Laurens Hof

2025-04-08 17:22:28

Fediverse Report – #111

A new security fund for the fediverse, and the Lemmy developers held an AMA.

The News

The Nivenly Foundation, the organisation that administers the Hachyderm.io instance, is opening a new security fund to sponsor contributors who disclose security vulnerabilities. All software has security vulnerabilities, and the fediverse is no exception. The recent Pixelfed vulnerability, which affected non-Pixelfed servers, is a clear example of how fediverse software can make software vulnerabilities more complex due to the interaction between different software platforms.

The Nivenly Fediverse Security Fund will sponsor $250 USD for vulnerabilities that are rated as high risk (7-9 CVSS score) and $500 USD for vulnerabilities with a critical score (9+ CVSS). The program will run until the end of September 2025. Nivenly members “hold a member vote to determine if we want to continue the program, and to establish a longer-term committee to steward and maintain the program.”

Last week, I wrote how Pixelfed’s vulnerability actually showed three different problems: The main problem is Pixelfed’s software vulnerability itself, but there were also two other problems: other software like Mastodon do not make it clear which risk comes with their private posts feature. And once a leak like this one happens, very few fediverse software admins communicated to their users that they might have been affected.

A security fund contributes to combating software vulnerabilities, but it can also help with communication to the rest of the fediverse once a vulnerability is found. It incentives that standard industry practices regarding software vulnerability get followed, and make communication clearer to a wider audience. For example, if Pixelfed’s recent vulnerability had gotten a CVSS classification, it might have been easier to make the severity of the vulnerability explicit to other fediverse software admins. In turn, this might have made it more likely that server admins would communicate the situation with their users.

In last week’s email essay I also wrote about how the fediverse is missing governance infrastructure that connects the various independent nodes and communities. One way to view the fediverse is as a response to centralised Big Tech platforms. These platforms have centralised governance, and are under the control of few people. The fediverse’s response to this is to build a social network that consists of tens of thousands of independent communities, all with their own governance structure. The fediverse has been successful in decentralising the single entity that oversees a social network into many pieces that all oversee a small portion of the network. But it has struggled to build a governance structure that ties all these individual pieces together again.

The Nivenly Fediverse Security Fund is a good example of this problem: software security impacts all the thousands of independent fediverse communities, but there is no overarching structure to collaborate and improve the security. It took one server taking the initiative into their own hands and provide a service for the entire network, at their own cost. Ideally, communities would collaborate on such a security fund instead. Nivenly’s announcement does leave space for such a future direction of the fund, saying that they are open to “establish a longer-term committee to steward and maintain the program”.

Note: if you sign up for my email newsletter, you get a weekly essay about the open social web that I do not publish anywhere else. You can sign up right here:

The Lemmy developers, Dessalines and nutomic, held an Ask Me Anything recently, and here are some of the answers that stood out to me:

• Lemmy is working towards their 1.0 release. This is currently expected to be in the fall, although nutomic also says that “these things always take longer than expected”. He also expects some instances like lemmy.ml already to upgrade some months before.
• One of the main features for Lemmy 1.0 is private communities, where only approved accounts can browse and posts to the community. This type of closed group functionality is in high demand, and both Mastodon and Pixelfed have tried to implement it. Mastodon got a grant for it, but the proof-of-concept code has been sitting there since 2022. Pixelfed has announced and teased a group feature multiple times over the year and showed screenshots of it, but it also is not publicly available yet.
• Lemmy posts are interoperable with Mastodon, but the interoperability is not great: a Lemmy post appears on Mastodon as the title plus the URL. There has been many conversations about how Mastodon handles content from other platforms, with no changes so far. In this AMA, nutomic is explicit in saying that it is up to Mastodon to change this. While Mastodon seems open to the idea, and has been in conversations with developers from platforms like Ghost and NodeBB on how to show their content better on Mastodon, there has been little indication that Mastodon is taking steps towards making Lemmy content also better visible on Mastodon.
• On the subject of how Lemmy can grow, Dessalines describes it as an organic progress, saying: “niche communities on reddit will keep getting fed up with the changes, and migrate to lemmy.” Nutomic describes a similar dynamic for fedi and Bluesky more broadly, saying that he expects that over the long term the fediverse might grow in a similar manner: “when the Bluesky admins make decisions that the community doesnt like, and then there may be another migration wave to the Fediverse”. Both replies indicate Lemmy’s vision of how the project can grow in the long run: stay consistently working on your product, and because platforms like Lemmy are not beholden to investors, they can have a longer lifespan, and outlive platforms who are beholden to shareholder expectations.
• Grouping of communities (similar to PieFed’s topics or Reddit’s multireddits) “will be implemented soon“.

---

Ahoy! is a one-day conference for the European Social Web, and will be held on April 24th 2025 in Hamburg, Germany. The conference is mainly focused on Bluesky and the AT Protocol, and has some super fascinating speakers of people who are in the forefront of building new communities on the open social web. If you’re around I can definitely recommend it. I’ll be doing some interviews with people there, so if you are considering joining, let me know and we can say hi!

The Links

• More notes on Organizing, Mutual Aid, and Activism on decentralized social networks – Jon Pincus/The Nexus of Privacy
• Ghost says there are now over a 1000 Ghost servers who have connected with the rest of the fediverse.
• Mastodon’s monthly engineering updates, Trunk & Tidbits, is now available for March 2025.
• A dataset with over 900 verified accounts of media organisations on Mastodon.
• This week’s fediverse software updates.

That’s all for this week, thanks for reading! You can subscribe to my newsletter to get all my weekly updates via email, which gets you some interesting extra analysis as a bonus, that is not posted here on the website. You can subscribe below:

#fediverse

fediversereport.com/fediverse-…

More notes on Organizing, Mutual Aid, and Activism on decentralized social networks

"Mutual aid. Organizing. Sharing, contextualizing, and making meaning of news and health information to counter propaganda and information overload.

^{Jon (The Nexus Of Privacy)}

The Nivenly Foundation

2025-04-02 13:00:14

Over the past year, we've been thinking about how we can improve the security of the Fediverse to provide a safer, more trustworthy experience for people of the Fediverse.

Today we're launching a time-and-funds limited Fediverse Security Fund, where we will pay researchers and contributors for the responsible disclosure of security vulnerabilities in open-source Fediverse software.

We're starting small as an experiment to gauge interest, figure out our processes, and eventually decide if/how to expand this program and make it more permanent. If you're a security researcher or upstream contributor, join us in making the Fediverse a safer place.

You can read more about this program on our blog: nivenly.org/blog/2025/04/01/ni…

Nivenly Fediverse Security Fund

Security bounty fund to sponsor contributors who responsibly disclose security vulnerabilities in popular open source Fediverse software.

^nivenly.org

Poliverso - notizie dal Fediverso ⁂

2025-03-31 13:24:45

Mastodon | social media empowering independent journalism (Perugia International Journalism Festival)

Inizia: Venerdì Aprile 11, 2025 @ 6:30 PM GMT+02:00 (Europe/Rome)

Finisce: Venerdì Aprile 11, 2025 @ 8:30 PM GMT+02:00 (Europe/Rome)

Join Mastodon for an aperitivo at the International Journalism Festival!

Are you curious about how Mastodon is shaping the media landscape for independent journalists? We will host an aperitivo together with a short presentation covering the latest trends and developments in Mastodon. After our presentation, join a discussion and networking session with the Mastodon team, where you can share your ideas and experiences.

Complimentary drinks and light bites will be provided.

This event is open to all, but registration is required, as space is limited. Please RSVP via this link.

Venue: Umbrò, Via Sant'Ercolano 4, Perugia.

Contact info: philip@joinmastodon.org

Organised by Mastodon.

Posizione: Via Sant'Ercolano 4, Perugia