Display

Streams

Wed, 30 Aug 2023 15:20:12 -0700 from Y

Mike Macgirvin wrote the following post Wed, 30 Aug 2023 15:18:56 -0700

!Streams

Fresh release from the streams repository. Available now.

Includes some enhancements to our defenses against Meta/Threads after reviewing their updated ToS.
Also includes access to protected content via OpenWebAuth over Opensearch.
And some other stuff.

You will want this update regardless of your stance regarding Meta.

If you are uncomfortable with Meta and their business practises, visit 'admin/security' and add 'threads.net' to 'Block communications from these sites' -- and also set 'Require signed fetch requests'.

@Mike Macgirvin

Bill Statler

Wed, 30 Aug 2023 16:50:39 -0700 from Bunny of Doom

What are "signed fetch requests", and is this something I might want to turn on for reasons other than Meta?

Bill Statler

Wed, 30 Aug 2023 18:50:15 -0700 from Bunny of Doom

Ah, I found this. It's written from a Mastodon perspective, but I assume their AUTHORIZED_FETCH is a similar thing.

What does AUTHORIZED_FETCH actually do?

A hopefully more approachable explanation of the Mastodon configuration settings Authorized Fetch and Disallow Unauthenticated API Access

I gather that there are some compatibility issues with some Fediverse servers?

Mike Macgirvin

Thu, 31 Aug 2023 04:02:07 -0700 last edited: Thu, 31 Aug 2023 04:50:22 -0700 from zap

The long story is that we normally provide unauthenticated access to public content because heck you can see it without authentication over HTML. Why shouldn't you be able to see it without authentication over JSON?

We also considered actor records to be public.

This gives you the choice to shut off activitypub access to anonymous viewers, and also puts access to actor records under control of blocklists instead of considering them to be public information. If the site admin blocks meta, it blocks it for everybody on the site.
Each channel can also block meta from harvesting their profile, even if the site owner doesn't.

Mike Macgirvin

Thu, 31 Aug 2023 13:35:38 -0700 from zap

Just to clarify - we have always required signatures/identification to access private/protected information. The security setting mentioned controls whether or not public information is accessible via ActivityPub (and Nomad) without a signature.

There should be very little impact to enabling this in 2023 since most if not all fediverse software sends signatures with every request and has for the last few years. Requests for things like actor records are usually signed by the so-called 'system channel' which acts on behalf of all site members when it isn't obvious who should sign for it.

Papa Dragon

Fri, 01 Sep 2023 02:54:11 -0700 from CaseLibre

Now also available using the YunoHost package!

st.dowa (no more available)

Fri, 01 Sep 2023 02:56:22 -0700 from Dowa (streams) EOL

Thank you for maintaining. 👍🏼