mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-05 11:46:04 +00:00
Code Packages Wiki Activity

FEP-0151: Update proposal (#761)

Browse Source 
- Expanded section about hiding usage statistics, replaced "incorrect" with "intentionally skewed".
- Clarified why `software` must not be used for capability detection.
- Added statement about blocking vulnerable instances.

Reviewed-on: https://codeberg.org/fediverse/fep/pulls/761
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>
This commit is contained in:
silverpill
2026-02-19 13:18:08 +01:00
committed by silverpill
parent d086d30647
commit 0db888d399
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/0151/fep-0151.md
+5 -5
View File
@@ -31,7 +31,7 @@ The NodeInfo endpoint could be disabled to hide that information.
### Hiding usage statistics
All numeric properties in the `usage` object are optional and could be omitted to hide usage statistics. Note that `users` property is not optional:
Some softwares might wish to publish NodeInfo, but without revealing usage statistics. While the [NodeInfo 2.1][NodeInfo] schema specifies `usage` and `usage.users` as required properties, it does not require any additional properties within `usage.users`. Servers MUST NOT publish intentionally skewed usage statistics; instead, servers wishing to hide their usage statistics SHOULD publish an empty object:
```json
{
@@ -41,13 +41,13 @@ All numeric properties in the `usage` object are optional and could be omitted t
}
```
Servers MUST NOT publish incorrect usage statistics.
### Capability detection
Servers SHOULD NOT rely on NodeInfo data for protocol negotiation and capability detection because server operators might intentionally disable NodeInfo. Servers MUST NOT infer capabilities from the `software` field and MUST treat `software.name` and `software.version` values as opaque strings.
Servers SHOULD NOT rely on NodeInfo data for protocol negotiation and capability detection, because server operators might intentionally disable NodeInfo.
Protocol-specific capability discovery mechanisms could be used instead. The capabilities of an ActivityPub application can be advertised using a server actor, as described in [FEP-844e: Capability discovery][FEP-844e].
Servers MUST NOT infer capabilities from the `software` field and MUST treat `software.name` and `software.version` values as opaque strings. Attempting to use this information is very difficult to do reliably, and often hinders inteoperability. However, software version information MAY be used to block instances with known security vulnerabilities.
Instead of NodeInfo, protocol-specific capability discovery mechanisms could be used. The capabilities of an ActivityPub application can be advertised using a server actor, as described in [FEP-844e: Capability discovery][FEP-844e].
### `metadata`