Technical Discussion

Understood, so the mod check is done but also accepts origin-based security as per fe34. That actually does make sense and allows for cross-origin moderation.

@silverpill@mitra.social @julian@activitypub.space @technical-discussion@activitypub.spaceI agree with Silverpill 'attributedTo' should not be overloaded by this extra meaning

@julian @benpate fixed on WordPress.com! (it was a CORS issue, because the API runs under a different domain on DotCom).You should now be able to test on activitypub.blog

Thanks @chocobozzz@framapiaf.org for the explanation. It does seem like the library is still usable. In a separate thread, @mradcliffe@nokoto.org mentioned that he had a PR/branch that introduced RFC 9421 support: https://nokoto.org/user/3/replies/317 It looks like you're the maintainer... would you be open to having that merged if someone (aka me) implements and tests it?

@evan 429? Amateur hour. You need to keep banging on the API until the server is overwhelmed and times out. That's the 2026 way.

That makes sense. When I implemented the Litepub style relay logic I figured it would immediately work the same way as well (since two-way relay communication uses the Follow-Accept flow as well.) It did not work immediately with NodeBB, have yet to figure out why

> @silverpill@mitra.social said: > > it should work well for POST requests because normally you fetch an actor before sending activities to its inbox. Aside: we should? I cache the inbox locally so I don't have to... I believe I read somewhere that bonfire (cc @mayel@bonfire.cafe) also caches whether a recipient supports 9421

@panos@catodon.rocks Thanks. Fixed Defer, not sure how to handle at the moment. N/A, when an Announce(Create) arrives, NodeBB makes a call out to retrieve the object again, so if a Create arrives after a Delete, it won't be added. We call the low level delete because it's an internal deletion. We don't need to call the api delete because that federates activities out. I don't expect your LLM to know this. Fixed. Fixed. Fixed.

I ended up blocking the instance.