You are crazy if you don't believe the USA is an authoritarian country. The leader who rules by decree (I mean executive order) is literally Donald fucking Trump. You have gangs of paramilitary police murdering innocent people, you have had a massive build out of surveillance technology without asking anyone, the elections are all fixed, there are more billionaires there than anywhere else on earth yet millions of people are hungry, the schools have been defunded, and you project military power around the world and killed millions of people in the past 20 years.

Adding a public ActivityPub service to a static recipe site using a Cloudflare Worker produced two interesting technical lessons.

Two production issues surfaced within a day. First, an overly permissive shared inbox, an endpoint with no practical benefit for a single-actor service, attracted approximately 2,900 unsolicited deliveries per day from across the federated network. Each delivery triggered cryptographic signature verification and a remote-key lookup, exhausting the daily storage-operation budget for an account with only seven subscribers.

Second, an unauthenticated statistics endpoint generated three database operations per request. Serverless platforms do not automatically cache dynamic responses at the edge, and our existing cache directive applied only to downstream clients.

Both issues were resolved without changing the authentication model. Removing the unnecessary inbox endpoint rejected unwanted traffic before signature verification. Adding edge caching prevented repeat statistics requests from reaching the database. I also applied platform-native rate limiting to protect a long-lived shared secret that lacked its own lockout mechanism.

ActivityPub is inherently susceptible to server-side request forgery because participating servers make outbound HTTP requests to URLs supplied by unauthenticated strangers. This behavior is fundamental to the protocol, not an implementation issue.

I'm glad I didn't throw this on my home server though. On serverless infrastructure that capability presents a much smaller risk because the runtime has no privileged network position. There is no instance metadata service, loopback interface, or neighboring RFC1918 address space to exploit. The same code running on my self-hosted server could expose internal services to anyone capable of sending a well-formed message. Mitigating that risk would require egress filtering, which is complicated by the ActivityPub protocol’s legitimate need to contact arbitrary public hosts.

That said serverless does not make an insecure design secure. It removes the network adjacency that can turn a design flaw into a foothold and shifts the remaining risk from compromise to cost. That is why both incidents appeared as billing alerts rather than security events. 🤓

People on Lemmy are extremely annoying and refuse to use block lists to tailor their experiences and instead engage in endless circlejerks. The people who need to police the tankies are the worst of the worst.

Looks great!!

Looks good!