v3.14.0 ("question authority") is the end of a long road.

The goal was pluggable, algorithmic feeds. "Pluggable" because I want to drop a script into a directory to add a new algorithm—not recompile the server. "Algorithmic" because I want predictable, fine-grained control over what I see and how it's organized.

I've been working on this feature, across releases, for almost four months. A recent thread gave me the motivation to just get it done!

The discussion in that thread also shaped the result: algorithmic feeds ships with four example algorithms (called "judges") that demonstrate what's possible:

• quiet_posters shows posts from the people you follow whose posting frequency is in the bottom 25%
• long_reads groups posts over 500 characters
• community groups posts from threadiverse servers (Lemmy, PieFed, etc.)
• polls puts all polls in one feed

One interesting implementation decision: the exchange format between server and judge is an SQLite database holding the batch of posts to be judged. Rather than rolling a custom data exchange format, you get a well-tested file format that brings schema support, serialization/deserialization, and a query language nearly for free.

Here is the full set of changes in this release:

Added

• Algorithmic feeds, judged by executables in etc/judges.
• Accept community-relayed votes authorized by the object's audience.
• Include the linked SQLite3 version and its features in NodeInfo.

Fixed

• Pick up a remote actor's rotated public key.
• Don't save actors embedded in community-relayed activities.
• Ignore community-relayed and directly delivered activities attributed to a local actor.
• Reload an actor's page only when that actor's Refresh button is pressed.
• Hide the Refresh button on a local actor's panel.
• Fall back to the default avatar when a refreshed icon fails to load.
• Enable icon repair on actor panels and actor cards.
• Keep the no-replies timeline queries on the timeline index.

Changed

• Judge feed posts in the background instead of in the request.
• Reconcile each key once when an actor is blocked or unblocked.

#ktistec #crystallang #activitypub #fediverse

This release encompasses two broad sets of changes: widening the pool of candidates for feeds and more carefully checking the origin of inbound activities (broadly FEP-fe34, Origin-based security model).

Candidates for feeds were originally limited to posts in the actor's mailboxes. This decision made authorization easy but omitted clearly acceptable posts (for example, posts addressed to the public collection) that arrived via other means (for example, filling in a thread).

Prior to this release, inbox processing did not consistently define an object's origin nor did it apply consistent rules to what it admitted based on the origin.

FEP-fe34 is still not fully enforced, and truth be told, I'm still reviewing some of its mandates, so I'm not yet listing it in Ktistec's federation documentation.

Here's the full list of changes:

Added

• Notify a deck pane when it has new posts.

Fixed

• Retry an unresolved quote authorization.
• Label a draft with the status of its quote request.
• Compare origins when deciding whether to trust an IRI, key document, or owner.
• Ignore a trailing slash when matching a dereferenced document's IRI.
• Allow only Create and Update to update objects.
• Ignore an inbound vote that fails the FEP-9967 checks.
• Expand commonly omitted ActivityStreams context terms.
• Break a long link rather than let it overflow.

Changed

• Widen the feed scan to every object the server holds.
• Address a published feed by slug rather than by id.

Removed

• The proxyUrl property from the actor document.

I am still working hard on the feed deck. Both notifications and feed ordering now work. It's now my preferred reading interface, and should be ready by the next release!

#ktistec #crystallang #activitypub #fediverse

In the past months, I have had a number of great PhD students pass their exams:

* Leon Bettscheider for "Input Grammars in Practice - Methods for Symbolic Mining, Systematic Evaluation, and Grey-Box Testing": https://scholar.google.com/citations?user=GNt3lsUAAAAJ&hl=en&oi=ao

* Masudul Hasan Masud for "Addressing Socio-Technical Blind Spots in Modern Software Systems": https://www.linkedin.com/feed/update/urn:li:activity:7471651787322634241/

* Abdullah AlHamdan for “Security Analysis of Modern JavaScript Runtimes”: https://www.linkedin.com/feed/update/urn:li:activity:7468044729646051329/

Big congratulations to all!

SIGPLAN’s treasurer, Alex Potanin, details where the money goes for running conferences and the SIG’s other community activities. 💸 https://blog.sigplan.org/2026/07/20/sigplan-budget/