@julian@community.nodebb.org
@julian@community.nodebb.org avatar

julian

@julian@community.nodebb.org

Hi! I'm Julian, one of the co-founders of NodeBB, the forum software you are using right now. I started this company with two colleagues, Baris and Andrew, in 2013, and have been doing the startup thing since (although I think at some point along the way we stopped being a startup and just became a boring ol' small business). In my free time I rock climb, cycle, and lift weights. I live just outside Toronto, Canada, with my wife and three children.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

julian, to random
@julian@community.nodebb.org avatar

Hello all,

It's been quite a cold and rainy March and April, but with a couple nice days in between and warmer days ahead, I'm looking forward to getting outside more.

In the meantime, there's been quite a bit of compatibility fixing and incremental updates to the ActivityPub branch, so there hasn't been anything major to report, but nevertheless, we're getting closer and closer to an alpha.

@oplik0 has been helping me this month with some of the trickier aspects, so thank you!


Here's a short summary of what's been tackled on our backlog, in no particular order:

Posts from the fediverse can now be linked to, if you wish to share them with others. The "Copy Permalink" button will copy a shareable link to your clipboard, and "View Original Post" will allow you to view the content from its original source instance.

e8ed6153-9dbc-497d-b1f0-41a4d0bd2299-image.png

You are now able to see posts from remote users

Minor improvements to mentions so they don't (hopefully) get turned into link previews by Mastodon.

Updates to our link-preview plugin so that uploaded images and external links are added to the attachment property for other instances to consume.

Ability to view Popular topics known to this instance, sort of like Mastodon's "trending" feed.


Next up would be bigger items like content pruning and better reply handling.

In coordination with @angusmcleod from Discourse, we are also working on our category-to-category mirroring implementation. This would be used by the SWICG Forum and Link Sharing Task Force, since we're hoping to have asynchronous discussion via the fediverse.

Finding time to test is hard given our respective time zones, but we're getting close!

julian,
@julian@community.nodebb.org avatar

Oh, one last (huge!) thing to add is that @oplik0 added basic support for the .

Accepting this means that reports from other servers can be appropriately responded to from NodeBB.

The other half of this is federating responses back out (e.g. Note deletion, etc.)

This small step is part of our Trust and Safety branch of the ActivityPub work. Without it, we wouldn't feel safe enough to tag a release as an alpha.

julian, to random
@julian@community.nodebb.org avatar

Hey @JP_Bennett β€” would you be interested in connecting with @Jay about having him on a show about the history of podcasting from the POV of one of the founders of Podcamp Toronto? He also founded the Toronto Independent Music Podcast back in 2005.

I was just having a conversation with him offline (how often do we do that nowadays?) and he's got an awful lot to share about podcasting and how far it's come in the years since.

RSS being an open protocol (and podcasting on top of it) sounds like it'd have some overlap with your userbase.

cc @FLOSS_Weekly

dentangle, to random
@dentangle@chaos.social avatar

Having now cancelled all of our streaming services, we watched something locally last night.

No ads.

No nagging to install updates*

No fighting with the interface to select language and subtitles.

No random buffering issues.

No random disappearing of content that was available minutes before on the same IP.

We just... watched a thing, and went to bed. 🍽️ + πŸ“Ί + πŸ›οΈ

Bliss.

julian,
@julian@community.nodebb.org avatar

@dentangle the thing that makes me upset is how much control we've given up to these streaming companies.

Once upon a time broadcasters didn't know who or how many people were watching (short of Neilson boxes/families). Now they're tailoring ads to you based on what and how long you've watched each episode.

It's even a little disappointing how the general public lays back and accepts it as normal.

julian, to random
@julian@community.nodebb.org avatar

@oplik0 and I are having a discussion regarding the conditions upon which origin checking should be done on S2S activity receipt.

The spec says this:

Servers should not trust client submitted content, and federated servers also should not trust content received from a server other than the content's origin without some form of verification.

Reasonable, if a little open-ended. I took this to mean that if an Activity(Object) is received, if Object is a copy of the resource itself, that origin checking is required. This is reflected currently in the NodeBB code where if typeof object !== 'string then origin check is carried out.

Problem is, that's a code smell. It's not readily apparent why an origin check is only carried out under that condition. Compounding this is that not all activities need an origin check: Create, Update, and Delete typically don't (careful in my wording here, lest I say something way off-base).

@oplik0 advocates for a more explicit approach, where perhaps an object uri is dereferenced regardless, and an origin check is carried out if the specific Activity-Object type pair calls for it (and if the uri doesn't match).

P.S. Yes, @hrefna I know object can also be an Array... or undefined... or null... don't @ me!)

julian,
@julian@community.nodebb.org avatar

@JsonCulverhouse Are JSON-LD signatures implemented broadly? Mastodon's docs state the following in a warning box:

... the LD Signatures specification as a whole has been superseded by the Verifiable Credential Data Integrity 1.0 specification, which is largely incompatible with the earlier LD Signature spec. For this reason, it is not advised to implement support for LD Signatures.

I'll admit I do not know whether there has been an effort by SWICG to compile a descriptive report on the state of security in ActivityPub implementors, but I would be interested in learning more.

julian,
@julian@community.nodebb.org avatar

@jenniferplusplus said:

I think you can trust that objects you receive that are attributed to the actor and hosted at the same authority as the actor are valid.

I think that's fair. If I recall correctly the main concern was Activity spoofing by third parties (e.g. Receiving Update(Note) from domainA for a Note whose origin hostname is domainB).

Each individual code path does their own checking if needed, so in the example above, Update handling actually does origin checking too (since the passed-in object is a uri, and thus not subject to checking via upstream middleware), but now that is a case of DRY.

Question is, what activity-pairs explicitly need origin checking... or conversely, is a deny-list a better fit? (e.g. Announce(Note) can refer to Notes outside of the actor origin, so don't do an origin check)

julian,
@julian@community.nodebb.org avatar
julian,
@julian@community.nodebb.org avatar

@erincandescent Yes, I think that's what @oplik0 and I ended up agreeing on. If we normalize all incoming requests so that any requests containing a full object on a different domain is just reduced down to its id, then you'd safeguard yourself from most edge cases. Applying FEP-8b32 would be handy to save yourself a few network calls but is optional.

The cost is you might have to make a couple extra calls, but it's probably worth it in order to keep the logic simple, predictable, and easily auditable.

julian, to random
@julian@community.nodebb.org avatar

For those who were not able to attend the technical alignment meeting of the informal "Threadiverse Working Group", I have taken minutes during the meeting and are sharing them here.

@angusmcleod has made a recording of the meeting for those who wish to listen β€” the password to access this recording is z+1*4pUB.

Thank you to all those who attended, we will meet again next month! Follow myself or the WG category to be notified about additional developments.


Attendees

  • Angus McLeod
  • Julian Lam
  • Evan Prodromou
  • Aaron Grey
  • Rimu Atkinson
  • Erlend Sogge Heggen
  • Laurens Hof
  • Other participants are not listed as they are not mentioned in notes below, but there were ~20 participants.

Notes

  • Participant introductions
  • β€œForasphere”/”Foraverse” vs β€œThreadiverse”
    • Both have a topic-like structure and so much of the technical structure is the same
    • More helpful to focus on the differences from microblogging as the de facto implementation of ActivityPub
    • No matter what name, it is mostly UI distinctions with some different handling based on nomenclature
  • Rimu brings up discussion regarding nomenclature; related document
    • β€œWe don’t call things the same words”
    • Aaron posits that β€œCircles” could be a useful common term
    • Julian posits that end of the day no implementor here will likely consider changing their already-established terminology
    • Aaron proposes a goal for the group: determine a common set of terms to use in discussions going forward; a lingua franca
  • Evan proposes a goal to produce documentation that other forum (or reddit-like alternatives) can use to become compatible
    • Additional goal (added later): reaching out to other forum devs (who aren’t already in this WG or looking into AP). Additional outreach/engagement from other forum softwares.
  • Julian suggests that perhaps the FEP process would be a possible path forward
    • Mastodon’s microblogging concept leads to other implementations following suit
    • Coordinated effort to increase compatibility between threadiverse-type applications is attractive
  • Erlend wants to see better interop between threadiverse apps. Discourse to NodeBB, etc.
  • Angus states that we’ve reached half-way point and summarizes (see above)
  • Meeting focus shifts to debate re: FEP process or Task force under SocialCG
    • Julian proposes on behalf of Johannes Ernst (in absentia) that the WG be organized under the FediDevs umbrella
    • Evan proposes that the WG be an official task force under the SocialCG
      • W3C/ActivityPub has many task forces already, one for data portability, one for webfinger, one for testing, etc.
    • Differences between task force report and FEP:
      • Both similar documents
      • FEP has a more asynchronous process for clearing out objections, less cohesion than SocialCG
        • Discussions take place on SocialHub
      • Most FEPs individually authored
      • SocialCG reports collaboratively edited and put forth to W3C
    • Some questions re: FEP process
      • Evan answers: Anyone can propose, comments collected. After 6 months author can determine it finalized, but implementation varies. Many draft FEPs are dropped due to lack of interest or are hypothetical in nature.
    • Penar asks whether FEP or W3C report process is faster
      • Both are roughly equivalent, SocialCG reports are β€œa few months” to draft, and β€œa few months” to be accepted/finalized.
    • Aaron posits that SWICG (or SocialCG) is a better group since it eventually goes into a published W3C article
      • Aim towards convergence, consistent UI. Safe and usable user experience where the end-user has choice.
    • Laurens remarks on the increased level of cooperation that has not been often found in the fediverse, sees this as an opportunity to forge a path toward what we want instead of being bound by an FEP.
  • Angus motions that we join the SWICG as a task force
    • Motion carries with 12 ayes out of 16 present
    • Next meeting of SWICG 5 Apr 1pm Eastern; Angus and Julian to attend
  • 3pm Eastern; meeting scheduled end, Evan and Erlend (and some others) drop out
  • What do we call the group β€œforaverse” β€œforasphere” β€œthreadiverse”
    • Benti posits that it is weird to call ourselves representatives of the threadiverse as that distinction is reserved for Lemmy and nutomic is not present
    • Julian suggests that the term is not exclusive to Lemmy/kbin and asks to simply expand the definition to include Piefed, Discourse, NodeBB, Flarum, et al.
  • Additional back and forth regarding how and where to carry on discussions outside of monthly calls
    • Shared Google Doc sufficient for now, can explore additional options later
    • Julian posits that a federated option is ideal, acknowledges bias when suggesting that NodeBB be used. However, as it would be federated, where the discussions take place is mostly incidental.
    • A federated solution would be easiest way to reach fediverse developers.
  • Angus motions that we call ourselves the Threadiverse Working Group (or Task Force)
    • Motion carries with 9 ayes out of 13 present

Action Items

  • Angus or Julian to set up shared Google Doc for meeting/agenda prep for next meeting
  • Attend SWICG meeting on 5 Apr 2024 13:00 EDT
chris, to fediverse
@chris@mstdn.chrisalemany.ca avatar

🚨 BOOST CHALLENGE! 🚨Ok and . If I tell my Canadian Member of Parliament, Gord Johns, that he will get 2000 followers within one week of creating a Mastodon account, will you make that happen?

I want him to be able to say when he stands in the House and presents the petition for an official Fediverse server that he himself is the first Canadian MP to be on the Fediverse!

Boost for yes! I am going to show him this post! I'm counting on you, literally! πŸ”₯ πŸ™ 2️⃣ 0️⃣ 0️⃣ 0️⃣ πŸ™

A gif of the lincoln pointing finger we want you 🫡

julian,
@julian@community.nodebb.org avatar

@chris I've been trying to get Nora Young from CBC Spark interested in the fediverse. While I don't actually have a direct contact, I've sent a couple inquiries via their contact form, and now sent another regarding e4769.

Low-key hoping I'll be able to get @evan onto the radio.

julian,
@julian@community.nodebb.org avatar

@chris No idea, but the idea is ripe for discussion, especially in 2024. Maybe this is the year fedi becomes mainstream!

I just found one article about it on CBC.

eeeee, to random
@eeeee@community.nodebb.org avatar

Maybe a basic question, but Im not sure, until theres a pre-release of Nodebb v4 (which I cant wait for!)
But will my forum fediverse account be enough for an all in one solution, so I wont necessarily need my Mastodon account too?
The reason Im asking is because, at times, ideal Mastodon hosts can be hard to find. I ran my own instance for a while, and many signed up - it was bursting at capacity before long πŸ™‚
So will a Nodebb v4 forum account be complete enough to be a full fediverse solution for those who use Mastodon etc.
Can I log into the fediverse mobile apps etc?
I tried logging into a couple I have on my android phone but it didnt work.
Not sure what my nodebb fed password is, (is it mirrored from my main account) or how to reset it?
1000016862.jpg

julian,
@julian@community.nodebb.org avatar

But will my forum fediverse account be enough for an all in one solution, so I wont necessarily need my Mastodon account too?

That's a very good question! In short, I intend for NodeBB to become that all-in-one app. It'd be disingenuous of me to say that it is meant to replace Mastodon, because it isn't, it's not even the same classification of software: Mastodon is a microblogging service, NodeBB is a forum.

However, NodeBB will (or already can):

  • allow you to follow users and see their content
  • contain the ability to discover new content from the fediverse (/world, et al.)
  • have two-way conversations with people from the fediverse

Additionally, NodeBB will:

  • classify content in topics so they are better organized
  • allow you to move topics into specific categories for further organization

However, NodeBB might/will not:

  • show posts in a "feed-style" format, at least not with Harmony theme
  • integrate the chat subsystem into the fediverse (this may be better handled via a different protocol like Matrix, Delta, etc.)

Can I log into the fediverse mobile apps etc?
I tried logging into a couple I have on my android phone but it didnt work.

Right now you cannot, and I don't know if you ever will be able to. Those apps either use the Mastodon API (which we don't support for an obvious reason β€” we're not Mastodon), or the client-to-server protocol subset of ActivityPub, which we do not support yet.

The login part expects NodeBB to act as an OAuth2 provider, which we also do not do yet.

julian, to random
@julian@community.nodebb.org avatar

Please see below for details regarding the first Forasphere/Threadiverse Working Group meeting.


Following up on the initial announcement post regarding the creation of a working group for threadiverse-type ActivityPub applications, I'm pleased to inform the community-at-large that we have scheduled our first meeting for Thursday, 4 April from 18:00 to 19:00 UTC.

Thank you @angusmcleod for organizing and providing an online meeting space:

The video-call details are below. The goal of the meeting is to clarify what this group is, what its goals are, and how it will be run. As such, the working agenda is:

  1. Intro & housekeeping (e.g. consent to record).
  2. Who/what we are, nomenclature and overall expectations.
  3. Relationship with standards organisations and processes, including Fediverse Developers Network (FediDevs), W3C Social Web Community Group, and FEP process.
  4. Organisational, including software (i.e. mailing list), meeting times, facilitation and minutes.

Topic: Forasphere/Threadiverse Technical Alignment Meeting
Time: Apr 4, 2024 06:00 PM Universal Time UTC

Join Zoom Meeting
https://us06web.zoom.us/j/83819428627?pwd=zEE5EQXwPeEjCbqQNyJnaMR21ZMcSe.1

If you have any suggestions on the agenda please respond to this post.

julian,
@julian@community.nodebb.org avatar

Reminder that the first Forasphere/Theadiverse working group meeting is starting... right about now!

The video-call details are below. The goal of the meeting is to clarify what this group is, what its goals are, and how it will be run. As such, the working agenda is:

  1. Intro & housekeeping (e.g. consent to record).
  2. Who/what we are, nomenclature and overall expectations.
  3. Relationship with standards organisations and processes, including Fediverse Developers Network (FediDevs), W3C Social Web Community Group, and FEP process.
  4. Organisational, including software (i.e. mailing list), meeting times, facilitation and minutes.

Topic: Forasphere/Threadiverse Technical Alignment Meeting
Time: Apr 4, 2024 06:00 PM Universal Time UTC

Join Zoom Meeting
https://us06web.zoom.us/j/83819428627?pwd=zEE5EQXwPeEjCbqQNyJnaMR21ZMcSe.1

paninid, to fediverse
@paninid@mastodon.world avatar

If Microsoft attempted federation with , I think that would be a much bigger deal than Threads.

My $0.02.

julian,
@julian@community.nodebb.org avatar

@mapache @evanprodromou this is what forgejo is doing isn't it?

julian, to random
@julian@community.nodebb.org avatar

Okay, here's a little completely unintentional side-effect that blew my mind.

tl;dr β€” never miss a popular post again.


NodeBB tracks a number of metrics when the internal methods are called to create topics (or post replies). Metrics such as post counts, vote counts, view counts. It uses those to provide alternative sorting of topic lists β€” by post, votes, and views.

Incoming content from the fediverse/social web is also run through this same logic, and so those metrics ended up tracked too.

One of our users pointed out that remote topics were drowning out local topics in the /popular route, which makes sense given the imbalance in traffic. Unintentional, but not problematic. I tweaked the logic to filter out those topics unless explicitly asked for.

... and I ended up with this page, which allows you to see popular fediverse topics that my instance knows about. You can even drill down by day, week, month, or all time.

A common fediverse concern is that things get missed. If you live several time zones away from somebody else, you may never see their content pop up naturally in your feed. Trending posts (in Mastodon) addresses this somewhat, though.

It seems without any additional effort, NodeBB has already taken a step towards resolving this issue.

julian,
@julian@community.nodebb.org avatar

@crazycells the topic list should load additional topics when you near the end. Maybe you have pagination enabled?

julian,
@julian@community.nodebb.org avatar

@crazycells thanks, maybe the popular route does not support pagination... Do you see pagination when you filter by other categories?

box464, to random
@box464@mastodon.social avatar

A takeaway from the is people need ways to make money here.

Very little funding reaches fediverse developers. Regardless, they push forward because they believe in this idea.

Not to mention users that want to make a living in this space.

I support fedi projects and the people making them, even when those investments make it more expensive to be here.

It's worthwhile. It's not enough.

Wish I had a solution. But I'm happy to offer support to those that do, and hope you will too.

julian,
@julian@community.nodebb.org avatar

@box464 said:

Or, instance admins could attach to an ad relay for specific topics, and they get paid for click throughs (oof, gonna hear about that just for suggestion it). Would be a god way to support your instance tho

Oh lord I can see the backlash now. If you thought servers defederating over admin spats was bad, wait until you see hordes of admins blocking each other for even considering allowing the "ad relay" onto their server for money.

julian, to random
@julian@community.nodebb.org avatar

The latest change to the ActivityPub integration for NodeBB introduces the concept of "group actors" to categories.

This change means that categories can be configured to be visible to other applications connected to the social web (including Mastodon, Misskey, and also other NodeBBs!)

49225588-744e-43f9-bfc4-950cb6f116fb-image.png

When followed, it means that any post made to the category will be automatically shared to anyone who follows that category.

NodeBB already supported this locally. You could set your watch state for a particular category to "tracking" or "watching", the latter allowing you to be notified of new posts.

Also of note is that remote replies to topics contained within a category will also be shared to the category's followers. This distinction means that you can effectively follow a specific category or sub-category in order to stay up-to-date on all discussions within that category.

As of today, users cannot create topics in a category from the social web (e.g. I cannot create a new topic in a NodeBB category), yet. That will come soon.


For the NodeBB community forum, the following categories are followable for now:

  1. General Discussion
  2. NodeBB Development
  3. NodeBB Development > ActivityPub

Lastly, all of this follows the FEP-1b12 Group Federation enhancement proposal.

julian,
@julian@community.nodebb.org avatar

I am very aware that one of the "holy grail" of fediverse applications seems to be private group discussions.

There's some R&D that needs to be done before we can even approach that β€” namely, post visibility controls β€” but this latest change lays the foundations toward that eventual goal.

julian,
@julian@community.nodebb.org avatar

@shoq feel free to just tag me in a new toot. When NodeBB encounters a Note that it hasn't seen before it'll resolve it back up to the root and make a topic in the Uncategorized category. If you mention me, I'll be notified, just like on Mastodon.

julian,
@julian@community.nodebb.org avatar

@shoq no, multi-tenancy is not available in NodeBB at this time. Each installation is tied to one canonical domain.

There has been scattered interest for something like that over the years but not enough to justify the maintenance burden, sorry.

shoq, to random
@shoq@mastodon.social avatar

@julian We’ve just installed NBB on one of our hosts. Really excited about digging into it next week. Where’s the best place to bring questions?

julian,
@julian@community.nodebb.org avatar

Hey @shoq, glad you got it up and running. What's important to know for you is that the current stable v3.7.1 does not contain ActivityPub code.

Tomorrow, I will put together a short guide for parties such as yourself, who are interested in playing with the pre-alpha code.

In the meantime, the best place to ask questions would be to either tag me (like you just did) or @baris (for non-AP stuff), or create a new topic in the Technical Support category.

Unfortunately you cannot post directly to the category from the fediverse yet. Give me a week or so.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • β€’
  • JUstTest
  • kavyap
  • DreamBathrooms
  • thenastyranch
  • magazineikmin
  • tacticalgear
  • cubers
  • Youngstown
  • mdbf
  • slotface
  • rosin
  • osvaldo12
  • ngwrru68w68
  • GTA5RPClips
  • provamag3
  • InstantRegret
  • everett
  • Durango
  • cisconetworking
  • khanakhh
  • ethstaker
  • tester
  • anitta
  • Leos
  • normalnudes
  • modclub
  • megavids
  • lostlight
  • All magazines