I wrote this script to learn how completing-read's complex arguments works. Compared to other clients it's quite limited; but thanks to packages like Vertico and Orderless, it works quite well for my use cases.

Screenshot

In vim terminal I use C-[ for ESC to escape from insert mode a lot, but didn't know C-[ works in GUI version of Emacs until recently. Since Meta can be replaced with ESC, we can enter C-M-s, for example, with C-[ C-s.

Thorough report about the recent Fediverse spam.

Related posts:

• We seem to be getting attacked. - https://lemmy.giftedmc.com/post/235816
• Solutions and origins of the spam wave currently hitting the Fediverse - https://feddit.cl/post/1883287
• Mastodon CVE Report - https://hachyderm.io/@maegul/111944073448637061
  • Remote User Impersonation and Takeover via Cache Poisoning - https://arcanican.is/excerpts/cve-2024-23832/discovery.htm
  • Remote user impersonation and takeover - https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw

The library has a nice guide and two working examples, so I tried the local_federation example. To build the example, you need Rust compiler, cargo package manager, and git:

$ git clone https://github.com/LemmyNet/activitypub-federation-rust
$ cd activitypub-federation-rust
$ cargo run --example local_federation axum
[INFO  local_federation] Start with parameter `axum` or `actix-web` to select the webserver
[INFO  local_federation::axum::http] Listening with axum on localhost:8001
[INFO  local_federation::axum::http] Listening with axum on localhost:8002
[INFO  local_federation] Local instances started
[INFO  local_federation] Alpha user follows beta user via webfinger
[INFO  activitypub_federation::fetch] Fetching remote object http://localhost:8002/.well-known/webfinger?resource=acct:beta@localhost:8002
[INFO  activitypub_federation::fetch] Fetching remote object http://localhost:8002/beta
[INFO  activitypub_federation::fetch] Fetching remote object http://localhost:8001/alpha
[INFO  local_federation] Follow was successful
[INFO  local_federation] Beta sends a post to its followers
[INFO  local_federation] Alpha received post: Hello world!
[INFO  local_federation] Test completed

You may want to use network analizyer (e.g, wireshark) to see how it works under the hood.

GET /.well-known/webfinger?resource=acct:beta@localhost:8002 HTTP/1.1
accept: application/jrd+json
digest: SHA-256=[redacted]
signature: keyId="http://localhost:8001/#main-key",algorithm="hs2019",[...]
host: localhost:8002

HTTP/1.1 200 OK
content-type: application/json
content-length: 269
date: Sat, 03 Feb 2024 23:05:19 GMT

{
  "subject": "acct:beta@localhost:8002",
  "links": [
    {
      "rel": "http://webfinger.net/rel/profile-page",
      "type": "text/html",
      "href": "http://localhost:8002/beta",
      "template": null
    },
    {
      "rel": "self",
      "type": "application/activity+json",
      "href": "http://localhost:8002/beta",
      "template": null
    }
  ]
}

[...]

Lemmy 0.19ではいくつかの機能変更の他に破壊的変更としてアクセストークンの使い方が変わるのだとか。サードパーティのLemmyクライアントの中にはログインできなくなったりログイン状態が無効になるものも出てくるかもしれないですね。

米軍 (.mil) が間違えてマリ共和国 (.ml) にメール送ってたとかいうニュースがありましたけど、良くも悪くもLemmyは持ってますね… lemmy.mlどうするんだろ

詳細は以下もどうぞ：

• https://sh.itjust.works/post/1473025
• https://sh.itjust.works/post/1484592
• https://lemmy.ml/post/2286939

lemmy.worldも被害を受けたみたいですね。人多いのに…

• https://github.com/LemmyNet/lemmy-ui/commits/0.18.2-rc.1
• https://lemm.ee/post/942359 - インスタンスのadmin管理者向けまとめと緩和方法
• https://github.com/LemmyNet/lemmy/issues/3499 - JWTトークンが期限切れしない問題
• https://github.com/LemmyNet/lemmy/issues/3364 - JWTトークンがログアウトしても無効化されない問題

One of the best live version I believe.