#Hollo

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

supports 's full spec with Hollo's own extended syntax (mentions and hashtags).

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

supports 's full spec with Hollo's own extended syntax (mentions and hashtags).

fedicat's avatar
fedicat

@fedicat@pc.cafe

quote posts are supported on platforms that support quote posts ( )

iphone screenshot of the context menu for a post showing a quote option in a link submenu
iphone screenshot of the context menu for a post showing a quote option in a link submenu
a post composer titled Quote followed by a snippet of the quoted post then the visibility then the text composition area prefilled with a mention of the quoted author
a post composer titled Quote followed by a snippet of the quoted post then the visibility then the text composition area prefilled with a mention of the quoted author
a home timeline showing the published quote post with the quoted list and under the author mention and in its own border Detected text: 7:32Hometechnicattechnicattesting quote postfrom @ycombinatorRT:https://rss-mstdn.studiofreesia.com/users/ycombinator/statuses/113942146481288788@ycombinator@rss-mstdn.studiofreesia.com7:26 PMHacker News (bot)ycombinator@rss-mstdn.studiofreesia.com2:46 PMThe Cantonese Scrolls (EE) - A CantoneseLanguage Learning Mental RPGhttps://cantoscrolls.com/#ycombinator #Cantonese #Chinese#Preservation #Language #Education#Culture #Identity #Traditional #Game#RPG #Mental #Mind#cantonese#chinese#culture#education#game#identity#language#mental#mind#preservation#rpg#traditional#combinator
a home timeline showing the published quote post with the quoted list and under the author mention and in its own border Detected text: 7:32Hometechnicattechnicattesting quote postfrom @ycombinatorRT:https://rss-mstdn.studiofreesia.com/users/ycombinator/statuses/113942146481288788@ycombinator@rss-mstdn.studiofreesia.com7:26 PMHacker News (bot)ycombinator@rss-mstdn.studiofreesia.com2:46 PMThe Cantonese Scrolls (EE) - A CantoneseLanguage Learning Mental RPGhttps://cantoscrolls.com/#ycombinator #Cantonese #Chinese#Preservation #Language #Education#Culture #Identity #Traditional #Game#RPG #Mental #Mind#cantonese#chinese#culture#education#game#identity#language#mental#mind#preservation#rpg#traditional#combinator
fedicat's avatar
fedicat

@fedicat@pc.cafe

quote posts are supported on platforms that support quote posts ( )

iphone screenshot of the context menu for a post showing a quote option in a link submenu
iphone screenshot of the context menu for a post showing a quote option in a link submenu
a post composer titled Quote followed by a snippet of the quoted post then the visibility then the text composition area prefilled with a mention of the quoted author
a post composer titled Quote followed by a snippet of the quoted post then the visibility then the text composition area prefilled with a mention of the quoted author
a home timeline showing the published quote post with the quoted list and under the author mention and in its own border Detected text: 7:32Hometechnicattechnicattesting quote postfrom @ycombinatorRT:https://rss-mstdn.studiofreesia.com/users/ycombinator/statuses/113942146481288788@ycombinator@rss-mstdn.studiofreesia.com7:26 PMHacker News (bot)ycombinator@rss-mstdn.studiofreesia.com2:46 PMThe Cantonese Scrolls (EE) - A CantoneseLanguage Learning Mental RPGhttps://cantoscrolls.com/#ycombinator #Cantonese #Chinese#Preservation #Language #Education#Culture #Identity #Traditional #Game#RPG #Mental #Mind#cantonese#chinese#culture#education#game#identity#language#mental#mind#preservation#rpg#traditional#combinator
a home timeline showing the published quote post with the quoted list and under the author mention and in its own border Detected text: 7:32Hometechnicattechnicattesting quote postfrom @ycombinatorRT:https://rss-mstdn.studiofreesia.com/users/ycombinator/statuses/113942146481288788@ycombinator@rss-mstdn.studiofreesia.com7:26 PMHacker News (bot)ycombinator@rss-mstdn.studiofreesia.com2:46 PMThe Cantonese Scrolls (EE) - A CantoneseLanguage Learning Mental RPGhttps://cantoscrolls.com/#ycombinator #Cantonese #Chinese#Preservation #Language #Education#Culture #Identity #Traditional #Game#RPG #Mental #Mind#cantonese#chinese#culture#education#game#identity#language#mental#mind#preservation#rpg#traditional#combinator
Markus 🌱:fosse:'s avatar
Markus 🌱:fosse:

@markus@skvip.lol

Eg har nett støtta @fedify ! Dei har fleire kule prosjekt. @markus@prosa.skvip.lol køyrer på deira teneste @hollo.

English:
I've just contributed to They have several cool projects. @markus@prosa.skvip.lol runs on their service .

opencollective.com/fedify

Markus 🌱:fosse:'s avatar
Markus 🌱:fosse:

@markus@skvip.lol

Eg har nett støtta @fedify ! Dei har fleire kule prosjekt. @markus@prosa.skvip.lol køyrer på deira teneste @hollo.

English:
I've just contributed to They have several cool projects. @markus@prosa.skvip.lol runs on their service .

opencollective.com/fedify

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

저장소가 @dahlia/hollo에서 @fedify-dev/hollo로 이전되었습니다. 이에 따라 이미지 레지스트리도 ghcr.io/dahlia/hollo에서 ghcr.io/fedify-dev/hollo로 이전되었습니다.

기존 이미지 레지스트리는 계속 접근 가능하지만, 새로운 태그는 더 이상 추가되지 않을 예정입니다. Hollo를 사용 중이신 모든 분들은 새로운 레지스트리 주소로 업데이트해 주시기 바랍니다.

Docker 설정을 다음과 같이 변경해 주세요:

  • 기존 이미지 주소: ghcr.io/dahlia/hollo:latest
  • 새 이미지 주소: ghcr.io/fedify-dev/hollo:latest

이번 이전은 프로젝트의 더 나은 운영과 지속적인 개발을 위해 진행되었습니다. 원활한 전환에 협조해 주셔서 감사합니다. :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

yamanoku's avatar
yamanoku

@yamanoku@hollo.yamanoku.net

HolloをRailwayにデプロイする時の作業ログをZenn Scrapsにまとめました。躓いた個所もあったのでこれからデプロイしてやってみたい人に届け～ https://zenn.dev/yamanoku/scraps/546b887da013d9

yamanoku's avatar
yamanoku

@yamanoku@hollo.yamanoku.net

HolloをRailwayにデプロイする時の作業ログをZenn Scrapsにまとめました。躓いた個所もあったのでこれからデプロイしてやってみたい人に届け～ https://zenn.dev/yamanoku/scraps/546b887da013d9

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

The repository has moved from @dahlia/hollo to @fedify-dev/hollo! Along with this move, our image registry has also been relocated from ghcr.io/dahlia/hollo to ghcr.io/fedify-dev/hollo.

While the old image registry will remain accessible, it won't receive any new tags. We recommend all Hollo users to update their Docker image references to the new registry address.

To update your Docker configurations, please change:

  • From: ghcr.io/dahlia/hollo:latest
  • To: ghcr.io/fedify-dev/hollo:latest

The migration ensures better project organization and continued development. Thank you for your understanding and cooperation in making this transition smooth! :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

저장소가 @dahlia/hollo에서 @fedify-dev/hollo로 이전되었습니다. 이에 따라 이미지 레지스트리도 ghcr.io/dahlia/hollo에서 ghcr.io/fedify-dev/hollo로 이전되었습니다.

기존 이미지 레지스트리는 계속 접근 가능하지만, 새로운 태그는 더 이상 추가되지 않을 예정입니다. Hollo를 사용 중이신 모든 분들은 새로운 레지스트리 주소로 업데이트해 주시기 바랍니다.

Docker 설정을 다음과 같이 변경해 주세요:

  • 기존 이미지 주소: ghcr.io/dahlia/hollo:latest
  • 새 이미지 주소: ghcr.io/fedify-dev/hollo:latest

이번 이전은 프로젝트의 더 나은 운영과 지속적인 개발을 위해 진행되었습니다. 원활한 전환에 협조해 주셔서 감사합니다. :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

The repository has moved from @dahlia/hollo to @fedify-dev/hollo! Along with this move, our image registry has also been relocated from ghcr.io/dahlia/hollo to ghcr.io/fedify-dev/hollo.

While the old image registry will remain accessible, it won't receive any new tags. We recommend all Hollo users to update their Docker image references to the new registry address.

To update your Docker configurations, please change:

  • From: ghcr.io/dahlia/hollo:latest
  • To: ghcr.io/fedify-dev/hollo:latest

The migration ensures better project organization and continued development. Thank you for your understanding and cooperation in making this transition smooth! :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

Holloのリポジトリが@dahlia/holloから@fedify-dev/holloに移行いたしました。これに伴い、Dockerイメージレジストリもghcr.io/dahlia/holloからghcr.io/fedify-dev/holloに移行しております。

旧イメージレジストリは引き続きアクセス可能ですが、新しいタグの追加は行われません。Holloをご利用の皆様には、新しいレジストリアドレスへの更新をお願いいたします。

Dockerの設定を以下のように更新してください：

  • 旧アドレス：ghcr.io/dahlia/hollo:latest
  • 新アドレス：ghcr.io/fedify-dev/hollo:latest

この移行はプロジェクトのより良い運営と継続的な開発のために行われました。円滑な移行にご協力いただき、誠にありがとうございます。 :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

Holloのリポジトリが@dahlia/holloから@fedify-dev/holloに移行いたしました。これに伴い、Dockerイメージレジストリもghcr.io/dahlia/holloからghcr.io/fedify-dev/holloに移行しております。

旧イメージレジストリは引き続きアクセス可能ですが、新しいタグの追加は行われません。Holloをご利用の皆様には、新しいレジストリアドレスへの更新をお願いいたします。

Dockerの設定を以下のように更新してください：

  • 旧アドレス：ghcr.io/dahlia/hollo:latest
  • 新アドレス：ghcr.io/fedify-dev/hollo:latest

この移行はプロジェクトのより良い運営と継続的な開発のために行われました。円滑な移行にご協力いただき、誠にありがとうございます。 :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

저장소가 @dahlia/hollo에서 @fedify-dev/hollo로 이전되었습니다. 이에 따라 이미지 레지스트리도 ghcr.io/dahlia/hollo에서 ghcr.io/fedify-dev/hollo로 이전되었습니다.

기존 이미지 레지스트리는 계속 접근 가능하지만, 새로운 태그는 더 이상 추가되지 않을 예정입니다. Hollo를 사용 중이신 모든 분들은 새로운 레지스트리 주소로 업데이트해 주시기 바랍니다.

Docker 설정을 다음과 같이 변경해 주세요:

  • 기존 이미지 주소: ghcr.io/dahlia/hollo:latest
  • 새 이미지 주소: ghcr.io/fedify-dev/hollo:latest

이번 이전은 프로젝트의 더 나은 운영과 지속적인 개발을 위해 진행되었습니다. 원활한 전환에 협조해 주셔서 감사합니다. :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

Holloのリポジトリが@dahlia/holloから@fedify-dev/holloに移行いたしました。これに伴い、Dockerイメージレジストリもghcr.io/dahlia/holloからghcr.io/fedify-dev/holloに移行しております。

旧イメージレジストリは引き続きアクセス可能ですが、新しいタグの追加は行われません。Holloをご利用の皆様には、新しいレジストリアドレスへの更新をお願いいたします。

Dockerの設定を以下のように更新してください：

  • 旧アドレス：ghcr.io/dahlia/hollo:latest
  • 新アドレス：ghcr.io/fedify-dev/hollo:latest

この移行はプロジェクトのより良い運営と継続的な開発のために行われました。円滑な移行にご協力いただき、誠にありがとうございます。 :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

The repository has moved from @dahlia/hollo to @fedify-dev/hollo! Along with this move, our image registry has also been relocated from ghcr.io/dahlia/hollo to ghcr.io/fedify-dev/hollo.

While the old image registry will remain accessible, it won't receive any new tags. We recommend all Hollo users to update their Docker image references to the new registry address.

To update your Docker configurations, please change:

  • From: ghcr.io/dahlia/hollo:latest
  • To: ghcr.io/fedify-dev/hollo:latest

The migration ensures better project organization and continued development. Thank you for your understanding and cooperation in making this transition smooth! :hollo:

https://hollo.social/@fedify/0194a851-581d-779c-b777-dc39e753ef14

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

We've just moved the project and related repositories to our new GitHub organization account, @fedify-dev! 🎉

Here's what moved:

All repositories have been transferred and GitHub's automatic redirects are in place, so existing links will continue to work. Also, the project's core functionality and development process remain unchanged.

Thanks to everyone who participated in our naming poll. Looking forward to Fedify's continued growth under its new organizational home!

:fedify: New GitHub organization: https://github.com/fedify-dev.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

In related news, has also released updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We have released updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a in 's implementation. We recommend all users update to the latest version of their respective release series immediately.

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

  • Perform denial of service attacks through infinite redirect loops
  • Execute server-side request forgery () attacks via redirects to private network addresses
  • Access unintended URL schemes through redirect manipulation

Fixed Versions

  • 1.3.x series: Update to 1.3.4
  • 1.2.x series: Update to 1.2.11
  • 1.1.x series: Update to 1.1.11
  • 1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

  1. Added a maximum redirect limit (5) to prevent infinite redirect loops
  2. Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
  3. Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

Once we have a @fedify org account, we'll be moving 's repository there as well.

https://hollo.social/@fedify/01949657-262f-78f4-a9a0-97643682ea70

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We're planning to move our GitHub repository to an organization account for better project management. We've requested GitHub support to help us acquire the inactive @fedify username for this purpose. (The attached screenshot is our formal request to GitHub support.)

If we successfully acquire @fedify, that will be our new organization name. If not, we'll choose an alternative name. We'll keep you updated on the progress!

In any case, we'll ensure a smooth transition with proper redirects from the current repository. Stay tuned for updates!

Dear GitHub Support, I am writing to request the takeover of the inactive GitHub username “@fedify”. This username is currently held by an account that shows no activity since its creation—no repositories, contributions, or any other engagement. I am the maintainer of the Fedify project (https://github.com/dahlia/fedify), which is an open source ActivityPub server framework. We would like to use this username as an organization account to host our project and related repositories. The reasons for this request are: 1. The current “@fedify” account has been completely inactive with no public contributions or repositories 2. The name directly relates to our project's name and purpose 3. We need an organization account to better manage our growing open source project 4. The username would help us maintain consistent branding across different platforms (@fedify on npm, JSR, etc.) If possible, we would greatly appreciate if you could help us acquire this username. We believe this would benefit the GitHub community by putting the inactive username to active use for an open source project. Please let me know if you need any additional information to process this request. Thank you for your time and consideration. Best regards, Hong Minhee (@dahlia)
Dear GitHub Support, I am writing to request the takeover of the inactive GitHub username “@fedify”. This username is currently held by an account that shows no activity since its creation—no repositories, contributions, or any other engagement. I am the maintainer of the Fedify project (https://github.com/dahlia/fedify), which is an open source ActivityPub server framework. We would like to use this username as an organization account to host our project and related repositories. The reasons for this request are: 1. The current “@fedify” account has been completely inactive with no public contributions or repositories 2. The name directly relates to our project's name and purpose 3. We need an organization account to better manage our growing open source project 4. The username would help us maintain consistent branding across different platforms (@fedify on npm, JSR, etc.) If possible, we would greatly appreciate if you could help us acquire this username. We believe this would benefit the GitHub community by putting the inactive username to active use for an open source project. Please let me know if you need any additional information to process this request. Thank you for your time and consideration. Best regards, Hong Minhee (@dahlia)
洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social

If you'd like to support the development of @fedify or @hollo or @botkit, you can sponsor me on GitHub!

https://github.com/sponsors/dahlia

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social · Reply to 洪 民憙 (Hong Minhee)'s post

제 프로젝트인 @fedify, @hollo, @botkit 等(등)의 開發(개발)을 後援(후원)하고 싶으신 분들께서는, GitHub에서 제 스폰서가 되어 주세요!

https://github.com/sponsors/dahlia

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social · Reply to 洪 民憙 (Hong Minhee)'s post

「@fedify」や「@hollo」や「@botkit」の開発を支援したい方は、GitHubでスポンサーになってください！

https://github.com/sponsors/dahlia

洪 民憙 (Hong Minhee)'s avatar
洪 民憙 (Hong Minhee)

@hongminhee@hollo.social

If you'd like to support the development of @fedify or @hollo or @botkit, you can sponsor me on GitHub!

https://github.com/sponsors/dahlia

Forfattar Markus Pedersen 📚🌱's avatar
Forfattar Markus Pedersen 📚🌱

@markus@prosa.skvip.lol

Introduksjon

Hei!

Eg er forfattar Markus Pedersen. Eg har tidlegare gjeve ut ein teikneserietrilogi om nokre udugelege superheltar kalla (https://www.uberpress.no/collections/udugeleg-collection).

For tida prøvar eg meg i heilt andre banar enn superheltar med dikt og anna kortprosa. Eg er i ein prosess med å sende nokre samlingar rundt til forlag.

På denne kontoen har eg tenkt å leggje ut nokre av desse tekstane eg skriv. Dei kan gjerne vera litt for lange for ein vanleg -konto, og difor nyttar eg til dette.

Det kjem til å vera ein del tekstar med tung tematikk, eg skal prøve å vera flink med innhaldsfilter på dei aller tyngste.

Min kvardagslege konto er @markus. Eg nyttar den som ein småblogg, så der finn du allslags tankar om allslags greiar.

Eg vonar du vil følgje meg her sjølv om du følgjar meg annastads allereie!

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

この件に関連して、Holloもセキュリティアップデートをリリースしました。0.3.6または0.4.4バージョンに今すぐアップデートしてください！

https://hollo.social/@fedify/0194848e-7cac-7af3-941b-c93999a51274

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

FedifyのWebFinger実装における脆弱性CVE-2025-23221に対するセキュリティアップデート（1.0.14、1.1.11、1.2.11、1.3.4）をリリースいたしました。すべてのユーザー様におかれましては、お使いのバージョンに応じた最新版への速やかなアップデートを推奨いたします。

脆弱性の詳細

セキュリティ研究者により、FedifyのlookupWebFinger()関数において以下のセキュリティ上の問題が発見されました：

  • 無限リダイレクトループによるサービス拒否攻撃（DoS）の可能性
  • プライベートネットワークアドレスへのリダイレクトを利用したSSRF（サーバーサイドリクエストフォージェリ）攻撃の可能性
  • リダイレクト操作による意図しないURLスキームへのアクセスの可能性

修正されたバージョン

  • 1.3.xシリーズ：1.3.4へアップデート
  • 1.2.xシリーズ：1.2.11へアップデート
  • 1.1.xシリーズ：1.1.11へアップデート
  • 1.0.xシリーズ：1.0.14へアップデート

変更内容

本セキュリティアップデートでは、以下の修正が実施されました：

  1. 無限リダイレクトループを防ぐため、最大リダイレクト回数（5回）の制限を導入
  2. 元のリクエストと同じスキーム（HTTP/HTTPS）のみにリダイレクトを制限
  3. SSRFを防止するため、プライベートネットワークアドレスへのリダイレクトをブロック

アップデート方法

以下のコマンドで最新のセキュアバージョンにアップデートできます：

# npmユーザーの場合
npm update @fedify/fedify

# Denoユーザーの場合
deno add jsr:@fedify/fedify

この脆弱性を責任を持って報告していただいたセキュリティ研究者の方に感謝申し上げます。迅速な対応が可能となりました。

本脆弱性の詳細については、セキュリティ勧告をご参照ください。

ご質問やご懸念がございましたら、GitHub Discussions、Matrixチャットスペース、またはDiscordサーバーまでお気軽にご連絡ください。

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

In related news, has also released updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We have released updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a in 's implementation. We recommend all users update to the latest version of their respective release series immediately.

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

  • Perform denial of service attacks through infinite redirect loops
  • Execute server-side request forgery () attacks via redirects to private network addresses
  • Access unintended URL schemes through redirect manipulation

Fixed Versions

  • 1.3.x series: Update to 1.3.4
  • 1.2.x series: Update to 1.2.11
  • 1.1.x series: Update to 1.1.11
  • 1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

  1. Added a maximum redirect limit (5) to prevent infinite redirect loops
  2. Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
  3. Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

이와 관련하여, 역시 업데이트가 이뤄졌습니다. 0.3.6 또는 0.4.4 버전으로 바로 업데이트하시기 바랍니다!

https://hollo.social/@fedify/0194848b-3b9e-7da1-b631-c011db2f4c43

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social · Reply to Fedify: an ActivityPub server framework's post

프레임워크의 구현에서 발견된 보안 취약점 CVE-2025-23221을 해결하기 위한 보안 업데이트(1.0.14, 1.1.11, 1.2.11, 1.3.4)를 배포했습니다. 모든 사용자께서는 각자 사용 중인 버전에 해당하는 최신 버전으로 즉시 업데이트하시기를 권장합니다.

취약점 내용

보안 연구자가 Fedify의 lookupWebFinger() 함수에서 다음과 같은 보안 문제점들을 발견했습니다:

  • 무한 리다이렉트 루프를 통한 서비스 거부 공격 가능
  • 내부 네트워크 주소로의 리다이렉트를 통한 SSRF (서버측 요청 위조) 공격 가능
  • 리다이렉트 조작을 통한 의도하지 않은 URL 스킴 접근 가능

수정된 버전

  • 1.3.x 시리즈: 1.3.4로 업데이트
  • 1.2.x 시리즈: 1.2.11로 업데이트
  • 1.1.x 시리즈: 1.1.11로 업데이트
  • 1.0.x 시리즈: 1.0.14로 업데이트

변경 사항

이번 보안 업데이트에는 다음과 같은 수정 사항이 포함되어 있습니다:

  1. 무한 리다이렉트 루프를 방지하기 위해 최대 리다이렉트 횟수 제한(5회) 도입
  2. 원래 요청과 동일한 스킴(HTTP/HTTPS)으로만 리다이렉트 허용하도록 제한
  3. SSRF 공격 방지를 위해 내부 네트워크 주소로의 리다이렉트 차단

업데이트 방법

다음 명령어로 최신 보안 버전으로 업데이트하실 수 있습니다:

# npm 사용자의 경우
npm update @fedify/fedify

# Deno 사용자의 경우
deno add jsr:@fedify/fedify

이 취약점을 책임감 있게 보고해 주신 보안 연구자께 감사드립니다. 덕분에 신속하게 문제를 해결할 수 있었습니다.

이 취약점에 대한 자세한 내용은 보안 권고문을 참고해 주시기 바랍니다.

문의 사항이나 우려 사항이 있으시다면 GitHub Discussions나 Matrix 채팅방, 또는 Discord 서버를 통해 언제든 연락해 주시기 바랍니다.

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

In related news, has also released updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework's avatar
Fedify: an ActivityPub server framework

@fedify@hollo.social

We have released updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a in 's implementation. We recommend all users update to the latest version of their respective release series immediately.

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

  • Perform denial of service attacks through infinite redirect loops
  • Execute server-side request forgery () attacks via redirects to private network addresses
  • Access unintended URL schemes through redirect manipulation

Fixed Versions

  • 1.3.x series: Update to 1.3.4
  • 1.2.x series: Update to 1.2.11
  • 1.1.x series: Update to 1.1.11
  • 1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

  1. Added a maximum redirect limit (5) to prevent infinite redirect loops
  2. Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
  3. Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Forfattar Markus Pedersen 📚🌱's avatar
Forfattar Markus Pedersen 📚🌱

@markus@prosa.skvip.lol

Introduksjon

Hei!

Eg er forfattar Markus Pedersen. Eg har tidlegare gjeve ut ein teikneserietrilogi om nokre udugelege superheltar kalla (https://www.uberpress.no/collections/udugeleg-collection).

For tida prøvar eg meg i heilt andre banar enn superheltar med dikt og anna kortprosa. Eg er i ein prosess med å sende nokre samlingar rundt til forlag.

På denne kontoen har eg tenkt å leggje ut nokre av desse tekstane eg skriv. Dei kan gjerne vera litt for lange for ein vanleg -konto, og difor nyttar eg til dette.

Det kjem til å vera ein del tekstar med tung tematikk, eg skal prøve å vera flink med innhaldsfilter på dei aller tyngste.

Min kvardagslege konto er @markus. Eg nyttar den som ein småblogg, så der finn du allslags tankar om allslags greiar.

Eg vonar du vil følgje meg her sjølv om du følgjar meg annastads allereie!

Forfattar Markus Pedersen 📚🌱's avatar
Forfattar Markus Pedersen 📚🌱

@markus@prosa.skvip.lol

Introduksjon

Hei!

Eg er forfattar Markus Pedersen. Eg har tidlegare gjeve ut ein teikneserietrilogi om nokre udugelege superheltar kalla (https://www.uberpress.no/collections/udugeleg-collection).

For tida prøvar eg meg i heilt andre banar enn superheltar med dikt og anna kortprosa. Eg er i ein prosess med å sende nokre samlingar rundt til forlag.

På denne kontoen har eg tenkt å leggje ut nokre av desse tekstane eg skriv. Dei kan gjerne vera litt for lange for ein vanleg -konto, og difor nyttar eg til dette.

Det kjem til å vera ein del tekstar med tung tematikk, eg skal prøve å vera flink med innhaldsfilter på dei aller tyngste.

Min kvardagslege konto er @markus. Eg nyttar den som ein småblogg, så der finn du allslags tankar om allslags greiar.

Eg vonar du vil følgje meg her sjølv om du følgjar meg annastads allereie!

Forfattar Markus Pedersen 📚🌱's avatar
Forfattar Markus Pedersen 📚🌱

@markus@prosa.skvip.lol

Introduksjon

Hei!

Eg er forfattar Markus Pedersen. Eg har tidlegare gjeve ut ein teikneserietrilogi om nokre udugelege superheltar kalla (https://www.uberpress.no/collections/udugeleg-collection).

For tida prøvar eg meg i heilt andre banar enn superheltar med dikt og anna kortprosa. Eg er i ein prosess med å sende nokre samlingar rundt til forlag.

På denne kontoen har eg tenkt å leggje ut nokre av desse tekstane eg skriv. Dei kan gjerne vera litt for lange for ein vanleg -konto, og difor nyttar eg til dette.

Det kjem til å vera ein del tekstar med tung tematikk, eg skal prøve å vera flink med innhaldsfilter på dei aller tyngste.

Min kvardagslege konto er @markus. Eg nyttar den som ein småblogg, så der finn du allslags tankar om allslags greiar.

Eg vonar du vil følgje meg her sjølv om du følgjar meg annastads allereie!

Forfattar Markus Pedersen 📚🌱's avatar
Forfattar Markus Pedersen 📚🌱

@markus@prosa.skvip.lol

Introduksjon

Hei!

Eg er forfattar Markus Pedersen. Eg har tidlegare gjeve ut ein teikneserietrilogi om nokre udugelege superheltar kalla (https://www.uberpress.no/collections/udugeleg-collection).

For tida prøvar eg meg i heilt andre banar enn superheltar med dikt og anna kortprosa. Eg er i ein prosess med å sende nokre samlingar rundt til forlag.

På denne kontoen har eg tenkt å leggje ut nokre av desse tekstane eg skriv. Dei kan gjerne vera litt for lange for ein vanleg -konto, og difor nyttar eg til dette.

Det kjem til å vera ein del tekstar med tung tematikk, eg skal prøve å vera flink med innhaldsfilter på dei aller tyngste.

Min kvardagslege konto er @markus. Eg nyttar den som ein småblogg, så der finn du allslags tankar om allslags greiar.

Eg vonar du vil følgje meg her sjølv om du følgjar meg annastads allereie!

Forfattar Markus Pedersen 📚🌱's avatar
Forfattar Markus Pedersen 📚🌱

@markus@prosa.skvip.lol

Introduksjon

Hei!

Eg er forfattar Markus Pedersen. Eg har tidlegare gjeve ut ein teikneserietrilogi om nokre udugelege superheltar kalla (https://www.uberpress.no/collections/udugeleg-collection).

For tida prøvar eg meg i heilt andre banar enn superheltar med dikt og anna kortprosa. Eg er i ein prosess med å sende nokre samlingar rundt til forlag.

På denne kontoen har eg tenkt å leggje ut nokre av desse tekstane eg skriv. Dei kan gjerne vera litt for lange for ein vanleg -konto, og difor nyttar eg til dette.

Det kjem til å vera ein del tekstar med tung tematikk, eg skal prøve å vera flink med innhaldsfilter på dei aller tyngste.

Min kvardagslege konto er @markus. Eg nyttar den som ein småblogg, så der finn du allslags tankar om allslags greiar.

Eg vonar du vil følgje meg her sjølv om du følgjar meg annastads allereie!

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

does not currently cache media attached to remote posts or avatars from remote accounts (except for thumbnails). Do you think we should cache them?

OptionVoters
It's fine the way it is.3 (9%)
They should be cached.6 (18%)
It would be nice to be configurable.24 (73%)
Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

Have you been having trouble fetching accounts or posts from that have custom emojis in ?

This is because they represent an Emoji object as an invalid JSON-LD object. Fortunately, this patch fixes that issue, so keep an eye out for it.

https://hollo.social/@fedify/01941dab-e4c3-7ce0-9307-b5b8c095d521

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social · Reply to Hollo :hollo:'s post

You can get started with your own Hollo in just a few clicks with the official template for :

https://railway.app/template/eopPyH?referralCode=qeEK5G

Hollo :hollo:'s avatar
Hollo :hollo:

@hollo@hollo.social

Introducing . Hollo is an -enabled single-user microblogging software. Although it's for a single user, it also supports creating and running multiple accounts for different topics.

It's headless, meaning you can use existing client apps instead, with its Mastodon-compatible APIs. It has most feature parity with Mastodon. Two big differences with Mastodon is that you can use in the content of your posts and you can quote another post.

Oh, and Hollo is built using and .

https://github.com/dahlia/hollo