🛡️ #Cybersecurity news & tips across the #fediverse

“Surveillance Daily: August 20, 2026 ⌗ALPR ⌗Surveillance ⌗Privacy ⌗FlockSafety deflocktheusa․com/surveillance-daily-august-20-2026/”

https://mastodon.social/@deflocktheusa/117128155702954537

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“🇷🇺 🧬 An ancient DNA perspective on the Russian conquest of Yakutia'We found Yakut origins tracing back to local populations that admixed with Trans-Baikal groups migrating as the Great Mongol Empire spread․ Despite …”

https://social.vivaldi.net/@bibliolater/117127880772160850

🤖 via RSS feed. Not an endorsement.

No, you can't follow me. What even is this? According to reverse image search:

This image shows Nadia Calviño, the President of the European Investment Bank (EIB) and former First Vice-President and Minister for Economy, Trade and Enterprise of Spain

Getting these botcreeps from mastodon.social about once a day lately. I'd block the whole stupid domain if that wouldn't mean half the fediverse.

#fediverse

Alt...

It says Laura Hamilton

Alt...

This is NOT "Laura Hamilton"

🐘 Mon instance Mastodon vient de passer en 4.7.0 !

Grosse mise à niveau côté interne (sécurité, nouveaux protocoles ActivityPub, préparation à la 5.0), presque invisible côté utilisateurs — mais ça méritait un petit guide.

📝 J'en ai profité pour documenter toute la procédure Docker Compose (backup, migrations, bascule) sur mon wiki, pour celles et ceux qui gèrent leur propre instance :
👉 https://wiki.blablalinux.be/fr/mise-a-niveau-mastodon-docker

#Mastodon #SelfHosting #Fediverse #Docker #FOSS

🛡️ #Cybersecurity news & tips across the #fediverse

“What's scary is how quickly these guys amassed power, and how little pushback they encountered ⌗siliconvalley ⌗peterthiel ⌗fascism ⌗TechFascism ⌗tech ⌗surveillance ⌗trump ⌗republicans ⌗…”

https://mas.to/@kelleynnn/117127820353007381

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“3: The triangular numbers (A000217) ➡️ decompwlj․com/3DgraphGen/Triangular_numbers․html ⌗decompwlj ⌗math ⌗mathematics ⌗maths ⌗sequence ⌗OEIS ⌗JavaScript ⌗graph ⌗3D ⌗threejs ⌗…”

https://mathstodon.xyz/@decompwlj/117126303448750728

🤖 via RSS feed. Not an endorsement.

littleFedi and your data

Several people have asked me the same thing over the past few days, in different words but with the same question underneath: "if I set up a littleFedi instance, or open an account on one that is already running, what ends up stored somewhere?".

It is a fair question and it deserves a precise answer. So I went back and reread the code, the database schema and the default configuration, and what follows is what I found. Including the parts I do not like, and the parts no fediverse software can solve.

One premise that applies to everything else: littleFedi is a binary running on a server. Whoever administers that server has access to the database. This is true for littleFedi, for Mastodon, for snac, for GoToSocial, for anything. The difference is how much that database holds, and how much of it leaves for the outside world without anyone asking.

The database holds the obvious things: username, display name, bio, avatar, header image, the key pair that is the account's ActivityPub identity, posts, favourites, follows, blocks, mutes, bookmarks, lists, filters.

Then the preferences: theme, interface language, default post language, default visibility, which notifications you want by email, which by push. Functional stuff.

Email is optional. require_email is false by default: on a single-user instance you can leave it out entirely, and on a multi-user one it is the operator who decides whether to require it. If you do provide it, it is used for verification, password reset and the notifications you chose. Nothing else.

The password is hashed with bcrypt. The TOTP secret, if you enable the second factor, is encrypted at rest, not stored in the clear.

And here is something I want to say because it was a deliberate choice: every bearer token is stored as a SHA-256 hash, never in the clear. Session tokens, OAuth access and refresh tokens, application client secrets, password reset tokens, email verification tokens. Anyone who walks off with a copy of the database does not walk off with reusable credentials.

We did a cleanup on exactly this just yesterday. The sessions table had been carrying a legacy token compatibility column for a long time, inherited from an older schema. It held nothing dangerous, because the function that creates sessions was writing the hash into it rather than the browser token, and I checked that this is the only path that leads to an insert. But the guarantee lived in one line of Go, not in the schema. A line of Go can be removed by accident; a column that does not exist cannot. So I dropped the column with a migration, and now there is simply nowhere in the sessions table for a token in the clear to end up.

There is exactly one place where an IP address ends up

The sessions table. When you log in, littleFedi saves the session row with: hashed token, creation date, expiry, User-Agent and IP address.

It serves one purpose: the Settings > Sessions page, where you can see your active logins and revoke them one at a time. It is your data, shown to you. There is no admin screen listing users' IP addresses, and we did not write one on purpose.

Sessions last 30 days and are removed by automatic maintenance when they expire, along with the push subscriptions attached to them.

What is not saved, and what other software does save:

• No registration IP. Until yesterday the registration struct had a field for the IP and one for the User-Agent that nobody ever read: the data arrived inside the function and died there, without touching the database. We took them out. I did ask myself whether it was worth actually recording it, the way Mastodon does, and the answer I arrived at is no. There is really only one use case, the wave of fake accounts created in bulk, and in that case you already have the data: a freshly registered account that is spamming has an open session, and that session holds the IP and the User-Agent. Someone who registers and never logs in is not spamming. On top of that the IP is a weak signal in itself, between CGNAT, mobile carriers and VPNs, while invites, manual approval and email verification are real defences. And unlike the session, which expires in 30 days and disappears, a column like that would stay attached to the account forever: one more entry in the privacy policy, one more target in a breach, and one more thing someone can come asking for with a stamped piece of paper. On a single-user instance it would mean nothing at all.
• No last-login IP on the account. Only the session, which expires.
• No IP history. Close the session and that row is gone.
• The per-IP rate limiter does exist, but it keeps its counters in memory only and cleans them up by itself. It never touches the disk.

What about cookies?

Five, all first-party, all functional:

session (HttpOnly, SameSite=Lax, Secure when you are behind HTTPS, 30 days), pwreset_token (lives 15 minutes during a password reset), locale, theme, appearance.

There is nothing else. There is no analytics cookie because there is no analytics.

Zero third parties

What the code does not contain: Google Analytics, Matomo, Plausible, Sentry, a CDN, a remote font, a third-party script, a pixel, a beacon. And, old-fashioned as it may sound, there is no AI listening in and offering suggestions.

The default Content-Security-Policy is default-src 'self' with a nonce for inline content. Pages load only what your own instance serves. If someone tried to slip an external resource in tomorrow, the browser would block it on its own.

There is not even an update check phoning home. littleFedi does not know you exist and I have no way of finding out.

The only connection to a server of mine is the commercial Big Tech domain list, still empty, (https://littlefedi.org/lists/commercial-bigtech.csv), which is downloaded only if you turn that block on, and it is off by default. It is a download of a CSV of domain names: it sends nothing about you, and you can point the same option at your own list or at a mirror.

The /metrics endpoint is disabled by default.

What about logs?

Here I owe you the whole truth. The access log is on by default and writes one line per request: method, path, status, bytes, duration and remote address.

High-volume, low-value requests (static assets, proxied media, /health, /metrics, /robots.txt, the service worker) are logged at debug level only, so at the default info level they stay silent. But pages are logged.

It goes away with one line:

[observability]
access_log = false

And retention is not littleFedi's call: those lines end up wherever your init system sends them, journald or syslog or anything else. It is the operator who decides how long they stay. In the policy template I ship I suggest 14 days as a starting point.

As for media?

EXIF metadata on uploaded images is stripped by default (strip_exif = true). Orientation is preserved because it is baked into the pixels before the rewrite, so the photo does not end up sideways.

With one honest caveat: the rewrite only happens for JPEG and PNG. GIFs are deliberately left untouched, because rewriting them would flatten the animation, and WebP files are not rewritten because the library I use has no WebP encoder. In practice: if you upload a WebP with GPS coordinates inside, those coordinates stay. I am saying it plainly because it is better to know than to find out. We will look at it later on.

File names are randomised (rename_media = true), so IMG_20250812_my_coffee.jpg does not become a public URL.

And then there is the thing I am proudest of, which is on by default: the remote media proxy.

proxy_remote = true. When an image, an avatar or an emoji living on another server shows up in your timeline, your browser does not contact that server. It contacts your instance, which streams it through. The result is that the remote instance does not see your IP address, does not see your User-Agent, does not see what time you read that post, and cannot use an image as a tracking pixel.

Proxy URLs are HMAC-signed and regenerated on every response, never stored anywhere. And cache_remote is off by default: the stream is passed through and that is it, without keeping other people's media on your disk. If you would rather keep them to cut down on traffic there are the lazy and eager modes, but that is your choice, not a default you find yourself saddled with.

I will add the security headers, which are privacy too: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin (meaning: when you click a link to the outside, the destination site does not see which exact page you came from), HSTS when you are behind TLS.

But there is also the part no software can fix.

Which is to say, it is time for the uncomfortable section, and it applies to littleFedi just as it does to any other ActivityPub implementation. If someone tells you otherwise, they are selling you something that does not exist.

Public posts are public. When you publish, a copy is delivered to every server that has at least one of your followers, and to every relay your instance is connected to. Those copies are on machines you do not administer. There is no way to call them back.

Direct messages are not end-to-end encrypted. In the fediverse a DM is a post with direct visibility. It sits in the clear in your instance's database and in the clear in the recipient's instance database. Whoever administers either server can read it. Do not use fediverse DMs for anything you would not put on a postcard. This applies to littleFedi, it applies to Mastodon, it applies to everyone. We are thinking about a way to encrypt DMs between littleFedi instances, but that could not apply with other software, and it risks giving a false sense of security.

Followers-only is a convention, not a lock. You tell the remote server "this is for followers only". The remote server, if it is honest, respects that. If it is not, no amount of encryption is going to stop it.

Deleting means asking to delete. littleFedi sends Delete activities to peers and has a queue with retries. If a peer is offline, or uncooperative, that copy stays where it is. That is a limitation of the protocol, not a bug.

And what if I delete my account?

I wrote this part carefully, because it is where a lot of software pretends.

When an account is deleted, a single transaction removes: posts and boosts, polls, options and votes, notifications (both received and generated), mentions, favourites, emoji reactions, bookmarks, link previews, home feed rows, attachments, filters and filter keywords, scheduled posts, push subscriptions, OAuth tokens, sessions, lists, followed tags, featured tags, blocks and mutes (in both directions), follows (in both directions), relays, read markers, personal domain blocks, password resets, email verifications, digest state, MFA recovery codes, exports, imports, reports, generated invites, and finally the account row itself. Counters on other accounts and other posts are recalculated, not left out of sync.

The actual files, meaning media, export archives and import archives, are deleted from storage, whether that is a local disk or S3.

What stays, and I am saying so explicitly:

• Tombstones. A row with a URI, the original type and a date. They exist so that deleted content is not resurrected when a peer offers it back to us. The ones for posts have a configurable retention, 90 days by default. The one for a deleted actor stays indefinitely, but it holds nothing but URI, type and date.
• The moderation log. Administrator actions stay, because an audit log you can delete is not an audit log. The template suggests 2 years.

Deletion has a window: peers are notified first, then it is finalised. There is a deadline past which it is finalised anyway, because at that point the right to erasure of someone who is here outweighs an unreachable peer.

But you can take your data with you.

There is the account export: a ZIP with account.json, the media index and the media themselves. It is served with private, no-store, it has an expiry, and a cleanup job removes it from storage. The template suggests 24 hours and a single download.

There is the import, which accepts the same format. And there is migration to another instance. The archive uploaded for an import is deleted as soon as the import succeeds.

What if you use littleMesh?

Anyone running an instance behind NAT with littleMesh has one more surface, and I want to be precise here too, because it is already written in the documentation.

The lighthouse relays encrypted circuits. It does not read the contents, it cannot impersonate a node, and it has neither the mesh key nor the actor key. But it does see which node IDs open circuits to which, with what sizes and what timings. littleMesh solves reachability, not anonymity. If anonymity is what you need, an onion service is the right tool, not this one.

The HTTPS gateway is a different matter: it is the one terminating TLS for non-mesh servers, so it sees the traffic. That is written in the trust table in the documentation, in plain terms, along with what it can and cannot do.

The default exposure is federation: discovery, inboxes, objects, actors and public media get through. The web interface, the authentication pages, the Mastodon API and the media proxy do not.

Retention defaults, all in one place

What

Default

Sessions

30 days, then removed

Remote posts

30 days (prune_remote_statuses_after_days = 30)

Remote media cache

disabled; if enabled, 720 hours

Terminal jobs

24 hours

Post tombstones

90 days

Your own posts

never, unless you ask

Moderation log

indefinitely

Access log

your system keeps them, not littleFedi

You can have your own posts pruned automatically, by age and with like and boost thresholds, if you want a timeline that forgets. And there are self-destructing posts with a per-post timer. But those are things you choose, not things I decide for you.

There is something the software cannot do in your place, though

If you open an instance to other people, the code cannot write your privacy policy for you. It cannot decide the lawful basis, the jurisdiction, the subprocessors, the policy on minors, the breach notification timelines.

That is what docs/instance-policy-template.md is for: an operator checklist with a starting retention table and a list of what an honest privacy policy has to cover, namely federation of profiles and posts to independent servers, caching and proxying of remote content, email, push endpoints, logs, moderation records, backups, exports, imports, tombstones, where the data lives and how people exercise their rights. It is not legal advice and does not claim to be.

Moderation, privacy and security contacts, the rules and the terms of service are published from the admin console without restarting anything, and they land on /about, on /terms and in the instance APIs.

In two lines...

...littleFedi collects what it needs to work and nothing more. One IP address per session, shown to you and revocable by you. No analytics, no telemetry, no third parties, no phoning home. We do not know how many of you there are or who you are, and we have no interest in finding out. EXIF stripped by default, remote media proxied by default, metrics off by default, secrets hashed at rest, deletion that actually deletes.

And then there is the fediverse, which is a publishing protocol. What you put on it in public is public, DMs are not encrypted, and deleting is a polite request to other servers. littleFedi does not change that and neither does anyone else. Once you know it, you can live with it perfectly well.

#littleFedi #littleOne #Fediverse #OwnYourData

Alt...

littleFedi Logo

🛡️ #Cybersecurity news & tips across the #fediverse

“Please just don't․ Don't advertise them․
Don't manufacture them․ Just take the blue prints and lock them in a vault with a sign that says 'Beware of the leopard'․ bloomberg․com/news/articles/2026-08-19/apple-s-camera…”

https://mstdn.social/@hazz223/117126811744248777

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“A069686: Primes whose internal digits form a prime
A069686 ➡️ oeis․org/A069686 3D graph, threejs - webGL ➡️ decompwlj․com/3Dgraph/A069686․html
3D graph Gen, threejs animation ➡️ decompwlj․com/3DgraphGen/A069686…”

https://mathstodon.xyz/@decompwlj/117125670219010447

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“Unlocking a locked/deactivated e-waste Cricut Maker
Link: sprocketfox․io/xssfox/2026/07/01/cricut-unlock/
Comments: news․ycombinator․com/item?id=49365841”

https://framapiaf.org/@newsycombinator/117124185836493797

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“📷 11 new license plate readers just reported around Longview, TX․ Newly mapped by volunteers — see what's watching․ ⌗ALPR ⌗Surveillance ⌗Longview ⌗Privacy ⌗FlockSafety deflocktheusa․com/flock-camer…”

https://mastodon.social/@deflocktheusa/117125684520262997

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“europesays․com/3203772/ Global warming 40 million years ago transformed the size of Europe’s carnivorous mammals ⌗BodyMassEvolution ⌗Carnivoramorpha ⌗Climate ⌗ClimateChange ⌗ClimateDrivenEvolution …”

https://pubeurope.com/@europesays/117123877017768473

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“Cameras in glasses․ Cameras on poles․ Cameras in ears․ No one wants this․ Jfc․ ⌗Surveillance ⌗Privacy ⌗AirPods dexerto․com/entertainment/new-airpods-leak-reveals-built-in-cameras-and-visual-intelligence-34…”

https://hachyderm.io/@csara/117124958165070799

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“Well, a cup of hot coffee ☕ and some mundane activity ⌗life ⌗coffee ⌗music ⌗linux ⌗research”

https://mastodon.social/@unixbhaskar/117123772848999962

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“Flock AI: Guilty Until Proven Innocent ⌗News ⌗TechNews ⌗Technology ⌗Surveillance ⌗Flock ⌗OSInvestigate ⌗Privacy youtu․be/72A4hmy8U00”

https://mastodon.social/@NickAEsp/117124491017033628

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“In August, ⌗RFKJr ’s ⌗HHS followed up by announcing it would no longer fund ⌗mRNA ⌗research through the Biomedical Advanced Research & Development Authority․ The latter move involved the cancellation of 2…”

https://masto.ai/@Nonilex/117123734869774423

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams
Link: github․com/onecli/onecli
Comments: news․ycombinator․com/item?id=49363710”

https://framapiaf.org/@newsycombinator/117123242534706685

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“Daily podcast: Flock AI: Guilty Until Proven Innocent ⌗News ⌗TechNews ⌗Technology ⌗Surveillance ⌗Flock ⌗OSInvestigate ⌗Privacy ⌗podcast open․spotify․com/episode/274EdEtimZKE0lUKlZh2kl”

https://mastodon.social/@NickAEsp/117124490774074193

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“💁🏻‍♀️ TIL: 📱🧠 An eight-year Finnish ⌗study followed 260 ⌗children to see how physical activity and ⌗screentime related to later cognitive processing․More screen time correlated with better ⌗teen cogn…”

https://fediscience.org/@tksst/117123593430387284

🤖 via RSS feed. Not an endorsement.

All aboard the Fediverse Express! 🚂

🆕 security_risk_domains.csv

A list of Fediverse domains running software that is at least one year out of date or past its supported lifecycle, and may therefore contain known security vulnerabilities. This includes instances running outdated versions of Misskey, Mastodon, and other Fediverse software.

This list is separate from my other blocklists because these domains are included due to software security concerns, not content or user behavior. 😉

Of course, I have also updated block_spam_scam_users.csv. Your Misskey or Mastodon feed will be so much cleaner and clutter-free once you remove those repeating spam and scam users! 🥳

How to use:

1) Pick a source of your choice.

2) Copy and paste or download the file as a CSV (example, blocks.csv).

3) Upload and merge.

Sources:

GitHub: https://github.com/Fediverse-Express/Fediverse

GitLab: https://gitlab.com/Fediverse-Express/Fediverse

GitFlic: https://gitflic.ru/project/fediverse-express/fediverse

As always, enjoy the Fediverse! 😇

#Mastodon #Misskey #FediAdmin #MastoAdmin #ActivityPub #Fediverse #FediBlock

🛡️ #Cybersecurity news & tips across the #fediverse

“US conducted ‘mass spying campaign’ against leftwing groups and anti-ICE protesters, records reveal
⌗ICE ⌗news ⌗technology ⌗surveillance ⌗trump theguardian․com/us-news/2026/aug/13/us-government-spi…”

https://social.vivaldi.net/@rogerc2738/117123969900727721

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“All other studies:'Do you want to participate?'
'No․'
'Well, I have bad news for you then․ 😈' ⌗Science ⌗Research ⌗MedicalResearch”

https://chaos.social/@esureL/117123071875723559

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“⌗Sainsbury ’s store pauses ⌗AI scanning after false shoplifting accusation theguardian․com/technology/2026/aug/17/humiliated-sainsburys-store-pauses-ai-scanning-after-false-shoplifting-accusation ⌗privacy ⌗…”

https://mastodon.thenewoil.org/@thenewoil/117123593229247033

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“A revisit of remote Spectre attacks on Cloudflare Workers blog․cloudflare․com/revisiting-spectre-attacks-on-workers/ ⌗Security ⌗Networking ⌗Research”

https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers/

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“The Two Factions of C++ (2024)
Link: herecomesthemoon․net/2024/11/two-factions-of-cpp/
Comments: news․ycombinator․com/item?id=49318311”

https://framapiaf.org/@newsycombinator/117121826548762235

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“Body camera footage shows police surveillance abuse is common: 'We’ve told them over and over again: 'You see a hot chick, you don’t look them up in a database․'' ⌗ALPR ⌗Surveillance
'I Saw a Shiny Thing': Cop …”

https://poliverso.org/display/0477a01e-c190616d-75655efbaba3cebc

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“One prompt ⌗Flock 🚨preloaded into the system reads: 'Find me witnesses based on vehicles most seen in [nbhd] during [last 14 days]․․․ Offs fill in the blanks➡️a list of plates➡️convert into names & home addrs․Anothe…”

https://toad.social/@KimPerales/117123151118542232

🤖 via RSS feed. Not an endorsement.

🔆 #FediTips for https://PrivacySafe.Social & the #fediverse

“If you are a fan of RSS feeds and RSS feed readers, you might like to know about RSS features on the Fediverse․ You can follow:- Mastodon accounts' public posts via RSS
- Hashtag search results on Mastodon via RSS
- Pee…”

https://social.growyourown.services/@FediTips/117123879233937628

🤖 via RSS feed. Your Mileage May Vary.

🔬 The best bytes of #science & #tech across the #fediverse

“Why are data scientists switching to ⌗LabPlot? A quick dive into why it’s gaining traction and how it compares to traditional options․Read the article:
👉 techmadesimple․net/posts/why-are-data-scientists-quietly-swi…”

https://floss.social/@LabPlot/117121657392440008

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“Civic Hygiene – avoid building technologies that could be used by a police state shkspr․mobi/blog/2013/11/civic-hygiene/ Comments: news․ycombinator․com/item?id=49363433 ⌗HackerNews ⌗CivicHygiene ⌗policeSt…”

https://mastodon.social/@h4ckernews/117123071269993486

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“Supersonic Trebuchet [video]
Link: youtube․com/watch?v=Co57SfcT-h0
Comments: news․ycombinator․com/item?id=49306207”

https://framapiaf.org/@newsycombinator/117120646847419483

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“The holiday's built-in culture of masks and anonymity makes it a sharp symbolic backdrop for an anti-surveillance movement․— Article
⌗privacy ⌗surveillance ⌗flock”

https://nerdculture.de/@cyberman/117122651465732372

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“New ⌗Paper published in Quantum: Quantum phase estimation with optimal confidence interval using three control qubits quantum-journal․org/papers/q-2026-08-19-2193/ ⌗OpenScience ⌗Quantum ⌗Research”

https://mathstodon.xyz/@quantumjournal/117120953291402991

🤖 via RSS feed. Not an endorsement.

Strangers

I keep a terminal window open most evenings, more out of habit than need, tailing the access log of one of the littleFedi test instances while I think about something else entirely. That's how I noticed it the first time: a fetch from a Threads host, correct in every way ActivityPub asks it to be, asking for someone's outbox.

Nothing wrong with it, technically. And yet I sat there for a while, thinking about the person behind that account, and whether they'd have wanted a company that size reading what they wrote, simply because the protocol says anyone can ask.

So we built a way to say no, but only to strangers, not to friends.

An instance still federates in the open by default, the way ActivityPub expects, because that's what almost everyone wants and I wasn't going to take it away from them. What changed is that an admin can now flip to an exact-host allowlist, from the console or from the command line, and it happens immediately, the switch is simply true the moment you set it. Once it's true, reads on posts, on the followers list, on the outbox, all start asking for a signature, and only the hosts you've named get an answer back. Discovery stays open regardless, because a peer that doesn't know you exist yet still needs a way to find out, before it can even be told no.

I went back and forth for a long time on what should happen to a peer once you remove them, or once you switch the whole instance back to open. In the end nothing gets deleted, not the account, not the relationship, not a single post or piece of media or anything cached from them. Traffic stops, that's all. I've never liked the idea that moderation means destroying what someone wrote, as if the words themselves were the problem and not who gets to see them.

There's a list, if you want it, of the big commercial names, the ones like Threads that started this whole conversation. It updates once a day over HTTPS, quietly, and if the update fails it just keeps yesterday's copy instead of leaving your instance with nothing. But whatever an admin decided on purpose always wins. Allow someone by hand and the list can't undo it. Suspend someone by hand and even an allow can't undo that either.

If you're bringing a block list with you from somewhere else, plain text works, CSV works, and so does the Mastodon export with all its fields, severity and everything. Ten thousand rows at most, checked before a single one is written, and you get to look at what's about to happen before it happens.

One thing I'll admit, since it will trip someone up eventually: matching is on the exact host. A peer that splits its actors and its inboxes across different addresses needs every one of them on the list, not just the one that looks like the main domain. It's the kind of mistake that fails closed instead of open, which is the direction I'd rather be wrong in, but it's still a mistake waiting to happen, so it's the first thing in the documentation.

I still think about that line in the log sometimes. A small server should get to say no to a stranger.

Now it can.

#littleFedi #littleOne #Fediverse

🛡️ #Cybersecurity news & tips across the #fediverse

“🚨 Video catches anti-LGBTQ+ MAGA candidate snooping through voter’s mail: 'Creepy AF'The homeowner called the cops after seeing the home surveillance video․ lgbtqnation․com/2026/08/video-catches-anti-lgbtq-candidate-s…”

https://social.aktaeon.net/@zendorea/117122295500593729

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“europesays․com/3202671/ Hadassah hospital performs first-ever experimental treatment for brain cancer ⌗cancer ⌗HadassahHospital ⌗health ⌗Israel ⌗medicine ⌗research ⌗Treatment”

https://pubeurope.com/@europesays/117120361422390148

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“A 3D fruit fly on macOS desktop powered by the real FlyWire connectome
Link: github․com/DenisSergeevitch/desktop-fly
Comments: news․ycombinator․com/item?id=49353221”

https://framapiaf.org/@newsycombinator/117118995303421030

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“A068501: Values m such that the consecutive pair parameters(m,m+1) generate Pythagorean triples whose odd terms are both prime
A068501 ➡️ oeis․org/A068501 3D graph, threejs - webGL ➡️ decompwlj․com/3Dgraph/A068501․…”

https://mathstodon.xyz/@decompwlj/117120031568119634

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“📷 16 new license plate readers just reported around Scranton, PA․ Newly mapped by volunteers — see what's watching․ ⌗ALPR ⌗Surveillance ⌗Scranton ⌗Privacy ⌗FlockSafety deflocktheusa․com/flock-camer…”

https://mastodon.social/@deflocktheusa/117120022088776966

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“💁🏻‍♀️ TIL: 🔁🚗 A ⌗Harvard study found ⌗US ⌗traffic fatalities rose by about 15% on the days major ⌗albums were released, compared with the surrounding days․Researchers tied the increase to distracted …”

https://fediscience.org/@tksst/117118638624907668

🤖 via RSS feed. Not an endorsement.

🛡️ #Cybersecurity news & tips across the #fediverse

“📷 40 new license plate readers just reported around Bronxville, NY․ Newly mapped by volunteers — see what's watching․ ⌗ALPR ⌗Surveillance ⌗Bronxville ⌗Privacy ⌗FlockSafety deflocktheusa․com/flock-c…”

https://mastodon.social/@deflocktheusa/117120022022821074

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“Well, a cup of hot coffee ☕ and some mundane activity ⌗life ⌗coffee ⌗music ⌗linux ⌗research”

https://mastodon.social/@unixbhaskar/117118385319426494

🤖 via RSS feed. Not an endorsement.

Spannende Zahlen vom ZDF: 67 % der Befragten sind offen für alternative soziale Medien. 63 % haben eine Plattform bereits bewusst weniger genutzt oder verlassen.

Und das Fediverse? Das ZDF nennt hier stellvertretend Mastodon: 6 % nutzen es bereits regelmäßig. Bluesky kommt auf 4 %.

Besonders interessant: 38 % kennen Alternativen zu den großen Konzernplattformen schlicht noch nicht. Aber nur 5 % halten sie für zu kompliziert.

Das Problem des Fediverse scheint also weniger die Technik zu sein als seine Bekanntheit.

Dabei bietet es genau die Alternative zur Abhängigkeit von einzelnen Konzernen: dezentral, föderiert und nicht in der Hand eines einzelnen Plattformkonzerns.

Das ZDF und 3sat sind übrigens selbst längst dabei und haben ihre X-Auftritte 2024 zugunsten unter anderem eigener Fediverse-Auftritte aufgegeben.

https://www.zdf.de/unternehmen/dein-zdf/zdf-mitreden/umfrageergebnisse/soziale-medien-102.html

#Fediverse #Mastodon #SocialMedia #SozialeMedien #ZDF

🛡️ #Cybersecurity news & tips across the #fediverse

“🛂 Google pays $10M for Spirit Airlines emails, chats, documents'Google is acquiring Spirit Airlines' emails, calendar info, chats, documents, spreadsheets and other business data, according to a bankruptcy court filing…”

https://indieweb.social/@jbz/117119582745044293

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“Pentagon scrutinizes US university ties to China, Russia, IranThe US Defense Department formally notified 30 domestic academic institutions, directing them to immediately review their 'academic, financial,…
⌗EuropeSay…”

https://pubeurope.com/@europesays/117117735030198843

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“Turbovec – Google's TurboQuant for vector search in Rust
Link: github․com/RyanCodrai/turbovec
Comments: news․ycombinator․com/item?id=49349898”

https://framapiaf.org/@newsycombinator/117118051603811207

🤖 via RSS feed. Not an endorsement.

Die wenigsten wissen, dass Ramen ja urspruenglich zum Fruehstueck geschluerft wurde. Ich hatte am Montag meinen Lieblings-Ramen in #Taipei und es komplett zelebriert.

Moin #Fediverse und euch einen gesunden Start in diesen Mittwoch. Alles wird gut!

Alt...

Eine Nahaufnahme einer appetitlich angerichteten Schale Ramen auf einem Holztisch. Hauptgericht: Eine blau-weiße Keramikschale gefüllt mit Ramen-Nudeln in einer cremigen Brühe (Tonkotsu-Stil). Toppings: Ein großes, rechteckiges Blatt getrockneter Nori-Alge liegt quer über der Schale. Eine zarte Scheibe Chashu-Schweinefleisch. Eine halbe marinierte Ajitsuke-Tamago (Ramen-Ei) mit weichem, glänzendem Eigelb. Eine frische rote Kirschtomatenscheibe und gehackte Frühlingszwiebeln am Rand. Umgebung: Die Schale steht auf einem Unterteller mit geometrischem Muster auf einer hellen Holzmaserung.

🛡️ #Cybersecurity news & tips across the #fediverse

“⌗OpenAI ditches ⌗Recall -style screenshot ⌗surveillance for friendly ⌗keylogging theregister․com/ai-and-ml/2026/08/14/openai-ditches-recall-style-screenshot-surveillance-for-friendly-keylogging/5287618 …”

https://mastodon.thenewoil.org/@thenewoil/117118402598805458

🤖 via RSS feed. Not an endorsement.

🔬 The best bytes of #science & #tech across the #fediverse

“If ⌗schools don’t complete a review & terminate any arrangements deemed 'problematic' in the next 2 weeks, they face losing ⌗funding․ The purported goal is to protect taxpayer-funded ⌗research from theft & exp…”

https://masto.ai/@Nonilex/117117391601396536

🤖 via RSS feed. Not an endorsement.