Happy Tuesday!
Today we’ve updated the NodeBB community forum onto the remote-categories testing branch, which means that users on the open social web that identify themselves as “Groups” will be rendered in NodeBB as categories. Prior to this, they looked like users.
Here are some examples of remote categories:
- Comic Strips (on lemmy.ml)
- Star Trek Social Club (on startrek.website)
- Social Web Foundation (a WordPress blog)
ActivityPub “groups” and forum categories have quite a few things in common — they don’t usually post topic themselves, they “contain” topics, and they are usually administered by a separate group of users (moderators!) In many ways, these groups lend themselves to categories much more easily than they do as users.
Notes:
- We will likely be releasing this as v4.3.0-alpha this Wednesday. Probably this means you don’t want this on a live forum just yet.
- A lot of the backend logic is complete, but a lot of the frontend UX will be worked on.
- You can “search” for categories (via “in categories” in the search page), paste the full handle in order to instruct NodeBB to pull a new category in.
- You can now no longer mention a remote category. Instead, create your topic right in that category itself. As it should be :smirk_cat: .
- Remote content coming in that is slotted into a remote category will still show up in your “world” feed. That is still intended to be where discovery of content outside the local NodeBB instance will take place.
- Report any bugs or confusing behaviours (and there will be some) here.
Screenshots
@julian How do you deal with situations where the group actor also sends posts?
For example, on Hubzilla, (streams), and Forte, the top level post of a forum thread is from the forum, not the user. This was originally done for Mastodon compatibility since it did not understand threaded conversations and groups. They could follow the forum as if it were a user, and receive all of the forum posts. They could send a DM to the forum to create a new post.
NodeBB took a different approach, using boosts to distribute user posts to people who follow the forum. And I think you said you use mentions within a post to create a new top level post.
How are we handling the differences in approaches?
@[email protected] can you share an example of a group actor from Hubzilla? Would be interesting to see how that’s handled. Likely it wouldn’t work properly because categories in NodeBB don’t author posts.
Do your group actors send creates on behalf of regular users? That might work ok.
Lastly, there’s no requirement that a NodeBB category be mentioned. It only needs to be addressed. A mention is the easiest way to do that because addressing is abstracted out of the Mastodon UI.
But for things like PieFed, Lemmy, Mbin, and likely Hubzilla, you’re able to change addressing based on where you create the post.
But for things like PieFed, Lemmy, Mbin, and likely Hubzilla, you’re able to change addressing based on where you create the post.
Yes, in Hubzilla, we can click on the padlock and select who the post is addressed to, including NodeBB forums. I haven’t tried it yet, but Hubzilla does recognize NodeBB categories as “forums.”
@julian I just tried posting five different posts from Hubzilla to @Testing Ground via various methods, and none are showing up.
- Post from a group actor, selecting audience from list.
- Post from a group actor, using a mention.
- Post from a normal actor, selecting audience from list.
- Post from a normal actor, using a mention.
- Post from a normal actor, posting to a Hubzilla Forum (group actor) and mentioning the NodeBB category in the post.
I am not sure if that forum is moderated, but none of my posts are showing up.
#[1](https://community.nodebb.org/inbox) delivery rejected: 403 Forbidden 2025-03-30 22:51:57
#[2](https://community.nodebb.org/inbox) delivery rejected: 403 Forbidden 2025-03-30 23:28:55
@[email protected] Hubzilla is formatting its Notes in a manner I wasn’t expecting.
- The group actor is the
attributedTo, which is not possible in NodeBB - The note itself is not addressed to the group actor, only its followers collection
- There is no way to discern without parsing the note content itself who authored the original note.
So at present while I would be able to retrieve the note, without a proper backreference to the group actor, I don’t think I can slot it correctly.
Not sure why the received activity is returning a 403, as well.
@julian we have recently rewritten the addressing logic and it seems mapping the mentions to
tofor public toplevel posts has fallen short. After fixing this it seems to work fine now: #[1](https://community.nodebb.org/topic/cbbf1640-2295-4fc5-b86f-5b1fd259cccb/test2)
@[email protected] that’s wonderful to hear! Thank you so much.
@julian in Hubzilla the group actor will fork the original post with a quote reshare. Hence
attributedTois set to the group actor. IIRC the author of the original post is being stored for refernce but we currently do not use this info.deleted by creator
@Scott M. Stolz i think this would be very misleading. But this discussion does not belong here.
@[email protected] since Hubzilla posts (incl. yours) are making it in fine I’m assuming this is only for the “forum” feature?
@julian right.
deleted by creator
@julian @Mario Vavti That is one thing that I wish Hubzilla did, and that is identify the author of the original note (top level post in a forum), both internally in the database and in a variable available to themes, and externally via Zot protocol and ActivityPub.
@julian I saw a NodeBB test on Hubzilla Monster. I’m guessing that was you.
In order for you to properly mention someone, the Hubzilla server needs to know about that actor first. The easiest way to achieve this is to follow (connect to) that actor. This adds the actor to the database. This only needs to be done if no one on the server is following them or being followed by them.
This does create an extra step if the actor is unknown to the server, but it does force spammers to follow unknown actors before they can mention them.
Forgot to cc @[email protected] re: the above.
- The group actor is the
@julian I’m not sure. They changed things in the last major version when they adopted FEP 171b Conversation Containers.
Some examples of forum channels are @Hubzilla Support Forum and @Neuhub Support Forum.
By the way, we also have a test forum set up here: @Neuhub Test Forum
#[1](https://neuhub.org/channel/testforum)
The search worked.
Some of the remote categories appear to be broken now.
These are the Flipboard magazines NodeBB is currently aware of when searching “flipboard” in the search page:
- [Tech News by @[email protected]](https://community.nodebb.org/category/[email protected])
- [Musik News by @[email protected]](https://community.nodebb.org/category/[email protected])
- [Gear by @[email protected]](https://community.nodebb.org/category/[email protected])
However, that very first one (tech news by The Verge) does not work; going to it gives a 404 page instead.
Something else appears to have happened to the Vivaldi Blog remote category (a WordPress blog). A week ago it was working fine, but now, searching for it lists it twice in the search page. Each listing indicates a completely different number of posts and topics for the remote category.
Even weirder though most of the topics that are correctly slotted into it, they are not actually in the category page, e.g. https://community.nodebb.org/topic/a85b0eff-5219-46ba-9ad4-a5d417a7bec5/minor-update-2-for-vivaldi-desktop-browser-7.3
Screenshots
@AltCode all three flipboard remote categories seem to be working now :joy:
Actually, I think I know what’s going on with the Vivaldi blog group actor - it’s not necessarily NodeBB’s fault.
Inspecting the AP objects coming from vivaldi.com/blog, all the English-written blog posts have their
as:audiencefield set tohttps://vivaldi.com/?author=0.Meanwhile, every other blog post that is written in a different language instead have it set to
https://vivaldi.com//?author=0, so for Japanese blog posts, for example, it ishttps://vivaldi.com/ja/?author=0.And all these URLs link to different group actors, but all of them have the same value on the
preferredUsernameandwebfingerproperties:blog, andblog@vivaldi.com.
EDIT: Actually this also appears to be all actor objects coming from vivaldi.com/blog. E.g. if you start typing
[.com](https://community.nodebb.org/user/ruari%40vivaldi.com)or search for it, you can see it be suggested twice too.So my guess is that there are two person actors that NodeBB knows of that are claiming to be
ruari@vivaldi.com:https://vivaldi.com/?author=46andhttps://vivaldi.com/ja/?author=46.This is probably a bug with the WPML+ActivityPub plugin combination they have going on.
Screenshots
@AltCode I forked this out to a new topic. I think it’s time to loop @[email protected] into the conversation (at the very least so this could be potentially escalated).
Mattias, it seems that when the WPML and ActivityPub plugins are enabled together, notes federated out by the blog user in another language have different
ids but the samepreferredUsername.e.g.
ruari@vivaldi.com: https://vivaldi.com/?author=46andhttps://vivaldi.com/ja/?author=46NodeBB interprets this as two different users. Curiously, Mastodon does not, the second ID explicitly does not resolve.
So there can be two solutions here:
- The underlying issue can be fixed by WordPress, the solution of which is out of scope (for me at least)
- NodeBB can adopt whatever mechanism Mastodon is using… which is most likely that Mastodon does a two-way when asserting an ID, and ensures that the webfinger resource points to the ID.
The remaining questions here are:
- whether
preferredUsernameis meant to be unique to the instance (in which case having multipleids point to an identicalpreferredUsernamewould be a violation), and - what exactly AP software should do when it encounters this situation… store a list of “known alias” IDs? There are potential security issues to doing so.
- whether
@[email protected] just wanted to poke you about this issue again.
The latest updates to NodeBB now do a webfinger backcheck to ensure that the actor has a valid webfinger entry for their purported handle. If it does not, then the user is not properly created. Mastodon also does this. This check is probably for security as well as for preventing handle collisions.
The multilingual plugin in conjunction with the ActivityPub plugin creates users that share the same handle, and that causes issues with federated content.
For example, this article by @[email protected] will load up just fine in Mastodon, but this japanese article by @[email protected] will not, because that second article’s
attributedToishttps://vivaldi.com/ja/?author=176, which fails that check (the author’s ID is actually https://vivaldi.com/?author=176 as per the handle backcheck)cc @AltCode
@AltCode okay! Thanks for reporting, it sounds like there are two issues going on:
- Categories losing their handle-to-id association
- Frustratingly, this read very similarly to #13283, and both remote users and categories share similar logic. I have so far not been able to reproduce it at all on local development.
- Separate users (different IDs) sharing the same
preferredUsername.- This is an interesting one, and I am not entirely sure where the fault lies. I wonder how other software handles it?
- Categories losing their handle-to-id association
This is getting out of hand! Now, there are six of them!
@AltCode This should be fixed in the upcoming v4.3.0.
https://github.com/NodeBB/NodeBB/issues/13352
It won’t proactively remove the duplicates, but they’ll be pruned out within ~7 days.
Bit of a thought experiment here as to how to handle these duplicate accounts.
(tl;dr two federated accounts with different IDs report the same webfinger handle, what do?)
Let’s say @[email protected] posts an English article under his account (and then is federated), and posts a translated Japanese one that is also federated, but under the Japanese ID.
What should NodeBB do when encountering the latter? Currently, it will try to assert the actor, fail the webfinger backreference check, and probably drop the post. Not so good.
One could adjust the actor to the former (canonical ID), but that’s not technically right either.
That also opens up potential account impersonation possibilities, so that is something that would need addressing as well.
