fediverse – Terence Eden’s Blog

ActivityPub - How to send an updated user profile to Mastodon and the Fediverse

Terence Eden — Sat, 12 Sep 2026 11:34:02 +0000

Let's suppose you've updated the description of your ActivityPub account from "World's Number 1 Taylor Swift Fan" to "This account is now a Nickleback Truther". How do you let the rest of the Fediverse know that you've changed your allegiance?

By default, most Mastodon instances won't periodically poll your account information just to see if you've updated it. So how does the information get from your server to your followers' servers?

This wasn't immediately obvious to me, but I got a clue from reading Evan Prodromou's book on ActivityPub:

The Update activity type is for updating the properties of an object represented by the object property.

The most common types of objects that can be updated are content objects, like Note or Image. Actor types (like Person) and Question activity types can also be updated.

Aha!

You need to craft an Update message which has as its object the new user information. That needs to be sent to the inbox of all your followers.

Something like this:

{
    "@context": "https://www.w3.org/ns/activitystreams",
    "actor": "https://example.com/user",
    "id": "6a9162a6-a8e5-ca0f-9c08-8e6b814acef8",
    "published": "2026-08-31T12:34:56+01:00",
    "to": "https://www.w3.org/ns/activitystreams#Public",
    "type": "Update",
    "object": {
        "@context": [
            "https://www.w3.org/ns/activitystreams",
            "https://w3id.org/security/v1"
        ],
        "id": "https://example.com/user",
        "name": "My new name",
        "summary": "A brand new description!",
        …
    },
}

Obviously the full user information is a bit more than that - it will include inbox details, public keys, avatars, etc. The published property in the Update activity should be when you changed your details - not when the account was created.

Once that was sent, Mastodon immediately reflected the changes.

Thanks to NLnet

This blog post was funded in part by the work I'm doing for my NLnet NGI0 grant to develop ActivityBot.

ActivityBot is the recipient of an NLnet grant!

Terence Eden — Sun, 30 Aug 2026 11:34:55 +0000

Back in February, I applied for NLnet's Next Generation Zero grant. They were looking for Fediverse projects to help rewild the social media landscape. Or, as they describe it:

Reclaim the public nature of the internet

Small and medium-sized R&D grants between 5.000 and 50.000 euro, with the possibility to scale up.

I run ActivityBot - it is a single-file ActivityPub server suitable for launching automated accounts and designed as a learning tool for those who want to understand how the protocol works. Several people have told me how useful it is, but I haven't had the time to make it better. So I decided to stick in a last-minute application to the fund.

I really didn't know how much to apply for - or even if my project would be suitable for funding - so I cheekily asked for €10,000. After a few months of back-and-forth, I'm delighted to announce that I was successful!

In the spirit of openness, this blog post details how the NLnet grant process worked for me and what I'll be using the money for.

The Process

The application was delightfully simple. Here's what it asked for, along with my answers. If you apply, please don't copy these verbatim; use your own words.

Abstract : A single file server for ActivityPub. Designed for write-only bots. Allows any project to quickly and easily start publishing automated content to the Fediverse. Uses PHP, no other dependencies.
Experience : I am the sole developer of Single File ActivityPub - https://gitlab.com/edent/activitypub-single-php-file
I was formerly the UK Government's representative to the W3C and have contributed to various ActivityPub projects and specifications.
Amount : € 10000
Use : The fund will be used for development, testing, promotional activity (including conference travel).
I anticipate this will fund 6 months of development. I have funded all previous development.

Comparison : Most ActivityPub services are complex. They implement a full specification and are designed for multi-user environments. Other projects allow reading and writing. ActivityBot is deliberately designed to be as simple as possible. A single file to upload, one user, publish only.
This will enable more projects to be able to instantly start publishing with low development cost and close to zero hosting cost.
Challenges : Formal spec verification and a security audit will be the main technical challenges. The ActivityBot software has been running well for over a year. The funding will allow for better compatibility and security.
Ecosystem : The project has mostly targeted individuals who want to run small bots. After further development, the project will engage with IoT providers, smaller publishers, open source projects who wish to publish updates, and other relevant parties.

I was told there was intense competition. After a couple of months, I received word that I'd made it to the 2nd round.

What then followed was a very polite interrogation about my ideas, how I would develop the project, what I would use the money for, and what my AI usage policy was. They also wanted a breakdown of the main tasks - with the understanding that this would be a provisional document subject to change.

I was on a train through Europe when I wrote this. I don't claim it to be a brilliant document - but it got the job done!

1. User Research
Recruit 2 - 5 potential users. Offer an incentive (approx £20ea) to participate in a user research session. Study design will take 1 - 2 days. Each interview and write up to take 1 day. Consolidation and report 2 days.
Total effort 3 - 4 weeks.
2. Standards Research
Participate in ActivityPub user communities and standardisation groups. Attend virtual conferences (or any local to the UK). Approx 1 day per week for 6 months.
3. Test Driven Development
Create modern test harness, write test suite, iterate design based on tests. Anticipated effort 2 days per week for approx 3 months.
4. Security Testing
Work with the community and security professionals to test the resultant code. This will use human testers and normal fuzzers - this will not use AI tools. Anticipated effort 2 days per week for approx 2 months.
5. User Acceptance Testing
Recruit 2 - 5 potential users (ideally different to the research participants). Offer an incentive (approx £20ea) to participate in a user acceptance session. Study design will take 1 - 2 days. Each interview and write up to take 1 day. Consolidation and report 2 days.
Total effort 3 - 4 weeks.
6. Updates Based on Research, Testing, and Security
While it would be lovely to anticipate getting everything right first time, the reality is that changes will need to be made based on the findings of the above. This will take up the remainder of the allocated time.

Again, there was a little more back and forth. But a few weeks later I was informed that I was at the final stage, pending review. And, a few weeks after that, I was told my project had been given the green light.

I was invited to a group call where the very friendly team discussed the practicalities of the grant, what it could and couldn't fund. I also met a bunch of other people who'd also won.

The final stage was writing a proper Memorandum of Understanding. With the help of one of the team (thanks Victoria!) I was able to turn my scrappy plan into something a bit more formal. The project tool NLnet uses made it easy to build up a plan and put € amounts by each task.

The idea is that I will invoice against the grant whenever I have completed a task or sub-task. Obviously I don't want to leave invoicing until the end of the project, but I also need to be mindful of the foreign exchange fees charged by my bank for receiving Euro payments.

Final Project Plan

This is the plan I submitted. It represents what I hope to accomplish and how I'll draw down on the grant. I suspect this will change as the months go on.

ActivityBot is an Open Source project which aims to develop, maintain, and improve a minimum viable ActivityPub server in a single PHP file.

The project is run by Terence Eden (trading as @edent); a developer residing in England.

This project is expected to run for approximately 6 months. All of the deliverables will be openly licenced using either an OSI approved software licence or a Creative Commons licence.

The high-level aims of the project are for ActivityBot to be:

A fully compliant ActivityPub server, running in a single PHP file.
A teaching tool to help developers understand the practical aspects of creating an ActivityPub server.
A practical method of publishing automated messages to the Fediverse.
A promotional tool to show how simple and easy ActivityPub development can be.
A secure and usable tool written in modern PHP.
Written by humans, with no AI/LLM generated code.

In light of NLnet's non-profit status, costs assume a discounted rate of €330 per day (£280). Incidentals such as hardware, software, travel, or sundries will be charged at cost with receipts provided.

Prepare for initial release

Ensure that the project is in a suitable state for initial release and future development.

Deliverable: Updates published to GitLab.

€495 Prepare initial release. Clarify licencing, solicit community engagement, include example usage.
€495 Standards Research. Collation of standards websites. Ensure code comments refer to specific standards. Publish blog post(s) about findings for others to reference.

User Research

Recruit up to 10 participants for a user-research study. Participants should represent the diversity of the Fediverse.

Investigate what participants want from a tool like ActivityPub. The project plan may be adapted following the results of this study.

Deliverable: Study plan and results will be published and given a Creative Commons licence. Changes based on the results will be pushed to GitLab.

€660 Study Design and recruitment of participants (blog post published as deliverable).
€990 Two days of user interviews, write up and publish results as blog post.

Test Driven Development

Create a modern test harness, write test suite, iterate design based on tests.

Deliverable: Tests published to GitLab. Blog posts published about the process and results.

€330 Set up test suite
€330 Write tests
€330 Fixes based on test results

Security Testing

Working with NLnet's security offering, ensure that the project meets modern security requirements.

€720 Work with security team to assess security risks and possible mitigations. Fixes based on security team feedback

Deliverable: Updates published to GitLab. Blogs published about the process and results.

User Acceptance Testing

Recruit up to 10 participants for a user-acceptance study. Participants should represent the diversity of the Fediverse.

Investigate whether participants are able to use ActivityBot. See which aspects need improvement. The project plan may be adapted following the results of this study.

Deliverable: Study plan and results will be published and given a Creative Commons licence. Changes based on feedback will be published to GitLab.

€660 Study Design and recruitment of participants (blog post published as deliverable).
€990 Two days of user interviews, write up and publish results as blog post.

Conferences and Standards Work

Open Source participation often depends on attending conferences, either in person or virtually. Getting involved in the standardisation process ensures that future versions of ActivityPub and associated standards will be suitable for the community.

Deliverables: Presentations material (slideware), speaking at conferences (may be published as video), conference outputs. Where possible, these will be available under a suitable Creative Commons licence.

€700 Travel and accommodation to one EU conference
€330 Publishing blog posts about ActivityPub standards work.
€330 Publishing blog posts about ActivityPub standards work.

Final release

Creating a final release for this phase of the ActivityBot project. This will involve incorporating all feedback received so far, improving documentation, and publishing code.

Deliverable: Updates published to GitLab. Blog post written. Release announcements.

€330 Phase 1: Process and implement feedback from users
€330 Phase 2: Bug fixes
€330 Phase 3: Features
€330 Phase 4: Bug fixes
€330 Phase 5: Features
€330 Phase 6: Remedial work
€330 Process and implement feedback from accessibility scan
€330 Final release

Next Steps

I've already begun work on updating the code. If you'd like to get involved, or have suggestions or bug reports - please take a look at ActivityBot on GitLab.

I'll be putting out a call for user-research participants once I've had a chance to catch my breath 😆

Scattered thoughts on social geolocation

Terence Eden — Wed, 22 Jul 2026 11:34:12 +0000

I want to be able to share my location with my friends on social media. Twitter (RIP) had a way to attach an optional location to a post. Facebook still lets me check in to venues. But neither ActivityPub (Mastodon) nor AT Protocol (BlueSky) allow me to do that.

I've been banging on about this for a while so was delighted to be invited to chat with the GeoSocial Task Force on their monthly call.

But, before I start, please remember that these proposals are not mandatory. If you don't want to share your location, then please don't share your location. This is an optional feature which shouldn't be used by people with a strong need for privacy.

We were primarily discussing the nascent Geographical Microsyntax proposals.

Firstly, I love the idea of being able to share my location. I want my friends to know I'm in town for a gig. I want people to think I'm cool because I'm seeing some experimental theatre. I want to virtue signal that I'm giving blood.

Similarly, I want to be able to find social media posts by location. What's happening right now in Paris? Did anyone else hear that sonic boom in London? Which cool people are also at this gig with me?

But, I do think these proposals have some issues which need to be addressed.

User Research

The primary thing missing from the proposal is any form of understanding what users want to do with a geotagged post.

You see a post like:

Hanging out with friends. I just checked in to Leicester Square.

What do you expect to happen when you click that link?

See who is at the location?
Read more information about the place being discussed?
Find all posts at that specific address?
Discover posts which are close to there?
Something else?

What other things do people want to do with geotagged posts?

Find all posts within 5Km of me?
Discover users who have posted near me?
Get emergency alerts for the city I'm in?
See what's trending in a specific country?

Without knowing what people might want to do with this information, it's rather hard to design a service which meets their needs.

To micro or not to micro?

Where I disagree with the proposals is the idea of using inline text as a form of microsyntax.

Proposals like "I am in /London/ eating ice-cream" or "Checked in to Leicester Square L:N123456" fail for a couple of reasons.

Things like #hashtags and @mentions developed organically on social networks before they were eventually adopted by the platforms themselves. It is rare that a top-down diktat can be used to tell people how they should be formatting their posts.

More importantly, people are crap at formatting things consistently! Every event I go to has people using #Event alongside #Event2026 or #Event26 or a hundred variations.

Even if users could format it consistently, names are ambiguous. Is 🌐:Paris the one in France or Texas?

I'm strongly of the opinion that text is for text, not syntax.

Openness 🆚 Centralisation

Saying that you're on a specific point on the globe doesn't always provide useful information. Even with altitude, it isn't always possible to work out if your in the Starbucks or the Costa next door. Do you want to say you're in a train station, or a distinct platform, or even a specific train journey?

There are various services which offer unique IDs per loosely-defined place.

Google Maps provides a Place ID for every thing that it knows about. There's a similar service from FourSquare. But both of those are closed and proprietary systems - they can only be updated by the company that creates them.

Wikipedia's Wikidata has IDs for lots of places, similarly OpenStreetMap has nodes with names which can be used to identify locations.

But all of these suffer from the same flaw; they are centralised.

If Google kills its service then all those Place IDs die.

This has happened before. Yahoo used to run the Where On Earth IDentifier service but discontinued it.

While OSM and Wikipedia are great projects, they're still centralised. If you're banned from OSM, you can't create a new node.

So, to my mind, the primary way of identifying a place has to use a fully open, globally agreed, and unrestricted standard.

Location Plus Plus

The obvious choice is latitude and longitude as defined by WGS 84. It allows for arbitrary precision anywhere on the planet.

No one can stop you issuing lat/long just because a country is under sanctions. The standards community can't revoke your access to it. The co-ordinates are well understood by almost all software.

There are some alternatives. Google's Plus.Codes build on top of lat/long to make something more human readable. But, crucially, human readability is not the issue here. This is metadata which should never be shown to a human. If a user interface wants to format a lat/long they can do so as a Plus.Code or any other format.

GeoJSON

There are dozens of competing ways to mark up a location.

It seems sensible to me that, given most major social media protocols use JSON, adding GeoJSON would be the simplest way to add geographic information to a post's metadata.

At its most basic, a single "Point" can be shared like so:

{
    "type": "Feature",
    "geometry": {
        "type": "Point",
        "coordinates": [-0.13005,51.5103]
    }
}

It can have as much or as little precision as needed.

If the place being checked into has a name, it can also be added - this could be used for display purposes within the message

{
    "type": "Feature",
    "geometry": {
        "type": "Point",
        "coordinates": [-0.13005,51.5103]
    },
    "properties": {
        "name": "Leicester Square"
    }
}

The properties can be as complex as the sender wants. For example it could add Wikidata references, OpenStreetMap IDs, telephone numbers, or some cool new thing which hasn't been invented yet.

Here's a maximalist example of checking in to a park:

{
    "type": "Feature",
    "geometry": {
        "type": "Polygon",
        "coordinates": [
        [
                [-0.1303791,51.5099976],
                [-0.1295305,51.5100444],
                [-0.1297077,51.510947 ],
                [-0.1308786,51.5105859],
                [-0.1308893,51.5105793],
                [-0.1303791,51.5099976]
            ]
        ]
    },
    "properties": {
        "name": "Leicester Square",
        "WikiData": "Q848912",
        "OSM": "4082589",
        "GooglePlaceID": "ChIJPcTFENIEdkgR94E58rgB69o",
        "PlusCode": "9C3XGV69+4X",
        "Quinfrob": "🌐89451_𰻝",
        "address": {
            "road": "Leicester Square",
            "neighbourhood": "St. James's",
            "quarter": "East Marylebone",
            "suburb": "Covent Garden",
            "city": "City of Westminster",
            "ISO3166-2-lvl8": "GB-WSM",
            "state": "England",
            "ISO3166-2-lvl4": "GB-ENG",
            "postcode": "WC2H 7NA",
            "country": "United Kingdom",
            "country_code": "gb"
        }
    }
}

What's Next

My personal opinion is that the following needs to happen:

Talk to some users - find out what they might use this for.
Work with privacy advocates to reduce possible harms (for example, being able to redact a location from a previously shared post).
Discuss with developers about how they'd work with this metadata.
Clients should start adding GeoJSON metadata to their posts, even if it can't be displayed yet.

You can read the minutes of the meeting and I'd encourage you to join the next call.

Now witness the power of this fully operational Fediverse!

Terence Eden — Sun, 23 Nov 2025 12:34:35 +0000

How can you measure the popularity of a social network site? Perhaps by counting the number of active accounts, or the quality of the discourse, or even how many people reply to your witty memes.

Me? I prefer to look at how many people visit my blog from each site. It is an imperfect measure - and a vain one - but lets me know where I should be spending my time. No point posting on a network which is just bots talking to each other, right?

Earlier this year I built a stats-counter for my blog. Every time someone clicks from a website which links to my blog, it records that visit in a database. I get to see which blog posts are doing numbers, and where those numbers came from.

Until fairly recently, the Mastodon social network didn't send referer details. I thought that reduced the visibility of the network and lobbied for it to change. As various Mastodon servers upgrade, and admins opt-in, it is becoming more apparent just how much traffic originates from the Fediverse.

Over the last few weeks, here's how many people have clicked from BlueSky and Mastodon to one of my blog posts.

Total	Source
1,607	bsky.app
752	mastodon.social

At first glance, it doesn't look good for our elephantine friends, does it? The butterfly sends over twice the traffic. Game over!

But, of course, while Mastodon.social is the biggest instance - it is far from the only one. What happens if we slide down the long tail? Here's all the Mastodon-ish instances which sent me over 10 clicks.

Total	Source
193	phanpy.social
120	android-app://org.joinmastodon.android/
106	infosec.exchange
62	mas.to
59	mstdn.social
55	social.vivaldi.net
49	wandering.shop
48	fosstodon.org
33	mathstodon.xyz
27	mastodon.online
26	mastodon.scot
24	app.wafrn.net
19	indieweb.social
18	social.lol
17	tech.lgbt
17	toot.wales
16	en.osm.town
16	feditrends.com
14	mstdn.ca
14	piefed.social
12	wetdry.world
11	c.im
11	mastodon.nl
51	Sites sending < 10 clicks

Ah! Add them all up and you get a grand total of 1,773 visitors from Mastodon-powered sites. That's more than BlueSky.

Now, there are some obvious caveats to the data:

I have a smaller follower count on BlueSky than I do on Mastodon.
My posts may appeal more to one demographic than another.
People may have strict privacy controls which suppress the true volume of visitors.
There's no way to measure how long someone spends reading my posts.
RSS and newsletter visitors aren't counted.
Clicks from apps may not always show a referer.
Some people may be on multiple services.
Fediverse users can follow the post directly, so don't need to visit the site to read it.

And yet… no matter how you slice it, Fediverse servers are sending as much traffic as BlueSky!

I think this is brilliant. Web services should be able to scale from small to big - and each ActivityPub-powered site helps power the open Internet.

Just for completeness, this is how Reddit, Facebook, LinkedIn, Twitter, and Lemmy do over the same period:

Total	Source
1,158	reddit.com
585	android-app://com.reddit.frontpage/
76	facebook.com
76	https://old.reddit.com/r/programming/
56	https://www.reddit.com/r/programming/
52	youtube.com
41	t.co
38	https://old.reddit.com/r/todayilearned/comments/1nsw7f4/til_in_mongolia_instead_of_a_street_address_a/
31	linkedin.com
27	android-app://io.syncapps.lemmy_sync/
27	https://www.reddit.com/r/todayilearned/comments/1nsw7f4/til_in_mongolia_instead_of_a_street_address_a/
22	https://old.reddit.com/r/programming/comments/1n96ftn/40_years_later_are_bentleys_programming_pearls/
22	lemmy.ca
17	android-app://com.linkedin.android/
16	lemmy.dbzer0.com
14	feddit.org
11	https://www.reddit.com/r/programming/comments/1n96ftn/40_years_later_are_bentleys_programming_pearls/
10	discuss.tchncs.de
10	l.instagram.com
8	lemmy.blahaj.zone
6	https://www.reddit.com/r/GrapheneOS/comments/1m2l84b/considering_making_the_switch_does_google_pay/
6	reddthat.com

If you add up all the Lemmy instances, they send about as much traffic as Facebook and LinkedIn combined. That's not a huge surprise - those platforms hate anyone clicking away to the wider web.

Twitter is basically the Dead Internet. I'm no longer on there, but I do occasionally search it to see who is sharing my posts. The popular posts I write get shared a lot - sometimes by accounts with huge followers - yet there are no comments or retweets and barely and clicks.

I don't do Instagram or Threads, and that might be reflected in their low numbers. But I'm not active on YouTube either - yet people there occasionally link back to me.

Final Thoughts

Firstly, my stats only represent my site. Your site might be very different.

Secondly, I've ignored search engine traffic, big blogs, newsletters, and other sources.

Thirdly, and most importantly, this isn't a competition! The desire for a "winner-takes-all" service is dangerous and disturbing. An ecosystem is at its most vibrant when there are multiple participants each thriving in their own niche.

I want a thousand sites, running a hundred different software stacks, some of which only serve a dozen people, or even a lone participant.

Diversity is strength.

Getting started with Mastodon's Quote Posts - technical implementation details for servers

Terence Eden — Fri, 03 Oct 2025 11:34:27 +0000

Quoting posts on Mastodon is slightly complex. Because of the privacy conscious nature of the platform and its users, reposting isn't merely a case of sharing a URl.

A user writes a status. The user can choose to make their statuses quotable or not. What happens when a quoter quotes that post?

I've read through the specification and tried to simplify it. Quoting is a multi-step process:

The status must opt-in to being shared.
The quoter quotes the status.
The quoter's server sends a request to the status's server.
The status's server sends an accept message back to the quoter's server.
When other servers see the quote, they check with the status's server to see if it is allowed.

I'm going to walk you through each stage as best as I understand them.

Opting In

An ActivityPub status message is JSON. In order to opt-in, it needs this additional field.

"interactionPolicy": {
  "canQuote": {
    "automaticApproval": "https://www.w3.org/ns/activitystreams#Public"
  }
}

That tells ActivityPub clients that anyone is allowed to quote this post. It is also possible to say that only specific users, or only followers, or no-one is allowed.

The QuoteRequest

Someone has hit the quote post button, typed their own message, and shared their wisdom. Their server sends the following message to the server which hosts the quoted status. This has been edited for brevity.

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    {
      "QuoteRequest":   "https://w3id.org/fep/044f#QuoteRequest"
    }
  ],
  "type": "QuoteRequest",
  "id":     "https://mastodon.test/users/Edent/quote_requests/1234-5678-9101",
  "actor":  "https://mastodon.test/users/Edent",
  "object": "https://example.com/posts/987654321.json",
  "instrument": {
    "id":           "https://mastodon.test/users/Edent/statuses/123456789",
    "url":          "https://mastodon.test/@Edent/123456789",
    "attributedTo": "https://mastodon.test/users/Edent",
    "quote":          "https://example.com/posts/987654321.json",
    "_misskey_quote": "https://example.com/posts/987654321.json",
    "quoteUri":       "https://example.com/posts/987654321.json"
  }
}

All this says is "I would like permission to quote you."

The Stamp

The quoted server needs to approve this quote. First, it generates a "stamp".

This is a file which lives on the quoted server. It is proof that the quote is allowed. If it is deleted, the quote permission is revoked. When the stamp's ID is requested the stamp must be returned.

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    {
      "gts": "https://gotosocial.org/ns#",
      "QuoteAuthorization": {
        "@id": "https://w3id.org/fep/044f#QuoteAuthorization",
        "@type": "@id"
      },
      "interactingObject": {
        "@id": "gts:interactingObject"
      },
      "interactionTarget": {
        "@id": "gts:interactionTarget"
      }
    }
  ],
  "type": "QuoteAuthorization",
  "id":                "https://example.com/quote-987654321.json",
  "attributedTo":      "https://example.com/users/username",
  "interactionTarget": "https://example.com/posts/987654321.json",
  "interactingObject": "https://mastodon.test/users/Edent/statuses/123456789"
}

If the quoted status is viewed from a different server, that server will query the stamp to make sure the share is allowed.

The Accept

This is the message that the quoted server sends to the quoting server. It references the request and the stamp.

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    {
      "QuoteRequest": "https://w3id.org/fep/044f#QuoteRequest"
    }
  ],
  "type": "Accept",
  "to":    "https://mastodon.test/users/Edent",
  "id":    "https://example.com/posts/987654321.json",
  "actor": "https://example.com/account",
  "object": {
    "type": "QuoteRequest",
    "id":         "https://mastodon.test/users/Edent/quote_requests/1234-5678-9101",
    "actor":      "https://mastodon.test/users/Edent",
    "instrument": "https://mastodon.test/users/Edent/statuses/123456789",
    "object":     "https://example.com/posts/987654321.json"
  },
  "result": "https://example.com/quote-987654321.json"
}

The "result" must be the same as the stamp's URl.

And then?

You can follow and quote @colours@colours.bots.edent.tel on your favourite Fediverse platform.

I've written an ActivityPub server in a single file which is designed to teach you have the protocol works. Have a play with ActivityBot.

Meeting my Fedifriends AFK

Terence Eden — Sat, 14 Jun 2025 11:34:11 +0000

There's a lovely moment in the documentary about The Pirate Bay where Peter Sunde is being interviewed in a District Court:

Prosecutor 1: When was the first time you met IRL?

brokep: We don't use the expression IRL. We say AFK. But that's another issue.

Prosecutor 2: Got to know each other IRL? What is that?

Prosecutor 1: In Real Life.

brokep: We don't like that expression. We say AFK - Away From Keyboard. We think that the Internet is for real.

Isn't that great? Why do some people insist that online relationships are somehow less real than physical relationships?

As part of our recent grand Interrail journey, I wanted to see how many people from social networks I could meet AFK. In the glory days of Twitter, I'm sure I'd've found a friend in every one-horse town. But the fractured nature of networking made it a bit of challenge.

Just before arriving in a new country, I sent out messages saying "Hey, I'm arriving in XYZ tomorrow. Anyone want to meet for a beer?" And, to my surprise and delight, many people did!

In half of the countries we went to, we met new friends. Sometimes for a quick drink, sometimes for dinner, and sometimes for a little exploring of a city. We even got invited to a local geek meet-up. It was lovely. We got tips on how to use the public transport system, which restaurants were tourist traps, and introduced to new beers.

It is nice to put faces to names. It's fun to meet a random friend and chat nonsense with them. And it is reassuring to know that there are people around the world who'll take a risk and meet a weary traveller.

Now, there are some obvious caveats to this story. We only met in well populated areas. I'm a tall bloke with a loud voice. Some light background stalking made sure the people we met weren't too crazy. We didn't get drunk. If you do this - I suggest taking all the normal precautions when meeting strangers. But, in the end, everything was fine.

Sometimes you want to go where at least one person knows your name.

Cheers!

Mastodon Now Sends Referer Headers! Hurrah!

Terence Eden — Sat, 14 Dec 2024 12:34:25 +0000

Back in 2022, I wrote this rather grumpy post on Mastodon, the federated social media platform.

When you click on this link - https://www.bbc.co.uk/news - your browser says "Hey! BBC! Please can I have your /news page? BTW, I was referred here by shkspr.mobi. THANKS!" This is called the "Referer" and, yes, it is mispelt.

One the one hand, sending the referer is good; it lets the linked-to server know who is linking to it. That allows them to see where traffic is coming from. On the other hand, this could be bad for much the same reason.

If you run a server anarcho_terrorists.biz, you probably don't want the FBI knowing that your members are sharing links to their pages. If you run a small personal server, you may not want anyone knowing that you personally linked to them. If you run a server for a marginalised community, you may not want a hate-site to know your members are linking to you.

But if you're a large-ish, general purpose, non-private site - like Mastodon.social - where's the harm in allowing referer headers?

Anyway, for historic reasons, Mastodon blocked the referer header. This, I believe, was sensible for smaller servers but a miss-step for larger servers. As I pointed out last week:

I'm not the only one to make this point - it has been a popular complaint for some time.

A few days ago, Mastodon changed to allow this to be configurable.

This is excellent news. Website owners will be able to (somewhat) accurately see how much traffic Mastodon sends them. That way they can determine if there is a suitably large audience to engage with on the Fediverse.

It is, of course, slightly more complicated than that!

Instance owners can opt-in to allowing Referer headers (it is off by default).
The policy means that only the domain name is sent; not the full page.
Mastodon is federated and there are thousands of sites. Even if they all opted-in, their statistics will be fragmented.
Apps can set their own Referer header - leading to more fragmentation.
Even if they do opt-in, users can set their browsers not to send Referer headers.

Nevertheless, I'm delighted with this change. Hopefully it will allow the Fediverse to grow and attract more users.

Self Hosting is an Unhelpful Term

Terence Eden — Sun, 24 Nov 2024 12:34:05 +0000

Mathew Duggan has a brilliant post called "Self-Hosting Isn't a Solution; It's A Patch". In it, he (correctly and convincingly) argues that compelling people to run their own computer services is a complex and distracting crutch for the current problems we face.

It's expensive to self-host, there are moderation problems, and the difficulty level is too high for most people.

But, in my opinion, I think he misunderstands something about self-hosting because, as a term, it is both misleading and unhelpful. When people say "Defund The Police" what they mean is "Move funds away from miliary style policing and give it to trained mental health professionals" - what people hear is "Abolish the police and let anarchy reign".

The ability to "Self Host" doesn't just mean "run this on a Raspberry Pi in your cupboard and be responsible for constant maintenance". Yes, you can do that if you're a masochist, but it isn't restricted to that.

To me, "Self-Hosting" means "I am in control of where I host something". I currently pay a company to host this blog. It has previously been hosted on Blogger, WordPress, my own VPS, and a variety of other services. Tomorrow I could decide to host it with a big company, or I could run it from my phone. I get to choose. That's what "Self-Hosting" is - a choice in where to host.

Similarly, Mastodon allows me self-host my account. I can have my content on one of the big servers and let them do moderation, storage, and maintenance for me - or I can move my account anywhere I choose. To a server in my cupboard and back again.

Email is similar. I know people who've gone from CompuServe, to HoTMaiL, to Gmail, to their own domain, then to OutLook. Their address-book moves with them. Forwarding rules ensure incoming email is routed correctly. They can choose to actively moderate spam, or outsource it. They can pay a company to host, keep backups in their basement, or watch adverts in return for services.

I agree with nearly everything Mathew says in his post. It is absurdly privileged to think that running your own services is something normal people want to do and are capable of doing. Strong regulation helps everyone, people want simplicity, and ecosystems can be fragile.

But witness all the people moving over from Twitter to new networks. Do they care where their data is hosted and how it is maintained? No! But they want to move their social graph with them. And when BlueSky and Mastodon collapse, people will want to move again.

In the UK, I have the ability to move my phone number between hundreds of providers. If I'm particularly techy, I can even run my own infrastructure and route the number there. People love the fact that they can leave crappy service providers and move somewhere cheaper or with with better customer service or whatever it is they value. I think that's a form of self-hosting; I get to choose who provides my services.

Similarly, I believe people have a desire for "self-hosting" which is difficult for them to articulate. They want to move their data around - be it old photos, a social graph, or a username. Most of them don't really care about the underlying technology (and why should they?) but they do care about continuity of service and being able to escape crappy service providers.

So, that's my reckons. Self-Hosting means you can choose where to host, and I think most people can find value in that.

What do you think?

Set your domain name as your handle for a BlueSky bot which is bridged from the Fediverse

Terence Eden — Thu, 14 Nov 2024 12:34:32 +0000

If you've found this page, it's because you are me in the future and want to remember these instructions!

Create an account on the Fediverse using a domain you control
- For example @user@bots.example.com
Follow the Fediverse-ATProto bridge @bsky.brid.gy@bsky.brid.gy
- Your account will need to be over 2 weeks old and have a name, profile picture, etc.
You now have an account on BSky! Its name will be something like user.bots.example.com.ap.brid.gy
Get the DID of your account
- https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=user.bots.example.com.ap.brid.gy
- Or https://fed.brid.gy/ap/@user@bots.example.com
Add the DID to your domain
- I think the easiest way is sticking it in a plain text file at bots.example.com/.well-known/atproto-did
Use the BSky Debugger to make sure it was successful.
Send a Direct Message from the Fediverse to @bsky.brid.gy@bsky.brid.gy. The message must only contain username bots.example.com.
- That's literally the word username. It isn't your account's username.
Wait a few moments.
Your bot will now be on BSky as https://bsky.app/profile/bots.example.com!

You can see that https://bot.viii.fi/bot is also available at https://bsky.app/profile/bot.viii.fi

Introducing ActivityBot - the simplest way to build Mastodon Bots

Terence Eden — Sun, 10 Nov 2024 12:34:00 +0000

As you may have read, BotsIn.Space is closing down, I have lots of automated bot accounts living on the Fediverse - and I want them to continue posting. Installing and maintaining an entire Mastodon instance sounds like hard work. Paying people to host my stuff feels like putting my fate in someone else's hands.

Say… didn't I write my own ActivityPub server? Why, yes! Yes I did!

I took the code and stripped it down to the bare essentials. All you need to do is upload two files⁰ - index.php and .htaccess - fill in your details, and you're done.

Get the ActivityBot source code on GitLab.

There's no database, no containers, no caching. It is as simple as I could make it

This bot can do the following:

🔍 Be discovered on the Fediverse
👉 Be followed by other accounts
🚫 Be unfollowed by accounts
📩 Send messages to the Fediverse
💌 Send direct messages to users
🖼️ Attach an image & alt text to a message
🕸️ Autolink URls, hashtags, and @ mentions
🚚 Move followers from an old account
🔏 Verify cryptographic signatures
🪵 Log sent messages and error.

That's it! Here's what it doesn't do:

❌ Receive messages (other than follows and unfollows)
❌ Thread replies
❌ Delete or update a post
❌ Create Polls
❌ Attach multiple images
❌ Set focus point for images
❌ Set sensitivity for images / blur
❌ Set "Content Warning"
❌ Accurate support for converting user's text to HTML
❌ Cannot be discovered by Lemmy instances

Grab a subdomain (don't buy a whole new domain name!) and stick this code on it. You'll have an ActivityPub bot running in minutes.

You can follow one of my bots @colours@colours.bots.edent.tel

Feedback very much welcome.

You can also upload a .env file for your configuration if you want. ↩︎

No, ActivityPub votes aren't anonymous

Terence Eden — Mon, 09 Sep 2024 11:34:07 +0000

Several years ago, I posted this poll on Twitter.

Most of the tech world that I interact with has moved to Mastodon and other ActivityPub-based social networks. Decentralised social media is great. It allows you to be fully in control of what you post, what you see, and how you interact with others.

Of course, there are downsides. No centralised authorities means verification is difficult. Abuse (of all sorts) can only be dealt with in a piecemeal fashion. And anonymity takes a bit of a nosedive.

When you block or mute someone, that information might leak to the offending user. By its nature, you need to send a message to someone else's server in order to interact with them.

So what about polls on the Fediverse? This poll, for example, is gathering sensitive personal information.

In order to vote on the poll, your server sends a message to the poll's server saying "I am user @someone@example.com. I wish to vote for option X. Here is an HTTP signature confirming my message."

Does the receiving server abide by GDPR? Who knows!

The specification around questions is a little ill-defined and the Mastodon documentation is also a bit vague. Neither of them discuss privacy.

There is an excellent blog post by Humberto Rocha looking at Mastodon Poll in ActivityPub. It shows quite clearly that a vote is just a normal message which is passed onto the receiving server.

Services like Mastodon won't let the poll's author see who voted for which option. But that's by convention. There's nothing technical to stop them. Indeed, I understand that the Akkoma social network does show users how users voted.

Of course, on a centralised service like Facebook or Twitter your vote is still recorded somewhere. It can be subpoenaed or looked at by unscrupulous engineers.

Privacy is, of course, a social construct. In some communities it might be sensible to have all votes on the public record. In others, it could be deadly. Some countries have laws mandating strong privacy protections, others less so.

Conduct yourself with that in mind!

The Limits of Organic Growth for Startups and Social Networks

Terence Eden — Mon, 05 Aug 2024 11:34:01 +0000

Many years ago, when I was younger and more foolish, I worked for an advertising startup. Things seemed to be going pretty well! The office was expanding, the sales team was screaming into phones, the budget for servers was rising. Growth had been healthy, but now looked to be plateauing.

One day we were summoned into a large conference room. Our CEO was on the speakerphone (I told you this was a long time ago) with an important update on our financial situation.

I think every arsehole in the room puckered. Were we about to be made redundant? No! Far from it. The business had just taken on a massive amount of investment from a prominent Venture Capital fund. The champagne flowed! With this money we could turbo-charge our hiring, build new products, and accelerate our growth.

At least, that's what I thought. In my naïveté, I congratulated our head of sales on the growth of his empire. More money meant more sales staff, yes?

He was glum. "That's not how it works," he explained.

Our large institutional investors had a vast stable of other companies. Each covered a different bit of the tech ecosystem and our advertising business was about to become part of an incestuous web. Every app that the VCs had invested in would now be "encouraged" to use our advertising solution. You don't need a sales team when your customers are your cousins in an arranged marriage.

Similarly, our approved corporate chat tool would be replaced by one from another stable-mate. Who, in turn, would buy advertising from us.

Over the next few months our growth rocketed and almost none of it was organic.

Eventually I left for pastures marginally more ethical than advertising. But I continue to see the same pattern repeat itself.

When you wonder why one social network grows and another doesn't - look at the investors.

For example, I'm sure a lot of Twitter's early growth was organic. But once rich and powerful companies can direct their investments to sign up and route all their customer service / product announcements through there, it exploded. When you have a financial investment at stake, finding ways to boost growth is a priority - and a little mutually reinforced reciprocation goes a long way.

I don't know if Mastodon (and other ActivityPub services) have reached their maximum organic growth. I suspect they have. To be clear, I'm not calling on Mastodon to take on a billion dollars of VC funding. But without sales teams and without a bunch of associated organisations forced to use it, I worry that the Fediverse will hit a natural limit.

And, again, I don't know if that's a bad thing per se - but if you're expecting big companies, governments, and your favourite VC-adjacent celebrities to join, you're likely to be disappointed.

The Fediverse of Things

Terence Eden — Sun, 07 Apr 2024 11:34:31 +0000

One of the most frustrating things in modern technology is the effort spent trying to artificially restrict abundance.

Take, for example, this tale from museum-worker Aaron Cope:

I was out with a friend who worked for Twitter and I asked them whether it would be possible for the museum to “create 200,000 Twitter accounts, one for each object in the Cooper Hewitt’s collection”. My friend looked at me for a moment, laughed, and then simply said: No.

In that blog post, Aaron reveals that the San Francisco International Airport Museum is using ActivityPub to create automated social-media bot accounts for all its exhibits and, possibly, every object it hold.

And why not! That would be close to impossible to do on a centralised service. But on a decentralised service under your own control, it is relatively simple. Perhaps I only want to follow the museum's canteen, or I just want to engage with a specific artefact. The Fediverse makes that possible.

This reminds me of the Melbourne "treemail" phenomenon. Every tree in the city had an email address, ostensibly so residents could email maintenance issues for a specific tree. Instead, people started interacting with the trees and sending them little love notes!

Dearest Golden Elm Tree, I finally found you! As in I see you everyday on my way to uni, but I had no idea of what kind of tree you are. You are the most beautiful tree in the city and I love you

A few weeks ago, I read about Ben Smith inventing Tweeting trains. With a bit of code, every train line in the UK was suddenly represented on the web in a convenient format. Well… Convenient if you were on Twitter.

Museums, trees, and trains naturally brings me on to the Internet of Things. I think it is fair to say that IoT is in a bit of an odd place right now. Matter is a confusing mishmash of standards. Security and privacy issues dog the simplest devices. Many people don't even want their toaster online!

For the majority of domestic uses, people want an Intranet of Things. There's little need to have your light-bulbs controlled when you're outside of WiFi range. Similarly, it is probably a really bad idea to have your hydroelectric dam connected to the Internet.

Which brings me back to the Fediverse.

On the one hand, it would be nice to be able to follow @Yellow_Line@Transit_Authority.gov - or even @Bus_Stop_1234@bus_company.biz - that would allow for hyperfocused data getting to the right people. It seems feasible that every civic object could have a Fediverse account. From the individual streetlights to the municipal sewerage system. Perhaps people won't send love letters to overflowing drains - but a social-dashboard of your civic environment could be both practical and delightful.

And, as for your domestic gadgets? Why not give every room, or every light-bulb, in your home a private Fediverse account? You could send a message like:

Hey @thermostat@My_Home.example.com, please set the temperature to 19°C. Thanks!

That might be a bit much! But I like the idea of a private social network which consists of all my IoT gadgets talking to me and each other.

HTTP Signature Infinite Loop?

Terence Eden — Mon, 26 Feb 2024 12:34:28 +0000

I'm trying to get my head round HTTP Signatures as they're used extensively in the Fediverse.

Conceptually, they're relatively straightforward.

You send me a normal HTTP request. For example, you want to POST something to https://example.com/data

You send me these headers:

POST /data
Host: example.com
Date: Sat, 24 Feb 2024 14:43:48 GMT
Accept-Encoding: gzip
Digest: SHA-256=aaC57TDzM0Wq+50We2TkCsdMDvdqON92edg7KI+Hk8M=
Content-Type: application/activity+json
Signature: keyId="https://your_website.biz/publicKey",algorithm="rsa-sha256",headers="(request-target) host date digest content-type",signature="JGQ53kEoIiMWRp9By9jajVGCOCu4n7XBeiA1uY5xLcnAxL2Y1GIgU/...=="
Connection: Keep-Alive
Content-Length: 751

In order to verify the contents of the message, I need to do three things:

Check the SHA-256 hash of the message matches the content of the "Digest" header.
Check the timestamp is somewhat fresh.
Check the signature matches.

The first is simple: base64_encode( hash( "sha256", $request_body, true ) ).

The second is a matter of opinion. I might be happy to receive messages from the distant past or far in the future. For the sake of a little clock drift, let's allow 60 seconds either way.

The third gets complicated.

First, I need to get the public key published at keyId="https://your_website.biz/publicKey".

Next, I need to know which algorithm is being used to sign the headers: algorithm="rsa-sha256"

Then, I need to know which headers - and in what order - are being signed: headers="(request-target) host date digest content-type"

So I create a string using the received details which matches those headers in that specific order:

(request-target) POST /data
Host: example.com
Date: Sat, 24 Feb 2024 14:43:48 GMT
Digest: SHA-256=aaC57TDzM0Wq+50We2TkCsdMDvdqON92edg7KI+Hk8M=
Content-Type: application/activity+json

I can verify if the signature - signature="JGQ53kEoIiMWRp9By9jajVGCOCu4n7XBeiA1uY5xLcnAxL2Y1GIgU/...==" matches by:

openssl_verify(
    $headersString, 
    $signature, 
    $publicKey, 
    $algorithm
);

If that's TRUE then all is well.

But can you spot the implicit problem?

How do I get your server's public key?

I just GET https://your_website.biz/publicKey - but if your server uses something like Authorised Fetch then I have to sign my request to you.

Which means your server will need to validate my signature by obtaining my public key. Which it will get by signing a request and sending it to me. Which, before I return my public key, I will need to validate your signature by obtaining your public key. Which I will get by signing a request... and so on.

This deadlock loop is documented. The usual way around it is either for the sending server to use an instance-specific signature which can be retrieved by an unsigned request, or to allow any unsigned request to access a user's public key.

I get why things happen this way - I just wish it were easier to implement!

Internationalise The Fediverse

Terence Eden — Sat, 17 Feb 2024 12:34:58 +0000

We live in the future now. It is OK to use Unicode everywhere.

It seems bizarre to me that modern Internet services sometimes "forget" that there's a world outside the Anglosphere. Some people have the temerity to speak foreign languages! And some of those languages have accents on their letters!! Even worse, some don't use English letters at all!!!

A decade ago, I was miffed that GitHub only supported some ASCII characters in its project names. There's no technical reason why your repo can't be called "ഹലോ വേൾഡ്".

Similarly, I'm frustrated that Mastodon (the largest ActivityPub service) doesn't allow Unicode usernames and has resisted efforts to change.

So I built a small ActivityPub server which publishes content from an Actor called @你好@i18n.viii.fi - it is only a demo account, but it works!

Some ActivityPub clients report that they are able to follow it and receive messages from it. Others - like Mastodon - simply can't see anything from it. Take a look at the replies on Mastodon to see which services work. You can also see some of its posts on the Fediverse.

What Does The Fox Spec Say?

The ActivityPub specification says:

Building an international base of users is important in a federated network. Internationalization

I can't find anything in the specifications which limits what languages a username can be written in. But there are a few clues scattered about.

The user's @ name is defined by preferredUsername which is:

A short username which may be used to refer to the actor, with no uniqueness guarantees. 4.1 Actor objects

There's nothing in there about what scripts it can contain. However, later on, the spec says:

Properties containing natural language values, such as name, preferredUsername, or summary, make use of natural language support defined in ActivityStreams. 4. Actors

So it is expected that a preferred username could be written in multiple scripts. Which implies that the default need not be limited to A-Z0-9.

The ActivityStreams specification talks about language mapping.

Finally, the ActivityPub specification has some examples on non-Latin text in names.

So, I think that it is acceptable for usernames to be written in a variety of non-Latin scripts.

But What About...?

There are usually a few objections to "Unicode Everywhere" zealots like me. I'd like to forestall any arguments.

What about homograph attacks?

Well, what about them? ASCII has plenty of similar looking characters. I doubt most people would notice when a capital i is replaced by a lower L - and vice-versa. Similarly the kerning issue of an r and n looking like an m is well known. Are mixed language homographs more dangerous? I don't think so.

What if people make names that can't be typed?

Well, what if they do? Maybe not being found by people who can't type your language is a feature, not a bug. But, anyway, clients can let users search for other people, or copy and paste their names.

What about weird "Zalgo" text?

It is up to a client to decide how they want to render text input. The "problems" of strange Unicode combinations are well known. This is not a hard computer-science problem.

What about bi-directional text?

The spec makes clear this is allowed.

Do people even want a username in their own script?

I have no evidence for this. But I bet you'd get pretty frustrated if you had to switch keyboard just to type your own name, wouldn't you? In any case, why can't I have a username of @😉

What's Next?

If you build ActivityPub software, give some thought to the billions of people who don't have names which easily fit into ASCII.

If your software can see @你好@i18n.viii.fi and its posts, please let me know.

A (tiny, incomplete, single user, write-only) ActivityPub server in PHP

Terence Eden — Sat, 03 Feb 2024 12:34:51 +0000

I've written an ActivityPub server which only allows you to post messages to your followers. That's all it does. It won't record favourites or reposts. There's no support for following other accounts or receiving replies. It cannot delete or update posts nor can it verify signatures. It doesn't have a database or any storage beyond flat files.

But it will happily send messages and allow itself to be followed.

This shows that it is totally possible to broadcast fully-featured ActivityPub messages to the Fediverse with minimal coding skills and modest resources.

Why

I wanted to create a service a bit like FourSquare. For this, I needed an ActivityPub server which allows posting geotagged locations to the Fediverse.

I didn't want to install a fully-featured server with lots of complex parts. So I (foolishly) decided to write my own. I had a lot of trouble with HTTP Signatures. Because they are cursed and I cannot read documentation. But mostly the cursed thing.

How

Creating a minimum viable Mastodon instance can be done with half a dozen static files. That gets you an account that people can see. They can't follow it or receive any posts though.

I wanted to use PHP to build an interactive server. PHP is supported everywhere and is simple to deploy. Luckily, Robb Knight has written an excellent tutorial, so I ripped off his code and rewrote it for Symfony.

The structure is relatively straightforward.

/.well-known/webfinger is a static file which gives information about where to find details of the account.
/[username] is a static file which has the user's metadata, public key, and links to avatar images.
/following and /followers are also static files which say how many users are being followed / are following.
/posts/[GUID] a directory with JSON files saved to disk - each ones contains the published ActivityPub note.
/photos/ is a directory with any uploaded media in it.
/outbox is a list of all the posts which have been published.
/inbox is an external API endpoint. An ActivityPub server sends it a follow request, the endpoint then POSTs a cryptographically signed Accept message to the follower's inbox. The follower's inbox address is saved to disk.
/logs is a listing of all the messages received by the inbox.
/new is a password protected page which lets you write a message. This is then sent to...
/send is an internal API endpoint. It constructs an ActivityPub note, with attached location metadata, and POSTs it to each follower's inbox with a cryptographic signature.

That's it.

The front-end grabs my phone's geolocation and shows the 25 nearest places within 100 metres. One click and the page posts to the /send endpoint which then publishes a message saying I'm checked in. It is also possible to attach to the post a short message and a single photo with alt text.

There's no database. Posts are saved as JSON documents. Images are uploaded to a directory. It is single-user, so there is no account management.

What Works

Users can find the account.
Users can follow the account and receive updates.
Posts contain geotag metadata.
Posts contain a description of the place.
Posts contain an OSM link to the place.
Posts contain a custom message.
Posts autolink #Hashtags (sort of).
Posts can have an image attached to them.
Messages to the inbox are recorded (but not yet integrated).

ToDo

My account only has a few dozen followers, some of whom share the same sever. Even with cURL multi handle, it takes time to post to several servers.
It posts plain text. It doesn't autolink websites
Hashtags are linked when viewed remotely, but they don't go anywhere locally.
There's no language selection - it is hard-coded to English.
The outbox isn't paginated.
The UI looks crap - but it is only me using it.
There's only a basic front-page showing a map of all my check-ins.
Replies are logged, but there's no easy way to see them.
Doesn't show any metadata about the place being checked-in to. It could use the item's website (if any) or hashtags for the type of amenity it is.
No way to handle being unfollowed.
No way to remove servers which have died.
Probably lots more.

Other Resources

I found these resources helpful while creating this project:

What's Next?

I've raised an issue on Mastodon to see if they can support showing locations in posts. Hopefully, one day, they'll allow adding locations and then I can shut this down.

The code needs tidying up - it is very much a scratch-my-own-itch development. Probably riddled with bugs and security holes.

World domination?

Where

You can laugh at my code on GitHub.

You can look at my check-ins on a map.

You can follow my location on the Fediverse at @edent_location@location.edent.tel

Rebuilding FourSquare for ActivityPub using OpenStreetMap

Terence Eden — Sat, 27 Jan 2024 12:34:55 +0000

I used to like the original FourSquare. The "mayor" stuff was a bit silly, and my friends never left that many reviews, but I loved being able to signal to my friends "I am at this cool museum" or "We're at this pub if you want to meet" or "Spending the day at the park".

So, is there a way to recreate that early Web 2.0 experience with open data and ActivityPub? Let's find out!

This quest is divided into two parts.

Get nearby "Points of Interest" (POI) from OpenStreetMap.
Share a location on the Fediverse.

OpenStreetMap API

OpenStreetMap is the Wikipedia of maps. It is a freely available resource which anyone can edit (if they're skilled enough).

It also comes with a pretty decent API for querying things. For example, nw["amenity"]({{bbox}}); finds all "amenities" near a specific location.

As you can see, it has highlighted some useful areas - a pharmacy and a pub. But it has ignored other useful locations - the train station and the park. It has also included some things that we may not want - bike parking and a taxi rank.

What API call is needed to get useful locations of of OverPass?

It's possible to specify the type of thing to find using nw["amenity"="restaurant"]; - but adding every single type of thing would quickly end up with a very large query containing hundreds of types.

It is also possible to exclude specific types of places. This retrieves all amenities except for fast food joints:

nw["amenity"]({{bbox}});
-
nw["amenity"="fast_food"]({{bbox}});

Again, that would be complex.

Perhaps one solution is just to return everything and let the user decide if they want to check in to a telephone kiosk or a fire hydrant? That's a bit user-hostile.

Instead, this query returns everything which has a name nw["name"]({{bbox}});

That cuts out any unnamed things - like park benches and car-sharing spots. But it does add named roads and train lines.

It is possible to use filters to exclude results from OverPass. The best that I can come up with is: nw["name"][!"highway"][!"railway"][!"waterway"][!"power"]({{bbox}});

That gets everything which has a name, but isn't a highway or railway or waterway or powerline. It isn't perfect - but it will do!

This is the query which will retrieve the 25 nearest things within 100 metres of a specific latitude and longitude. It includes the name and any other tags, the location, and the OSM ID.

overpass-api.de/api/interpreter?data=[out:json];nw["name"][!"highway"][!"railway"][!"waterway"][!"power"](around:100,51.5202,-0.1040);out center qt 25;

ActivityPub

There's good news and bad news here. Firstly, ActivityStreams (which are subscribed to in ActivityPub) supports the concept of "Place" and "Location".

Once the user has a latitude and longitude, the can share it - along with a message, photo, or anything else.

Something like:

{
    "@context": "https://www.w3.org/ns/activitystreams",
    "type": "Note",
    "content": "Here in NYC! <a href=\"https://www.openstreetmap.org/way/958999496\">John Lennon's Imagine Mosaic</a>.",
    "attachment": [
        {
            "type": "Image",
            "mediaType": "image\/jpeg",
            "url": "https:\/\/fastly.4sqi.net\/img\/general\/590x786\/56367_9pxuZJD7d1hgPdaMFcFq1pipvTTMynBJsYcpHH-b8mU.jpg",
            "name": "A photo of a mosaic which says 'Imagine'."
        }
    ],
    "location": {
        "name": "John Lennon's Imagine",
        "type": "Place",
        "longitude": 40.77563,
        "latitude": -73.97474
    }
}

For example, here's a PixelFed post with an attached location - and this is the JSON representation. That status can be reposted into other social networks.

It is worth noting that Mastodon doesn't (natively) support location - if you view my repost of that PixelFed post you'll see there's no location metadata attached. That's OK! It just means that the status needs to include human-readable data.

Similarly, Mastodon doesn't support the arrive vocabulary. So this will be limited to a message with a location attached.

Other ActivityPub services do support location.

Putting it all together

Well… that's a job for next week. Probably!

Building a web site which gets the user's location is easy.
Getting the data from OverPass should be straightforward.
Creating an ActivityPub server which can post geotagged notes into the Fediverse might be a little beyond my skillset! Some testing with Darius Kazemi's AP Glitch suggests this should work.

If you'd like to help, please leave a comment.

Federation is pretty cool, but kinda confusing, and maybe a little scary

Terence Eden — Sun, 18 Jun 2023 11:34:11 +0000

Last week, this strange mention appeared on my Mastodon feed.

After a bit of clicking around, I figured out what had happened. A user on the Kbin social network had linked to my Mastodon profile. Thanks to the magic of the ActivityPub protocol, it filtered into my mentions - even though I've never even heard of Kbin. That's pretty cool! A user on one social network can mention a user on a different social network - neither needs to be registered on the other.

And that is where things get a little confusing and, perhaps, a bit scary.

At the moment, users on TikTok and Facebook are completely segregated. If my TikTok video gets shared on Facebook, I have no way of knowing about it. But ActivityPub breaks down those walls.

If my cat photo on Mastodon goes viral, I can start receiving comments from PixelFed telling me how cute my cat is. Lovely!

If I post something on Lemmy saying "I don't think that Trump fellow is entirely my cup of tea", I can start receiving vitriolic comments from a dozen different networks which sprang up in the last week and will vanish tomorrow. Not lovely.

In many ways, this isn't a new problem. Users have always been at risk of abusive people - but that's usually confined to the users of a single network. And most users understand the norms of their social network community. And most networks have ways to combat harassment and limit post visibility.

Because most social networks are walled gardens, the easiest way to share content is via a screenshot. That makes it harder for a user on Facebook to find the Twitter user whose screenshot so offended them. But with ActivityPub there is zero friction. There's no need to share a screenshot when you can embed a post from Network A into Network B with no fuss. Which means with a single click a disgruntled user can slake their ire.

I don't think federation is a bad thing. But I think it's a new way of thinking about your social networking. I like having a different personality and different audience of Facebook and LinkedIn and Reddit and MySpace. And, just sometimes, I want a little bit of friction to stop angry idiots from shouting at me.

Naming things is hard - DNS for the Federated Web

Terence Eden — Tue, 27 Dec 2022 12:34:27 +0000

How should I design my personal DNS for all the cool new Federated Services and IndieWeb protocols?

Way back in the early 2000s, I started this website - shkspr.mobi. A few years later, I added a blog. I could have used the main domain, or created a subdomain like blog.shkspr.mobi. In the end, I chose a subdirectory of shkspr.mobi/blog

I don't know if that was the right choice back then, but it is looking like the wrong choice now.

I want to be a "first class" citizen of the Fediverse. I want a dozen different apps installed on my little slice of the Internet. I want a fairly consistent online identity. What's the best way to do that?

Buy a new domain for every app!

No. This is impractical for two reasons.

It's expensive.
Nothing ties together my_awesome_photos.biz to read_my_blog.com.

Subdirectories

I currently have /blog. Should I also have /mastodon and /pixelfed and /yet_another_cool_service and...

Maybe? The problem is, most of these new services assume that they're going to be on their own domain. Usernames are based on domains - so I guess I'd end up with @edent-mastodon@shkspr.mobi and @edent-pixelfed@shkspr.mobi? That just looks ugly.

Subdomains

Adding sub-domains is free and easy.

mastodon.shkspr.mobi and pixelfed.shkspr.mobi - done!

But there are a couple of issues.

Do I want to name them after the app, or something more generic in case I switch later? Perhaps posts.shkspr.mobi and pictures.shkspr.mobi?
Do users understand that they need to follow @edent@location.shkspr.mobi for my Foursquare-style check-ins and @edent@beer.shkspr.mobi for my beer reviews?

One Domain To Rule Them All

Perhaps I'll just have everything on my main domain? That also comes with a few problems! I'll need to install the apps somewhere and then work out how to redirect users to the correct app based on... what? And it still doesn't resolve the username issue.

Just treat everything as a single ActivityPub feed

I think this is where I'm heading.

I've written before about my perfect social network.

I post items tagged work, tech, sport, politics, etc.
You decide which of those channels you want to subscribe to.

If you only want to read my sport punditry, subscribe to that channel. If you want everything except my political views, ignore that specific channel.

I could publish everything on a single feed. It is then up to you or your client to work out how to filter that.

I'm still not sure how that would work! Perhaps clients will be smart enough to ignore statuses which don't fit their model? Perhaps users will manually choose what to follow?

That's sort of how Aaron Parecki's unified view works.

What would you do?

If you've done this successfully - or have particularly strong opinions - please let me know!

Snowflake IDs in Mastodon (and Unique IDs in the Fediverse more generally)

Terence Eden — Mon, 12 Dec 2022 12:34:06 +0000

Computer Science has two canonical "hard problems":

cache invalidation
naming things
off-by-one errors

Let's talk about how we name unique items in Federated services - for example, posts on a social media service.

If you have only one service, it's pretty easy. Every time a new entry is created in a database, give it a sequential number.

This becomes a problem at scale. If you have millions of users on hundreds of different shards of a database, eventually you'll get a clash of IDs. To that end, Twitter invented Snowflake IDs.

Snowflakes are pretty clever. They are a 64 bit ID. The first part of the ID is a timestamp, and the second part is some information about the server which generated the ID. This means that IDs can be sorted by time, and will globally unique.

So, does the Fediverse use Snowflake? Yes. AND NO!

The Mastodon service uses Snowflake for its IDs. For example, one of my posts has the ID 109347703064222520. If you bitshift that into a 64 bit number, you'll see it is a UNIX timestamp with a few bits of extra data.

But here comes the problem. On a Federated service, there's no guarantee of uniqueness. A naughty server could deliberately generate a duplicate Snowflake ID. You can't trust anyone on the Internet!

So here's how Mastodon - and the wider Fediverse - deals with unique IDs. It cheats.

When I make a post, my server gives it a Snowflake ID which is unique to my server - e.g. 123456
This generates a URl which is globally unique - e.g. https:// my_server.xyz/@username/123456
My post is delivered to your server.
Your server gives it an ID which is unique to your server - e.g. 4d7b70c7
Your server turns that into a URl - e.g. https:// your_server.lol/incoming/from/@username@my_server.xyz/4d7b70c7

For example, here's the JSON response I get when I look up the Snowflake ID of a reply someone sent me. My server replies with:

{
 'created_at': datetime.datetime(2022, 11, 13, 0, 52, 37, tzinfo=tzutc()),
 'id': 109347716491680514,
 ...
 'uri': 'https://queer.af/@erincandescent/109347716173491502',
}

The original ID is 109347716173491502 on the sender's server. But the unique ID on my server is 109347716491680514.

Their unique ID could be a GUID, a series of emoji, or a sequential number. It doesn't matter. To prevent clashes, the receiving server generates its own ID.

This could all be solved a lot more easily if every server minted each post using a Proof of Work transaction against a centralised BlockCha… *sound of gunshot*

Ahem.

It is a pretty reasonable solution. A remote server may or may not have a globally unique ID. It doesn't matter. Once you see a post, it is given its own locally unique ID. And that's good enough.