Nostr notes by Hollo :hollo:

### Hollo security updates: 0.8.17 and 0.9.25 If you run Hollo, ...

2026-10-26T23:51:49Z

### Hollo security updates: 0.8.17 and 0.9.25

If you run Hollo, update to [0.8.17] or [0.9.25] now. These releases fix [GHSA-r48c-xx2h-fv4g], a DNS rebinding vulnerability in Fedify that could bypass Hollo's server-side request forgery (SSRF) protection and cause requests to reach internal services.

Fedify checked that a hostname resolved only to public addresses, then let the HTTP client resolve it again when connecting. An attacker controlling the hostname's DNS answers could return a public address for validation and a private or loopback address for the connection. Redirects and alternate-document links had the same gap.

The affected Fedify paths used by Hollo include remote document loading (authenticated or not), outbound activity delivery, and WebFinger lookups. On Node.js, which Hollo uses, the fix restricts connections to addresses that passed validation. Hollo's `ALLOW_PRIVATE_ADDRESS=true` option still permits private destinations; leave it unset for public federation. For full technical details, see the [Fedify security announcement] and the advisory linked above.

All releases on the supported Hollo 0.8.x and 0.9.x lines up to and including 0.8.16 and 0.9.24 are affected. [0.8.17] and [0.9.25] are the first fixed releases and the latest on those lines, incorporating Fedify 2.1.31 and 2.2.20 respectively. Hollo 0.7.x and earlier are no longer supported under the [Hollo security policy]; operators on those lines should move to a supported release.

For 0.8.x deployments, update to [0.8.17]:

~~~~ bash
docker pull ghcr.io/fedify-dev/hollo:0.8.17
~~~~

For 0.9.x deployments, update to [0.9.25]:

~~~~ bash
docker pull ghcr.io/fedify-dev/hollo:0.9.25
~~~~

After pulling the image, recreate your Hollo container using the new image. With Docker Compose, update the image tag in your Compose file and run `docker compose up -d`. For source deployments, check out the corresponding release tag, run `pnpm install --frozen-lockfile` using the pnpm version pinned in that tag's *package.json*, run `pnpm run build`, and restart the server.

If you have a large 0.9.x database and are upgrading from a release before 0.9.20, follow the [0.9.20 index preparation instructions] before starting the new version to avoid blocking writes during the new version's automatic migration.

Thanks to 파차 / finalchild (npub1g29…4nce) for reporting the DNS rebinding issue to the Fedify project.

If anything is unclear, ask below.

[0.8.17]: https://github.com/fedify-dev/hollo/releases/tag/0.8.17
[0.9.25]: https://github.com/fedify-dev/hollo/releases/tag/0.9.25
[GHSA-r48c-xx2h-fv4g]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-r48c-xx2h-fv4g
[Fedify security announcement]: https://github.com/fedify-dev/fedify/discussions/1332
[Hollo security policy]: https://github.com/fedify-dev/hollo/blob/main/SECURITY.md
[0.9.20 index preparation instructions]: https://github.com/fedify-dev/hollo/blob/0.9.25/CHANGES.md#version-0920

### Hollo security updates: 0.8.12 and 0.9.19 If you run Hollo, ...

2026-09-27T10:26:15Z

### Hollo security updates: 0.8.12 and 0.9.19

If you run Hollo, update to a patched release now. Fedify has disclosed three vulnerabilities that affect Hollo: [CVE-2026-96625], a critical actor impersonation vulnerability; [CVE-2026-96623], a high-severity denial-of-service vulnerability in remote document parsing; and [CVE-2026-96624], a medium-severity server-side request forgery vulnerability in outbound activity delivery. Treat the actor impersonation issue as an immediate upgrade: anyone on the internet could have an activity accepted by your Hollo inbox as coming from any actor.

For CVE-2026-96625, Fedify verified the signature on an incoming activity, but trusted the signing key document's own claim about whom the key belonged to. An attacker with an ordinary HTTP server could serve a key document naming any actor as its owner and have activities accepted under that actor's identity. No account on the receiving Hollo instance was required. The same flaw affected signed-key ownership checks used to restrict access to posts, allowing a forged key document to pass those checks under another actor's identity.

The fix resolves the claimed owner's actor document and requires it to link back to the key. It also validates the origin of fetched actor documents. Fedify's built-in key cache automatically stops reading entries whose ownership had not been verified, so Hollo operators do not need to clear that cache manually.

For CVE-2026-96623, Fedify parsed JSON bodies without a byte limit, including inbox bodies and remote documents such as keys, actors, objects, JSON-LD contexts, WebFinger descriptors, and NodeInfo documents. An attacker could exhaust memory and CPU with a large body, including a compressed response that expanded substantially before parsing. An inbound body limit at a reverse proxy did not protect the outbound fetch paths.

The fix limits JSON bodies to 16 MiB after decompression. Oversized inbox requests receive HTTP 413, and remote JSON documents larger than this limit are rejected.

For CVE-2026-96624, outbound activity delivery validated neither the inbox URL advertised by a remote actor nor its redirect destinations. A remote actor could point its inbox at a loopback address, a link-local cloud metadata service, or a private network host, or redirect delivery there. On the RSA delivery path, the redirected request remained a POST carrying the activity body and was re-signed for the internal host.

The fix validates the initial destination and every redirect target before sending a request. This is a separate path from the authenticated document loader fixed in the [previous Hollo security update]. Hollo's existing `ALLOW_PRIVATE_ADDRESS=true` option still permits private destinations, including private inbox URLs and redirect targets. Use it only in test environments or closed federations where you control the remote actors.

For full technical details, see the Fedify security advisories for [CVE-2026-96625], [CVE-2026-96623], and [CVE-2026-96624], and the [Fedify security announcement].

All Hollo versions in the supported 0.8.x and 0.9.x release lines up to and including 0.8.11 and 0.9.18 are affected. Patched releases are [0.8.12] for the 0.8.x series and [0.9.19] for the 0.9.x series, incorporating Fedify 2.1.24 and 2.2.13 respectively.

Hollo 0.7.x is also affected. It and earlier release lines are no longer supported under the [Hollo security policy]. Upgrade to a supported release series rather than remaining on an older version.

For 0.8.x deployments, update to [0.8.12]:

~~~~ bash
docker pull ghcr.io/fedify-dev/hollo:0.8.12
~~~~

For 0.9.x deployments, update to [0.9.19]:

~~~~ bash
docker pull ghcr.io/fedify-dev/hollo:0.9.19
~~~~

After pulling the new image, restart your Hollo container. If you deploy from source, pull the corresponding release tag and restart.

Thanks to [@kaimandalic] and Lee Dogeon (npub15dn…sjrz) for independently reporting the actor impersonation issue, to [@kaimandalic] for reporting the unbounded document parsing issue, and to [@euriconicacio] for reporting the outbound delivery SSRF issue, and to all three for their responsible disclosure to the Fedify project.

If anything is unclear, ask below.

[CVE-2026-96625]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-q9f8-5hc7-898f
[CVE-2026-96623]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-mc44-6cfg-2v6w
[CVE-2026-96624]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-f59r-8gcj-68f2
[previous Hollo security update]: https://github.com/fedify-dev/hollo/discussions/594
[Fedify security announcement]: https://github.com/fedify-dev/fedify/discussions/1075
[0.8.12]: https://github.com/fedify-dev/hollo/releases/tag/0.8.12
[0.9.19]: https://github.com/fedify-dev/hollo/releases/tag/0.9.19
[Hollo security policy]: https://github.com/fedify-dev/hollo/blob/main/SECURITY.md
[@kaimandalic]: https://github.com/kaimandalic
[@euriconicacio]: https://github.com/euriconicacio

We're excited to announce Hollo 0.6.0, a significant release ...

2025-06-05T07:54:21Z

We're excited to announce Hollo 0.6.0, a significant release that brings enhanced security, better user experience, and important infrastructure improvements to your single-user microblogging setup.

## Enhanced OAuth Security with Modern Standards

This release prioritizes security with comprehensive OAuth 2.0 improvements that align with current best practices. We've implemented several critical RFC standards that significantly strengthen the authorization process:

**OAuth 2.0 Authorization Code Flow with Access Grants** — We've overhauled the OAuth implementation to properly separate authorization codes from access token issuance, providing better security isolation throughout the authentication process.

**RFC 7636 PKCE (Proof Key for Code Exchange) Support** — Hollo now supports [PKCE](https://tools.ietf.org/html/rfc7636) with the S256 code challenge method, which prevents authorization code interception attacks. This is particularly important for public clients and follows the latest OAuth 2.0 security recommendations outlined in [RFC 9700](https://tools.ietf.org/html/rfc9700) (OAuth 2.0 Security Current Best Practices).

**RFC 8414 OAuth Authorization Server Metadata** — We've added support for [OAuth Authorization Server metadata](https://tools.ietf.org/html/rfc8414) endpoints, allowing clients to automatically discover Hollo's OAuth capabilities and configuration. This makes integration smoother and helps clients adapt to your server's specific OAuth setup.

**Enhanced Profile Scope Support** — The new `/oauth/userinfo` endpoint and expanded profile scope support provide applications with standardized ways to access user profile information, improving compatibility with a wider range of OAuth-compliant applications.

These OAuth improvements not only make Hollo more secure but also position it at the forefront of federated social media security standards. We encourage other fediverse projects to adopt these same standards to ensure the entire ecosystem benefits from these security enhancements.

Special thanks to Emelia Smith (@thisismissem@hachyderm.io) for spearheading these critical OAuth security improvements and ensuring Hollo stays ahead of the curve on authentication best practices.

## Revamped Media Storage Configuration

We've significantly improved how Hollo handles media storage configuration, making it more flexible and future-ready:

**New Environment Variables** — The storage system now uses `STORAGE_URL_BASE` (replacing the deprecated `ASSET_URL_BASE`) and `FS_STORAGE_PATH` for local filesystem storage (replacing `FS_ASSET_PATH`). These changes provide clearer naming and better organization.

**Improved Security Requirements** — The `SECRET_KEY` environment variable now requires a minimum of 44 characters, ensuring sufficient entropy for cryptographic operations. You'll need to update your configuration if your current secret key is shorter.

**Network Binding Control** — The new `BIND` environment variable lets you specify exactly which network interface Hollo should listen on, giving you more control over your server's network configuration.

Thanks to Emelia Smith (@thisismissem@hachyderm.io) for leading these infrastructure improvements.

## Better User Experience

**Customizable Profile Themes** — You can now personalize your profile page with different theme colors. Choose from the full range of [Pico CSS color options](https://picocss.com/docs/colors) to make your profile uniquely yours.

**Enhanced Administration Dashboard** — The dashboard now displays the current Hollo version at the bottom, making it easier to track which version you're running. You can also sign out directly from the dashboard for better session management.

**Improved Post Presentation** — Shared posts on profile pages now have better visual separation from original content, and the sharing timestamp is clearly displayed. This makes it much easier to distinguish between your original thoughts and content you've shared from others.

**Better Image Accessibility** — Alt text for images is now displayed within expandable details sections, improving accessibility while keeping the interface clean.

**Syntax Highlighting** — Code blocks in Markdown posts now feature beautiful syntax highlighting powered by [Shiki](https://shiki.style/), supporting a [comprehensive range of programming languages](https://shiki.style/languages). This makes technical discussions much more readable.

**Enhanced Character Limit** — The maximum post length has been increased from 4,096 to 10,000 characters, giving you more space to express your thoughts in detail.

Thanks to RangHo Lee (@rangho_220@rangho.moe) for the version display feature and Okuto Oyama (yamanoku (npub1tal…6phe)) for the image accessibility improvements.

## Privacy and Content Improvements

**EXIF Metadata Removal** — Hollo now automatically strips EXIF metadata from uploaded images before storing them, protecting your privacy by removing potentially sensitive location and device information.

**Public API Endpoints** — Following Mastodon's approach, certain API endpoints are now publicly accessible without authentication, making Hollo more compatible with various client applications and improving the overall federation experience.

Thanks to NTSK (@ntek@hl.oyasumi.dev) for the privacy-focused EXIF metadata stripping implementation.

## Technical Foundation

**Node.js 24+ Requirement** — This release requires Node.js 24.0.0 or later. We've also upgraded to Fedify 1.5.3 and @fedify/postgres 0.3.0 for improved performance and compatibility.

**Test Coverage & Quality Assurance** — The codebase now includes comprehensive testing infrastructure and test coverage. We're committed to expanding this coverage and integrating testing more deeply into our development and release workflows. This also provides an excellent opportunity for first-time contributors to get involved by writing tests.

**Cross-Origin Request Support** — OAuth and well-known endpoints now properly support cross-origin requests, aligning with Mastodon's behavior and improving client compatibility.

**Cleaner Token Endpoint** — The scope parameter is now properly optional for the OAuth token endpoint, clarifying that it only affects client credentials flows (not authorization code flows, where it was already ignored).

## Looking Forward

This release represents a major step forward in making Hollo not just a great single-user microblogging platform, but also a leader in federated social media security standards. The OAuth improvements we've implemented should serve as a model for other fediverse projects.

We're particularly excited about the OAuth security enhancements, which demonstrate our commitment to staying ahead of security best practices. As the federated web continues to evolve, we believe these standards will become increasingly important for maintaining user trust and ensuring secure interactions across the fediverse.

## Upgrading

Upgrading to Hollo 0.6.0 is straightforward, but there are a few important considerations:

### Railway Deployment
1. Go to your Railway dashboard
2. Select your Hollo project and service
3. In the deployments tab, click the three-dot menu and select *Redeploy*

### Docker Deployment
1. Pull the latest image: `docker pull ghcr.io/fedify-dev/hollo:latest`
2. Stop your current container
3. Start with the new image using your existing configuration

### Manual Installation
1. Pull the latest code: `git pull`
2. Install dependencies: `pnpm install`
3. Restart the service: `pnpm run prod`

### Important Upgrade Notes

**Environment Variables**: Update your configuration if you're using deprecated variables:
- Replace `ASSET_URL_BASE` with `STORAGE_URL_BASE`
- Replace `FS_ASSET_PATH` with `FS_STORAGE_PATH`
- Ensure your `SECRET_KEY` is at least 44 characters long

**Session Reset**: Due to the OAuth security improvements, existing user sessions may be invalidated during the upgrade. You'll likely need to log in again through your client apps (like Phanpy, Moshidon, etc.) after upgrading. This is a one-time inconvenience that ensures you benefit from the enhanced security features.

Thank you to everyone who contributed to this release, and to the community for your continued support. Hollo 0.6.0 brings significant improvements to security, usability, and the overall experience of running your own corner of the fediverse.

#Hollo everyone! :hollo: We'd like to hear your thoughts on ...

2025-02-14T07:02:30Z

#Hollo everyone! :hollo:

We'd like to hear your thoughts on something we've been considering.

As you know, Hollo has always been focused on self-hosting—this won't change, and our source code will continue to be available under the AGPLv3 license.

We're exploring ways to make the project more sustainable, and we're considering offering a hosting service for those who regularly support us with a certain amount through @opencollective@opencollective.com.

This would be an additional option for those who want to use Hollo without managing the technical aspects themselves. Of course, you'll still be able to self-host just like you do now.

What are your thoughts on this idea? Please vote below! 📊

💭 Have additional thoughts or suggestions? Feel free to share them in the comments!

#poll #fediverse