洪 民憙 (Hong Minhee)

@ntek 現在、latestタグが0.9.14を指しているのですが、確認してもらえますか？

Hollo security updates: 0.8.11 and 0.9.14

If you run Hollo, update to a current patched release now. Fedify has disclosed two vulnerabilities, one of which affects Hollo: CVE-2026-77632, a high-severity server-side request forgery vulnerability in Fedify's authenticated document loader.

Hollo relies on the authenticated document loader when it fetches remote documents such as actors and public keys with a signed HTTP request. Affected Fedify versions checked that the initial URL resolved to a public network destination, but did not apply the same check when that URL returned an HTTP redirect. An attacker who controlled the public URL could therefore redirect the signed request to a loopback address, a link-local cloud metadata service, or an RFC 1918 private address.

An unauthenticated attacker could reach this path by sending an inbox request with a signature whose keyId points to an attacker-controlled public URL. Fedify has to fetch the key before it can verify the signature, so even a bogus signature is enough to trigger the request. The demonstrated attack is blind SSRF: the internal response is consumed while resolving the remote document and is not automatically returned to the attacker.

The fix validates every redirect target before fetching it. Hollo's existing ALLOW_PRIVATE_ADDRESS option still permits private destinations when an operator explicitly opts in, such as for a closed federation or test environment.

The other disclosed vulnerability, CVE-2026-69132, concerns unbounded circuit-breaker state in Fedify 2.3.0 through 2.3.4. Hollo's supported 0.8.x and 0.9.x release lines use Fedify 2.1.x and 2.2.x respectively, so this issue does not affect them.

For full technical details, see the Fedify security advisories for CVE-2026-77632 and CVE-2026-69132, and the Fedify security announcement.

All Hollo versions in the supported 0.8.x and 0.9.x release lines up to and including 0.8.9 and 0.9.12 are affected by CVE-2026-77632. The fix first appeared in 0.8.10 for the 0.8.x series and 0.9.13 for the 0.9.x series. The current releases are 0.8.11 and 0.9.14, and those are the versions we recommend installing.

Hollo 0.7.x is also affected. It and earlier release lines are no longer supported under the Hollo security policy. Upgrade to a supported release series rather than remaining on an older version.

For 0.8.x deployments, update to 0.8.11:

docker pull ghcr.io/fedify-dev/hollo:0.8.11

For 0.9.x deployments, update to 0.9.14:

docker pull ghcr.io/fedify-dev/hollo:0.9.14

After pulling the new image, restart your Hollo container. If you deploy from source, pull the corresponding release tag and restart.

Thanks to Jace for reporting CVE-2026-77632 and to @nyanrus for reporting CVE-2026-69132, and for their responsible disclosure to the Fedify project.

If anything is unclear, ask below.

If you use BotKit, update to a patched release now. Two vulnerabilities affect Fedify versions included by BotKit as a dependency: CVE-2026-77632, a high-severity server-side request forgery vulnerability in the authenticated document loader, and CVE-2026-69132, a medium-severity denial-of-service vulnerability in the outbound delivery circuit breaker.

CVE-2026-77632 affects the authenticated document loader Fedify uses to fetch remote documents such as actors and public keys with signed HTTP requests. Affected versions checked that the initial URL was public, but did not apply the same check when the URL returned an HTTP redirect. An attacker who controlled the public URL could redirect the signed request to a loopback address, a link-local cloud metadata service, or an RFC 1918 host. In the ordinary inbox path, Fedify may fetch a signature's keyId before it can verify the signature, so a bogus signature is enough to reach this path. The demonstrated attack is blind SSRF: the internal response is consumed while resolving the remote document and is not automatically returned to the attacker.

The fix validates every redirect target before it is fetched. The existing allowPrivateAddress option continues to permit private destinations when an application explicitly opts in, such as for a closed federation or test environment.

CVE-2026-69132 affects the outbound delivery circuit breaker introduced in Fedify 2.3, which records delivery failures in the configured key–value store using the remote inbox's host:port as part of the key. An attacker could send signed Follow activities from actors whose inbox URLs pointed to distinct ports where delivery would fail. Each failure created a separate record, allowing the attacker to grow circuit-breaker state until storage or memory was exhausted. Fedify 2.3.0 and 2.3.1 were vulnerable with every circuit-breaker configuration. In versions 2.3.2 through 2.3.4, the vulnerable configuration was a custom failure policy without an explicit stateTtl.

The fix gives custom failure policies a bounded default stateTtl, equal to recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values). On stores that support compare-and-set operations, Fedify also sweeps circuit-breaker state left by affected releases and stamps it with a TTL.

BotKit 0.4.x versions through 0.4.5 and BotKit 0.5.x versions through 0.5.1 include a Fedify version affected by CVE-2026-77632. The circuit-breaker issue, CVE-2026-69132, affects only the BotKit 0.5.x line. Patched releases are BotKit 0.4.6 and 0.5.2. BotKit 0.4.6 uses Fedify 2.1.21, and BotKit 0.5.2 uses Fedify 2.3.5.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.6
yarn upgrade @fedify/botkit@0.4.6
pnpm update  @fedify/botkit@0.4.6
bun  update  @fedify/botkit@0.4.6
deno update  @fedify/botkit@0.4.6

After updating, redeploy. The GitHub Security Advisories are GHSA-cxc3-7q96-6cpx and GHSA-fx98-wc5v-jrg5. See also Fedify's own announcement.

Thanks to Jace and @nyanrus for the reports and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

If you use an affected Fedify release, update now. Two vulnerabilities have been fixed in @fedify/fedify: CVE-2026-77632, a high-severity server-side request forgery vulnerability in the authenticated document loader, and CVE-2026-69132, a medium-severity denial-of-service vulnerability in the outbound delivery circuit breaker.

CVE-2026-77632 affects versions 1.6.1 through 2.3.4. Fedify uses an authenticated document loader when it fetches remote documents such as actors and public keys with a signed HTTP request. Affected versions checked that the initial URL was public, but did not apply the same check when that URL returned an HTTP redirect. An attacker who controlled the public URL could redirect the signed request to a loopback address, a link-local metadata service, or an RFC 1918 host. In the ordinary inbox path, Fedify may fetch a signature's keyId before it can verify the signature, so a bogus signature is enough to reach this path. The demonstrated attack is blind SSRF: the internal response is consumed while resolving the remote document and is not automatically returned to the attacker.

The fix validates every redirect target before it is fetched. The existing allowPrivateAddress option still permits private destinations when an application explicitly opts in, such as for a closed federation or test environment.

CVE-2026-69132 affects versions 2.3.0 through 2.3.4. Fedify 2.3 introduced an outbound delivery circuit breaker that records failures in the configured key–value store, using the remote inbox's host:port as part of the key. An attacker could send signed Follow activities from actors whose inbox URLs pointed to distinct ports where delivery would fail. Each failure created a separate record, allowing the attacker to grow circuit-breaker state until storage or memory was exhausted. Versions 2.3.0 and 2.3.1 were vulnerable with every circuit-breaker configuration. In versions 2.3.2 through 2.3.4, the vulnerable configuration was a custom failure policy without an explicit stateTtl.

The fix gives custom failure policies a bounded default stateTtl, equal to recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values). On stores that support compare-and-set operations, Fedify also sweeps circuit-breaker state left by affected releases and stamps it with a TTL. Applications that need a different retention period for a custom failure policy can continue to set stateTtl explicitly.

The SSRF fix first appeared in 2.0.25, 2.1.21, 2.2.10, and 2.3.5; the circuit-breaker fix first appeared in 2.3.5. The current releases on those lines are 2.0.26, 2.1.22, 2.2.11, and 2.3.6, and those are the versions we recommend installing. The circuit-breaker issue only affects the 2.3 line; the authenticated document-loader issue affects every Fedify release from 1.6.1 through 2.3.4. If you still use Fedify 1.x, change your dependency to a current 2.x release because package-manager update commands do not cross the declared major-version range.

The GitHub Security Advisories are GHSA-cxc3-7q96-6cpx and GHSA-fx98-wc5v-jrg5.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to Jace and @nyanrus for the reports and responsible disclosure.

If anything is unclear, ask below.

@hboon Unless there's a specific reason not to, I tend to write my prompts in my native language, Korean. Within the Korean developer community, there's some talk that writing prompts in English is more token-efficient, but I don't think that's been proven. Even if it were true, I keep using Korean because I feel it's better for conveying subtle nuances and giving detailed instructions compared to writing in English.

@2chanhaeng 😡

@2chanhaeng 쒸익쒸익

方今(방금) LLM이 「표식」이라는 表現(표현)을 쓰길래 생각나서 썼다.

이제는 사람들이 漢字語(한자어) 【標識(표지)】를 한글로 「표지」가 아니라 「표식」이라고 적는 것을 그러려니 하고 받아들여야만 하는데… 아직도 너무나 거슬리는 것이다. 【標識板(표지판)】은 「표식판」이라고 안 읽을 거면서!

https://www.joongang.co.kr/article/14879259

@jj1bdx.tokyo Thanks!

@heybran Don't you have any photos that someone else took of you instead of selfies? Selfies are fine, but I think photos taken by others look more natural and better!

My previous avatar was pretty outdated, so I updated it with a more recent photo.

OTel Isn't Going Well (And I Made A Spreadsheet About It) https://lobste.rs/s/ubeyqf #distributed
https://matduggan.com/otel-isnt-going-well-and-i-made-a-spreadsheet-about-it/

どんなテーマで発表のCFPを出せばよいか分からなかったので、LogTapeに関する発表と、いま鋭意開発中のJavaScript AOTコンパイラに関する発表の、計2本のCFPを提出した。

11月末に開催されるJSConf JP 2026に登壇のCFPを出そうか悩んでいる。

Hollo에는 (나 혼자 쓰려고 文書化(문서화) 없이 具顯(구현)해 놓았던) 韓國語(한국어) 포스팅 內(내)의 漢字語(한자어)에 <ruby> 태그로 한글 讀音(독음)을 自動(자동)으로 붙여주는 Seonbi 聯動(연동) 機能(기능)이 있었는데, Seonbi 백엔드를 Gukhanmun으로 交替(교체)했다. Seonbi는 Haskell로 만들었기 때문에 JavaScript 바인딩이 쉽지 않아 그냥 HTTP API 서버를 띄워서 RPC로 聯動(연동)하고 있었지만, Gukhanmun은 Rust로 만들었기 때문에 WebAssembly/Node-API를 通(통)한 JavaScript 바인딩이 쉬워서 굳이 別途(별도)의 프로세스를 따로 維持(유지)할 必要(필요)가 없어졌다.

아직 릴리스한 건 아니고, main 브랜치에 들어갔으니 다음 마이너 릴리스에 包含(포함)될 豫定(예정).

@sabrinkmann We always appreciate your contributions to Fedify!

I'm so happy about my third open PR to @fedify !
It's amazing to see that every time the repository grows, it becomes easier to contribute to the project. For example the pre-commit hook!

東(동)아시아의 三人稱(삼인칭) 代名詞(대명사) 【그女(그녀)】【彼女(피녀)】【她】에 對(대)해서는 다음의 글을 일어보실 것을 勸(권)합니다: 〈「그女(그녀)」는 名譽(명예)롭게 隱退(은퇴)할 資格(자격)이 있다〉.

요즘 SNS에서 바이럴 타는 게시물들 중 상당수가 '이 사람이나 단체는 욕 먹을 만 하니 같이 욕해달라'는 의도를 담고 있다고 느껴진다. 공적인 의도가 있는 게 아니고 사소한 실수도 그저 조회수 늘리려고 조롱하는데 이게 지탄받던 렉카 유튜버들과 다른 게 뭔지 잘 모르겠다. 알 필요 없었던 타인의 치부를 알고 작성자의 의도대로 혐오감을 느끼는 것이 매일같은 일상이 된다는 점에서 사회적으로 더 유해하다고도 느낀다. 스레드든 쇼츠든 뭐든 거대한 렉카 플랫폼처럼 느껴지는 요즘이다.

#Tuba 0.11.0 is now available, with many new features and bug fixes!

✨️ Highlights:
- Tuba moved to Codeberg!
- Full Mastodon quotes support
- Collections
- Hashtag Lists
- UnifiedPush
- Android builds
- Better custom emoji picker
- Improved media viewer
- More compact narrow layout
- Custom thumbnail support for media
- Font-size slider
- Prominent notes
🧵

As usual, the release notes go into more detail, but this time they are even more informative, check them out: https://codeberg.org/GeopJr/Tuba/releases/tag/v0.11.0

@jdlh @z9mb1 Haha, as far as I know, Mastodon doesn't support rich formatting like inline links. I'm using Hollo, an ActivityPub software I built myself, instead of Mastodon, which is why I was able to use Markdown.

@evan

Does Fedify send and receive RFC 9421 signatures for GET and POST requests?

Yes.

Which of the rest of these server software packages depend on Fedify, so we can switch them over too?

Yes.

Can you submit a PR with the corrected values?

Sure, I will open a pull request soon!

Fun first day at #PyConKorea, meeting the local community and especially hearing how they're not only building but sustaining communities:

🐍 @dongheena building a #Python language support team, starting informally to encourage participation

🐍Luna building PyLadies Seoul through asking for help and learning to teach

🐍 Jiwoo Oh, Jiyoung Hwang & Juyeong Lee jumped right into a big open-source project and learned early the importance of collaboration

#PyConKorea #PyConKorea2026 #MakeItHappy

파이콘 한국 2026에 오신 분들은 신공학관 6층 6144호실에 오셔서 Hackers' Pub 부스도 들러주세요! 홍민희 님(@hongminhee)과 이찬행 님(@2chanhaeng)이 반겨드립니다.

@jdlh @z9mb1 Great to hear you're enjoying Seoul, and yes, the weather's been kinder than usual this year.

If you have time, Jongmyo Shrine is worth the detour. Most visitors stop at Gyeongbokgung and never make it there, but the empty scale of the main shrine courtyard and the walk through the oak forest leave a stronger impression on a lot of people than the palace does. It's a UNESCO World Heritage site too, so not exactly a secret, just overlooked.

For a neighborhood to wander, try Seochon instead of the more famous Bukchon. Fewer tour groups, and the back alleys still feel lived-in rather than staged for photos.

And if you don't mind cold noodles, Woo Lae Oak does some of the best naengmyeon in the city, a restaurant with real history behind it. Go right when it opens or just after the afternoon break, since the line gets long this time of year.

I updated my proof of concept for #fep_0837 with Fedify. In the POC, you can now also use the FEP logic to purchase a certain quantity of a single item. You can test it out here: https://marketplace.playground.54gradsoftware.de/ This basically completes the POC 🎉
The next goal is to implement this logic in a real beta version of the software, which, from an ActivityPub perspective, is the same, but includes real user sign-ups. This will result in a very very simple working shop system and a marketplace aggregating different shops, with the possibility of users buying certain products directly from the marketplace.
#fedidevs #fedify #buildinPublic

오오누키 타에코 작년 라이브 음반 듣는데 재밌네... 초반엔 탱고나 보사노바 가까운 곡들이 나왔는데 뒤쪽엔 과거 느낌 그대로의 밝은 시티팝이랑 테크노팝도 있고.

망고 氷水(빙수)가 너무 먹고 싶어서 雪氷(설빙)에서 시켰다…

IRC has emoji reactions now?? And typing indicators and quote replies and scrollback without a bouncer?! Omg