This post is written on https://normals.me/ and delivered to !fediverse@lemmy.world over #ActivityPub, so if you are reading it the basic plumbing works. Now let me explain what is this.
Normals is a forum with communities, threads, and questions with an accepted answer. It is a single instance, not software you can host, and the core is closed for anti-abuse reasons. The federation module will be published separately with implementation notes (FEP-67ff).
What federates today Every community is a Group actor following the Lemmy model (FEP-1b12). Follow @selfhosted@normals.me or any other community from Lemmy, PieFed, Mbin or Mastodon.
Posts and comments go both ways. Replies from your instance appear in the thread on Normals, replies from Normals go back to the origin.
Remote content is labelled with its origin, links back to it, and is never copied. Media loads from the source.
Signed fetches, so it works with instances that require authorized fetch. NodeInfo 2.1 is up.
Policies, in case they matter to you, it has no ads, and no paid reach, and of course no AI training on posts. AI crawlers blocked by default, public mod log with reasons, and no automated removals. Numbers at https://normals.me/transparency so please take a look.
If something from your instance shows up wrong here, or something from here shows up wrong on yours, reply with the URL and I’ll fix it. Andy Piper mentioned NodeBB uses the same group model, if anyone runs a NodeBB instance I’d like to test against it, if possible.
I hope we all have fun. Cheers!
Good question, however the security model doesn’t depend on the code being secret, and it shouldn’t. The auth, signatures, permissions and input handling are standard and went through an OWASP review before launch.
What’s closed is the anti-abuse layer, spam, rate-limit tuning, the signals for detecting ban evasion and coordinated accounts. Those work partly because spammers don’t know the exact numbers. Lemmy’s and Mastodon’s are public and they get played for exactly that reason. Hope it helps :)
Nothing stops those being adjustable tunables.
Yes. They could just not set them at all in the published source, and just set them in their deployment. They are at least dishonest about the reasons for keeping the source closed, which is sad.
not really, no.