A Guide to Implementing ActivityPub in a Static Site (or Any Website) - Part 8 is out!
Follow the site here @blog or check the article here: https://maho.dev/2025/01/a-guide-to-implementing-activitypub-in-a-static-site-or-any-website-part-8/
#fediverse #activitypub #static-sites #hugo #azure #mastodon #web-development #social-web #webfinger #http #azure #azurefunctions
A Guide to Implementing ActivityPub in a Static Site (or Any Website) - Part 8 is out!
Follow the site here @blog or check the article here: https://maho.dev/2025/01/a-guide-to-implementing-activitypub-in-a-static-site-or-any-website-part-8/
#fediverse #activitypub #static-sites #hugo #azure #mastodon #web-development #social-web #webfinger #http #azure #azurefunctions
A Guide to Implementing ActivityPub in a Static Site (or Any Website) - Part 8 is out!
Follow the site here @blog or check the article here: https://maho.dev/2025/01/a-guide-to-implementing-activitypub-in-a-static-site-or-any-website-part-8/
#fediverse #activitypub #static-sites #hugo #azure #mastodon #web-development #social-web #webfinger #http #azure #azurefunctions
A Guide to Implementing ActivityPub in a Static Site (or Any Website) - Part 8 is out!
Follow the site here @blog or check the article here: https://maho.dev/2025/01/a-guide-to-implementing-activitypub-in-a-static-site-or-any-website-part-8/
#fediverse #activitypub #static-sites #hugo #azure #mastodon #web-development #social-web #webfinger #http #azure #azurefunctions
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート（1.0.14、1.1.11、1.2.11、1.3.4）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。
セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました：
本セキュリティアップデートでは、以下の修正が実施されました：
以下のコマンドで最新のセキュアバージョンにアップデートできます：
# npmユーザーの場合
npm update @fedify/fedify
# Denoユーザーの場合
deno add jsr:@fedify/fedify
この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。
本脆弱性の詳細については、セキュリティ勧告をご参照ください。
ご質問やご懸念がございましたら、GitHub Discussions、Matrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート（1.0.14、1.1.11、1.2.11、1.3.4）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。
セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました：
本セキュリティアップデートでは、以下の修正が実施されました：
以下のコマンドで最新のセキュアバージョンにアップデートできます：
# npmユーザーの場合
npm update @fedify/fedify
# Denoユーザーの場合
deno add jsr:@fedify/fedify
この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。
本脆弱性の詳細については、セキュリティ勧告をご参照ください。
ご質問やご懸念がございましたら、GitHub Discussions、Matrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート（1.0.14、1.1.11、1.2.11、1.3.4）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。
セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました：
本セキュリティアップデートでは、以下の修正が実施されました：
以下のコマンドで最新のセキュアバージョンにアップデートできます：
# npmユーザーの場合
npm update @fedify/fedify
# Denoユーザーの場合
deno add jsr:@fedify/fedify
この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。
本脆弱性の詳細については、セキュリティ勧告をご参照ください。
ご質問やご懸念がございましたら、GitHub Discussions、Matrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート（1.0.14、1.1.11、1.2.11、1.3.4）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。
セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました：
本セキュリティアップデートでは、以下の修正が実施されました：
以下のコマンドで最新のセキュアバージョンにアップデートできます：
# npmユーザーの場合
npm update @fedify/fedify
# Denoユーザーの場合
deno add jsr:@fedify/fedify
この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。
本脆弱性の詳細については、セキュリティ勧告をご参照ください。
ご質問やご懸念がございましたら、GitHub Discussions、Matrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート（1.0.14、1.1.11、1.2.11、1.3.4）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。
セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました：
本セキュリティアップデートでは、以下の修正が実施されました：
以下のコマンドで最新のセキュアバージョンにアップデートできます：
# npmユーザーの場合
npm update @fedify/fedify
# Denoユーザーの場合
deno add jsr:@fedify/fedify
この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。
本脆弱性の詳細については、セキュリティ勧告をご参照ください。
ご質問やご懸念がございましたら、GitHub Discussions、Matrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
#Fedify 프레임워크의 #WebFinger 구현에서 발견된 보안 취약점 CVE-2025-23221을 해결하기 위한 보안 업데이트(1.0.14, 1.1.11, 1.2.11, 1.3.4)를 배포했습니다. 모든 사용자께서는 각자 사용 중인 버전에 해당하는 최신 버전으로 즉시 업데이트하시기를 권장합니다.
보안 연구자가 Fedify의 lookupWebFinger() 함수에서 다음과 같은 보안 문제점들을 발견했습니다:
이번 보안 업데이트에는 다음과 같은 수정 사항이 포함되어 있습니다:
다음 명령어로 최신 보안 버전으로 업데이트하실 수 있습니다:
# npm 사용자의 경우
npm update @fedify/fedify
# Deno 사용자의 경우
deno add jsr:@fedify/fedify
이 취약점을 책임감 있게 보고해 주신 보안 연구자께 감사드립니다. 덕분에 신속하게 문제를 해결할 수 있었습니다.
이 취약점에 대한 자세한 내용은 보안 권고문을 참고해 주시기 바랍니다.
문의 사항이나 우려 사항이 있으시다면 GitHub Discussions나 Matrix 채팅방, 또는 Discord 서버를 통해 언제든 연락해 주시기 바랍니다.
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート（1.0.14、1.1.11、1.2.11、1.3.4）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。
セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました：
本セキュリティアップデートでは、以下の修正が実施されました：
以下のコマンドで最新のセキュアバージョンにアップデートできます：
# npmユーザーの場合
npm update @fedify/fedify
# Denoユーザーの場合
deno add jsr:@fedify/fedify
この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。
本脆弱性の詳細については、セキュリティ勧告をご参照ください。
ご質問やご懸念がございましたら、GitHub Discussions、Matrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
#Fedify 프레임워크의 #WebFinger 구현에서 발견된 보안 취약점 CVE-2025-23221을 해결하기 위한 보안 업데이트(1.0.14, 1.1.11, 1.2.11, 1.3.4)를 배포했습니다. 모든 사용자께서는 각자 사용 중인 버전에 해당하는 최신 버전으로 즉시 업데이트하시기를 권장합니다.
보안 연구자가 Fedify의 lookupWebFinger() 함수에서 다음과 같은 보안 문제점들을 발견했습니다:
이번 보안 업데이트에는 다음과 같은 수정 사항이 포함되어 있습니다:
다음 명령어로 최신 보안 버전으로 업데이트하실 수 있습니다:
# npm 사용자의 경우
npm update @fedify/fedify
# Deno 사용자의 경우
deno add jsr:@fedify/fedify
이 취약점을 책임감 있게 보고해 주신 보안 연구자께 감사드립니다. 덕분에 신속하게 문제를 해결할 수 있었습니다.
이 취약점에 대한 자세한 내용은 보안 권고문을 참고해 주시기 바랍니다.
문의 사항이나 우려 사항이 있으시다면 GitHub Discussions나 Matrix 채팅방, 또는 Discord 서버를 통해 언제든 연락해 주시기 바랍니다.
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.
A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:
The security updates implement the following fixes:
To update to the latest secure version:
# For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.
For more details about this vulnerability, please refer to our security advisory.
If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.
Fedify is an #ActivityPub server framework in #TypeScript & #JavaScript. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.
The key features it provides currently are:
If you're curious, take a look at the #Fedify website! There's comprehensive docs, a demo, a tutorial, example code, and more:
@[email protected] · Reply to @reiver ⊼ (Charles) :batman:'s post
6/
Issue №4:
Having to make one HTTP to WebFinger to resolve a Fediverse ID (such as "＠joeblow＠example·com"), and then make another HTTP request to get the activity document ("application/activity+json") — adds an extra HTTP request.
Using a well-known path to resolve the Fediverse ID and get the activity document ("application/activity+json") — in one HTTP request would be better.
...
@[email protected] · Reply to @reiver ⊼ (Charles) :batman:'s post
5/
Issue №3:
If we are going to use Internet domain-names, maybe host-meta could be replaced by a DNS TXT or DNS SRV record — that is used to specify what host to connect to to resolved a Fediverse ID like "＠joeblow＠example·com" to an activity document ("application/activity+json").
...
@[email protected] · Reply to @reiver ⊼ (Charles) :batman:'s post
4/
Issue №2:
host-meta is in XML (where everything else is in JSON).
I am NOT saying I am a fan of JSON, but — I think it would be easier for developers if only JSON xor XML was used (but not both).
(host-meta is used to specify where WebFinger is. It does not necessarily have to be at "/.well-known/webfinger". And doesn't have to be on the same host.)
...
@[email protected] · Reply to @reiver ⊼ (Charles) :batman:'s post
3/
Issue №1:
host-meta is yet another format to write encoders and decoders for.
(host-meta is used to specify where WebFinger is. It does not necessarily have to be at "/.well-known/webfinger". And doesn't have to be on the same host.)
...
@[email protected] · Reply to @reiver ⊼ (Charles) :batman:'s post
2/
Their reason (for wanting to replace WebFinger):
“While useful, Webfinger is not part of the ActivityPub specification”
Why does that matter?
Having said that, (I do think) there some issues with WebFinger that could motivate one to replace it.
But that would mean that — any replacement MUST address these issues.
...
1/
It seems like someone wants everyone on the Fedivese to stop using WebFinger.
https://github.com/mastodon/mastodon/issues/17030
(WebFinger is used to resolve a Fediverse ID like "＠joeblow＠example·com" to an activity document ("application/activity+json").)
...
The Fediverse's usage of rel-self in WebFinger, to point to an ActivityPub Activity file (application/activity+json), seem different than how Atom feeds uses rel-self.
The semantics seem different.
(I am assuming ActivityPub borrowed rel-self from Atom feeds.)
#Debugging #activitypub implementations seems to be quite hard. I've got a pretty simple server set up that for now only serves information for one Actor of type Service. My goal at some point is to have this be a working bot that does things. But for the time being I'm still struggling to get other servers to actually consume that actor from my server. I've got #webfinger working I believe correctly (here) and the ID it returns responds with what seems to me like a valid Actor json-id (here). However the several instances I've tried accessing it from all seem to not be able to consume that for any reason. Misskeys end up with an An error has occurred message, mastodons just say they're not finding anything.
With the misskeys at least I see a request coming in to /.well-known/webfinger, but mastodon instances don't seem to attempt to make any call, even if I search directly for the URL of the actor object. Meanwhile fedify lookup seems to be fine with what it gets from the webfinger request since it then proceeds to hit the actor URL as well and prints out the json-ld it gets from it.
There don't seem to be any tools that I can point at a resource and have them tell me what it is I haven't implemented properly which is a bit frustrating.
@[email protected] · Reply to Julian Fietkau's post
Hi @julian @canary,
what problem are you solving? Why should the domains have to match? And bad implementations happen. #Webfinger
https://dev.seppo.social/2024-03-19/apchk.cgi/webfinger?redirect=self&resource=@[email protected]
P.S.: Are you aware #webfinger isn't part of #activitypub?
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
The #Fedify docs now have a section on actor identifiers and #WebFinger usernames.
https://unstable.fedify.dev/manual/actor#actor-identifier-and-webfinger-username
Part 3 of "A Guide to Implementing ActivityPub in a Static Site (or Any Website)" is just out the oven!
In this blog post, I explain how to make your blog discoverable in the Fediverse as an account, and also address some of the annoying pitfalls I encountered.
Full article here: https://maho.dev/2024/02/a-guide-to-implementing-activitypub-in-a-static-site-or-any-website-part-3/
If you like it don't forget to follow the @blog !
#fediverse #activitypub #static-sites #hugo #azure #mastodon #web-development #social-web #webfinger #http
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
#Fedify 프레임워크는 #연합우주 (#fediverse) 개발에 중요한 기능들을 기본으로 내장하고 있습니다:
@[email protected] · Reply to Fedify: an ActivityPub server framework's post
Out of the box, #Fedify comes packed with features crucial for #fediverse development:
#Fedify is an #ActivityPub server framework in #TypeScript & #JavaScript. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.
The key features it provides currently are:
• Type-safe objects for Activity Vocabulary (including some vendor-specific extensions)
• #WebFinger client and server
• HTTP Signatures
• Middleware for handling webhooks
• #NodeInfo protocol
• #Node.js, #Deno, and #Bun support
• CLI toolchain for testing and debugging
If you're curious, take a look at the Fedify website! There's comprehensive docs, a demo, a tutorial, example code, and more:
Fedify is an #ActivityPub server framework in #TypeScript & #JavaScript. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.
The key features it provides currently are:
If you're curious, take a look at the #Fedify website! There's comprehensive docs, a demo, a tutorial, example code, and more:
ANN: FediTest 0.2 is out. This is our first release, even if early as you can tell from the version number.
feditest is now in the python repos, so you can say "pip install feditest", and the documentation is current on https://feditest.org
You can currently use it to run your own WebFinger server tests similar to https://feditest.org/assets/2024-06-05/webfinger-server-all-wellknown-saas-imp.testmatrix.html Obviously much more to come.
Feedback appreciated!
/cc @activitypubtestsuite #fediverse #activitypub #webfinger #testing #qa