Release v3.13.0 of Ktistec ("love who you choose to love") links the feed deck into the navigation. Feeds are now fully supported.

Feeds are custom collections of posts selected by hashtag, mention, and keyword, each grouped as terms you want any of, all of, or none of, so a feed can be as broad or as narrow as you like. The feed deck is my primary reading interface now.

The rest of the changes mostly address a variety of small federation issues:

Added

• Link the feed deck from the secondary nav bar.
• Offer a retry and a link when a quoted post can't be loaded.

Fixed

• Keep the verify button when a quote authorization can't be fetched.
• Verify HTTP signatures over the full set of headers the headers signature parameter names.
• Sign an inbox delivery's fetches with the implicated account.
• Render directly published media objects as attachments.
• Handle more attachment media types when rendering.

Changed

• Finish the feeds API.
• Widen the metrics charts display.

With feeds shipped, I'm turning my attention back to federation. There are still a ton of small issues (e.g. Likes relayed through Groups are always rejected, RFC 9421 support, blurhash support) that I'd like to squash.

#ktistec #crystallang #activitypub #fediverse

every so often i crank inbox logging up as loud as it will go and then spend the next two weeks fixing federation bugs. this is apparently the start of those two weeks.

fixing issues with http signatures now...

#ktistec #activitypub #fediverse

Release v3.12.1 patches a bug that's been present for about two years and fixes issue #163 in the process. Looking at FediDB, it appears most servers on v3.X.X made it through the upgrade to v3.5.0, which is where the bug would have bitten, but the consequences of the bug are annoying enough that a patch is warranted.

Changed

• Gather query planner statistics on startup and before reconciling materialized views.

Up-to-date query statistics ensure that the expensive migration in v3.5.0 completes in seconds or minutes, instead of hours!

#ktistec #crystallang #activitypub #fediverse

This release encompasses two broad sets of changes: widening the pool of candidates for feeds and more carefully checking the origin of inbound activities (broadly FEP-fe34, Origin-based security model).

Candidates for feeds were originally limited to posts in the actor's mailboxes. This decision made authorization easy but omitted clearly acceptable posts (for example, posts addressed to the public collection) that arrived via other means (for example, filling in a thread).

Prior to this release, inbox processing did not consistently define an object's origin nor did it apply consistent rules to what it admitted based on the origin.

FEP-fe34 is still not fully enforced, and truth be told, I'm still reviewing some of its mandates, so I'm not yet listing it in Ktistec's federation documentation.

Here's the full list of changes:

Added

• Notify a deck pane when it has new posts.

Fixed

• Retry an unresolved quote authorization.
• Label a draft with the status of its quote request.
• Compare origins when deciding whether to trust an IRI, key document, or owner.
• Ignore a trailing slash when matching a dereferenced document's IRI.
• Allow only Create and Update to update objects.
• Ignore an inbound vote that fails the FEP-9967 checks.
• Expand commonly omitted ActivityStreams context terms.
• Break a long link rather than let it overflow.

Changed

• Widen the feed scan to every object the server holds.
• Address a published feed by slug rather than by id.

Removed

• The proxyUrl property from the actor document.

I am still working hard on the feed deck. Both notifications and feed ordering now work. It's now my preferred reading interface, and should be ready by the next release!

#ktistec #crystallang #activitypub #fediverse