We are happy to finally release the full 1.10.0 and looking forward to your feedback.

We have 3 different summaries below. One for end-users, one for server admins, and finally a summary for developers.

Summary for Users

• Add support for lists of keyword filters of content; they can be scoped to content, comments and profile-overviews and can have an expiration-date
• Show the custom title of users and add the option to set one for yourself
• Add the option to also show content which was boosted by people you follow in the Combined view
• Pagination is now done by "anchors" (like that date of the last thread on the page) instead of page-numbers, to improve performance
• Add an indicator when a user has their "cake day"
• Fix search not returning most of Lemmy users and magazines
• Fix the search when searching content, users or magazines by their URL
• The date field of the search form now has a preset value
• Small UI improvements to make the elements of posts and threads more consistent (the layout for posts in Combined view can be toggled in the UI settings)
• Prevent opening a thread or post when touching interactive elements (buttons, spoilers, ...) on mobile
• Suppress notification for added content if it is more than two days old (for example after delayed federation)
• Fix infinite scrolling of comments
• Fix reply button for comments on locked threads and posts not being disabled

Summary for Server Admins

• Introduces monitoring: record a variety of metrics and show statistics what causes performance-issues on your server
• Uploaded images now get compressed to fit the size limit (see the docs)
• Cached images can be removed with a command
• A new command for deleting orphaned media
• Extend the "check duplicate magazines" command to find and delete duplicate users in the database (which might block DB migrations)
• Make the language of fulltext-search configurable (see the docs)
• Fix list of inactive users always being empty

Tip about the Messengers

As the load of deliveries can get high from time to time it is now recommended to run at least one separate messenger process for the Deliver queue.

Summary for developers

Mbin:

• PHP updated to 8.4
• Symfony updated to 7.4
• Some dependencies updated

App:

• New API endpoints to retrieve content, boosts and list moderated magazines of a user
• New or extended API endpoints listing who liked and boosted content
• New API endpoints for managing mod and owner requests of magazines
• Get Combined feed for magazine (/api/magazine/{magazine_id}/combined[/v2])
• Get chat messages of specific user (/api/users/{user_id}/messages)
• Get content for a Tag (/api/tag/{name}/[entries|entryComments|post|postComments])
• Add filter 'abandoned' for /api/magazines
• New OAuth permissions
• Breaking API changes:
  • Schema of the DTO for notifications on user signup
  • /api/combined/{collectionType} changed from PUT to GET
  • Reworked response of the search API

Fediverse:

• Fix federation issues of some activities by adding the published property to the Instance actor
• Fix federation of link+image threads to Lemmy
• Send Delete activities to all known instances (instead of only ones the user interacted with)
• Honor the "application/ld+json" type in endpoint requests
• Periodic updates of user actors will also update their username
• Fix parsing of actors from PeerTube
• Treat as:Public or just Public correctly
• Fix support for image property on Page type, add support for string

Crossposted from https://fedia.io/m/mbinReleases@gehirneimer.de/t/3849075

This is the second release candidate for the upcoming 1.10 release. It contains mostly bugfixes and small improvements.

Summary for Users

• added an option to use the old layout for posts in Combined view
• boosted content in Combined feed will only be included if sorted by newest
• user titles will ignore special Unicode characters
• fix infinite scrolling of comments
• disable reply button for comments on locked threads and posts
• better layout for thread comments in Combined view

Summary for Server Admins

• fix mbin:images:remove-remote command

Summary for developers

Mbin:

• updated some dependencies

App:

• new API endpoints for
  • get Combined feed for magazine (/api/magazine/{magazine_id}/combined[/v2])
  • get chat messages of specific user (/api/users/{user_id}/messages)
  • get content for a Tag (/api/tag/{name}/[entries|entryComments|post|postComments])

Fediverse:

• Treat as:Public or just Public correctly
• Fix support for image property on Page type, add support for string

Crossposted from https://fedia.io/m/mbinReleases@gehirneimer.de/t/3764888

This is the first release candidate for the upcoming 1.10 release.
As some parts of the UI/UX and admin features were notably changed, we decided for the RC to get more widespread feedback.
It includes new features for users and admins, bug fixes, performance fixes and some breaking changes of the REST API.

We have 3 different summaries below. One for end-users, one for server admins, and finally a summary for developers.

Summary for Users

• Add support for lists of keyword filters of content; they can be scoped to content, comments and profile-overviews and can have an expiration-date
• Show the custom title of users and add the option to set one for yourself
• Add the option to also show content which was boosted by people you follow in the Combined view (still needs polishing)
• Pagination is now done by "anchors" (like that date of the last thread on the page) instead of page-numbers, to improve performance
• Add an indicator when a user has their "cake day"
• Fix search not returning most of Lemmy users and magazines
• Fix the search when searching content, users or magazines by their URL
• The date field of the search form now has a preset value
• Small UI improvements to make the elements of posts and threads more consistent
• Prevent opening a thread or post when touching interactive elements (buttons, spoilers, ...) on mobile
• Suppress notification for added content if it is more than two days old (for example after delayed federation)

Summary for Server Admins

• Introduces monitoring: record a variety of metrics and show statistics what causes performance-issues on your server
• Uploaded images now get compressed to fit the size limit (see the docs)
• Cached images can be removed with a command
• A new command for deleting orphaned media
• Extend the "check duplicate magazines" command to find and delete duplicate users in the database (which might block DB migrations)
• Fix list of inactive users always being empty

Summary for developers

Mbin:

• PHP updated to 8.4
• Symfony updated to 7.4

App:

• New API endpoints to retrieve content, boosts and list moderated magazines of a user
• New or extended API endpoints listing who liked and boosted content
• New API endpoints for managing mod and owner requests of magazines
• Add filter 'abandoned' for /api/magazines
• New OAuth permissions
• Breaking API changes:
  • Schema of the DTO for notifications on user signup
  • /api/combined/{collectionType} changed from PUT to GET
  • Reworked response of the search API

Fediverse:

• Fix federation issues of some activities by adding the published property to the Instance actor
• Fix federation of link+image threads to Lemmy
• Send Delete activities to all known instances (instead of only ones the user interacted with)
• Honor the "application/ld+json" type in endpoint requests
• Periodic updates of user actors will also update their username
• Fix parsing of actors from PeerTube

Crossposted from https://gehirneimer.de/m/mbinReleases/t/912046

This is our v1.9.1 stable release of Mbin. This release includes bug fixes, performance improvements, ActivityPub compatibility improvements, thread and microblog locking, usability improvements and more...

Summary for Users

• Improve the RSS feeds: they should be faster, you can also get a combined feed of threads and microblogs now
• The search should be a lot faster now and you can also search for magazines and users by their URL again (previously you could only search for their handle)
• Likes, dislikes and boosts of Mastodon posts can now be extracted, however Mastodon does not sent us updates if these values change
• We added a discoverability setting for users and magazines. This setting is activated by default. If disabled you and your content cannot be found by searching and do not appear on /all
• Fix comments from Mastodon posts not appearing
• Threads and microblogs can now be locked
• The combined view should look more coherent. We adjusted the way microblog posts are displayed in this view
• The notification switches now have a tooltip
• We added an indexable setting for users and magazines. This setting is also activated by default. If disabled, search engines are advised to not index the corresponding threads and microblogs. Because you can only set this on a page to page basis and your comments appear on the page of threads or microblogs, the indexability of comments is dependent on the thread or microblog you're commenting on
• The random magazine is now pre-selected when creating a microblog
• Each magazine has a Tags page in which moderators of the magazine can set the hashtags by which microblogs are put in this magazine. Previously we used the name as a tag as well, without telling the user and without a way to disable it. We now add the name of each magazine to its tags page to make this behavior clear and to provide a way to disable it. When creating a magazine, we added a checkbox to add the name as a hashtag
• Infinite scroll is now working on the search page and the profile pages
• The magazine rules field is now officially deprecated. If a magazine currently has this field populated, it will still be editable, otherwise this field is removed. It will be removed in the future, as there is not a good way to federate this field to other servers. At the moment we just append it to the description with a ### Rules in front of it

Summary for Server Admins

• Signup notifications should be created correctly again. We previously introduced a bug preventing these notifications from being sent
• Add some problematic paths to the robots.txt, which should result in fewer hits by crawlers (like, dislike, boost, search, ...)
• We removed some indexes from the DB which should result in some size savings
• We also added some missing indexes, which resulted in some performance hits. If you run in any conflicts, we created a command to fix errors for duplicate users or magazines (see documentation)
• We reduced the amount of requests to other instances in the background jobs -> should run faster

Summary for developers

Mbin:

• Improve CI by just doing nothing in some actions if there are no relevant files changes -> the required actions still run, they just don't do anything

App:

• The subject of the magazine log API is now correctly set in case of a pinned, unpinned, banned, unbanned, moderator add and moderator removed "events". The documentation should reflect that now. See #1951
• When supplying a rules value in the MagazineUpdateApi, but the magazine did not already have rules defined, the API will throw an error, because this field is now deprecated
• There are new endpoints to lock a thread and a microblog post
• There also are new OAuth scopes for locking and we added a missing one for pinning microblog posts

Fediverse:

• Having a single URL instead of an array of URLs in the to and cc field are now supported. JSON-LD allows this for array fields
• Like Activities use the magazine id instead of followers collection in the to field
• We no longer include the activity streams namespace twice (once in the @context and once in the /context.json)

Mbin 1.9.0 stable is finally out! Upgrade your server now, if you didn't do it already.

We have 3 different summaries below. One for end-users, one for server admins, and finally a summary for Mbin developers.

Thank you everybody who made this release possible!

Summary for Users

This release contains numerous improvements and changes that we can't list everything here, so we'll stick to the highlights (in random order).

We enhanced security so that after a user changes their password or 2FA, all the current sessions of that user will be invalid and the user will need to log in again.

A new combined front page. You could make the combined front page the default in your profile settings. Which means you see both threads and microblogs combined on the homepage.

We also introduced a new feature under general settings, where you can select "Who can send you a direct message" (defaults to everybody).

We added support for magazine banners in Mbin (which is also compatible with Lemmy Communities).

Mbin combines the thread form into just one form (instead of having article, link, and photo having a separate form). Mbin now also federates bans correctly (both incoming and outgoing bans).

Global mods can now manage (view, approve and/or deny) account signups. Global mods can now also receive signup notifications, which will also come with a new menu item in the drop-down menu.

Plus various other bug fixes and CSS layout improvements, ban notification fixes, and too many other fixes to mention here.

Summary for Server Admins

Multiple Docker setup enhancements, we upgraded to Debian Trixie images. We also upgraded to use Node v24 (current LTS release) within our Mbin Docker images. Plus we added a new amqproxy service to the docker compose file. See upgrade instructions for Docker below for more info.

We now added two different server settings:

• Restrict "Random Threads/Posts" sidebar sections to local only
• Restrict "Active people" sidebar section to local only

The first option has been known to cause SQL performance issues (we recommended NOT enabling this first option), hence we gave you the two options. The second option shows local only active users, which does NOT impact performance (so feel free to enable that option if you wish).

Mbin now comes with new moderation log filter capabilities.

We also documented Anubis setup for Mbin, setup is optional. However, Anubis could protect your server from DDoS attacks or other unwanted traffic towards your server.

Mbin now also has a command to rotate the private keys for one user or all the local users.

We renamed an existing environment variable: MAX_IMAGE_BYTES to: MBIN_MAX_IMAGE_BYTES, please rename the variable if you have set it. On top of that we also added a new environment variable: MBIN_USE_FEDERATION_ALLOW_LIST (default value: false) for in the .env file. We also added MBIN_NEW_USERS_NEED_APPROVAL (also default value: false) several months ago, in case you didn't added that variable yet. Although both variables are optional to add. See the latest .env.example file.

Finally, we upgraded several Composer dependency packages plus Symfony recipe updates as well as NPM package updates. So like always be sure to run: ./bin/post-upgrade to install all the updated Composer packages (on bare metal). Which should fix security vulnerabilities in our composer & npm depedency packages. And clear all caches.

Summary for developers

We extended and improved the getting started guide, documenting how to leverage dev containers to get started. Please follow the full "Docker as a dev server" guide if you wish to help with development.

We also created a new Fediverse developer page that lists all our ActivityPub messages.

See the full release notes / how-to upgrade here: https://github.com/MbinOrg/mbin/releases/tag/v1.9.0

This is our v1.9.0 Release Candidate 1 (also known as a pre-release) of Mbin. This release includes security patches of upstream dependencies, documentation improvements, new features, bug fixes, design improvements, Docker improvements and so much more...

I have 3 different summaries below. One for end-users, one for server admins, and finally a summary for Mbin developers.

Summary for Users

This release contains numerous improvements and changes that we can't list everything here, so we'll stick to the highlights (in random order).

We enhanced security so that after a user changes their password or 2FA, all the current sessions of that user will be invalid and the user will need to log in again.

New combined frontpage, which means you see both microblogs and threads combined on the homepage.

We also introduced a new feature under general settings, where you can select "Who can send you a direct message" (defaults to everybody).

We added support for magazine banners in Mbin (which is also compatible with Lemmy Communities).

Mbin combines the thread form into just one form (instead of having article, link, and photo having a separate form). Mbin now also federates bans correctly (both incoming and outgoing bans).

Global mods can now manage (view, approve and/or deny) account signups. Global mods can now also receive signup notifications, which will also come with a new menu item in the drop-down menu.

Plus various other bug fixes and CSS layout improvements, too many to mention here.

Summary for Admins

Multiple Docker setup enhancements, we upgraded to Debian Trixie images. We also upgraded to use Node v24 (current LTS release) within our Mbin Docker images. Plus we added a new amqproxy service to the docker compose file. See upgrade instructions for Docker below for more info.

Mbin now comes with new moderation log filter capabilities.

We also documented Anubis setup for Mbin, setup is optional. However, Anubis could protect your server from DDoS attacks or other unwanted traffic towards your server.

Mbin now also has a command to rotate the private keys for one user or all the local users.

New environment variable is added: MBIN_USE_FEDERATION_ALLOW_LIST (default value: false) for in the .env file. We also added MBIN_NEW_USERS_NEED_APPROVAL (also default value: false) several months ago, in case you didn't added that variable yet. Although both variables are optional to add.

Finally, we upgraded several Composer dependency packages plus Symfony recipe updates as well as NPM package updates. So like always be sure to run: ./bin/post-upgrade to install all the updated Composer packages (on bare metal). Which should fix security vulnerabilities in our composer & npm depedency packages. And clear all caches.

Summary for developers

We extended and improved the getting started guide, documenting how to leverage dev containers to get started. Please follow the full "Docker as a dev server" guide if you wish to help with development.

We also created a new Fediverse developer page that lists all our ActivityPub messages.

See the full changelog and release notes at: https://github.com/MbinOrg/mbin/releases/tag/v1.9.0-rc1

Crossposted from https://gehirneimer.de/m/updates@kbin.melroy.org/t/766866/Mbin-security-disclosure

As most of the servers listed on the fediverse.observer and fedidb are not at v1.8.3 anymore, we need to talk about the security patch we released as part of v1.8.4. We have tried to get in touch with the remaining instance admins and gave them a week to update their instances.

In v1.8.3 a bug was introduced that caused a significant information leak on the user outbox endpoint, reachable through https://mbin.instance/u/username/outbox. This endpoint contains all public activities of a user. On servers running v1.8.3. this endpoint did not return JSON in an ActivityPub compatible format, but just serialized data. This serialized data contained nearly every bit of data Mbin has about a user: the IP, the email address, the private key to sign activities from this user, securely hashed passwords, 2FA secret and backup codes, etc. We think it is unlikely that someone made use of this, as this endpoint is not commonly used. Other ActivityPub software of course uses this endpoint to fetch data, but if that data is not in a compatible format it just ignores it.

We are very sorry about this and honestly very frustrated that it slipped by.

What can users do

The only thing you can really do is to change your password and two factor authentication (disable and re-enable it).

What can admins do

You could check your access logs for any requests on this endpoint not coming from a known fediverse software to research your instance specific instance.

What did we do / What are we going to do

To prevent this from happening again we introduced automated tests on that endpoint and will do so on similar new endpoints (like a magazine outbox) in the future.

We will also add a new command next release to generate new private keys for all users to prevent impersonation. However that might cause rejected activities for up to 24 hours. Every software we checked updates remote users at least every 24 hours including re-fetching the private key.

As most of the servers listed on the fediverse.observer and fedidb are not at v1.8.3 anymore, we need to talk about the security patch we released as part of v1.8.4. We have tried to get in touch with the remaining instance admins and gave them a week to update their instances.

In v1.8.3 a bug was introduced that caused a significant information leak on the user outbox endpoint, reachable through https://mbin.instance/u/username/outbox. This endpoint contains all public activities of a user. On servers running v1.8.3. this endpoint did not return JSON in an ActivityPub compatible format, but just serialized data. This serialized data contained nearly every bit of data Mbin has about a user: the IP, the email address, the private key to sign activities from this user, securely hashed passwords, 2FA secret and backup codes, etc. We think it is unlikely that someone made use of this, as this endpoint is not commonly used. Other ActivityPub software of course uses this endpoint to fetch data, but if that data is not in a compatible format it just ignores it.

We are very sorry about this and honestly very frustrated that it slipped by.

What can users do

The only thing you can really do is to change your password and two factor authentication (disable and re-enable it).

What can admins do

You could check your access logs for any requests on this endpoint not coming from a known fediverse software to research your instance specific instance.

What did we do / What are we going to do

To prevent this from happening again we introduced automated tests on that endpoint and will do so on similar new endpoints (like a magazine outbox) in the future.

We will also add a new command next release to generate new private keys for all users to prevent impersonation. However that might cause rejected activities for up to 24 hours. Every software we checked updates remote users at least every 24 hours including re-fetching the private key.

This is our v1.8.4 release of Mbin. It includes one very important security patch and some improvements to the API and the handling of dead instances.

Update ASAP!

Mbin version 1.8.2 has been released, see: https://github.com/MbinOrg/mbin/releases/tag/v1.8.2

Aside from several bug fixes, the main take away is that we overhaul the Docker setup. From today onwards we now also recommend the new Docker setup for the users who like to use Docker instead of bare metal/VM.

Existing Docker users need to pay extra attention, since there is quite some migration involved. That being said, the new Docker setup is much more solid and hopefully future proof.

Of course we also updated our Docker installation documentation guide accordingly: https://docs.joinmbin.org/admin/installation/docker

I know, it has been a while :D. However, we are happy to release v1.8.1!

Mainly a lot of bug fixes / improvements. Composer package dependency updates. Lot of documentation and language improvements (we also got Catalan now fully translated, thanks!). Feel free to upgrade to PHP v8.4 as well.

A noticeable fronted difference to point out is that we now put thumbnails in a lightbox by default. Although this can be changed by the end-user at: ⚙ Settings -> Under "Threads" section -> "Thread thumbnails opens full screen" option.

See full release notes: https://github.com/MbinOrg/mbin/releases/tag/v1.8.1

Today we released Mbin v1.8.0! It has been already 1 month since we released v1.7.4.

This is the v1.8.0 release of Mbin and it is a feature packed one like always ;).

It brings an extensive bookmarking system, signup request support, signup notifications, extended markdown rendering, custom notification settings to set magazines, users, threads and microblogs to default, loud or muted, setting a default sort for the front page and comment lists, a new image delete command for admins and documentation changes.

You also still might want to double check if you are using the latest Nginx configs (v1.8.0 has now additional regex improvements).

I want to thank all the contributors! We can't do it without you all!

Mbin takes a lot of time to develop, maintain and improve. Created as a successor of /kbin, but still going strong ever since. If you would like to support this work or cover the server costs, please consider donating. Thank you.

Melroy

EDIT: There is a more detailed post here.

Mbin released a new version: Mbin v1.7.4.

This is the v1.7.4 release of Mbin and it brings a lot of documentation updates and bug fixes (especially in the backend): documentation for the Nginx setup has been altered a lot (allowing you to rate limit on Nginx level), PostgreSQL has also seen a few edits, most Symfony commands are now documented, we improved the federation backend, we "revive" dead instances when we get activities from them, the search experience is now improved when searching for URLs, we now support strike through HTML to markdown and a lot more.

The most important thing for developers is that the automated tests are now working and required for PRs to be merged.

Again, see full release note at: https://github.com/MbinOrg/mbin/releases/tag/v1.7.4

Thank you!

Sorry for the late post.

This is the 1.6.0 release of Mbin. It brings several changes and improvements including, but not limited to, a new UI filter for sorting threads and microblog posts, a new hashtag system, Microsoft Azure and SimpleLogin SSO additions, private instance mode, framework upgrade to Symfony 7.0, outgoing federation of delete actions, several backend improvements to address federation stability and compatibility, UI fixes and route changes, etc.

We are already preparing for release 1.7.0, which is coming along very nicely. See you soon with v1.7.0.

A community-focused fork of Kbin, which has tons of improvements, features and bug fixes. Mbin is a federated content aggregator, voting, discussion and microblogging platform.

Feel free to host your own instance on the fediverse! If you are already running Kbin; migrating is straightforward towards Mbin and experience the benefits yourself.

If you have any questions let us know down below or join the community matrix chat.

Visit the project page: https://github.com/MbinOrg/mbin

In the past months development of Kbin slowly came to a halt, development was bottlenecked by a single maintainer. I have tried several times to start a discussion about the way of working and trying to address the problems and to come up with a plan to keep development doing and more importantly keep contributors happy!

Despite all of this; no response on Matrix and nothing has really changed at Kbin. I saw the project slowly dying over the past months, and I couldn't let this happen. That's why I decided to fork the project called Mbin. I wanted to avoid a fork initially, but I didn't saw any way out.

Mbin is community-focused fork, build upon trust and embracing the Collective Code Construction Contract (C4).

Despite the fact I'm the creator of Mbin, I am NOT the only maintainer, several contributors already have owner rights on the GitHub organization as well as on the Matrix Space and Weblate. We are all maintainers, we peer-review each other's code and are allowed to merge pull requests from other external contributors and our own. The community of Mbin will now decide what will be picked-up and resolved, what will be merged or not. The community is in charge. And I am "just" another contributor, following the C4 rules.

Mbin development has been accelerated tremendously over just one week time. With tons of improvements in GUI, backend, security and documentation. We have great internal discussions and a friendly community. We work as a team, sharing knowledge and helping each other out. We review and test our code changes together, we all feel responsible. I think all this is the real reason why I created the fork; it's about the people and about empowerment.

Various instances already migrated towards Mbin, see: https://fedidb.org/software/mbin. Mbin is backwards compatible with kbin, so migration should be straight forward and easy.

Success story: Jerry almost gave up fedia.io, if it weren't for Mbin, we would already have lost a big federated instance (I genuinely didn't know he was about to give up). Luckily the fork gave him hope. And hopefully I gave everybody hope again.