micro social network, federated https://join.upub.social/
Find a file
2024-05-13 01:20:48 +02:00
apb feat(apb): add emoji reacts activity 2024-05-11 22:48:35 +02:00
mdhtml feat(mdhtml): also allow <br/> 2024-05-03 00:59:54 +02:00
src fix: empty digest is rejected by mastodon, revert 2024-05-12 02:26:55 +02:00
web fix(web): better config page, debug under config 2024-05-13 01:20:48 +02:00
.editorconfig chore: initial commit with environment 2023-12-30 05:07:49 +01:00
.gitignore chore: gitignored trunk dist 2024-04-14 17:23:48 +02:00
.rustfmt.toml chore: initial commit with environment 2023-12-30 05:07:49 +01:00
.tci ci: fix trunk compile jobs (must use env var) 2024-04-14 17:35:41 +02:00
Cargo.lock feat(web): added simple config page with filters 2024-05-12 00:11:54 +02:00
Cargo.toml fix: process emojireacts as likes for now 2024-05-11 22:50:39 +02:00
README.md docs: update progress, made FE/BE configs 2024-05-12 00:57:17 +02:00

μpub

micro social network, federated

screenshot of upub simple frontend

μpub aims to be a private, lightweight, modular and secure ActivityPub server

μpub is usable as a very simple ActivityPub project: it has a home and server timeline, it allows to browse threads, star notes and leave replies, it renders remote media of any kind and can be used to browse and follow remote users

all interactions happen with ActivityPub's client-server methods (basically POST your activities to your outbox), with appropriate extensions: μpub doesn't want to invent another API!

development is still active, so expect more stuff to come! since most fediverse software uses Mastodon's API, μpub plans to implement it as an optional feature, becoming eventually compatible with most existing frontends and mobile applications, but focus right now is on producing something specific to μpub needs

a test instance is usually available at feditest.alemi.dev

about security

most activitypub implementations don't really validate fetches: knowing an activity/object id will allow anyone to resolve it on most fedi software. this is of course unacceptable: "security through obscurity" just doesn't work

μpub correctly and rigorously implements and enforces access control on each object based on its addressing

most instances will have "authorized fetch" which kind of makes the issue less bad, but anyone can host an actor, have any server download their pubkey and then start fetching

μpub may be considered to have "authorized fetch" permanently on, except it depends on each post:

  • all posts marked public (meaning, addressed to "https://www.w3.org/ns/activitystreams#Public"), will be fetchable without any authorization
  • all posts not public will require explicit addressing and authentication: for example if post A is addressed to example.net/actor
    • anonymous fetchers will receive 404 on GET /posts/A
    • local users must authenticate and will be given said post only if it's addressed to them
    • remote servers will be given access to all posts from any of their users once they have authenticated themselves (with http signing)

note that followers get expanded: addressing to example.net/actor/followers will address to anyone following actor that the server knows of, at that time

contributing

all help is extremely welcome! if my cgit looks too scary there's a github mirror you can open issues or PRs on. get in touch with me (fedi is fine, but a mail works too), i'd be thrilled to showcase the project to you!

progress

  • barebone actors
  • barebone activities and objects
  • activitystreams/activitypub compliance (well mostly)
  • process barebones feeds
  • process barebones inbox
  • process barebones outbox
  • http signatures
  • privacy, targets, scopes
  • simple web client
  • announce (boosts)
  • threads
  • remote media
  • editing via api
  • advanced composer
  • api for fetching
  • like, share, reply via frontend
  • backend config
  • frontend config
  • mentions, notifications
  • mastodon-like search bar
  • polls
  • better editing via web frontend
  • remote media proxy
  • upload media
  • hashtags
  • public vs unlisted for discovery
  • user fields
  • lists
  • full mastodon api
  • optimize addressing database schema

what about the name?

μpub (or simply upub) means "micro-pub", but could also be read "upub", "you-pub" or "mu-pub"