1
0
Fork 0
forked from mirrors/akkoma
erincandescent's akkoma fork, potentially with various experimental changes. Synced to https://akkoma.dev/erincandescent/akkoma
Go to file
Oneric 8684964c5d Only allow exact id matches
This protects us from falling for obvious spoofs as from the current
upload exploit (unfortunately we can’t reasonably do anything about
spoofs with exact matches as was possible via emoji and proxy).

Such objects being invalid is supported by the spec, sepcifically
sections 3.1 and 3.2: https://www.w3.org/TR/activitypub/#obj-id

Anonymous objects are not relevant here (they can only exists within
parent objects iiuc) and neither is client-to-server or transient objects
(as those cannot be fetched in the first place).
This leaves us with the requirement for `id` to (a) exist and
(b) be a publicly dereferencable URI from the originating server.
This alone does not yet demand strict equivalence, but the spec then
further explains objects ought to be fetchable _via their ID_.
Meaning an object not retrievable via its ID, is invalid.

This reading is supported by the fact, e.g. GoToSocial (recently) and
Mastodon (for 6+ years) do already implement such strict ID checks,
additionally proving this doesn’t cause federation issues in practice.

However, apart from canonical IDs there can also be additional display
URLs. *omas first redirect those to their canonical location, but *keys
and Mastodon directly serve the AP representation without redirects.

Mastodon and GTS deal with this in two different ways,
but both constitute an effective countermeasure:
 - Mastodon:
   Unless it already is a known AP id, two fetches occur.
   The first fetch just reads the `id` property and then refetches from
   the id. The last fetch requires the returned id to exactly match the
   URL the content was fetched from. (This can be optimised by skipping
   the second fetch if it already matches)
   05eda8d193/app/helpers/jsonld_helper.rb (L168)
   63f0979799

 - GTS:
   Only does a single fetch and then checks if _either_ the id
   _or_ url property (which can be an object) match the original fetch
   URL. This relies on implementations always including their display URL
   as "url" if differing from the id. For actors this is true for all
   investigated implementations, for posts only Mastodon includes an
   "url", but it is also the only one with a differing display URL.
   2bafd7daf5 (diff-943bbb02c8ac74ac5dc5d20807e561dcdfaebdc3b62b10730f643a20ac23c24fR222)

Albeit Mastodon’s refetch offers higher compatibility with theoretical
implmentations using either multiple different display URL or not
denoting any of them as "url" at all, for now we chose to adopt a
GTS-like refetch-free approach to avoid additional implementation
concerns wrt to whether redirects should be allowed when fetching a
canonical AP id and potential for accidentally loosening some checks
(e.g. cross-domain refetches) for one of the fetches.
This may be reconsidered in the future.
2024-03-25 14:05:05 -01:00
.gitea/issue_template Update '.gitea/issue_template/feat.yml' 2022-12-12 04:26:43 +00:00
.woodpecker Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
benchmarks Merge branch 'benchmark-fixes' into 'develop' 2021-12-09 15:38:26 +00:00
ci CI: Use own package as base 2021-12-26 18:05:42 +01:00
config Never automatically assign privileged content types 2024-03-18 22:33:10 -01:00
docker-resources Update docker compose commands to Compose V2 2023-06-18 01:37:40 -04:00
docs StealEmoji: check remote size before downloading 2024-03-18 22:33:10 -01:00
installation Update example nginx config 2024-03-18 22:33:10 -01:00
lib Only allow exact id matches 2024-03-25 14:05:05 -01:00
priv Drop media base_url default and recommend different domain 2024-03-18 22:33:10 -01:00
rel Disable busy waits in the default OTP vm.args configuration. 2024-02-17 13:21:56 +01:00
restarter fix_flaky_transfer_task_test.exs (#237) 2022-11-01 14:31:29 +00:00
scripts document prometheus 2022-12-16 10:24:36 +00:00
test Only allow exact id matches 2024-03-25 14:05:05 -01:00
uploads fix issues with the uploads directory 2019-04-28 06:43:00 +02:00
.buildpacks CI: Add auto-deployment via dokku. 2019-05-31 10:55:35 +02:00
.credo.exs Move Consistency.FileLocation to ./test 2020-10-13 19:57:45 +02:00
.dockerignore Docker builds (#231) 2022-10-16 19:25:54 +00:00
.formatter.exs Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
.gitattributes Don't treat js/css as binary in git anymore 2022-12-23 18:03:14 +00:00
.gitignore Change docs README for new way of building docs 2023-01-26 15:42:53 +01:00
.mailmap Add myself to .mailmap 2021-02-15 13:19:44 +03:00
AGPL-3 LICENSE → AGPL-3 2019-04-01 00:31:21 +02:00
CC-BY-4.0 Add a copy of CC-BY-4.0 to the repo 2020-09-06 11:38:38 +03:00
CC-BY-SA-4.0 CC-BY-SA-4.0: Add a copy of the CC-BY-SA-4.0 license 2019-04-01 00:30:21 +02:00
CHANGELOG.md Always insert Dedupe upload filter 2024-03-18 22:33:10 -01:00
CODE_OF_CONDUCT.md add code of conduct (#129) 2022-08-03 10:55:11 +00:00
COPYING Remove reference to city.jpg in COPYING 2022-11-25 07:29:50 +00:00
coveralls.json exclude file_location check from coveralls 2020-10-13 16:44:01 +03:00
docker-compose.yml Add shm_size to the Database container 2023-08-21 21:50:10 +00:00
docker-entrypoint.sh Docker builds (#231) 2022-10-16 19:25:54 +00:00
Dockerfile Bump builds to OTP26 2023-08-09 14:39:28 +01:00
elixir_buildpack.config Update elixir version in elixir_buildpack.config 2023-03-16 12:54:15 -04:00
mix.exs mix: fix docs task 2024-03-18 22:40:43 -01:00
mix.lock don't select ueberauth 0.10.6, as it is broken 2023-12-17 18:59:31 +00:00
Procfile CI: Add auto-deployment via dokku. 2019-05-31 10:55:35 +02:00
README.md Add YunoHost to installation guides 2023-04-03 11:22:53 +02:00
SECURITY.md Update notes on security exploit handling 2024-03-04 17:50:19 +01:00
SIGNING_KEY.pub 2022.09 stable release chores (#206) 2022-09-10 14:44:17 +00:00

akkoma

a smallish microblogging platform, aka the cooler pleroma

English OK 日本語OK

About

This is a fork of Pleroma, which is a microblogging server software that can federate (= exchange messages with) other servers that support ActivityPub. What that means is that you can host a server for yourself or your friends and stay in control of your online identity, but still exchange messages with people on larger servers. Akkoma will federate with all servers that implement ActivityPub, like Friendica, GNU Social, Hubzilla, Mastodon, Misskey, Peertube, and Pixelfed.

Akkoma is written in Elixir and uses PostgreSQL for data storage.

For clients it supports the Mastodon client API with Pleroma extensions (see the API section on https://docs.akkoma.dev/stable/).

Differences with Pleroma

Akkoma is a faster-paced fork, it has a varied and potentially experimental feature set tailored specifically to the corner of the fediverse inhabited by the project creator and contributors.

This should not be considered a one-for-one match with pleroma; it is more opinionated in many ways, and has a smaller community (which is good or bad depending on your view)

For example, Akkoma has:

  • Custom Emoji reactions (compatible with misskey)
  • Misskey-flavoured markdown support
  • Elasticsearch and Meilisearch support for search
  • Mastodon frontend (Glitch-Soc and Fedibird flavours) support
  • Automatic post translation via DeepL or LibreTranslate
  • A multitude of heavy modifications to the Pleroma Frontend (Pleroma-FE)
  • The "bubble" concept, in which instance administrators can choose closely-related instances to make a "community of communities", so to say

And takes a more opinionated stance on issues like Domain blocks, which are enforced far more on Akkoma.

Take a look at the Changelog if you want a full list of recent changes, everything since 3.0 has been Akkoma.

Installation

If you are running Linux (glibc or musl) on x86, the recommended way to install Akkoma is by using OTP releases. OTP releases are as close as you can get to binary releases with Erlang/Elixir. The release is self-contained, and provides everything needed to boot it. The installation instructions are available here.

From Source

If your platform is not supported, or you just want to be able to edit the source code easily, you may install Akkoma from source.

Docker

Docker installation is supported via this setup

Packages

Akkoma is packaged for YunoHost and can be found and installed from the YunoHost app catalogue.

Compilation Troubleshooting

If you ever encounter compilation issues during the updating of Akkoma, you can try these commands and see if they fix things:

  • mix deps.clean --all
  • mix local.rebar
  • mix local.hex
  • rm -r _build

Documentation