Oneric
fee57eb376
This brings it in line with its name and closes an, in practice harmless, verification hole. This was/is the only user of contain_origin making it safe to change the behaviour on actor-less objects. Until now refetched objects did not ensure the new actor matches the domain of the object. We refetch polls occasionally to retrieve up-to-date vote counts. A malicious AP server could have switched out the poll after initial posting with a completely different post attribute to an actor from another server. While we indeed fell for this spoof before the commit, it fortunately seems to have had no ill effect in practice, since the asociated Create activity is not changed. When exposing the actor via our REST API, we read this info from the activity not the object. This at first thought still keeps one avenue for exploit open though: the updated actor can be from our own domain and a third server be instructed to fetch the object from us. However this is foiled by an id mismatch. By necessity of being fetchable and our longstanding same-domain check, the id must still be from the attacker’s server. Even the most barebone authenticity check is able to sus this out. |
||
|---|---|---|
| .gitea/issue_template | ||
| .woodpecker | ||
| benchmarks | ||
| ci | ||
| config | ||
| docker-resources | ||
| docs | ||
| installation | ||
| lib | ||
| priv | ||
| rel | ||
| restarter | ||
| scripts | ||
| test | ||
| uploads | ||
| .buildpacks | ||
| .credo.exs | ||
| .dockerignore | ||
| .formatter.exs | ||
| .gitattributes | ||
| .gitignore | ||
| .mailmap | ||
| AGPL-3 | ||
| CC-BY-4.0 | ||
| CC-BY-SA-4.0 | ||
| CHANGELOG.md | ||
| CODE_OF_CONDUCT.md | ||
| COPYING | ||
| coveralls.json | ||
| docker-compose.yml | ||
| docker-entrypoint.sh | ||
| Dockerfile | ||
| elixir_buildpack.config | ||
| mix.exs | ||
| mix.lock | ||
| Procfile | ||
| README.md | ||
| SECURITY.md | ||
| SIGNING_KEY.pub | ||
akkoma
a smallish microblogging platform, aka the cooler pleroma
About
This is a fork of Pleroma, which is a microblogging server software that can federate (= exchange messages with) other servers that support ActivityPub. What that means is that you can host a server for yourself or your friends and stay in control of your online identity, but still exchange messages with people on larger servers. Akkoma will federate with all servers that implement ActivityPub, like Friendica, GNU Social, Hubzilla, Mastodon, Misskey, Peertube, and Pixelfed.
Akkoma is written in Elixir and uses PostgreSQL for data storage.
For clients it supports the Mastodon client API with Pleroma extensions (see the API section on https://docs.akkoma.dev/stable/).
Differences with Pleroma
Akkoma is a faster-paced fork, it has a varied and potentially experimental feature set tailored specifically to the corner of the fediverse inhabited by the project creator and contributors.
This should not be considered a one-for-one match with pleroma; it is more opinionated in many ways, and has a smaller community (which is good or bad depending on your view)
For example, Akkoma has:
- Custom Emoji reactions (compatible with misskey)
- Misskey-flavoured markdown support
- Elasticsearch and Meilisearch support for search
- Mastodon frontend (Glitch-Soc and Fedibird flavours) support
- Automatic post translation via DeepL or LibreTranslate
- A multitude of heavy modifications to the Pleroma Frontend (Pleroma-FE)
- The "bubble" concept, in which instance administrators can choose closely-related instances to make a "community of communities", so to say
And takes a more opinionated stance on issues like Domain blocks, which are enforced far more on Akkoma.
Take a look at the Changelog if you want a full list of recent changes, everything since 3.0 has been Akkoma.
Installation
OTP releases (Recommended)
If you are running Linux (glibc or musl) on x86, the recommended way to install Akkoma is by using OTP releases. OTP releases are as close as you can get to binary releases with Erlang/Elixir. The release is self-contained, and provides everything needed to boot it. The installation instructions are available here.
From Source
If your platform is not supported, or you just want to be able to edit the source code easily, you may install Akkoma from source.
Docker
Docker installation is supported via this setup
Packages
Akkoma is packaged for YunoHost and can be found and installed from the YunoHost app catalogue.
Compilation Troubleshooting
If you ever encounter compilation issues during the updating of Akkoma, you can try these commands and see if they fix things:
mix deps.clean --allmix local.rebarmix local.hexrm -r _build