ActivityPub

I've been toying with the idea of using OAuth2/OpenID and the C2S API to have a service act on behalf of another instance (e.g. act on Lemmy, post as Mastodon account)

But now I'm wondering whether that kind of complexity is needed... one could theoretically register a public key to the instance it is acting on behalf of, and simply sign activities using the ID of the other server... Second server would need only update the actor with the new public key for verification purposes...

The only problematic account I have encountered so far is welcome@friends.deko.cloud but I have not tested many. On attempting to follow, it just hangs on “request pending”. I have been able to reliably follow the account from mastodon (for example).

This question was asked by mike@flipboard.social on Dot Social's latest episode about the blogosphere on Fedi.

johnonolan@mastodon.xyz: "we wanted to connect Ghost blogs to each other, but then we discovered ActivityPub"

pfefferle@mastodon.social: "we wanted to connect WordPress blogs to each other, and ActivityPub has been the most successful attempt"

[paraphrased for brevity]

Did you catch the subtext? Both those answers, and my own answer with NodeBB contain the same seed idea... that we originally wanted to connect our software with itself only. We went through years of building a company and vying for profitability that it never occurred to us to work towards cross compatibility with anyone besides out own software.

Then ActivityPub came along and quite literally expanded the potential for the entire endeavour a hundred-fold, because not only are you connecting your own software to each other, but every other ActivityPub enabled software in existence. Blogs, microblogs, forums, image boards, etc. all with a built-in user base ready from the get-go.

It's no wonder that after discovering AP, it becomes the protocol to utilise.

In February 2025, I presented a topic at FOSDEM in Brussels entitled The Fediverse is Quiet — Let's Fix That! In it, I outlined several "hard problems" endemic to the fediverse, focusing on one particular complaint that is often voiced by newcomers and oldtimers alike; that the fediverse is quiet because you don't ever see the full conversation due to some design considerations made at the protocol level.

Since then there have been a number of approaches toward solving this problem, and it is worth spending the time to review the two main approaches and their pros and cons.

N.B. I have a conflict of interest in this subject as I am a proponent of one of the approaches (FEP 7888/f228) outlined below. This article should be considered an opinion piece.

Crawling of the reply tree

First discussed 15 April 2024 and merged into Mastodon core on 12 Mar 2025, jonny@neuromatch.social pioneered this approach to "fetch all replies" by crawling the entirety of the reply tree. When presented with an object, the Mastodon service would make a call to the context endpoint, and if supported(?) would start to crawl the reply tree via the replies collection, generating a list of statuses to ingest.

This approach is advantageous for a number of reasons, most notably that inReplyTo and replies are properties that are ubiquitous among nearly all implementations and their usage tends not to differ markedly from one another.

N.B. I am not certain whether the service would crawl up the inReplyTo chain first, before expanding downwards, or whether context is set in intermediate and leaf nodes that point to the root-level object.

One disadvantage is this approach's susceptibility to network fragility. If a single node in the reply tree is temporarily or permanently inaccessible, then every branch of the reply tree emanating from that node is inaccessible as well.

Another disadvantage is the reliance on intermediate nodes for indexing the reply tree. The amount of work (CPU time, network requests, etc.) scales linearly with the size of the reply tree, and more importantly discoverability of new branches of the reply tree necessitate a re-crawl of the entire reply tree. For fast-growing trees, this may not net you a complete tree depending on when you begin crawling.

Lastly, in the ideal case, a full tree crawl would net you a complete tree with all branches and leaves. Great!

Mastodon is the sole implementor of this approach, although it is not proprietary or special to Mastodon by any means.

FEP 7888/f228, or FEP 171b/f228

Summarized by silverpill@mitra.social in FEP f228 (as an extension of FEPs 7888 by trwnh@mastodon.social and 171b by mikedev@fediversity.site), this conversational backfill approach defines the concept of a "context owner" as referenced by compatible nodes in the tree. This context owner returns an OrderedCollection containing all members of the context.

A major advantage of this approach centers around the pseudo-centralization provided by the context owner. This "single source of truth" maintains the index of objects (or activities) and supplies their IDs (or signed full activities) on request. Individual implementations then retrieve the objects (or activities). It is important to note that should the context owner become inaccessible, then backfill is no longer possible to achieve. On the other hand, a dead or unresponsive intermediate node will not affect the ability of the downstream nodes to be processed.

The context owner is only able to respond with a list of objects/activities that it knows about. This does mean that downstream branches that do not propagate upwards back to the root will not be known to the context owner.

Additionally, consumers are also able to query the context owner for an index without needing to crawl the entire reply tree. The ability to de-duplicate objects at this level reduces the overall number of network requests (and CPU time from parsing retrieved objects) required, making this approach relatively more efficient.

Additional synchronization methods (via id hashsums) could be leveraged to reduce the number of network calls further.

A number of implementors follow this approach to backfill, including NodeBB, Discourse, WordPress, Frequency, Mitra, and Streams. Additional implementors like Lemmy and Piefed have expressed interest.

One technical hurdle with this approach is technical buy-in from implementors themselves. Unlike crawling a reply tree, this approach only works when the context owner supports it, and thus should be combined with various other backfill strategies as part of an overall conversational backfill solution.

Conclusion

2025 is shaping up to be an exciting year for resolving some of the harder technical and social problems endemic to the open social web/fediverse. It is this author's opinion that we may be able to make good headway towards resolving the "quiet fedi" problem with these two approaches.

It is important to note that neither approach conflicts with the other. Implementations are free to utilise multiple approaches to backfill a conversation. Both methods presented here have pros and cons, and a combination of both (or more) could be key.

Feel free to use this as a starting point for discussions regarding either approach. Does one speak to you more than the other? Are the cons of either approach significant enough for you to disregard it? What other approaches or changes could you recommend?

It all started with a report about federation breaking between Lemmy and NodeBB. I was subconsciously aware that something was going on, but had chalked it up to network issues.

Observed behaviour showed that some remote categories would be receiving content in spurts, with long gaps in between.

I spent the next 3-4 days looking into it, but came up empty. Whatever was happening wasn't throwing any obvious errors, and along the way, I found what I thought was related (it was), but I wasn't sure why: against some Lemmy servers, the "follow"/"unfollow" mechanic would simply stop working, and this would often coincide with gaps in content. In some egregious cases, the flow of content stopped completely!

Unable to make headway, I had to reach out to the folks at Lemmy to figure out what the issue was. NodeBB occasionally sends non-200 level responses depending on the activity. Specifically, the following scenarios:

• A remote user upvoting more than 20 posts in a single day (a spam prevention tactic) causing NodeBB to throw an error, which was caught and returned an HTTP 500 Internal Server Error.
• A Dislike activity, which is not currently handled by NodeBB. In these cases, NodeBB would send an HTTP 501 Not Implemented

When encountering either of these responses, Lemmy would return the activity back to the queue for later delivery and mark a delivery failure. If enough of these (~40) happened within 24 hours, Lemmy would give the instance a time-out and pause delivery completely.

That was it — a quick pair of code updates later, and we started working through Lemmy's backlog of 4.1M activities.

As of 4am this morning, community.nodebb.org is no longer behind lemmy.world.

Fun week. Let's not do that again LOL.

v4.4.2 of NodeBB contains the updated logic for smoother Lemmy federation.

I'm assuming Unicode in handles is not allowed? At least by Mastodon.

This user is not able to have their content federated because the username is all Hebrew (I think?) characters!

I'm wondering how content on threadiverse is automatically assigned its community when received by the software (e.g. PieFed, Lemmy, Mbin).

The answer I am expecting is "if the community is addressed (to, cc, audience), then it is slotted into that community".

However that causes issues for compatibility with microblogs... for example, silverpill@mitra.social recently authored a post that mentioned [swf@socialwebfoundation.org](https://community.nodebb.org/category/swf@socialwebfoundation.org) and it got slotted into that community on NodeBB, which isn't correct since that group is private.

Better practice would be to only trust the addressed community if it is Announce'd by the community directly, but would fall short if my instance does not receive the Announce (say, if nobody follows the community), in which case we'd fall back to "uncategorized", which is where all microblog posts currently go. Then it's neither correct nor incorrect, I suppose.

I think this might be an issue where NodeBB tries to be too many things at once (microblog and threadiverse compatible).

Does anybody know what exactly Pleroma needs for a valid Webfinger check? I'm attempting to figure out why @jmtd@pleroma.debian.social won't resolve in NodeBB, and it's because the webfinger call returns 400 Bad Request.

NodeBB is calling https://pleroma.debian.social/.well-known/webfinger?resource=acct%3Ajmtd%40pleroma.debian.social with User-Agent and Content-Type headers (curiously, it's not sending Accept, but it also fails if that header is set, so that's irrelevant.)

Navigating to that webfinger url in the browser returns XML, which is :grimacing: but I'm not even getting that when NodeBB makes the call.

In my ever-continuing use of NodeBB as a single-user Fediverse instance, here are some things I've noticed. Both things I've already talked about before, and some new things. These are some suggestions for functionality or perhaps plugins.

1. Confusion between following remote categories as a user and the synchronization options in category settings as an admin. I think the category synchronization should be repurposed somewhat. The suggestion from @julian@community.nodebb.org was to perhaps rework it as a cross-posting feature.

   • Right now, the feature relies on the other ActivityPub endpoint to be able to follow the NodeBB category, which (notably Lemmy) does not always work.
   • Making a "proxy user" is a pretty common solution to this, used by Misskey etc. One single system proxy user can follow all remote categories, and then NodeBB itself can handle the synchronization.

2. Lack of posts. This is a general problem for single-user instances, and it's why things like relays and Fedifetcher exist. Support for relays would help a lot, but a Fedifetcher-like plugin/function would be even better.

   • Fedifetcher works by loading posts from the source server, and finding all the replies there. It then executes a search against your own server, which fofrces your server to load the reply. This should work just fine for NodeBB, because searching post links causes the posts to load.
   • But Fedifetcher relies on platform-specific APIs (Mastodon, Misskey, etc). So I think this would be a good candidate for a NodeBB plugin.

3. Slotting posts and topics into local categories. To me, this feels like the holy grail of integrating the traditional forum experience into the Fediverse. It's something I've brought up before, and someone was working on a plugin, but I'm not sure it ever got finished.

   • It would be amazing to add a function in the admin settings under category settings to make a list of remote ActivityPub actors that get posts slotted into the category automatically.
   • Any incoming note from that actor will be automatically put into the specified category.
   • This shouldn't need to rely on altering or updating any synchronization stuff, because it can work with any incoming post. The framework for receiving remote posts is already there.

These are all just ideas, and maybe some discussion can be had on them before I start embarking on a path of attempting to make some NodeBB plugins :smile:.

Following up on this question I asked back in late March, I wanted to continue thinking about how one would handle cross-posting between categories/communities, given that there isn't current consensus on it, and especially given that NodeBB—as of v4.3.0—can now see and browse remote categories.

From that original topic, we can distil the following:

1. Both PieFed and Mbin do not natively handle cross-posts, a new entity is made with the crucial bits (link, text, possibly title) copied over and changed if needed, sometimes a "cross-posted from..." helper text is prepended.
2. There are legitimate concerns that a cross-post might not succeed depending on privilege settings on the receiving end, so a pre-flight check (or explicit rejection) of some kind might be required.
3. Cross-posting can be done by the original author, or another user.

So were an FEP to be written, we'd center it around the following assumptions:

• "A user (which may or may not be the object author) is sharing an object to additional audiences"
• We would use the existing Announce(Object) model
• We would not use Announce(Activity) because it is not the original object creation that is being announced, but the object itself, to a new audience.
• Some form of Reject handling would be required for cases where the cross-post is not allowed
• How the receiver handles the activity is out-of-scope of the FEP. It could be that the original object is contained within multiple categories/communities, or a duplicate object could be created — implementor's choice.

This is very similar to an existing announce/boost/reshare, except that instead of addressing the activity to followers list you are addressing it to a group actor's inbox.

Some additional questions:

1. Is there desire from PieFed/Lemmy/Mbin for supporting incoming (and possibly outgoing) federation of cross-posting?
2. What exactly happens currently if a Group actor receives an Announce(Object)? My guess is nothing, currently, but let me know otherwise :smile:
3. Would this allow you to accept cross-posts from other AP applications without needing to refactor any existing code?
4. Duplicating the object would mean the discussion is split between objects. The ideal implementation would be the same object present in multiple categories/communities. Is there desire for this in the threadiverse?

@rimu@piefed.social @andrew_s@piefed.social @melroy@kbin.melroy.org @bentigorlich@gehirneimer.de @nutomic@lemmy.ml @angusmcleod@mastodon.social

tl;dr — you can now find remote categories and see your tracked/watched categories in /world.

A new alpha version of NodeBB was tagged today: v4.3.0-alpha.3. The biggest change is to the /world route, which up until now showed a list of topics from outside of the local NodeBB instance.

New to this alpha release:

1. A quick search widget was added, allowing you to directly search for remote categories. There is no need to navigate to to the search page to discover new categories.
2. Your list of tracked and watched categories will show at the top of the page.
   • "Tracking" and "Watching" categories—both local and remote—is how content discovery happens in NodeBB. Tracked categories will have new content show up in the "unread" page, while watched categories take that a step further and notify you when new content is posted.
   • Tracking and watching a category will tell NodeBB to subscribe to that remote community for updates

At this time we're continuing to look for stability issues with the remote category integration. We'll be working on QoL fixes as we move into the beta phase this/next week.

tl;dr — how do PieFed/Lemmy/Mbin handle cross-posting?

Currently, when a NodeBB admin moves a topic from the uncategorized pseudo-category into a local category, we federate out an as:Announce, people typically think of that as a "boost" or "share".

That worked fine when the entirety of the category list was your local categories plus the "uncategorized" pseudo-category. However, now that NodeBB is moving towards supporting remote categories (via group actors), this UX makes less sense. We wouldn't want to "move" a topic out of the category it is supposed to be in, just for visibility to other local users. Additionally, topic moving was limited to administrators, and from the get-go we knew it would eventually cause issues because people other than admins would want to share topics to other local users.

This is where the "cross-post" functionality comes in, which is entirely new to NodeBB. I don't think this is new to other AP-enabled threaded discussion software. The idea would be that if a new topic comes in, whether it's uncategorized or not, any user could "cross-post" that topic to a local category, where it would be visible to other users on that instance. On the ActivityPub side, we would then federate out an as:Announce as we already do.

Is this what PieFed/Lemmy/Mbin already do, if they support cross-posting? What other alternative solutions would there be to this problem?

cc @rimu@mastodon.nzoss.nz @andrew_s@piefed.social @nutomic@lemmy.ml @bentigorlich@wehavecookies.social

As far as ActivityPub posts are concerned, how are Hashtags handled?

Is it just like normal and we add them in the posts?

Hey @mike@flipboard.social, are Flipboard collections (or are they magazines? I forget the term!) federating out as as:Group? I'm wondering whether it would be possible for NodeBB to load them in as categories, and be able to browse them natively...

I'm just not able to easily find them in the Flipboard UI right now, but I'm relatively new at using the app :)

Happy Tuesday!

Today we've updated the NodeBB community forum onto the remote-categories testing branch, which means that users on the open social web that identify themselves as "Groups" will be rendered in NodeBB as categories. Prior to this, they looked like users.

Here are some examples of remote categories:

• Comic Strips (on lemmy.ml)
• Star Trek Social Club (on startrek.website)
• Social Web Foundation (a WordPress blog)

ActivityPub "groups" and forum categories have quite a few things in common — they don't usually post topic themselves, they "contain" topics, and they are usually administered by a separate group of users (moderators!) In many ways, these groups lend themselves to categories much more easily than they do as users.

Notes:

• We will likely be releasing this as v4.3.0-alpha this Wednesday. Probably this means you don't want this on a live forum just yet.
• A lot of the backend logic is complete, but a lot of the frontend UX will be worked on.
• You can "search" for categories (via "in categories" in the search page), paste the full handle in order to instruct NodeBB to pull a new category in.
• You can now no longer mention a remote category. Instead, create your topic right in that category itself. As it should be :smirk_cat: .
• Remote content coming in that is slotted into a remote category will still show up in your "world" feed. That is still intended to be where discovery of content outside the local NodeBB instance will take place.
• Report any bugs or confusing behaviours (and there will be some) here.

Screenshots

The upcoming possibility of browsing to remote federated categories/communities has me thinking about interesting use cases for it.

Note that Lemmy, PieFed, mBin, and other "community-centric" software already do support this, so it's nothing new, I'm actually playing catch-up.

One interesting use case centers around NodeBB's /unread route, which tracks new topics since your last visit. Since ever, and even now in v4, this is only for local categories, but if you're able to "subscribe" to a remote category, then we could enable use of this page for that content too.

Think about waking up and seeing a self-curated feed of new content from your subscribed communities! There are some interesting parallels to RSS here, too.

What other forum-centric use cases do you think would be enhanced by the ability to browse remote categories?

Hi @andrew_s@piefed.social/@freamon and @nutomic@lemmy.ml —I'm working (not-so-secretly) on refactoring NodeBB so that it is able to "browse" remote audiences/group actors, and that would include things like PieFed and Lemmy communities.

N.B. Given varied nomenclature (group/category/community/subforum), the ForumWG calls this structure an "audience".

Where I am at now is working through the logic for slotting an object into a category.

The most obvious choice here would be to look at as:audience. It's even specified in 1b12, and the majority of threaded implementations follow 1b12.

I am making this post because nutomic explicitly removed the audience from being served in Lemmy (as of January this year), so I don't think relying on that property would be wise.

I asked in that issue whether Lemmy finds community via to/cc (it does). Does PieFed do the same?

Would this also open up the possibility of a topic/context being part of multiple audiences/communities? Interesting...

I followed mander@medicine.xyz from my account on this instance, and another nodebb instance. This one shows Following, the other shows pending! Follows dont need acceptance do they, why the difference?

Also, why a settings icon only on my nodebb instance?!

@hamishcampbell@mastodon.social recently made a statement that got me thinking about our place in the open social web, and the direction it's going.

He says to @deadsuperhero@social.wedistribute.org and @evan@cosocial.ca re: SXSW

> #FediverseHouse this feels like an irrelevant echo chamber, I really miss the grassroots #DIY that built this space in the first place. This #maistreaming is too much noise vs signal... currently the grassroots #DIY space is a hollow shell

(two posts combined)

That immediately got me on edge as someone new to ActivityPub in 2024. Does this mean I'm "mainstream", and somehow "bad"?

Mainstream adoption is good and a step in the right direction. I personally think ActivityPub isn't ready for general mainstream consumption, but we as a group are rapidly closing the gap and I'd much rather continue building momentum instead of waiting for the opportune moment.

Here's the hot take that I was going to originally write, but thought came off as too combative:

> It sounds like you feel like ActivityPub development only counts when you're toiling away in obscurity.

As someone who's hacking away on a platform that hasn't been "mainstream" for over a decade (forum/BBS software), I bristle at the notion that what I do doesn't count as grassroots or DIY. You don't have to be the perpetual underdog to do good in the world.

I might be wrong, but it sounds like Hamish feels like big players are coming in and taking the ball away... that big players' clout and presence takes away from the attention that smaller DIY projects receive.

Maybe... but if the fediverse is 100x larger with a big player, and they take 99% of the eyeballs, have they really taken anything away from you?

So I was wondering if there was a way for me to have a Category follow a federated account.

I can't seem to find the way to do it if that's possible.

But optimally the category would post a topic related to the new posts the followed account would post. Or something like that.

Wanted to start a convo with @johnonolan@mastodon.xyz from Ghost and @angus@socialhub.activitypub.rocks from Discourse about AP resource discovery.

A common use case from fediverse users is to be linked out to a site, and attempt to "bring it in" to their local instance/app of choice. This is done by taking the browser URL and pasting it into their site/app's search bar, or equivalent.

For example:

• Ghost: https://activitypub.ghost.org/warp-factor-5-mr-sulu/
• Discourse: any forum topic

For context, last night I discovered that Ghost's latest blog post didn't make it into NodeBB, due to a bug on my end. I attempted to resolve it via URL but there was no AP resource at that URL. I ended up having to query the instance actor (which I happened to already know), and looking at the outbox.

To my knowledge there is no way to find a Discourse post or topic's AP resource ID without having a local Discourse account.

Would it be possible for you to send back an HTTP 301 Moved Permanently (or similar) if the Accepts header contains one of the AP-related types?

N.B. This probably has some overlap with @evan@cosocial.ca's HTTP Discovery Task Force, a 308 is recommended there.

Hey @dansup@mastodon.social, can I poke you about getting NodeBB on FediDB?

It automatically picked up a couple NodeBB sites, so I think the nodeinfo stuff is working, just not sure if it required some manual intervention on your end to get the software link working — it currently 404s.

Cheers :flag-ca:

For awhile now we've hosted https://try.nodebb.org/ as our demo instance for people to see a plain NodeBB instance.

I have added a federated category on that instance now. You can of course still make test posts to this instance, but you can also feel free to fill @federated@try.nodebb.org with garbage instead :laughing:

Please note that the "try" instance of NodeBB is reset every 24 hours, which means all follow relationships, content, etc. will only last at most that long. If you follow the category or an account on that instance, those categories/users will "forget" you followed them.

The logs from this are already cleared on my server, but when I sent a private message (standard Create/Note with a single recipient who also has a Mention in the tag property) from my custom software to my account here, I received a 500 error saying something like "cc is not iterable" (though I don't know the exact phrasing). When I included cc as an empty array, it started working. Not sure whether it was missing on Create or Note, maybe it was both.