This release encompasses two broad sets of changes: widening the pool of candidates for feeds and more carefully checking the origin of inbound activities (broadly FEP-fe34, Origin-based security model).

Candidates for feeds were originally limited to posts in the actor's mailboxes. This decision made authorization easy but omitted clearly acceptable posts (for example, posts addressed to the public collection) that arrived via other means (for example, filling in a thread).

Prior to this release, inbox processing did not consistently define an object's origin nor did it apply consistent rules to what it admitted based on the origin.

FEP-fe34 is still not fully enforced, and truth be told, I'm still reviewing some of its mandates, so I'm not yet listing it in Ktistec's federation documentation.

Here's the full list of changes:

Added

• Notify a deck pane when it has new posts.

Fixed

• Retry an unresolved quote authorization.
• Label a draft with the status of its quote request.
• Compare origins when deciding whether to trust an IRI, key document, or owner.
• Ignore a trailing slash when matching a dereferenced document's IRI.
• Allow only Create and Update to update objects.
• Ignore an inbound vote that fails the FEP-9967 checks.
• Expand commonly omitted ActivityStreams context terms.
• Break a long link rather than let it overflow.

Changed

• Widen the feed scan to every object the server holds.
• Address a published feed by slug rather than by id.

Removed

• The proxyUrl property from the actor document.

I am still working hard on the feed deck. Both notifications and feed ordering now work. It's now my preferred reading interface, and should be ready by the next release!

#ktistec #crystallang #activitypub #fediverse