fiona :loading: / is on Nostr

ℹ️ formerly fiona (npub174p…35xy)

i hate it when computer, but sometimes i love it when computer

feel free to send a follow request

alt: fionya (npub1k6g…g44f)

age: mid twenties
pro™ nouns: she/it/they
location: SB-129

Last Notes

2025-03-25 17:33:51

- reply

Pixelfed before v0.12.5 has a vulnerability where it could leak your private posts, regardless of whether you are a Pixelfed user or not.
Admins should update ASAP.
When following someone from a different server on the Fediverse, the remote server decides whether you are allowed to do that. This enables features like locked accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. If a legitimate user from a Pixelfed instance follows you on your locked account, anyone on that Pixelfed instance can read your private posts.
I wrote a blog post about how I found the vulnerability, how disclosure coordination went and general ramblings about Fediverse safety:
https://fokus.cool/2025/03/25/pixelfed-vulnerability.html
#pixelfed #fediverse #activitypub

2025-03-24 16:00:22

pixelfed instance admins: Please update pixelfed to v0.12.5 asap. The version contains fixes for serious security vulnerabilities that I reported.
I will disclose further details about the vulnerabilities in about 24 hours.
:boost_requested:

2025-03-07 16:23:37

tiny blinky city
https://mystical.garden/system/media_attachments/files/114/122/065/173/074/584/original/1d3f09c8a4f76e88.mp4

2025-02-10 17:39:28

https://mystical.garden/system/media_attachments/files/113/980/805/440/899/661/original/27851bca54d56c0f.png

2025-02-10 00:53:11

https://mystical.garden/system/media_attachments/files/113/976/844/653/133/603/original/2243ff11565cb778.png

2025-01-17 21:44:57

- reply

We, the users, should question the context and purpose under which the protocols and software we promote are created - and whether that's in our interest or not.
Heck, maybe having a venture capital funded company at the steering wheel of the protocols that were meant to free us from the venture capitalist messengers... wasn't the best approach?
Where to go from here? Honestly, no idea. I have no proposals to make. But I think commentary is important. Maybe we can learn and find better ways to have nice things.

2025-01-17 21:44:49

- reply

Welp, I didn't expect this post to blow up like that. Maybe I should add some context.
I think this is a messy PR move gone awry. It's not a secret that Synapse doesn't scale well. The interesting part lies in the bigger picture.
First of all: There's nothing *inherently* wrong with a company building a closed source product to interface with open software/standards.
People have opinions on whether that's beneficial for the ecosystem or not. It's not the can of worms I want to open, but I can't avoid it entirely.
Some history. In the end of 2023 Element pulled a very interesting move where they forked Synapse and relicensed the code from Apache 2.0 to AGPLv3 and started requiring a CLA for contributions. See: https://matrix.org/blog/2023/11/06/future-of-synapse-dendrite/
Since Element staff is responsible for most of the maintenance work, the Matrix Foundation had no chance but to discontinue their Apache licensed version.
So, essentially project ownership of Synapse (forcefully) changed from the Matrix Foundation to the Element company.
A bit later Element announced a proprietary version of Synapse where they claimed to have fixed some of the most glaring architectural issues.
Suddenly they have a big commercial incentive to keep Synapse slow. And in this blog post they say that, loud and clear.

2025-01-17 14:47:07

lol @ element for pulling "our code base is utter trash and we have no intention to fix that, please buy our proprietary rewrite"
https://element.io/blog/scaling-to-millions-of-users-requires-synapse-pro/

2025-01-05 22:40:30

https://mystical.garden/system/media_attachments/files/113/778/132/339/158/968/original/f44bbc72d226cd3b.png