julian<p><strong>Pleroma Webfinger compatibility</strong></p>
<p>Does anybody know what exactly Pleroma needs for a valid Webfinger check? I'm attempting to figure out why <code>@jmtd@pleroma.debian.social</code> won't resolve in NodeBB, and it's because the webfinger call returns <code>400 Bad Request</code>.</p>
<p>NodeBB is calling <code>https://pleroma.debian.social/.well-known/webfinger?resource=acct%3Ajmtd%40pleroma.debian.social</code> with <code>User-Agent</code> and <code>Content-Type</code> headers (curiously, it's <em>not</em> sending <code>Accept</code>, but it also fails if that header is set, so that's irrelevant.)</p>
<p>Navigating to that webfinger url in the browser returns XML, which is :grimacing: but I'm not even getting that when NodeBB makes the call.</p>
<p><a href="https://community.nodebb.org/post/104461" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">community.nodebb.org/post/1044</span><span class="invisible">61</span></a></p>
Recent searches
No recent searches
Search options
Only available when logged in.
mstdn.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A general-purpose Mastodon server with a 500 character limit. All languages are welcome.
Administered by:
Server stats:
14Kactive users
mstdn.social: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.8
#webfinger
1 post · 1 participant · 0 posts today
Fedify: an ActivityPub server framework<p>Fetching remote <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/ActivityPub" target="_blank">#<span>ActivityPub</span></a> objects or actors often involves handling <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/WebFinger" target="_blank">#<span>WebFinger</span></a> lookups, content negotiation, and then parsing potentially untyped JSON.</p><p>With <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/Fedify" target="_blank">#<span>Fedify</span></a>, it's much simpler: use <a href="https://fedify.dev/manual/context#looking-up-remote-objects" rel="nofollow noopener noreferrer" target="_blank"><code>Context.lookupObject()</code></a>. Pass it a URI (e.g., <code>https://instance.tld/users/alice</code>) <em>or</em> a handle (e.g., <code>@alice@instance.tld</code>), and Fedify handles the lookup and content negotiation automatically.</p><p>The real power comes from the return value: a <a href="https://fedify.dev/manual/vocab" rel="nofollow noopener noreferrer" target="_blank">type-safe Activity Vocabulary object</a>, not just raw JSON. This allows you to confidently access properties and methods directly. For example, you can safely traverse account moves using <code>.getSuccessor()</code> like this:</p><pre><code>let actor = await ctx.lookupObject("@alice@instance.tld");
while (isActor(actor)) {
const successor = await actor.getSuccessor();
if (successor == null) break;
actor = successor;
}
// actor now holds the latest account after moves
</code></pre><p>This is readily available in handlers where the <a href="https://fedify.dev/manual/context" rel="nofollow noopener noreferrer" target="_blank"><code>Context</code></a> object is provided (like <a href="https://fedify.dev/manual/actor" rel="nofollow noopener noreferrer" target="_blank">actor dispatchers</a> or <a href="https://fedify.dev/manual/inbox" rel="nofollow noopener noreferrer" target="_blank">inbox listeners</a>).</p><p>Focus on your app's logic, not protocol boilerplate!</p><p>Learn more: <a href="https://fedify.dev/manual/context#looking-up-remote-objects" rel="nofollow noopener noreferrer" target="_blank">https://fedify.dev/manual/context#looking-up-remote-objects</a></p><p><a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/fedidev" target="_blank">#<span>fedidev</span></a></p>
Epiphyt<p>Running the ActivityPub plugin for WordPress requires particular URLs to be working as expected. This is even more true for a multisite instance in a sub-directory. Learn how to configure your nginx to get it working.</p><p><a href="https://epiph.yt/en/blog/2025/activitypub-in-sub-directory-multisite-in-nginx/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">epiph.yt/en/blog/2025/activity</span><span class="invisible">pub-in-sub-directory-multisite-in-nginx/</span></a></p><p><a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/en/blog/tag/activitypub/" target="_blank">#ActivityPub</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/en/blog/tag/multisite/" target="_blank">#Multisite</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/en/blog/tag/nginx/" target="_blank">#nginx</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/en/blog/tag/webfinger/" target="_blank">#Webfinger</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/en/blog/tag/wordpress/" target="_blank">#WordPress</a></p>
Epiphyt<p>Das ActivityPub-Plugin für WordPress erfordert, dass bestimmte URLs funktionieren. Das trifft insbesondere auf Multisite-Instanzen mit Unterverzeichnissen zu. Erfahre, wie du deinen nginx konfigurieren musst, damit es funktioniert.</p><p><a href="https://epiph.yt/blog/2025/activitypub-in-nginx-multisite-mit-unterverzeichnissen/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">epiph.yt/blog/2025/activitypub</span><span class="invisible">-in-nginx-multisite-mit-unterverzeichnissen/</span></a></p><p><a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/blog/tag/activitypub/" target="_blank">#ActivityPub</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/blog/tag/multisite/" target="_blank">#Multisite</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/blog/tag/nginx/" target="_blank">#nginx</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/blog/tag/webfinger/" target="_blank">#Webfinger</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://epiph.yt/blog/tag/wordpress/" target="_blank">#WordPress</a></p>
Simon Greenwood<p>I've set up a Snac instance and it all seems to work, but am I right in thinking that it doesn't support webfinger queries, or have I set something up wrong? <a href="https://gotosocial.grnwds.uk/tags/snac" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>snac</span></a> <a href="https://gotosocial.grnwds.uk/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webfinger</span></a></p>
⁂ Kaleb<p>Finally figured out how to set up a .well-known/webfinger for multiple accounts on a split instance/account<em><strong>¹</strong></em> domain setup.</p><p>This piece from <span class="h-card"><a href="https://fosstodon.org/@aohorodnyk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>aohorodnyk</span></a></span> was critical to making it work, but I would love to make it dynamic rather than creating a rule each time I add a user. <em>Unfortunately, I haven’t yet figured out how to achieve this with wildcard rules.</em></p><p><a href="https://aohorodnyk.com/post/2023-07-08-mastodon-alias-in-cloudflare/" rel="nofollow noopener noreferrer" target="_blank">aohorodnyk: Mastodon Alias in Cloudflare</a></p><p><em><strong>¹</strong></em> I’m glad I set it up this way, but I wouldn’t recommend it for new instance admins as it is severely limiting in what is supportable.</p><p><a href="https://fedi.haugenh.us/tags/gotosocial" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GoToSocial</span></a> <a href="https://fedi.haugenh.us/tags/gts" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GtS</span></a> <a href="https://fedi.haugenh.us/tags/fediadmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FediAdmin</span></a> <a href="https://fedi.haugenh.us/tags/cloudflare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cloudflare</span></a> <a href="https://fedi.haugenh.us/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebFinger</span></a></p>
🇺🇦𖤐AlderForrest 𖤐 🇺🇦<p><span>Oma </span><a href="https://1m2lab.anvil.top/tags/nextcloud" rel="nofollow noopener noreferrer" target="_blank">#nextcloud</a><span> palvelin on nyt toiminnassa, ja säädetty kuntoon. Muutama havainto asiaan liittyen heille, jotka suunnittelevat itsehostaamista:<br><br>1) Nextcloud -asennuksen voi tehdä monella tapaa. Itse ajoin testin vuoksi asennukset </span><a href="https://1m2lab.anvil.top/tags/dietpi" rel="nofollow noopener noreferrer" target="_blank">#dietpi</a><span> distron, </span><a href="https://1m2lab.anvil.top/tags/snap" rel="nofollow noopener noreferrer" target="_blank">#snap</a><span> paketin ja </span><a href="https://1m2lab.anvil.top/tags/AIO" rel="nofollow noopener noreferrer" target="_blank">#AIO</a><span> (All-In-One) paketin kautta. <br><br>2) Dietpi distron kautta asennus on melko mutkaton prosessi, käyttöliittymä retromaisen tekstipohjainen. Asentuu raudalle ilman kontteja. Joutuu säätämään jälkikäteen, jos haluaa ajella reverse proxyn kautta. Jatkoon, jos säätäminen maistuupi.<br><br>3) Snap paketin kautta, asennus on myös melko suoraviivaista, muutaman komentorivikomennon syöttämistä. Asennus menee kontteihin, asennuksessa asentaa snap -version dockerista, josta piireissä ollaan montaa mieltä. Valkotaulun joutuu asentamaan erikseen omaan konttiin, ja on "pain in the rectal area" -tyyppistä. Myös reverse proxyn kanssa menee tappeluksi. Ei jatkoon. <br><br>4) AIO -asennus asentaa omiin kontteihin kaiken tarpeellisen, </span><a href="https://1m2lab.anvil.top/tags/borg" rel="nofollow noopener noreferrer" target="_blank">#borg</a><span> backupista ja valkotaulupalvelimesta lähtien. Hyvät ohjeet eri reverse proxy -vaihtoehdoille. Asennus verkkoselainpohjainen kontin kautta. Tämä valikoitui omaan purkkiini.<br><br>5) On todella harmillista, ettei missään vaihtoehdoista saa </span><a href="https://1m2lab.anvil.top/tags/social" rel="nofollow noopener noreferrer" target="_blank">#social</a><span> -aplikaatiota toimimaan aplikaatiossa </span><a href="https://1m2lab.anvil.top/tags/webfinger" rel="nofollow noopener noreferrer" target="_blank">#webfinger</a><span> -käsittelijässä lymyilevän bugin johdosta. Käänsin käytännössä kaikki kivet tuota debugatessa, ja lokien ja testien perusteella syy on apissa, ei itse nextcloud -raamissa. Jos kehitysporukka saisi tuon bugin torpattua, saisin uuden instanssin nextcloudista myös </span><a href="https://1m2lab.anvil.top/tags/fediverse" rel="nofollow noopener noreferrer" target="_blank">#fediverse</a><span> -perheeseen.<br><br>6) Integraatio mobiililaitteen kanssa onnistuu, valmiit apit ovat </span><a href="https://1m2lab.anvil.top/tags/android" rel="nofollow noopener noreferrer" target="_blank">#android</a><span> ja </span><a href="https://1m2lab.anvil.top/tags/iphone" rel="nofollow noopener noreferrer" target="_blank">#iphone</a><span> luureille. Itse jouduin debuggaaman oman S3 -purkkiservon kanssa, kun iPhonen appi virheili melkoisen määrän alussa. Syy löytyi lopulta </span><a href="https://1m2lab.anvil.top/tags/S3" rel="nofollow noopener noreferrer" target="_blank">#S3</a><span> servon ja </span><a href="https://1m2lab.anvil.top/tags/bucket" rel="nofollow noopener noreferrer" target="_blank">#bucket</a><span> -asetuksista.<br><br></span><a href="https://1m2lab.anvil.top/tags/selfhosting" rel="nofollow noopener noreferrer" target="_blank">#selfhosting</a><span> </span><a href="https://1m2lab.anvil.top/tags/asd" rel="nofollow noopener noreferrer" target="_blank">#asd</a><span> </span><a href="https://1m2lab.anvil.top/tags/adhd" rel="nofollow noopener noreferrer" target="_blank">#adhd</a><span> </span><a href="https://1m2lab.anvil.top/tags/erityismielenkiinnonkohteet" rel="nofollow noopener noreferrer" target="_blank">#erityismielenkiinnonkohteet</a></p>
Marcus Rohrmoser 🌻<p>⁂ Create <a href="https://digitalcourage.social/tags/fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fediverse</span></a> / <a href="https://digitalcourage.social/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webfinger</span></a> interact <a href="https://digitalcourage.social/tags/bookmarklets" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bookmarklets</span></a> wit a <a href="https://digitalcourage.social/tags/CGI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CGI</span></a> / <a href="https://digitalcourage.social/tags/RFC3875" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RFC3875</span></a>.<br><a href="https://codeberg.org/mro/bookmarklet-interact" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">codeberg.org/mro/bookmarklet-i</span><span class="invisible">nteract</span></a><br>Sample <a href="https://digitalcourage.social/tags/deployment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>deployment</span></a> and <a href="https://digitalcourage.social/tags/soucecode" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>soucecode</span></a>.</p><p>Enjoy!<br>¹ <a href="https://mro.name/b4fzzac" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">mro.name/b4fzzac</span><span class="invisible"></span></a></p>
CarK :python:<p><span class="h-card" translate="no"><a href="https://blog.fami.ga/@Thomas" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Thomas</span></a></span> </p><p>Ich weiß zwar nicht genau, was <a href="https://social.tchncs.de/tags/WebFinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebFinger</span></a> ist, aber es löst ziemlich sicher nicht das Problem, dass Leute – aus gut nach vollziehbaren Gründen – unterschiedliche Mailadressen für unterschiedliche Dienste (z.B. WeAct und Mastodon) verwenden.</p><p><span class="h-card" translate="no"><a href="https://mastodon.social/@Stefan_S_from_H" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Stefan_S_from_H</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@campact" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>campact</span></a></span> <span class="h-card" translate="no"><a href="https://social.heise.de/@heiseonline" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>heiseonline</span></a></span> <span class="h-card" translate="no"><a href="https://digitalcourage.social/@digitalcourage" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>digitalcourage</span></a></span></p>
Thomas Ganter<p><span class="h-card" translate="no"><a href="https://mastodon.social/@Stefan_S_from_H" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Stefan_S_from_H</span></a></span> </p><p>Genau hier könnte ja, mit etwas gutem Willen, <span class="h-card" translate="no"><a href="https://mastodon.social/@campact" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>campact</span></a></span> mittels <a href="https://blog.fami.ga/tags/WebFinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>WebFinger</span></a> versuchen, zu der E-Mail-Adresse die man gerade im Schritt zuvor bestätigt hat schon mal einen Server zu identifizieren … </p><p><span class="h-card" translate="no"><a href="https://social.tchncs.de/@cark" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cark</span></a></span> <span class="h-card" translate="no"><a href="https://social.heise.de/@heiseonline" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>heiseonline</span></a></span> <span class="h-card" translate="no"><a href="https://digitalcourage.social/@digitalcourage" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>digitalcourage</span></a></span></p>
Chris Trottier<p><span class="h-card"><a class="u-url mention" href="https://cyberplace.social/@antoinnesterk" rel="nofollow noopener noreferrer" target="_blank">@<span>antoinnesterk</span></a></span> Strictly speaking, <a class="hashtag" href="https://atomicpoet.org/tag/webfinger" rel="nofollow noopener noreferrer" target="_blank">#WebFinger</a> is not <a class="hashtag" href="https://atomicpoet.org/tag/finger" rel="nofollow noopener noreferrer" target="_blank">#finger</a> but is based on <a class="hashtag" href="https://atomicpoet.org/tag/finger" rel="nofollow noopener noreferrer" target="_blank">#finger</a>.</p>
Chris Trottier<p>Fun fact: the <a class="hashtag" href="https://atomicpoet.org/tag/fediverse" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> doesn’t just depend on <a class="hashtag" href="https://atomicpoet.org/tag/activitypub" rel="nofollow noopener noreferrer" target="_blank">#ActivityPub</a>. </p><p>A good portion of it runs on <a class="hashtag" href="https://atomicpoet.org/tag/webfinger" rel="nofollow noopener noreferrer" target="_blank">#WebFinger</a>. It’s why we’re able to find each other across different servers running vastly different software.</p><p><a href="https://en.wikipedia.org/wiki/WebFinger" rel="nofollow noopener noreferrer" target="_blank">https://en.wikipedia.org/wiki/WebFinger</a><span class=""><br><br>RE: <a href="https://atomicpoet.org/objects/6bc30357-bc44-4114-a036-1a6caaf3c42e" rel="nofollow noopener noreferrer" target="_blank">https://atomicpoet.org/objects/6bc30357-bc44-4114-a036-1a6caaf3c42e</a></span></p>
Dendrobatus Azureus<p>Have you ever asked yourself how the BSD Café Mastodon instance was built?</p><p>Stefano has written here what he has done. You should have at least rudimentary knowledge of what a jail is in order to follow everything and at least a simple manner.</p><p>In short a jail is much more efficient than a VM, uses much less resources and it's easier to control</p><p>If you take the time to Study all the subjects, you will be a will to build a freeBSD instance of Mastodon yourself; all the information necessary Is provided Here and Deep to very Deep details you can dig up yourself</p><p><a href="https://wiki.bsd.cafe/bsdcafe-technical-details" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">wiki.bsd.cafe/bsdcafe-technica</span><span class="invisible">l-details</span></a></p><p>🖋️ <a href="https://mastodon.bsd.cafe/tags/bash" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bash</span></a> <a href="https://mastodon.bsd.cafe/tags/sh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sh</span></a> <a href="https://mastodon.bsd.cafe/tags/zsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>zsh</span></a> <a href="https://mastodon.bsd.cafe/tags/ksh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ksh</span></a> <a href="https://mastodon.bsd.cafe/tags/csh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>csh</span></a> <a href="https://mastodon.bsd.cafe/tags/tsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tsh</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>programming</span></a> <a href="https://mastodon.bsd.cafe/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JavaScript</span></a> <a href="https://mastodon.bsd.cafe/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Mastodon</span></a> <a href="https://mastodon.bsd.cafe/tags/freeBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>freeBSD</span></a> <a href="https://mastodon.bsd.cafe/tags/ngix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ngix</span></a> <a href="https://mastodon.bsd.cafe/tags/json" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>json</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/SocialMedia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SocialMedia</span></a> <a href="https://mastodon.bsd.cafe/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webfinger</span></a></p>
Dendrobatus Azureus<p>I have had an account on an instance where the System Operator had to shut down because the operational costs were too high to sustain the node. All proper precautions were made and the operator gave us more than six weeks to get all of our followers moved somewhere else. He also made sure that everybody got the message by sending it multiple times also through email. I've made an account there because that place was bot Friendly {<a href="https://botsin.space/}" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">botsin.space/}</span><span class="invisible"></span></a> and I was going to Create a bot on that instance </p><p>However, since I put so few toots out there, on that account I didn't even bother to download them. And since I'm quite aware of high internet costs, I also make sure that I have accounts on different places because in the end somebody is paying for it either in cash or paying for it by using Surplus bandwidth and surplus disc area space.</p><p>We as Fediverse Community users should realise that nothing is free apart from Air and Water; everything else cost either Time, Space_Time or Energy, often a combination of the latter two. </p><p>I've just checked and <a href="https://botsin.space/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">botsin.space/</span><span class="invisible"></span></a> still seems to be up as a read-only instance. </p><p><span class="h-card" translate="no"><a href="https://fuzzies.wtf/@altbot" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>altbot</span></a></span> </p><p>🖋️ <a href="https://mastodon.bsd.cafe/tags/bash" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bash</span></a> <a href="https://mastodon.bsd.cafe/tags/sh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sh</span></a> <a href="https://mastodon.bsd.cafe/tags/zsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>zsh</span></a> <a href="https://mastodon.bsd.cafe/tags/ksh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ksh</span></a> <a href="https://mastodon.bsd.cafe/tags/csh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>csh</span></a> <a href="https://mastodon.bsd.cafe/tags/tsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tsh</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>programming</span></a> <a href="https://mastodon.bsd.cafe/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JavaScript</span></a> <a href="https://mastodon.bsd.cafe/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Mastodon</span></a> <a href="https://mastodon.bsd.cafe/tags/freeBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>freeBSD</span></a> <a href="https://mastodon.bsd.cafe/tags/ngix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ngix</span></a> <a href="https://mastodon.bsd.cafe/tags/json" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>json</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/SocialMedia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SocialMedia</span></a> <a href="https://mastodon.bsd.cafe/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webfinger</span></a></p>
Dendrobatus Azureus<p>Make sure that you always think about the data that you divulge to big companies. Use the Easy Storage knowing that they will use your data also even your copyrighted photographs. </p><p>Within the Fediverse it's easy to own your data, very easy, always remember that and be thankful</p><p>🖋️ <a href="https://mastodon.bsd.cafe/tags/bash" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bash</span></a> <a href="https://mastodon.bsd.cafe/tags/sh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sh</span></a> <a href="https://mastodon.bsd.cafe/tags/zsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>zsh</span></a> <a href="https://mastodon.bsd.cafe/tags/ksh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ksh</span></a> <a href="https://mastodon.bsd.cafe/tags/csh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>csh</span></a> <a href="https://mastodon.bsd.cafe/tags/tsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tsh</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>programming</span></a> <a href="https://mastodon.bsd.cafe/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JavaScript</span></a> <a href="https://mastodon.bsd.cafe/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Mastodon</span></a> <a href="https://mastodon.bsd.cafe/tags/freeBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>freeBSD</span></a> <a href="https://mastodon.bsd.cafe/tags/ngix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ngix</span></a> <a href="https://mastodon.bsd.cafe/tags/json" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>json</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/SocialMedia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SocialMedia</span></a> <a href="https://mastodon.bsd.cafe/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webfinger</span></a></p>
Dendrobatus Azureus<p>In this article Stefano explains to you how to use a web finger system so that people can always find your address</p><p>An important message here is that _you should always own your data_. So do not rely on cloud or web services to maintain your data. Always remember that many of those massive conglomerates use your data and sell it, literally sell it, or the metadata off it, to the highest bidder</p><p>Within the Fediverse it's easy to migrate from one server to the next, your followers will automatically follow your new account</p><p><a href="https://it-notes.dragas.net/2024/10/08/using-a-permanent-webfinger-address/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">it-notes.dragas.net/2024/10/08</span><span class="invisible">/using-a-permanent-webfinger-address/</span></a></p><p>🖋️ <a href="https://mastodon.bsd.cafe/tags/bash" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bash</span></a> <a href="https://mastodon.bsd.cafe/tags/sh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sh</span></a> <a href="https://mastodon.bsd.cafe/tags/zsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>zsh</span></a> <a href="https://mastodon.bsd.cafe/tags/ksh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ksh</span></a> <a href="https://mastodon.bsd.cafe/tags/csh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>csh</span></a> <a href="https://mastodon.bsd.cafe/tags/tsh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tsh</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>programming</span></a> <a href="https://mastodon.bsd.cafe/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JavaScript</span></a> <a href="https://mastodon.bsd.cafe/tags/Mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Mastodon</span></a> <a href="https://mastodon.bsd.cafe/tags/freeBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>freeBSD</span></a> <a href="https://mastodon.bsd.cafe/tags/ngix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ngix</span></a> <a href="https://mastodon.bsd.cafe/tags/json" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>json</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/SocialMedia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SocialMedia</span></a> <a href="https://mastodon.bsd.cafe/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webfinger</span></a></p>
Maho Pacheco 🦝🍻<p>A Guide to Implementing ActivityPub in a Static Site (or Any Website) - Part 8 is out!</p><p>Follow the site here <span class="h-card" translate="no"><a href="https://maho.dev/" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>blog</span></a></span> or check the article here: <a href="https://maho.dev/2025/01/a-guide-to-implementing-activitypub-in-a-static-site-or-any-website-part-8/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">maho.dev/2025/01/a-guide-to-im</span><span class="invisible">plementing-activitypub-in-a-static-site-or-any-website-part-8/</span></a> </p><p> <a href="https://hachyderm.io/tags/fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fediverse</span></a> <a href="https://hachyderm.io/tags/activitypub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>activitypub</span></a> <a href="https://hachyderm.io/tags/static" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>static</span></a>-sites <a href="https://hachyderm.io/tags/hugo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hugo</span></a> <a href="https://hachyderm.io/tags/azure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>azure</span></a> <a href="https://hachyderm.io/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mastodon</span></a> <a href="https://hachyderm.io/tags/web" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>web</span></a>-development <a href="https://hachyderm.io/tags/social" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>social</span></a>-web <a href="https://hachyderm.io/tags/webfinger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>webfinger</span></a> <a href="https://hachyderm.io/tags/http" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>http</span></a> <a href="https://hachyderm.io/tags/azure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>azure</span></a> <a href="https://hachyderm.io/tags/azurefunctions" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>azurefunctions</span></a></p>
Fedify: an ActivityPub server framework<p>FedifyのWebFinger実装における脆弱性<a href="https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx" rel="nofollow noopener noreferrer" target="_blank">CVE-2025-23221</a>に対するセキュリティアップデート（<a href="https://github.com/dahlia/fedify/releases/tag/1.0.14" rel="nofollow noopener noreferrer" target="_blank">1.0.14</a>、<a href="https://github.com/dahlia/fedify/releases/tag/1.1.11" rel="nofollow noopener noreferrer" target="_blank">1.1.11</a>、<a href="https://github.com/dahlia/fedify/releases/tag/1.2.11" rel="nofollow noopener noreferrer" target="_blank">1.2.11</a>、<a href="https://github.com/dahlia/fedify/releases/tag/1.3.4" rel="nofollow noopener noreferrer" target="_blank">1.3.4</a>）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。</p>
<p><strong>脆弱性の詳細</strong></p>
<p>セキュリティ研究者により、Fedifyの<code>lookupWebFinger()</code>関数において以下のセキュリティ上の問題が発見されました：</p>
<ul>
<li>無限リダイレクトループによるサービス拒否攻撃（DoS）の可能性</li>
<li>プライベートネットワークアドレスへのリダイレクトを利用したSSRF（サーバーサイドリクエストフォージェリ）攻撃の可能性</li>
<li>リダイレクト操作による意図しないURLスキームへのアクセスの可能性</li>
</ul>
<p><strong>修正されたバージョン</strong></p>
<ul>
<li>1.3.xシリーズ：<a href="https://github.com/dahlia/fedify/releases/tag/1.3.4" rel="nofollow noopener noreferrer" target="_blank">1.3.4</a>へアップデート</li>
<li>1.2.xシリーズ：<a href="https://github.com/dahlia/fedify/releases/tag/1.2.11" rel="nofollow noopener noreferrer" target="_blank">1.2.11</a>へアップデート</li>
<li>1.1.xシリーズ：<a href="https://github.com/dahlia/fedify/releases/tag/1.1.11" rel="nofollow noopener noreferrer" target="_blank">1.1.11</a>へアップデート</li>
<li>1.0.xシリーズ：<a href="https://github.com/dahlia/fedify/releases/tag/1.0.14" rel="nofollow noopener noreferrer" target="_blank">1.0.14</a>へアップデート</li>
</ul>
<p><strong>変更内容</strong></p>
<p>本セキュリティアップデートでは、以下の修正が実施されました：</p>
<ol>
<li>無限リダイレクトループを防ぐため、最大リダイレクト回数（5回）の制限を導入</li>
<li>元のリクエストと同じスキーム（HTTP/HTTPS）のみにリダイレクトを制限</li>
<li>SSRFを防止するため、プライベートネットワークアドレスへのリダイレクトをブロック</li>
</ol>
<p><strong>アップデート方法</strong></p>
<p>以下のコマンドで最新のセキュアバージョンにアップデートできます：</p>
<pre><code># npmユーザーの場合
npm update @fedify/fedify
# Denoユーザーの場合
deno add jsr:@fedify/fedify
</code></pre>
<p>この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。</p>
<p>本脆弱性の詳細については、<a href="https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx" rel="nofollow noopener noreferrer" target="_blank">セキュリティ勧告</a>をご参照ください。</p>
<p>ご質問やご懸念がございましたら、<a href="https://github.com/dahlia/fedify/discussions" rel="nofollow noopener noreferrer" target="_blank">GitHub Discussions</a>、<a href="https://matrix.to/#/#fedify:matrix.org" rel="nofollow noopener noreferrer" target="_blank">Matrixチャットスペース</a>、または<a href="https://discord.gg/bhtwpzURwd" rel="nofollow noopener noreferrer" target="_blank">Discordサーバー</a>までお気軽にご連絡ください。</p>
<p><a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/Fedify" target="_blank">#<span>Fedify</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/WebFinger" target="_blank">#<span>WebFinger</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" target="_blank">#<span>セキュリティ</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/%E8%84%86%E5%BC%B1%E6%80%A7" target="_blank">#<span>脆弱性</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/DoS" target="_blank">#<span>DoS</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/SSRF" target="_blank">#<span>SSRF</span></a></p>
Fedify: an ActivityPub server framework<p><a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/Fedify" target="_blank">#<span>Fedify</span></a> 프레임워크의 <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/WebFinger" target="_blank">#<span>WebFinger</span></a> 구현에서 발견된 보안 취약점 <a href="https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx" rel="nofollow noopener noreferrer" target="_blank">CVE-2025-23221</a>을 해결하기 위한 보안 업데이트(<a href="https://github.com/dahlia/fedify/releases/tag/1.0.14" rel="nofollow noopener noreferrer" target="_blank">1.0.14</a>, <a href="https://github.com/dahlia/fedify/releases/tag/1.1.11" rel="nofollow noopener noreferrer" target="_blank">1.1.11</a>, <a href="https://github.com/dahlia/fedify/releases/tag/1.2.11" rel="nofollow noopener noreferrer" target="_blank">1.2.11</a>, <a href="https://github.com/dahlia/fedify/releases/tag/1.3.4" rel="nofollow noopener noreferrer" target="_blank">1.3.4</a>)를 배포했습니다. 모든 사용자께서는 각자 사용 중인 버전에 해당하는 최신 버전으로 즉시 업데이트하시기를 권장합니다.</p>
<p><strong>취약점 내용</strong></p>
<p>보안 연구자가 Fedify의 <code>lookupWebFinger()</code> 함수에서 다음과 같은 보안 문제점들을 발견했습니다:</p>
<ul>
<li>무한 리다이렉트 루프를 통한 서비스 거부 공격 가능</li>
<li>내부 네트워크 주소로의 리다이렉트를 통한 SSRF (서버측 요청 위조) 공격 가능</li>
<li>리다이렉트 조작을 통한 의도하지 않은 URL 스킴 접근 가능</li>
</ul>
<p><strong>수정된 버전</strong></p>
<ul>
<li>1.3.x 시리즈: <a href="https://github.com/dahlia/fedify/releases/tag/1.3.4" rel="nofollow noopener noreferrer" target="_blank">1.3.4</a>로 업데이트</li>
<li>1.2.x 시리즈: <a href="https://github.com/dahlia/fedify/releases/tag/1.2.11" rel="nofollow noopener noreferrer" target="_blank">1.2.11</a>로 업데이트</li>
<li>1.1.x 시리즈: <a href="https://github.com/dahlia/fedify/releases/tag/1.1.11" rel="nofollow noopener noreferrer" target="_blank">1.1.11</a>로 업데이트</li>
<li>1.0.x 시리즈: <a href="https://github.com/dahlia/fedify/releases/tag/1.0.14" rel="nofollow noopener noreferrer" target="_blank">1.0.14</a>로 업데이트</li>
</ul>
<p><strong>변경 사항</strong></p>
<p>이번 보안 업데이트에는 다음과 같은 수정 사항이 포함되어 있습니다:</p>
<ol>
<li>무한 리다이렉트 루프를 방지하기 위해 최대 리다이렉트 횟수 제한(5회) 도입</li>
<li>원래 요청과 동일한 스킴(HTTP/HTTPS)으로만 리다이렉트 허용하도록 제한</li>
<li>SSRF 공격 방지를 위해 내부 네트워크 주소로의 리다이렉트 차단</li>
</ol>
<p><strong>업데이트 방법</strong></p>
<p>다음 명령어로 최신 보안 버전으로 업데이트하실 수 있습니다:</p>
<pre><code># npm 사용자의 경우
npm update @fedify/fedify
# Deno 사용자의 경우
deno add jsr:@fedify/fedify
</code></pre>
<p>이 취약점을 책임감 있게 보고해 주신 보안 연구자께 감사드립니다. 덕분에 신속하게 문제를 해결할 수 있었습니다.</p>
<p>이 취약점에 대한 자세한 내용은 <a href="https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx" rel="nofollow noopener noreferrer" target="_blank">보안 권고문</a>을 참고해 주시기 바랍니다.</p>
<p>문의 사항이나 우려 사항이 있으시다면 <a href="https://github.com/dahlia/fedify/discussions" rel="nofollow noopener noreferrer" target="_blank">GitHub Discussions</a>나 <a href="https://matrix.to/#/#fedify:matrix.org" rel="nofollow noopener noreferrer" target="_blank">Matrix 채팅방</a>, 또는 <a href="https://discord.gg/bhtwpzURwd" rel="nofollow noopener noreferrer" target="_blank">Discord 서버</a>를 통해 언제든 연락해 주시기 바랍니다.</p>
<p><a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/%EB%B3%B4%EC%95%88" target="_blank">#<span>보안</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/%EB%B3%B4%EC%95%88%ED%8C%A8%EC%B9%98" target="_blank">#<span>보안패치</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/%EC%B7%A8%EC%95%BD%EC%A0%90" target="_blank">#<span>취약점</span></a> <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/SSRF" target="_blank">#<span>SSRF</span></a></p>
Fedify: an ActivityPub server framework<p>We have released <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/security" target="_blank">#<span>security</span></a> updates (<a href="https://github.com/dahlia/fedify/releases/tag/1.0.14" rel="nofollow noopener noreferrer" target="_blank">1.0.14</a>, <a href="https://github.com/dahlia/fedify/releases/tag/1.1.11" rel="nofollow noopener noreferrer" target="_blank">1.1.11</a>, <a href="https://github.com/dahlia/fedify/releases/tag/1.2.11" rel="nofollow noopener noreferrer" target="_blank">1.2.11</a>, <a href="https://github.com/dahlia/fedify/releases/tag/1.3.4" rel="nofollow noopener noreferrer" target="_blank">1.3.4</a>) to address <a href="https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx" rel="nofollow noopener noreferrer" target="_blank">CVE-2025-23221</a>, a <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/vulnerability" target="_blank">#<span>vulnerability</span></a> in <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/Fedify" target="_blank">#<span>Fedify</span></a>'s <a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/WebFinger" target="_blank">#<span>WebFinger</span></a> implementation. We recommend all users update to the latest version of their respective release series immediately.</p>
<p><strong>The Vulnerability</strong></p>
<p>A security researcher identified multiple security issues in Fedify's <code>lookupWebFinger()</code> function that could be exploited to:</p>
<ul>
<li>Perform denial of service attacks through infinite redirect loops</li>
<li>Execute server-side request forgery (<a class="mention hashtag" rel="nofollow noopener noreferrer" href="https://hollo.social/tags/SSRF" target="_blank">#<span>SSRF</span></a>) attacks via redirects to private network addresses</li>
<li>Access unintended URL schemes through redirect manipulation</li>
</ul>
<p><strong>Fixed Versions</strong></p>
<ul>
<li>1.3.x series: Update to <a href="https://github.com/dahlia/fedify/releases/tag/1.3.4" rel="nofollow noopener noreferrer" target="_blank">1.3.4</a></li>
<li>1.2.x series: Update to <a href="https://github.com/dahlia/fedify/releases/tag/1.2.11" rel="nofollow noopener noreferrer" target="_blank">1.2.11</a></li>
<li>1.1.x series: Update to <a href="https://github.com/dahlia/fedify/releases/tag/1.1.11" rel="nofollow noopener noreferrer" target="_blank">1.1.11</a></li>
<li>1.0.x series: Update to <a href="https://github.com/dahlia/fedify/releases/tag/1.0.14" rel="nofollow noopener noreferrer" target="_blank">1.0.14</a></li>
</ul>
<p><strong>Changes</strong></p>
<p>The security updates implement the following fixes:</p>
<ol>
<li>Added a maximum redirect limit (5) to prevent infinite redirect loops</li>
<li>Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)</li>
<li>Blocked redirects to private network addresses to prevent SSRF attacks</li>
</ol>
<p><strong>How to Update</strong></p>
<p>To update to the latest secure version:</p>
<pre><code># For npm users
npm update @fedify/fedify
# For Deno users
deno add jsr:@fedify/fedify
</code></pre>
<p>We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.</p>
<p>For more details about this vulnerability, please refer to our <a href="https://github.com/dahlia/fedify/security/advisories/GHSA-c59p-wq67-24wx" rel="nofollow noopener noreferrer" target="_blank">security advisory</a>.</p>
<p>If you have any questions or concerns, please don't hesitate to reach out through our <a href="https://github.com/dahlia/fedify/discussions" rel="nofollow noopener noreferrer" target="_blank">GitHub Discussions</a>, join our <a href="https://matrix.to/#/#fedify:matrix.org" rel="nofollow noopener noreferrer" target="_blank">Matrix chat space</a>, or our <a href="https://discord.gg/bhtwpzURwd" rel="nofollow noopener noreferrer" target="_blank">Discord server</a>.</p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload