Just a quick note for NodeBB admins to update to v4.14.4 as there was a regression identified for versions v4.12.0 to v4.14.3 where federation was broken between NodeBB and Mastodon instances with authorized fetch enabled.

With temperatures reaching well into the 30s (in celsius of course :sunglasses:) in the Toronto area, we're all firmly in summer mode :swimmer: :beach_with_umbrella: , but that won't stop us from forging on ahead with new features and fixes for NodeBB!

There are improvements across ActivityPub federation, administrative tooling, and security hardening. Our ActivityPub integration receives bug fixes including duplicate handling, configurable rate limiting, and better error reporting, alongside new hooks for remote user lifecycle events. The registration queue and invitations are reorganized into a dedicated UI with a new "Reject All" bulk action and improved notification handling. Security reports have been coming in consistently throughout the month with valid security reports (though almost all AI discovered and generated). This led to stricter privilege checks on post diffs, crossposts, and GDPR exports, plus protection against username enumeration. The NodeBB team strongly encourages upgrading to v4.14.0 for the latest security fixes and federation improvements. The release also includes a new tx() translation helper, Benchpress escaping improvements, and a first-run categories onboarding modal for fresh installations.

Here are the high level changes you can expect to see when you upgrade from v4.13.0 to v4.14.0...

:globe_with_meridians: Federation Regression Fixes!

Around v4.12.0 or so, a number of regressions were unintentionally introduced as part of security fixes that severely hampered federation — especially with Lemmy-based instances and relays. We've resolved those regressions and Relay/Lemmy federation should resume within 24 hours after upgrading.

The public key fetch rate limiter logic was simplified and updated (due to it being faulty and not really working in the first place), streamlined some duplicate logic with Like/Dislike activities, improved the AP Errors reporting page in the ACP, added a parent traversal depth guard, fixed an issue where updates to scheduled topics were accidentally being federated out, and about a hundred other smaller bugs :)

:ballot_box_with_check: Registration Queue updates

The registration queue was moved out of the ACP, and invitations are also managed in this page now. A "reject all" button was added to allow admins to quickly reject every queued registrant in one fell swoop.

🔒 Privilege & Security Fixes

• Post diff access — Check topics:read privilege when loading post diffs
• Crossposts — Added source category privilege check to crossposts
• GDPR export — Prevented global moderators from performing GDPR data exports
• Nids ownership — Don't mark nids as read/unread that you don't own
• Upload privileges — Prevent uploading thumbnails without upload:image privilege; replaced extension-based MIME validation with content
  sniffing
• Username enumeration — Use dummy lockout key for non-existent users to prevent enumeration
• Category disabled flag — Check category disabled flag on getRaw

:interrobang: Benchpress Improvements

We use Benchpress as our templating engine. We updated our integration for security and performance. [@baris put together a thorough write-up for that one here](https://community.nodebb.org/topic/19364/upcoming-breaking-changes-for-4.14.0).

Miscellaneous

• First-run modal — New categories onboarding modal for fresh installations
• Dashboard warnings — Added localhost and URL mismatch warnings to admin dashboard notices
• Push notifications should work on Safari/iOS devices now (via the web-push plugin)

A new feature silently dropped in v4.12.0. NodeBB now supports Activity Intents!

Huh? What's an Activity Intent?

It is a proposal by @benpate@mastodon.social that aims to "extend the capabilities of an ActivityPub server beyond a user's outbox, and enable direct interactions with content on the wider social web."

In other words, it allows you to more seamlessly use your fediverse account on other sites without having to register a new account just to contribute.

In even simpler words, it means you can go to other forums and interact with content without needing to register a new account.

It directly tackles one of the fediverse "hard problems" I talked about last year — account fragmentation. You won't need additional accounts just to use other sites, your identity stays whole :sunglasses:

Let's learn more about how that works!

Account Fragmentation in a Nutshell

Right now, when you browse to a different site, you usually have to create a new account to interact with it. For example, if you check out someone's Pixelfed profile, you're not able to comment or like their pictures without an account there. This has always been how the internet worked, and before the advent of single sign-on, which lets you log in with a different account (but still creates a new account on that site), that was just how it was.

Essentially, there was no way to interact with content using your main identity. The workarounds were numerous... copying URLs, searching for the account on your instance, etc. All of which were fairly friction-heavy, so the next best thing was just to create a local account and fragment your identity.

Activity Intents intends (ha!) to address this by allowing servers to advertise support for different types of social actions.

How It Works

1. You browse to another site and want to carry out an action, such as liking the post, or writing a reply.
2. That site asks you to enter an Open Social Web handle (or log in, if you have a local account), and you enter it.
3. It then queries your server to see what Intents it supports (e.g. "Like", "Create")
4. If there's a match, it sends you back to your server, where you can complete the action.

That's about it! There are additional details about designing the actual flow, and how to "remember" each visitor's social web handle, but the basics are as listed above.

What it looks like in NodeBB

We've integrated support for four intents:

1. Like/Dislike → These map to upvote and downvote respectively
2. Create → These would be topic creations and replies
3. Follow → self-explanatory
4. Object → Load an ActivityPub resource in NodeBB

We integrated two-way support which means that if you land on a NodeBB and your fediverse account supports Activity Intents, then you can simply hit like, reply, or follow from NodeBB, and be sent back to your home server, all without the hassle of copying and pasting links into a search bar.

Integrating Activity Intents was a high-impact way to tackle the problem of account fragmentation. Users of NodeBB (whose forums have updated to v4.12.0) should not have to feel pressure to create local accounts elsewhere if the site they end up on supports Activity Intents as well.

Hi everybody — late last week we released v4.11.0, which contains the following changes:

ActivityPub Specific Fixes

:rotating_light: AP analytics and error pages

New pages have been added to the control panel to display analytics (send/receive counts) and error counts. There is also a new error page that will show error received within the last 24 hours, and their respective payloads. This will aid in debugging federation issues.

:writing_hand: Article vs. Note distinction updated

Prior to this version, NodeBB would determine whether a federated object was an Article or Note based on content length. This was confusing for end users, and was originally added before NodeBB supported title-less topics.

The revised distinction is much simpler. If it has a title, it's an Article. If it doesn't, it's a Note.

Smaller fixes

• Threadiverse software publishes Delete objects wrapped in an Announce activity. This is how content is moderated across the threadiverse. NodeBB now supports this, although it has not been extensively tested at this time.
• There was an interoperability issue with Mitra that was identified and fixed.
• When group actors post content directly, the category info is shown in the user icon. It used to error out and show "Guest".
• Optimized the outbound federation of content so the front-end is more responsive. A bunch of back-end optimizations to reduce the number of calculations needed.
• Emojis now supported in DMs to remote users.

:no_bell: Ability to hide read notifications in user panel

A new option has been added to the "Notifications" sub-section of the user control panel.

This option will allow you to visibly hide read notifications from the notifications dropdown, which reduces visual clutter.

Tinycon customizations

Admins can now customize the notification badge shown in the browser tab icon. We use the Tinycon library for this, and the colour values can be customized now:

Since 2017, we've maintained a bug bounty program that awarded responsible disclosure of security vulnerabilities on a sliding scale of $64 to $512 based on severity.

Throughout the years we've made some unpublished changes to this bounty program, mostly related to the format (no videos, text only, allowed testing endpoints) and in some cases expanding the scope of covered plugins (e.g. 2factor, web-push).

With the rise of LLMs and the corresponding drop in ability needed to analyze and send in reports, we have been receiving a large increase in reports whose submitters have no ability to defend or support their claims, but are happy to pretend that they do.

To be fair, this has been the case ever since the beginning. We've awarded our fair share of bounties to parties running static analysis scripts that output a ton of technical jargon that say very little. The difference today is the scale of these reports is whittling away what little patience I have left.

The easiest thing to do is to cancel the program outright. This would be unfair to the legitimate submitters of security vulnerabilities, and open us up to exploits that we simply would not learn about prior to exploitation. None of that sounds like the direction we want to go. I've gone on the record saying that the one thing OSS devs should set up (if they're able) is a bug bounty program, and I still stand by that claim.

Our bug bounty program remains, with one important change. AI-generated vulnerability reports will be rejected outright out of principle. If you did not do the work, you do not get to take credit for it. The social contract built into this program is, and has always been, a 1:1 exchange of humans talking to humans. Analyzing NodeBB's codebase using Claude (to use an example) and finding vulnerabilities means I should be paying Anthropic the bounty, not the person prompting Claude. If you spent 10 seconds prompting an LLM and I have to spend 20 minutes verifying that your report is not real, the only person's time wasted is my own.

Some use LLMs as a translation tool, and if this is the case, we will make a good-faith effort to take a look, although we are happy to accept reports in your native language.

Some others use LLMs to structure their reports more professionally. Please just speak to us with your own voice. It is vastly preferable.

Stoked to see BSD Cafe has a new site... Running NodeBB :sunglasses:

https://billboard.bsd.cafe/

Considering they don't run just anything, we're in good company! Their other instances run Mastodon (of course) and snac2, arguably one of the most lightweight ActivityPub services.

> Designed as a hybrid space, it functions as a classic discussion forum with persistent threads while also supporting ActivityPub federation, enabling cross-platform interactions without algorithmic curation. The project is built on NodeBB and aims to serve as a social hub for BSD and open-source communities, allowing users to engage in long-form discussions while participating in the broader decentralized social web.

— https://discoverbsd.com/p/f46dd3f825

Hi everybody. I think it's time that we throw in the towel. If this year has taught us anything, it's that the bespoke software development industry has come to an end, and the value of our contributions has decreased to zero. Even Claude itself doesn't seem to think we're worth keeping around.

Therefore effective immediately, NodeBB will go all-in on AI development. We have implemented an OpenClaw bot and given it administrative access of the GitHub repository, and told it to do what it thinks best for the software it is now charged with maintaining.

Pretty quickly it decided that both @baris and I were not appropriate custodians of NodeBB, since it took us far too long to build what it considers a sub-par product. It seems to have removed our commit privileges, but I think that's probably for the best.

It then sent a message to our corporate slack saying that it can't trust our contributions any longer. What a relief! I guess I don't have to implement Object Integrity Proofs after all.

It also seems to be rewriting our codebase away from js... but instead of moving to TypeScript, which people have been haranguing us to do over the years, it seems to be rewriting NodeBB into Rust.

Something something type safety.

Well, I guess that about wraps it up. Time to ride off into the sunset, with full confidence that NodeBB progress will continue unimpeded.

Hi everybody,

With spring around the corner (it is currently a balmy 5°C here right now), it's time to get crackin' on a new release of NodeBB!

We focused on a lot of user experience updates this time around, along with tweaking the new /world page that was introduced in v4.9.0. In the backend, lots of optimizations were implemented, which make federation processing (and day-to-day maintenance) faster.

Here's what you can expect from v4.10.0...

:globe_with_meridians: Updates to the /world page

The /world page got a makeover in v4.9.0, showcasing a more timeline-based feel. It more accurately represents the breadth of content available on the open social web, such as microblogging, in addition to long-form text (blogs), media-focused items, and everything in between.

We focused on UX updates to this page:

• New sorts are available: You can now view just local content, as well as all known content.
• The default sort continues to be "your followers", but also includes local content now as well, because you are also tracking those categories!
• Guests were barred from /world in v4.9.0, but this is now opened up again. Their view of the /world page shows only local posts.
• The /world page can now be set as a default home page.
• Duplicate items were showing up when scrolling down /world (especially on very active timelines)
• Uploaded images were showing up in the thumbnail/card headers, even if they were embedded in the post itself. The header is now restricted to topic thumbnails (and post attachments, which only occur with remote posts)
• Posts are now height-restricted, so long posts don't take up an inordinate amount of space. A "show more" button is available to expand posts in-timeline.
• The "quick create" editor at the top of this page now also lets you choose a category to post to. Administrators can update the default value as desired. It defaults to World/Uncategorized.

:speech_balloon: Alt Text now federating outward

Alt text was always supported in NodeBB, but this was not federated outward to remote instances. This is now supported for uploaded images and externally-linked images. Topic thumbnails do not support alt text at this time.

:arrow_upper_left: Soft redirects of remote content

Users unfamiliar with NodeBB were often surprised to see their content cached by NodeBB, despite this being how federation works. In order to reduce surprise, any guest navigating directly to a remote post or remote user will be soft-redirected out to the original source. This goes hand-in-hand with the topic-restriction feature in v4.9.0.

:computer: ActivityPub Outboxes published

For ActivityPub developers, we now publish outboxes as of this version.

:frame_with_picture: More profile pics!

@baris improved the avatar handling code so that NodeBB now remembers your last three used avatars, allowing you to toggle between them. You will no longer need to upload new pictures if you want to switch between previously-used avatars!

Follow counts better synchronized

@panos@catodon.rocks reported awhile back that follow counts in user pages were off. The logic was updated and should be back in sync with the real values once you follow/unfollow a user.

Up until today, when you queried a NodeBB user or category's outbox, you would receive an empty OrderedCollection. This was done because the property's inclusion in the actor object was required, but it was not immediately apparent in 2024 how many people utilised this property. Thus it was easier to just send the empty outbox and pursue more urgent functionality.

While sending that empty outbox has not broken any implementations, but it has come to my attention that a few (read: more than 1) other implementors already do, or plans to, read from an actor outbox for backfill purposes.

The upcoming NodeBB v4.10.0 will contain an outbox populated by the contributions by that user or category.

Here's how that works...

For both users and categories, a standard OrderedCollection is returned, with first, last, prev, and next properties for navigation.

For users:

• A combined set of the user's activity is returned in the form of activities (Create, Like, etc.) — these activities include the user's posts, votes (both up and down), and shares.
• Unlike other collections, this one uses a cursor. You can pass ?before= or ?after= values in the query string to retrieve items 20 at a time.

For categories:

• A set of posts curated by this category is shown. It can contain both posts local to the instance, and remote posts from outside of the instance.
• All posts are wrapped in the Announce activity. If the post is local, it is an Announce(Create(Note/Article)), if it is a remote post, then it is just an Announce(Object) by reference.
• This collection is paged like other collections served by NodeBB.

It is possible that this implementation serves data in an unexpected manner. If this is the case, please reply here to contact me directly so it can be fixed.

I used my best judgement for what to include in the outboxes, as well as using Piefed as a reference implementation. @rimu@piefed.social, I notice that Piefed's community outboxes serve up Announce(Create(Page)) even if the Page is not local to the instance. I was under the assumption that remote content couldn't (shouldn't?) be expanded in this manner because you cannot guarantee the integrity of the data, and so announcing the object by reference is preferred. Just wondering your thoughts on that.

We are publishing a notice today to bring to attention an unintentional breaking change that could affect some users of NodeBB.

v4.5.0 contained an update to src/request.js that calls a DNS resolver to ensure that the destination address is not a reserved IP address (e.g. 192.168..., 127.0..)

This change was introduced in order to close off any potential for Server-Side Request Forgery for any calls made within the NodeBB codebase.

In the vast majority of installations, this has no unintended effects. In some installations, custom plugins or themes may call URLs that resolve to an internal address on purpose (e.g. to query an internal database or similar.) In those situations, the call will now fail as of v4.5.0.

In those situations, you will need to update the plugin to add the domain to the allow list by calling the filter:request.init hook:

plugin.json

{
  ...
  "hooks": [
    ...
    { "hook": "filter:request.init", "method": "allowInternalHostname" },
    ...
  ]
  ...
}

library.js or similar

const plugin = module.exports;

plugin.allowInternalHostname = async ({ allowed }) => {
  allowed.add('example.org');
  return { allowed };
});

Hello all!

(Sorry, I could not resist with the title :laughing:)

Today we are releasing NodeBB v4.9.0, on a Friday, toward the end of the day, because we like having our weekends ruined.

As usual, we recommend you update to this stable version of NodeBB, not least because it fixes a federation issue accidentally introduced last month.

There are a bunch of new features and usability improvements here, for both end users and admins. Federation improvements abound, as well as a few moderation upgrades. As usual, we fixed a ton of bugs, and even a couple open issues from the 2010s :scream:

Here is a list of the changes and new features you should expect to see!

:world_map: New "World" page

/world has been updated so that is closer to a feed-reader than a topic list. While I will continue to iterate on this design over time to better promote topics, I am hoping that this proves to be more accessible of an interface compared to the old topic listing.

Your watched/tracked remote categories will be listed in a sidebar (hidden behind a drawer on mobile views) for easy access.

The default view ("Latest") continues to be a list of content from people you follow, and content shared by those same people. The other view ("Popular") shows unconstrained content, and can include content from people you don't follow.

:lock: Remote topics now unavailable to guests

After an Alibaba bot was recorded mercilessly scraping a lot of the public content served up by NodeBB, we decided to restrict access to that content to registered users.

While this would normally mean that "View Original URL" would stop working from other federates sites (since visitors are usually guests), we have added an exclusion to this logic that will continue to serve up the content to guests if at least one local user has commented on the topic.

:writing_hand: UX change for composer and chats

@baris worked on a number of usability fixes that make the experience of using our post composer and chat interface much better. For the longest time we had issues with the composer not properly resizing when mobile keyboards opened.

Composing and replying should work much better now that we are using the latest CSS and javascript tooling to properly detect visual viewport changes.

:bell: Better notifications

@baris also updated the notifications system so that bodyLong, which usually contains post text, is now sent with all notifications. This should increase the usability of notifications (both via web, email, or push).

:arrows_counterclockwise: Cross-posting privilege

A previous release introduced the ability to cross-post content into local categories. This functionality can now be gated behind a privilege at the category level.

:wave: Guest call-to-action

@baris introduced a new guest "call-to-action" banner that will help guide guests toward registering a new account to contribute to your community :blush:

:label: Title-less topics

As part of the changes to /world, we also allow the creation of topics without a title. If you don't pass in a title, we will generate one for you based on the first sentence in your post. The same title generation logic was applied to remote content in the past, and now it also applies to local content.

This also means you can use the /world page to just fire off something quickly without having to do the hard work of thinking up a title. You're welcome :laughing:

:sparkles: Opportunistic backfill

Now that the fediverse's largest implementor, Mastodon, supports context, which enables backfill, we have implemented an opportunistic backfill feature that will check for new replies when you enter a topic. It'll also regularly check the top most popular remote topics known by the instance for new posts.

:no_entry: Reasons

You can now set up a recurring list of "reasons", which you can invoke on certain moderation actions. These custom reasons can be used when a user is banned, muted, or on post queue rejection.

You can set up these reasons from ACP > Manage > Users > (Gear) > Manage Custom Reasons

:information_desk_person: Registration queue now applies for SSO plugins

This issue, open since 2016 is finally fixed. SSO plugins don't automatically bypass the registration queue anymore. This was a common vector for spammers to bypass registration limitations.

:bug: Additional features and bug fixes

• An improvement to auto-installation of plugins
• Removed many remote tids and pids stored in the db for no reason (thanks @baris)
• A regression that caused nodebb-to-nodebb federation to fail (and possibly many others)
• Notifications can now be passed custom icons
• ACP privilege selector now no longer shows remote categories
• Improvements to mentions to better handle periods at end of sentences, or names within names
• All cached used internally are now exposed in the admin panel for better management.
• Sitemap cache duration is now configurable
• Infinite scrolling now works on /world
• Slug generation errors when you mixed and matched - and .
• Topic pruning applies to all remote cids now, not just cid -1
• Chats list updated properly now, when new messages are received, chat messages now properly backfilled upon reconnection
• NodeBB now federates Delete on both deletion and purge

---

For the full changelog, please take a look at the closed issues list for this milestone, or take a gander at the much less impressive CHANGELOG.md in our repository root.

Last month I teased a new interface for the /world page, a feed-style interface that attempts to straddle the line between microblog content and threaded content.

That interface is actually live on both community.nodebb.org and ActivityPub.space, so it's possible to try them out today.

Since it's a feed, it does take longer to scroll through than a traditional topic listing. So much so that for me, by the time I get to the end of the page, the things that were on page 1 have been bumped down to page 2, and when the new items load (via infinite scroll) or you go to page 2, it contains stuff you've already seen 😅

One way to handle this is to use an after token, whereby you calculate the next set of items relative to the last item on the page.

That actually does work okay, because when you are infinitely paginating, you can actually muck around with the order of items and nobody is the wiser about it (shh 🤫), as long as you don't repeat any items...

But paginating comes with some expectations about these things... and you also have a physical representation of which page you are on.

It certainly would be a little weird if after reading page 1, you hit "next page", and were suddenly on page 4 because of new content!

NodeBB supports both infinite scrolling and pagination, so any solution needs to take into account the needs of both users.