fediverse

<div class="article-body"> <p>We’ve rolled out an update that makes sharing content to the fediverse via ActivityPub even better—especially when it comes to images in comments. Now, when you include an HTML &lt;img&gt; tag that points to a file in your WordPress media library, that image is bundled as a proper attachment in the ActivityStreams payload. This means your followers on other platforms will see both your comment and its image, making conversations more vivid and engaging.</p><p>To protect your privacy and security, only images hosted in your own WordPress media library are supported. Images from external sources are intentionally skipped.</p><p>Smoother Following, Better Interactions</p><p>If you’ve turned on the “Following User Interface” feature in the advanced settings, you’ll see a few nice improvements. The followers list now shows whether you’re already following someone—and if not, you can follow them back with just one click.</p><p>We’ve also made it easier to follow people from other sites. When you click “Follow” on someone else’s blog, you’ll now be taken to your own site to complete it. It keeps things simple and familiar, even when you start following someone from another site.</p><p>Better Support for Multibyte Text</p><p>Finally, we’ve improved how multibyte characters (like those in Greek and other non-Latin scripts) are handled when generating post summaries for the fediverse. We’ve replaced byte-based string functions with multibyte-safe alternatives and reordered text processing steps to avoid errors.</p><p>Full Changelog</p><p>Added</p><p>Add image attachment support to federated comments – HTML images in comment content now include proper ActivityStreams attachment fields.<br>Link to the following internal dialog for remote interactions, if the feature is enabled.<br>The followers list now shows follow status and allows quick follow-back actions.<br>Trigger Actor updates on (un)setting a post as sticky.<br>You can now use OrderedCollections as starter packs — just drop in the output from a Follower or Following endpoint.</p><p>Changed</p><p>Ensure that tests run in production-like conditions, avoiding interference from local development tools.<br>Moved HTTP request signing to a filter instead of calling it directly.</p><p>Fixed</p><p>Allow non-administrator users to use Follow Me and Followers blocks.<br>Correct linking from followers to the following list.<br>Fix avatar rendering for followers with missing icon property.<br>Fix multibyte character corruption in post summaries, preventing Greek and other non-ASCII text from being garbled during text processing.<br>Informational Fediverse blocks are no longer rendered when posts get added to the Outbox.</p><p>Downloads</p><p>WordPress.org: <a href="https://downloads.wordpress.org/plugin/activitypub.7.2.0.zip" rel="nofollow">activitypub.7.2.0.zip</a><br>GitHub: <a href="https://github.com/Automattic/wordpress-activitypub/releases/tag/7.2.0" rel="nofollow">tag/7.2.0</a></p><p>Thank you!</p><p>Huge thanks to everyone who shared code, gave feedback, tested, or simply cheered us on! Together, we’re building a more connected fediverse, one release at a time. ❤️</p><p>We’ve just released version 7.2.0, give it a spin and let us know what you think!</p> </div>

<div class="article-body"> <p>Ever wonder how your site proves it’s really you talking to the rest of the Fediverse? It’s not magic—it’s HTTP signatures, the digital equivalent of a secret handshake. With our next release, we’re making that handshake a lot more universal (and a little less awkward).</p><p>Why HTTP Signatures Matter</p><p>When you interact with the Fediverse, you want to know that the messages you send and receive are genuine. <a href="https://swicg.github.io/activitypub-http-signature/" rel="nofollow">HTTP signatures</a> are the technology that makes this possible. Every time your site sends a message, it includes a digital signature—like sealing an envelope with your personal stamp. This signature proves that your content really came from your account and that no one has tampered with it along the way. As a result, you can trust that your interactions across the network are authentic.</p><p>A Bit of Background: draft-cavage and RFC 9421</p><p>If you’ve heard about HTTP signatures, you might have come across terms like “draft-cavage” and “RFC 9421.” These are just different versions of the rules for how those digital signatures are created and checked.</p><p>For a long time, most of the Fediverse has used what’s called <a href="https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12" rel="nofollow">the draft-cavage-12 specification</a>. Think of this as a set of instructions that people agreed to try out, but that hadn’t been officially finalized. It worked well enough to let sites talk to each other securely, but because it was just a draft, there were sometimes small differences in how different software used it.</p><p>Recently, the community agreed on a final, official version of these rules, called <a href="https://www.rfc-editor.org/rfc/rfc9421.html" rel="nofollow">RFC 9421</a>. This is now the standard way to create and verify HTTP signatures. This makes it easier for sites and servers to understand each other and work together, since everyone is following the same process.</p><p>Incoming Support for the New Standard, Out of the Box</p><p>With this update, the plugin will support incoming HTTP signatures that use the new standard right away. There’s nothing extra you need to do. This means that when other servers use the new, official approach for signatures, your site will recognize and accept them. By making support for the new standard easy and automatic, the plugin helps move the Fediverse forward, encouraging more sites to adopt this approach and making connections across the network more reliable.</p><p>Outgoing Requests and the Double Knock Approach</p><p>There’s a new setting for outgoing requests, but for most people, there’s no need to touch it. This option is really for the folks who like to be on the cutting edge and want to start using the new standard for outgoing messages right away. If that sounds like you, here’s how to find it: head to the ActivityPub settings in your dashboard, open “Screen Options” at the top right, and enable “Advanced Settings.” Then, click on the Advanced Settings tab and turn on “Use modern signature format for Fediverse communications.”</p><p>But don’t feel any pressure—leaving this setting off is perfectly fine. The plugin already handles incoming messages with the new standard out of the box, and we’ll automatically enable outgoing support for everyone once the wider Fediverse is ready. For now, this is just an option for early adopters.</p><p>If you do turn it on, the plugin uses what we call the “double knock” approach. It’ll try the new standard first, and if the other server isn’t ready for it, it’ll automatically fall back to the older method. So, you can experiment without worrying about breaking communication with anyone.</p><p>Improved Verification for Existing Signatures</p><p>The plugin also brings improvements to how it handles signatures that use the older method, especially those using the hs2019 algorithm. Now, when a signed message arrives, the plugin fetches the sender’s public key and uses it to determine the correct way to verify the signature, following the specification more closely. This means more reliable verification and fewer errors, making your experience smoother and more predictable.</p><p>Looking Forward</p><p>With this update, the plugin helps move the Fediverse toward a shared standard for signing and verifying messages. By supporting both the new standard and the older method, you’re making it easier for everyone to communicate using the same agreed-upon approach. There’s no change in security, but you’re part of making the network more consistent and helping the community take the next step forward.</p><p>We hope this explanation helps clarify these technical changes. If you have any questions about HTTP signatures or how our plugin interacts with the Fediverse, please don’t hesitate to reach out in the comments below.</p> </div>

<p>Once again, the Open Social Web community is meeting online for the global FediForum unconference, to discuss, teach and learn, and move the Open Social Web forward. </p><p>If you think the commercial social media platforms are, let’s say, “not perfect”, and you are looking forward to alternatives that are: </p><p>decentralized, <br>community-governed, <br>based on open protocols (such as ActivityPub, ATProto, and others), <br>open-source, <br>open for innovation, <br>or all of the above and more! </p><p>Consider joining us and help the community build the future we all want to see. </p><p>FediForum is scheduled from 8am to 1pm Pacific Time, which is 17:00 to 22:00 Central European Time. This allows people everywhere from central Europe and Africa to the west coast of the Americas to participate. We’ve had some brave souls come to FediForum from the Asia-Pacific region, too, so don’t let that deter you if you live there.</p>