Laurens Hof<p><strong>Fediverse Report – #111</strong></p><p>A new security fund for the fediverse, and the Lemmy developers held an AMA.</p><p><strong>The News</strong></p><p>The Nivenly Foundation, the organisation that administers the Hachyderm.io instance, is <a href="https://nivenly.org/blog/2025/04/01/nivenly-fediverse-security-fund/" rel="nofollow noopener noreferrer" target="_blank">opening a new security fund</a> to sponsor contributors who disclose security vulnerabilities. All software has security vulnerabilities, and the fediverse is no exception. The <a href="https://fediversereport.com/fediverse-report-110/" rel="nofollow noopener noreferrer" target="_blank">recent Pixelfed vulnerability</a>, which affected non-Pixelfed servers, is a clear example of how fediverse software can make software vulnerabilities more complex due to the interaction between different software platforms.</p><p>The Nivenly Fediverse Security Fund will sponsor $250 USD for vulnerabilities that are rated as high risk (7-9 CVSS score) and $500 USD for vulnerabilities with a critical score (9+ CVSS). The program will run until the end of September 2025. Nivenly members “hold a <a href="https://nivenly.org/governance" rel="nofollow noopener noreferrer" target="_blank">member vote</a> to determine if we want to continue the program, and to establish a longer-term committee to steward and maintain the program.”</p><p>Last week, I wrote how Pixelfed’s vulnerability actually showed three different problems: The main problem is Pixelfed’s software vulnerability itself, but there were also two other problems: other software like Mastodon do not make it clear which risk comes with their private posts feature. And once a leak like this one happens, very few fediverse software admins communicated to their users that they might have been affected.</p><p>A security fund contributes to combating software vulnerabilities, but it can also help with communication to the rest of the fediverse once a vulnerability is found. It incentives that standard industry practices regarding software vulnerability get followed, and make communication clearer to a wider audience. For example, if Pixelfed’s recent vulnerability had gotten a <a href="https://nvd.nist.gov/vuln-metrics/cvss" rel="nofollow noopener noreferrer" target="_blank">CVSS</a> classification, it might have been easier to make the severity of the vulnerability explicit to other fediverse software admins. In turn, this might have made it more likely that server admins would communicate the situation with their users.</p><p>In last week’s email essay I also wrote about how the fediverse is missing governance infrastructure that connects the various independent nodes and communities. One way to view the fediverse is as a response to centralised Big Tech platforms. These platforms have centralised governance, and are under the control of few people. The fediverse’s response to this is to build a social network that consists of tens of thousands of independent communities, all with their own governance structure. The fediverse has been successful in decentralising the single entity that oversees a social network into many pieces that all oversee a small portion of the network. But it has struggled to build a governance structure that ties all these individual pieces together again.</p><p>The Nivenly Fediverse Security Fund is a good example of this problem: software security impacts all the thousands of independent fediverse communities, but there is no overarching structure to collaborate and improve the security. It took one server taking the initiative into their own hands and provide a service for the entire network, at their own cost. Ideally, communities would collaborate on such a security fund instead. Nivenly’s announcement does leave space for such a future direction of the fund, saying that they are open to “establish a longer-term committee to steward and maintain the program”.</p><p><em>Note: if you sign up for my email newsletter, you get a weekly essay about the open social web that I do not publish anywhere else. You can sign up right here:</em></p> <p>The Lemmy developers, Dessalines and nutomic, held an <a href="https://lemmy.ml/post/27659153" rel="nofollow noopener noreferrer" target="_blank">Ask Me Anything</a> recently, and here are some of the answers that stood out to me:</p><ul><li>Lemmy is working towards their 1.0 release. This is currently expected to be in the fall, although nutomic also <a href="https://lemmy.ml/post/27659153/17532580" rel="nofollow noopener noreferrer" target="_blank">says</a> that “these things always take longer than expected”. He also expects some instances like lemmy.ml already to upgrade some months before.</li><li>One of the main <a href="https://lemmy.ml/post/27659153/17535675" rel="nofollow noopener noreferrer" target="_blank">features</a> for Lemmy 1.0 is private communities, where only approved accounts can browse and posts to the community. This type of closed group functionality is in high demand, and both Mastodon and Pixelfed have tried to implement it. Mastodon got a grant for it, but the <a href="https://github.com/mastodon/mastodon/pull/19059" rel="nofollow noopener noreferrer" target="_blank">proof-of-concept code</a> has been sitting there since 2022. Pixelfed has announced and teased a group feature multiple times over the year and showed screenshots of it, but it also is not publicly available yet.</li><li>Lemmy posts are interoperable with Mastodon, but the interoperability is not great: a Lemmy post <a href="https://dev.phanpy.social/#/mastodon.social/s/114302739769085777" rel="nofollow noopener noreferrer" target="_blank">appears</a> on Mastodon as the title plus the URL. There has been many conversations about how Mastodon handles content from other platforms, with no changes so far. In this AMA, nutomic is explicit in <a href="https://lemmy.ml/post/27659153/17532972" rel="nofollow noopener noreferrer" target="_blank">saying</a> that it is up to Mastodon to change this. While Mastodon seems open to the idea, and has been in conversations with developers from platforms like Ghost and NodeBB on how to show their content better on Mastodon, there has been little indication that Mastodon is taking steps towards making Lemmy content also better visible on Mastodon.</li><li>On the subject of how Lemmy can grow, Dessalines describes it as an organic progress, <a href="https://lemmy.ml/post/27659153/17537792" rel="nofollow noopener noreferrer" target="_blank">saying</a>: “niche communities on reddit will keep getting fed up with the changes, and migrate to lemmy.” Nutomic <a href="https://lemmy.ml/post/27659153/17529761" rel="nofollow noopener noreferrer" target="_blank">describes</a> a similar dynamic for fedi and Bluesky more broadly, saying that he expects that over the long term the fediverse might grow in a similar manner: “when the Bluesky admins make decisions that the community doesnt like, and then there may be another migration wave to the Fediverse”. Both replies indicate Lemmy’s vision of how the project can grow in the long run: stay consistently working on your product, and because platforms like Lemmy are not beholden to investors, they can have a longer lifespan, and outlive platforms who are beholden to shareholder expectations.</li><li>Grouping of communities (similar to PieFed’s topics or Reddit’s multireddits) “<a href="https://lemmy.ml/post/27659153/17554882" rel="nofollow noopener noreferrer" target="_blank">will be implemented soon</a>“.</li></ul> <p><a href="https://ahoy.eu/" rel="nofollow noopener noreferrer" target="_blank">Ahoy</a>! is a one-day conference for the European Social Web, and will be held on April 24th 2025 in Hamburg, Germany. The conference is mainly focused on Bluesky and the AT Protocol, and has some super fascinating speakers of people who are in the forefront of building new communities on the open social web. If you’re around I can definitely recommend it. I’ll be doing some interviews with people there, so if you are considering joining, let me know and we can say hi!</p><p></p><p><strong>The Links</strong></p><p></p><ul><li><a href="https://privacy.thenexus.today/more-notes-on-organizing/" rel="nofollow noopener noreferrer" target="_blank">More notes on Organizing, Mutual Aid, and Activism on decentralized social networks</a> – Jon Pincus/The Nexus of Privacy</li><li>Ghost <a href="https://activitypub.ghost.org/you-think-youre-following-us-but-you-might-not-be/" rel="nofollow noopener noreferrer" target="_blank">says</a> there are now over a 1000 Ghost servers who have connected with the rest of the fediverse. </li><li>Mastodon’s monthly engineering updates, Trunk & Tidbits, is now <a href="https://blog.joinmastodon.org/2025/04/trunk-tidbits-march-2025/" rel="nofollow noopener noreferrer" target="_blank">available</a> for March 2025.</li><li>A <a href="https://social.heise.de/@mho/114285272597524971" rel="nofollow noopener noreferrer" target="_blank">dataset</a> with over 900 verified accounts of media organisations on Mastodon.</li><li><a href="https://mitra.social/objects/01960262-d8ba-73dd-51c1-18f3881f9ec7" rel="nofollow noopener noreferrer" target="_blank">This week’s fediverse software updates.</a></li></ul><p>That’s all for this week, thanks for reading! You can subscribe to my newsletter to get all my weekly updates via email, which gets you some interesting extra analysis as a bonus, that is not posted here on the website. You can subscribe below:</p> <p><a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://fediversereport.com/tag/fediverse/" target="_blank">#fediverse</a></p><p><a href="https://fediversereport.com/fediverse-report-111/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">fediversereport.com/fediverse-</span><span class="invisible">report-111/</span></a></p>