The identity key of this actor is controlled by the server, which generates and signs an actor object on GET request.
Starting with custodial keys is easier than with non-custodial, so I will probably continue working in this direction. The next step is exporting posts.
@mikedev I'm seeing various Add activities, such as Add{Like}. In one case my server failed to verify the integrity proof, I think it was this activity https://fediversity.site/activity/ce763d95-b46e-434a-931b-aaec941d7b79
@japananon Good. It could remove legit mentions as well (e.g. a direct message from someone you haven't met before), so I recommend switching back to default once the spam wave is over.
@japananon Have you enabled it in your profile settings? See attached pic
If you did that, check your logs, there should be records saying "mention removed from post"
journalctl -u mitra | grep "mention removed"
>might have been an account that previously spammed at me
This is possible. The "only known users" protection is very weak and can be easily bypassed, I'll add a stronger variant later (accept only from followers / following).
- Mentions can be limited in profile settings. Only two options are supported in this version: accept mentions from everybody and accept mentions only from known users. Known users include followers/following, and everyone else who was discovered by the server more than 1 hour ago. This may be effective against the spam from newly registered accounts, or may not - I haven't been able to test it. - Federated timeline is visible to all local users
Developer of ActivityPub-based micro-blogging and content subscription platform Mitra. Working on Fediverse standards: https://codeberg.org/silverpill/feps