Nostr

Developer of ActivityPub-based micro-blogging and content subscription platform [Mitra](https://codeberg.org/silverpill/mitra ). Admin of [mitra.social](https://mitra.social/ ) instance.

Last Notes

2024-09-12 14:02:22

- reply

no particular reason, that is just how it is implemented

2024-08-27 14:18:55

- reply

Not really, I'd prefer to just put a hash into URL in a standardized way and use it to verify the integrity of a resource:
https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md#media
Fediverse can be its own data storage network.

2024-06-20 17:18:29

Welcome @npub1akg…ycjf, the first ever [FEP-ef61](https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md ) + [FEP-ae97](https://codeberg.org/fediverse/fep/src/branch/main/fep/ae97/fep-ae97.md ) actor.
It doesn't have S2S inbox yet, but it has C2S outbox and was created from a client. The client controls the identity key, can send signed messages to local users, and receive messages from them. I published the code here: https://codeberg.org/silverpill/fep-ae97-client
FEP-ae97 clients are not difficult to build, and I invite everyone to do so. C2S protocol is identical to S2S protocol, except you send activities to a local outbox instead of a remote inbox, and you pull activities from local inbox instead of listening for them online. The [development version](https://codeberg.org/silverpill/mitra ) of Mitra already has necessary endpoints. FEP-ae97 spec needs to be updated though, I will do that soon.
#fep_ef61

2024-06-03 01:51:44

Let's talk about object ownership in #ActivityPub
I'm writing a new FEP: https://codeberg.org/silverpill/feps/src/branch/main/c7d3/fep-c7d3.md
This topic is rarely discussed, but any server that doesn't implement ownership checks as described in this document is likely vulnerable to impersonation attacks.

2024-05-17 14:49:55

- reply

I don't know. Could you provide an example of such post?
@npub1uq5…z8a5

2024-05-17 02:14:25

- reply

+1Article
= rich content, embedded images, videos, and other media.
But how embedded images should be treated by implementations that use media cache? Are they expected to rewrite src attributes in images?
@npub1scy…khe4 @npub1zu5…pytj @npub1k90…q43y

2024-05-17 01:16:38

- reply

I'm not using context, but I think FEP-7888 is great and I want to implement it in the future. Haven't decided yet on what exactly this collection should contain. Slightly in favor of collection of activities (as in Streams / Conversation Containers).
@npub1t5c…ppw4 @npub1k90…q43y

2024-05-11 18:39:57

- reply

Mitra transforms Event objects into posts, that works reasonably well. I'm not against extended support but I'd like to wait until some standard in this area emerges. As far as I know, existing event servers use slightly different protocols.
@npub1fxv…u9e5 was working on better interop
https://event-federation.eu/

2024-04-27 22:48:24

Mitra v2.17.0 has been released. From now on these announcements will be published from [@mitra](https://mitra.social/users/mitra) account
https://mitra.social/objects/018f214d-8273-0d4f-42b3-602feee5ee1f
#note1k5p…yzhy

2024-04-27 12:15:34

- reply

Mastodon already can display long Note content (it adds "Read more" at the end), I think it is reasonable to do the same for Article and other types of objects.
>The question is how, but this WG is not at the point where we start throwing around decrees and making up standards
Just talk to developers. There's an open issue (and an open pull request): https://github.com/mastodon/mastodon/pull/24081. This proposal has not been formally rejected, perhaps [@renchap](https://oisaur.com/@renchap) could provide some feedback?

2023-09-21 11:37:00

**How to set up key-based identity in Mitra**
Mitra implements a mechanism for migrating your connections from one server to another, which works even if your current server is offline. At the moment, this mechanism is only supported by Mitra. People who use different software won't be able to connect automatically to your new account, so the more of your contacts use #Mitra, the less connections you lose during migration. It's not very difficult for other developers to implement it though, and it's documented in [FEP-7628](https://codeberg.org/silverpill/feps/src/branch/main/7628/fep-7628.md ) and [FEP-c390](https://codeberg.org/fediverse/fep/src/branch/main/fep/c390/fep-c390.md ).
For migration to work, two accounts must be linked to the same cryptographic key. To do that, you need to add a public key to your profile, then create a signature to prove the possession of the corresponding private key. You can think of this key as something that represents your primary identity and your fediverse accounts as temporary aliases. Mitra currently supports two signing tools: [Minisign](https://jedisct1.github.io/minisign/ ) and [Metamask](https://metamask.io/ ).
**Minisign**
#Minisign is a command line tool. It might be difficult to use, but it is secure and doesn't violate your privacy.
1. Install Minisign. The tool is available in most Linux distros. For example, on Debian you can simply run apt install minisign.
2. Generate a key pair: minisign -G.
3. Go to your profile page, click on three dots to open the profile menu and select "Link minisign key".
4. Tell Minisign to export your public key:<code>minisign -R -f -p minisign.pub
</code>
Copy the text from minisign.pub file and paste it into the form. Press "Generate message" button.
5. Run displayed commands to create a signature. The first one (starting with printf) creates a file that needs to be signed. The second one<code>minisign -S -l -m message -x message.sig
</code>
creates a signature. Copy the text from message.sig file and paste it into the form. Press "Submit".
Now, back up your social graph. Go to "Settings" and scroll down to the "Export" section. Download both follows and followers lists.
**Metamask**
#Metamask is a browser extension and a cryptocurrency wallet. It leaks the hash of your public key to third parties, has non-free license and has other shortcomings.
However, it is much easier to use than Minisign. If you have it installed, just go to your profile page, open dropdown menu and select "Link ethereum address". Follow the instructions and approve the signature request. Done!
**Migration**
If you need to migrate your connections, repeat the linking procedure with your new account. Then go to "Settings", find the "Experiments" section with "Import follows" and "Move followers" buttons, and upload your previously backed up lists. That's all.
In the future more identity verification methods will be added. For example, a client may generate a private key for you, and let you back it up as a passphrase. This is less secure, because you have to trust the server admin to not steal your private key, but it is much easier than using Minisign. Arguably, the tradeoff is acceptable.