Woo! It's now official 😊

I'm getting some grant funding to further develop #ActivityBot.

If you have any feature requests or suggestions - or just want to build your own ActivityPub bot - check out https://gitlab.com/edent/activity-bot

I'm going to try and keep a record of all the bugs, errors, and inconsistencies I've reported in #ActivityPub and #Mastodon documentation.

First up, how big are the limits on what you can federate?

Mastodon lists some limits in KB/MB, but others are just raw numbers. That might make sense for an ASCII world - but emoji complicate everything.

https://github.com/mastodon/mastodon/issues/40290

Next is slightly more trivial - a broken internal link in the Mastodon documentation.

https://github.com/mastodon/documentation/issues/1947

I think the #RFC9421 HTTP Signature algorithm should be explicitly included in #Mastodon's requests.

Feedback welcome - especially those explaining politely why I'm a wrong about this.

https://github.com/mastodon/mastodon/issues/29905#issuecomment-5440336919

Hey, #Mastodon and #ActivityPub developers.

How much skew do you allow before rejecting a message?

I've just received something where the header is signed:
Mon, 31 Aug 2026 20:09:54 GMT

But the ActivityPub message was published:
Mon, 31 Aug 2026 19:58:36 GMT

That's a little over 10 minutes. Is that too much? Should I not care as long as the signature validates?

A weird #ActivityPub message from #Frendica.

Signed on 2026-09-01
Published on 2026-03-02

That's a skew of six months! The message type is "Undo" - so they're undoing a like they sent in March.

Is there *really* a worry about accepting requests like this? Given the message has been signed, what risk is there to replay attacks?

Bug report at https://github.com/friendica/friendica/issues/16150

@Edent wait, why would you even care if the publish date and the signature date are skewed? They are two different pieces of information that don't have to match.

For example your server could have been down for a day and a task queue might have been retrying to send you the message which was created by a different part of the sending pipeline

@Profpatsch yeah, that's the question I'm asking. Is there any risk in accepting a message that old?
I don't think there is - but I wanted to check with wiser minds.

@Edent personally I think it's healthy for the network to accept these, but @silverpill knows best

@Profpatsch @Edent

An HTTP signature proves that an activity exists on the originating server - it's substitute for fetching activity by its ID. The originating server has full control over the activity JSON and the request headers, so the date of publishing doesn't matter.

What may matter is the date when the signature itself was created. If you receive a request signed several days ago, that might indicate a replay attack... Or a broken clock on the sender side.