洪 民憙 (Hong Minhee)

The pull request is merged now: https://w3id.org/fep/f799.

Okay, now it's merged!

https://w3id.org/fep/f799

The Web Can't Afford a JavaScript Runtime Monoculture via @hongminhee https://lobste.rs/s/x6n380 #javascript
https://redmonk.com/kholterhoff/2026/10/27/js-runtime-monoculture/

Following my previous proposal, FEP-22cd: Attributing translations, I've now drafted a proposal for FEP-f799: Coordinated Inbox Delivery Suspension. @nyanrus also helped out this time! The PR hasn't been merged yet, but you can read it here in the meantime.

@jackalope_tracks 알려주신 링크가 https://jpendleton.substack.com/about 쪽으로 리다이렉트되는 것 같은데, 이 링크가 맞나요? 아티클(article)이 아니라 作家(작가) 紹介(소개) 페이지 같아서요!

AI ban should not be an excuse to exclude minorities, as I heard some communities started banning non English speakers who use machine translation

이 짤이 벌써 10年(년)도 넘었구나. 좋아하는 블랙 조크지만 韓國語(한국어) 話者(화자)가 아니면 웃긴 포인트들을 제대로 알아채기 힘들 듯…? 😂 프로필 寫眞(사진)과 닉네임이 伊藤博文(이토 히로부미)인 點(점)(게다가 日本語(일본어) 읽기가 아니라 韓國語(한국어) 漢字音(한자음) 읽기인 「이등박문」)이나, 朴正熙(박정희)를 굳이 그의 創氏改名(창씨개명)한 日(일)本姓(본성)인 「高木(고목)」로 부른 點(점)이나, 「內地(내지)」라는 表現(표현)이 韓國語(한국어)에서 갖는 뉘앙스라든가…

參考(참고)로, 伊藤博文(이토 히로부미)와 朴正熙(박정희) 둘 다 射殺(사살)된 날이 10月(월) 26日(일)로 같다. (伊藤博文(이토 히로부미)은 1909年(년) 10月(월) 26日(일), 朴正熙(박정희)는 1979年(년) 10月(월) 26日(일).)

Hollo security updates: 0.8.17 and 0.9.25

If you run Hollo, update to 0.8.17 or 0.9.25 now. These releases fix GHSA-r48c-xx2h-fv4g, a DNS rebinding vulnerability in Fedify that could bypass Hollo's server-side request forgery (SSRF) protection and cause requests to reach internal services.

Fedify checked that a hostname resolved only to public addresses, then let the HTTP client resolve it again when connecting. An attacker controlling the hostname's DNS answers could return a public address for validation and a private or loopback address for the connection. Redirects and alternate-document links had the same gap.

The affected Fedify paths used by Hollo include remote document loading (authenticated or not), outbound activity delivery, and WebFinger lookups. On Node.js, which Hollo uses, the fix restricts connections to addresses that passed validation. Hollo's ALLOW_PRIVATE_ADDRESS=true option still permits private destinations; leave it unset for public federation. For full technical details, see the Fedify security announcement and the advisory linked above.

All releases on the supported Hollo 0.8.x and 0.9.x lines up to and including 0.8.16 and 0.9.24 are affected. 0.8.17 and 0.9.25 are the first fixed releases and the latest on those lines, incorporating Fedify 2.1.31 and 2.2.20 respectively. Hollo 0.7.x and earlier are no longer supported under the Hollo security policy; operators on those lines should move to a supported release.

For 0.8.x deployments, update to 0.8.17:

docker pull ghcr.io/fedify-dev/hollo:0.8.17

For 0.9.x deployments, update to 0.9.25:

docker pull ghcr.io/fedify-dev/hollo:0.9.25

After pulling the image, recreate your Hollo container using the new image. With Docker Compose, update the image tag in your Compose file and run docker compose up -d. For source deployments, check out the corresponding release tag, run pnpm install --frozen-lockfile using the pnpm version pinned in that tag's package.json, run pnpm run build, and restart the server.

If you have a large 0.9.x database and are upgrading from a release before 0.9.20, follow the 0.9.20 index preparation instructions before starting the new version to avoid blocking writes during the new version's automatic migration.

Thanks to @finalchild for reporting the DNS rebinding issue to the Fedify project.

If anything is unclear, ask below.

If you use BotKit, update to a patched release now. GHSA-r48c-xx2h-fv4g is a DNS rebinding vulnerability in Fedify, which BotKit uses for federation. An attacker could bypass its server-side request forgery (SSRF) protection and cause your bot's server to reach internal services. Deno deployments need additional network restrictions; upgrading BotKit alone does not close the vulnerability on Deno.

Fedify checked that a hostname resolved only to public addresses, then let fetch() resolve it again when connecting. An attacker controlling the hostname's DNS answers could return a public address for validation and a private or loopback address for the connection. This affects remote document loading, both anonymous and authenticated, as well as outbound activity delivery, NodeInfo lookups, and WebFinger lookups. Redirects and alternate-document links were subject to the same gap.

On Node.js and Bun, the fix makes connections only to addresses that passed validation. Bun deployments that set HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY, including their lowercase forms, should use Bun 1.4.3 or later. Alternatively, unset those variables for the bot process or configure the proxy to refuse private destinations. Earlier Bun versions can send requests through a proxy that resolves the hostname again. With the fix applied, HTTPS requests to non-default ports fail on Bun versions before 1.3.11 because those versions cannot verify a pinned connection's certificate against the original hostname. See the Bun deployment guidance.

Deno's fetch() cannot pin connections to validated addresses. Use Deno 2.8.1 or later with the documented --deny-net list covering private IPv4 ranges, [::1], and [::], and listen on a Unix domain socket behind a reverse proxy, since the deny list also blocks listening on those IP addresses. Private IPv6 ranges also need network-level restrictions. If that setup is unsuitable, apply equivalent outbound restrictions at the firewall or container network layer. Follow the Deno deployment mitigation for the full deny list and deployment requirements.

BotKit 0.4.x versions through 0.4.10 and BotKit 0.5.x versions through 0.5.7 include affected Fedify versions. The first releases containing the fix, and the current recommended releases, are BotKit 0.4.11 and 0.5.8, which upgrade Fedify to 2.1.31 and 2.3.15, respectively. These are the two supported BotKit lines under the security policy; users on older lines should move to a supported release.

For BotKit 0.5.x, install @fedify/botkit 0.5.8 using the command for your package manager:

npm  install @fedify/botkit@0.5.8
yarn add     @fedify/botkit@0.5.8
pnpm add     @fedify/botkit@0.5.8
bun  add     @fedify/botkit@0.5.8
deno add     jsr:@fedify/botkit@0.5.8

For BotKit 0.4.x, install @fedify/botkit 0.4.11:

npm  install @fedify/botkit@0.4.11
yarn add     @fedify/botkit@0.4.11
pnpm add     @fedify/botkit@0.4.11
bun  add     @fedify/botkit@0.4.11
deno add     jsr:@fedify/botkit@0.4.11

Check the installed or locked versions: @fedify/botkit should be 0.4.11 or 0.5.8. The affected Fedify packages, @fedify/fedify, @fedify/vocab-runtime, and @fedify/webfinger, should resolve to at least 2.1.31 on the 2.1.x line, 2.2.20 on 2.2.x, 2.3.15 on 2.3.x, or 2.4.5 on 2.4.x. Update any direct dependencies on those packages too. If you use a routine update command instead, check that your declared dependency range allows a patched release and change it explicitly if needed. Apply the runtime mitigations above and redeploy all web and worker processes.

The full GitHub Security Advisory is GHSA-r48c-xx2h-fv4g. See also Fedify's own announcement.

Thanks to @finalchild for reporting the DNS rebinding issue to the Fedify project.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

A security update addressing two vulnerabilities in Fedify has been released. Please update as soon as possible!

https://hackers.pub/@fedify/2026/GHSA-r48c-xx2h-fv4g

If you use an affected Fedify release, update now. Two server-side request forgery vulnerabilities have been addressed: GHSA-r48c-xx2h-fv4g, a DNS rebinding bypass of Fedify's private address checks, and GHSA-cj5r-cw77-6gwp, unvalidated page and favicon requests in fedify nodeinfo. Deno deployments need additional network restrictions; upgrading Fedify alone does not close the DNS rebinding vulnerability.

The patched releases are 2.0.35, 2.1.31, 2.2.20, 2.3.15, and 2.4.5. Update to the corresponding release on your minor line, with the runtime mitigations described below. The affected releases on these lines are 2.0.34 and earlier, 2.1.30 and earlier, 2.2.19 and earlier, 2.3.14 and earlier, and 2.4.4 and earlier. For ongoing support, the security policy covers the latest two minor lines, 2.3 and 2.4. Users on releases before 2.0 should move to a supported release.

DNS rebinding bypasses SSRF protection (GHSA-r48c-xx2h-fv4g, medium, CVSS 5.4)

Fedify checked that a hostname resolved only to public addresses, then let fetch() resolve it again when connecting. An attacker controlling the hostname's DNS answers could return a public address for validation and a private or loopback address for the connection, causing requests to reach internal services. Redirects and alternate-document links were subject to the same gap.

This affects document loading, including authenticated document loading, outbound activity delivery, NodeInfo lookups, and WebFinger lookups in @fedify/fedify, @fedify/vocab-runtime, and @fedify/webfinger. On Node.js and Bun, the fix makes connections only to addresses that passed validation. Calling validatePublicUrl() before an application's own fetch() still does not pin that connection. Setting allowPrivateAddress: true continues to permit private destinations.

On Bun, deployments with HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY set, including their lowercase forms, should upgrade to Bun 1.4.3 or later. Alternatively, unset those variables for the Fedify process or configure the proxy to refuse private destinations. Older Bun versions may send requests through a proxy that resolves the hostname again. On Bun versions before 1.3.11, Fedify now refuses HTTPS requests to non-default ports because those Bun versions cannot verify a pinned connection's certificate against the original hostname. See the Bun deployment guidance.

Deno's fetch() cannot pin connections to validated addresses. Use Deno 2.8.1 or later with the documented --deny-net list and a Unix domain socket behind a reverse proxy, plus network-level restrictions for private IPv6 ranges. If that setup is unsuitable, apply equivalent outbound restrictions at the firewall or container network layer. Follow the Deno deployment mitigation.

Unvalidated page and favicon requests (GHSA-cj5r-cw77-6gwp, low, CVSS 3.1)

An operator running fedify nodeinfo against a malicious instance could cause the CLI to send a GET request to a loopback, link-local, or private address from the operator's machine. The NodeInfo lookup validated destinations, but the subsequent page and favicon requests used plain fetch() with automatic redirects. A malicious favicon URL or page redirect could therefore reach an internal endpoint.

The attacker does not directly receive the response body, but the request can affect an internal endpoint with GET side effects. The fix validates page, favicon, and redirect destinations, skipping the favicon when a destination is private while still showing the NodeInfo document. Upgrade @fedify/cli separately from the library. Until then, --no-favicon or --raw avoids these page and favicon requests. The Bun and Deno caveats above also apply to the CLI.

Updating

Use the command for your package manager to install 2.4.5 explicitly:

npm  install @fedify/fedify@2.4.5
yarn add     @fedify/fedify@2.4.5
pnpm add     @fedify/fedify@2.4.5
bun  add     @fedify/fedify@2.4.5
deno add jsr:@fedify/fedify@2.4.5

If you stay on another minor line, substitute 2.0.35, 2.1.31, 2.2.20, or 2.3.15 as appropriate. Update direct dependencies on @fedify/vocab-runtime and @fedify/webfinger to the same release as well. Check the resolved versions in your lockfile, since an ordinary update command can stay within a vulnerable dependency range or leave a transitive dependency locked. Apply the runtime mitigations above and redeploy all web and worker processes.

For an npm-installed global CLI:

npm install -g @fedify/cli@2.4.5

For other installation methods, reinstall the corresponding patched version using the CLI installation instructions. Check fedify --version before using it against an untrusted instance.

Thanks to @finalchild for reporting the DNS rebinding issue and to Zachariah Mithani for reporting the favicon request issue.

If anything is unclear, ask below.

올해 11月(월) 末(말) 서울에서 開催(개최)되는 @fossforall Conference 2026에서 〈Oseo: SBCL 스타일의 JavaScript/TypeScript AOT 컴파일러〉라는 題目(제목)으로 發表(발표)합니다. Oseo는 JavaScript/TypeScript를 인터프리터나 JIT 없이 미리 네이티브 코드로 컴파일하는 프로젝트로, 動的(동적) 타입 言語(언어)임에도 오래 前(전)부터 AOT 컴파일러가 쓰여 온 SBCL이나 Chez Scheme 같은 Common Lisp 및 Scheme 系譜(계보)에서 靈感(영감)을 얻었습니다. 모든 函數(함수)를 저네릭(generic) 經路(경로)와 가드가 붙은 特殊化(특수화) 經路(경로)로 두 벌 컴파일해 두고, 가드가 失敗(실패)하면 바이너리 안의 저네릭 經路(경로)로 갈라질 뿐 最適化(최적화) 解除(해제)(deoptimization) 같은 건 하지 않는 게 核心(핵심) 아이디어입니다.

아직 未完成(미완성)인 프로젝트라, 實際로(실제로) 돌아가는 모습과 앞으로 남은 길을 함께 보여드릴 豫定(예정)입니다. 寄與(기여)에 關心(관심) 있는 분도 歡迎(환영)합니다.

Really excited to see progress on this effort after many many years of stalled discussion. Thanks to @Edent, @hongminhee, @lnkr, @north and @evan as well for their recent work on this matter, I can now see a fediverse in sight that supports the world's languages fully!

#TIL there's a spec for detecting links in text: "UTS #58: Unicode Link Detection and Formatting: URLs and Email Addresses" https://www.unicode.org/reports/tr58/

#Unicode #UTS58

@dansup Great job! I tested it with my Hollo instance, and it already works well! 👍

https://columnly.social is a Mastodon/Pixelfed column based multi-account client I'm building for myself.

- It's hosted in Canada
- Without Cloudflare enabled
- There is no 3rd party servers, Columnly speaks directly with your server
- It will be licensed under AGPL-3.0 and open sourced later this year.

#Columnly

#Gukhanmun 0.3.0をリリースしました。漢字の異体字認識、後ろに続く助詞による読みの選択、句読点プロファイル、外来語表記用例の同梱が入っています。

沖縄県（新字体）は、辞書にある沖繩縣（康熙字典体）と照合して오키나와현と読みます。--hanja-variant-setは漢字を新字体や康熙字典体で出力し直します。一切は既定で일절ですが、一切를のように後ろに付く助詞によって일체を選びます。--punctuation modernは하나、둘。を하나, 둘.に変えます。国立国語院の『外来語表記用例』を辞書としてko-krプリセットに同梱したので、香港が홍콩と読まれるようになりました。

v0.2.xからアップグレードする場合は、ko-krプリセットの出力が変わり、同梱辞書ファイルが形式v2になるので、バインディングとデータパッケージを一緒に上げてください。

https://github.com/dahlia/gukhanmun/discussions/32

#国漢文 #国漢文混用 #国漢文混用体 #漢字 #異体字 #韓国語 #ハングル

#Gukhanmun 0.3.0 is out with Han character variants, reading selection from following particles, punctuation profiles, and a bundled loanword dictionary.

沖縄県 (shinjitai) now finds 沖繩縣 (Kanxi form) in the dictionary and reads 오키나와현, while --hanja-variant-set re-emits hanja in shinjitai or Kanxi form. 一切 defaults to 일절, but a following particle such as 一切를 selects 일체, and --punctuation modern turns 하나、둘。 into 하나, 둘.. The National Institute of Korean Language's loanword spelling examples are bundled into the ko-kr preset as well, which is why 香港 now reads 홍콩.

Upgrading from v0.2.x changes ko-kr output and moves the bundled dictionaries to format v2, so upgrade the bindings and data packages together.

https://github.com/dahlia/gukhanmun/discussions/32

#hanja #hangul #korean #國漢文 #國漢文混用 #國漢文混用體 #국한문 #국한문혼용 #국한문혼용체

#Gukhanmun 0.3.0이 나왔습니다. #漢字(한자) 異體(이체)字(자) 認識(인식), 助詞(조사)를 利用(이용)한 讀音(독음) 選擇(선택), 句讀(구두) 符號(부호) 프로파일, 內藏(내장) 外來語(외래어) 表記(표기) 用例(용례)가 들어갔습니다.

沖縄県(新(신)字體(자체))은 辭典(사전)에서 沖繩縣(康熙(강희)字典體(자전체))을 찾아 오키나와현으로 읽고, --hanja-variant-set은 漢字(한자)를 新(신)字體(자체)나 康熙(강희)字典體(자전체)로 다시 出力(출력)합니다. 一切은 일절이 基本(기본)이지만 一切를과 같이 뒤에 붙는 助詞(조사)에 따라 일체를 고르며, --punctuation modern은 하나、둘。을 하나, 둘.로 바꿉니다. 또한, 國立(국립)國語(국어)院(원) 《外來語(외래어) 表記(표기) 用例(용례)》를 辭典(사전)으로 묶어 ko-kr 프리셋에 넣었습니다. 德分(덕분)에 香港이 홍콩으로 읽힙니다.

v0.2.x에서 올릴 때는 ko-kr 프리셋의 出力(출력)이 달라지고 內藏(내장) 辭典(사전) 파일이 形式(형식) v2로 바뀌므로, 바인딩과 데이터 패키지를 함께 올리세요.

https://github.com/dahlia/gukhanmun/discussions/32

#國漢文(국한문) #國漢文(국한문)混用(혼용) #國漢文(국한문)混用體(혼용체) #국한문 #국한문혼용 #국한문혼용체

Seoul 1988 Olympic logo :)

https://css-doodle.com/d/hjVbidTo0QkEkxjQ

빵은 그다지 좋아하지 않지만 햄버거는 좋아한다. 그래서 빵 代身(대신) 밥이 들어간 라이스버거를 좋아한다. 모스버거에서 파는 モス(모스)ライス(라이스)バーガー(버거)燒肉(야키니쿠)를 가장 좋아하는데, 아쉽게도 韓國(한국)에서는 안 팔아서 日本(일본)에 갈 때만 가끔 사 먹는다. 韓國(한국)에서는 그 代身(대신) 롯데리아에서 파는 全州(전주) 비빔라이스 버거를 즐겨 먹는다. 오늘도 이걸 먹었다. 이 메뉴는 反對(반대)로 또 日本(일본) ゼッテリア(젯테리아)(日本(일본) 롯데리아는 2023年(년)에 すき家(스키야) 等(등)의 母會社(모회사)인 ゼンショー(젠쇼)ホールディングス(홀딩스)에 賣却(매각)되어, 商號(상호)가 바뀌었다)에서는 안 판다.

https://moreal.github.io/gukhanmun-font/playground/ https://github.com/moreal/gukhanmun-font

@timapple Thanks! Yeah, it's actually a very specific problem for people who still write in mixed-script Korean today like me (which is very rare). 😂

@dansup Thanks!! 🥰

I'm happy and honored that Gukhanmun has been selected as one of the five recipients of FOSS for All Microgrants 2026! Gukhanmun is my Rust/JavaScript library and CLI tool for converting mixed-script Korean text, which combines hangul and hanja, into hangul-only text.

FOSS for All Microgrants is a new program launching this year that collects donations to support open source projects and communities. It also explores fiscal sponsorship by paying expenses on recipients’ behalf, alongside direct grants.

Thank you to @fossforall, the reviewers, and everyone who donated to the program. I'm grateful for your support for Gukhanmun and its continued development.

제가 開發(개발)하는 Gukhanmun이 FOSS for All Microgrants 2026의 受惠(수혜) 組織(조직)으로 選定(선정)되었습니다! Gukhanmun은 國漢文(국한문)混用體(혼용체)로 쓰인 韓國語(한국어) 文書(문서)를 한글 專用(전용)으로 變換(변환)하는 Rust/JavaScript 라이브러리이자 CLI 道具(도구)입니다.

올해 처음 始作(시작)하는 이 事業(사업)의 支援(지원)을 받게 되어 무척 기쁘고 榮光(영광)스럽습니다. @fossforall 및 審査(심사)委員(위원) 여러분, 그리고 寄附(기부)로 함께해 주신 모든 분께 感謝(감사)드립니다. Gukhanmun의 開發(개발)을 繼續(계속)해 나가는 데 큰 힘이 되겠습니다!

https://forum.fossforall.org/t/foss-for-all-microgrants-2026/162

Beginning of the Ende (a community Deno fork) via @hongminhee https://lobste.rs/s/8ejwsp #javascript
https://blog.webb.page/WM-105