overview for pathwonder

Displaying Images From View Community in c/piefed_help@piefed.social

[–] pathwonder@kopitalk.net 1 points 6 days ago* (last edited 6 days ago) (1 children)

#solved

EDIT: 2025-10-25 at 11h29 - I deleted the Content-Security-Policy and PieFed displays images as expected.

Reasoning

So after crawling through some very old Reddit posts, I came across other self-hosters discussing their new found interest in Security Headers from 5 years ago (dated, yes). Among the comments was a post by pentesticals (glorious):

quote

Don't stress about security headers and CSP. These are there to help provide additional protection against client-side issues which may or may not be present.

These will not have any direct impact on your services you expose, rather they aim to be a last resort to protect your browser in case an attacker tries to exploit existing vulnerabilities such as a Cross Site Scripting - but not having these does not increase the risk of your server being compromised.

Use Nessus Essentials for scanning your services and have fun.

https://www.reddit.com/r/selfhosted/comments/mpzl8f/any_recommendations_for_security_scans/

I use Caddy and I can indeed see the security headers that involve CSP. How should this setting be amended?

For what it's worth I looked over the "Using Caddy as reverse proxy" for Lemmy, and I notice that they just don't use the Content-Security-Policy option at all. I'm wondering if I should simply delete this Header for PieFed.

https://join-lemmy.org/docs/administration/caddy.html

Security Headers

(security_headers) {  
  header {  
    Strict-Transport-Security "max-age=31536000; includeSubDomains"  
    X-Content-Type-Options "nosniff"  
    X-Frame-Options "SAMEORIGIN"  
    Referrer-Policy "no-referrer"  
    X-XSS-Protection "1; mode=block"  
    Permissions-Policy "camera=(), microphone=(), geolocation=(), accelerometer=(), autoplay=(), fullscreen=(), gyroscope=(), interest-cohort=(), magnetometer=(), payment=()"  
    -Server  
    -x-powered-by  
  }  
}

How effective are ads? in c/asklemmy@lemmy.ml

[–] pathwonder@kopitalk.net 9 points 1 week ago (2 children)

Super effective!

It's not so much that ads can only sell you something anymore. They're able to sell your personal details and identity when abused.

I believe the issue has been written on even prior to the 2025 article from Wired.

Data brokers are basically form centralized American platforms which carry immense databases about its users. These demographics can essentially be used to target high value targets. These can include government employees, members of military, and other persons of interest.

These brokers use Mobile IDs to allow advertisers to micro-target people with their habits, browsing fingerprint, and purchase habits. Even if these companies say they don't associate identities with these Mobile IDs, the brokers can cross-reference enough information to basically de-anonymize a target.

Plus with influencers these days, many don't disclose if what they do is sponsored or part of a greater outreach campaign. You're basically stuck wondering if you're getting targeted or astroturfed.

https://www.wired.com/story/google-dv360-banned-audience-segments-national-security/

9

Displaying Images From View Community (kopitalk.net)

submitted 1 week ago* (last edited 6 days ago) by pathwonder@kopitalk.net to c/piefed_help@piefed.social

5 comments fedilink

Sorry, new guy here.

So about images, on my desktop browser, when I click just on the thumbnail to the side, I'm expecting the image to display. But the image loading graphics just keep looping without any image.

If I click the post, the image typically displays as expected.

On Voyager, tapping the thumbnail loads the image to the screen as expected.

PieFed Email Error in c/piefed_help@piefed.social

[–] pathwonder@kopitalk.net 2 points 1 week ago

Thank you everyone, for your replies and tips!!

I haven't followed PeerTube channels directly from PieFed - yet.

After just under 24 hours up, so far everything seems to be working just as wjs018 says.

Thanks Rimu for the Sentry tip.

I think I'll just not set the email for errors so as to avoid the logs being sent out.

7

PieFed Email Error (kopitalk.net)

submitted 1 week ago* (last edited 1 week ago) by pathwonder@kopitalk.net to c/piefed_help@piefed.social

5 comments fedilink

Hello!

I wanted to move away from Reddit and started with a Lemmy instance for a few days. But, I kept on bumping into these mentions about PieFed and got curious. I figured since I just started, no harm in just spinning up PieFed. That, and once I saw Voyager was able to work with PieFed, it just seemed like a no brainer.

I'm so very impressed, I'm just exploring everything, checking out settings, and adding new communities.

That said I probably did something wrong in the process. I input the settings for email in .env.docker. As soon as I did, error emails arrived in batches of 5-8 at a time. I tried making sense of it myself, but I got stuck. Would anyone kindly take a look and point me in the right direction?

Error

Exception on /inbox [POST]
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/requests/models.py", line 976, in json
return complexjson.loads(self.text, **kwargs)
~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/json/init.py", line 346, in loads
return _default_decoder.decode(s)
~~~~~~~~~~~~~~~~~~~~~~~^^^
File "/usr/local/lib/python3.13/json/decoder.py", line 345, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/json/decoder.py", line 363, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/pyld/documentloader/requests.py", line 72, in loader
'document': response.json()
~~~~~~~~~~~~~^^
File "/usr/local/lib/python3.13/site-packages/requests/models.py", line 980, in json
raise RequestsJSONDecodeError(e.msg, e.doc, e.pos)
requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 143, in _fetch_context
remote_doc = jsonld.load_document(url,
{'documentLoader': self.document_loader},
requestProfile='http://www.w3.org/ns/json-ld#context')
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 6583, in load_document
remote_doc = options['documentLoader'](url, options)
File "/usr/local/lib/python3.13/site-packages/pyld/documentloader/requests.py", line 100, in loader
raise JsonLdError(
...<2 lines>...
cause=cause)
pyld.jsonld.JsonLdError: ('Could not retrieve a JSON-LD document from the URL.',)
Type: jsonld.LoadDocumentError
Code: loading document failed
Cause: Expecting value: line 1 column 1 (char 0) File "/usr/local/lib/python3.13/site-packages/pyld/documentloader/requests.py", line 72, in loader
'document': response.json()
~~~~~~~~~~~~~^^
File "/usr/local/lib/python3.13/site-packages/requests/models.py", line 980, in json
raise RequestsJSONDecodeError(e.msg, e.doc, e.pos)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1219, in to_rdf
expanded = self.expand(input_, options)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 870, in expand
expanded = self._expand(active_ctx, None, document, options,
inside_list=False)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 2302, in _expand
active_ctx = self._process_context(
active_ctx, element['@context'], options)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 3049, in _process_context
resolved = options['contextResolver'].resolve(active_ctx, local_ctx, options.get('base', ''))
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 58, in resolve
resolved = self._resolve_remote_context(
active_ctx, ctx, base, cycles)
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 108, in _resolve_remote_context
context, remote_doc = self._fetch_context(active_ctx, url, cycles)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 148, in _fetch_context
raise jsonld.JsonLdError(
...<8 lines>...
code='loading remote context failed')
pyld.jsonld.JsonLdError: ('Dereferencing a URL did not result in a valid JSON-LD object. Possible causes are an inaccessible URL perhaps due to a same-origin policy (ensure the server uses CORS if you are using client-side JavaScript), too many redirects, a non-JSON response, or more than one HTTP Link Header was provided for a remote context.',)
Type: jsonld.InvalidUrl
Code: loading remote context failed
Details: {'url': 'https://www.w3.org/ns/activitystreams', 'cause': JsonLdError('Could not retrieve a JSON-LD document from the URL.')}

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1128, in normalize
dataset = self.to_rdf(input_, opts)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1221, in to_rdf
raise JsonLdError(
'Could not expand input before serialization to '
'RDF.', 'jsonld.RdfError', cause=cause)
pyld.jsonld.JsonLdError: ('Could not expand input before serialization to RDF.',)
Type: jsonld.RdfError
Cause: ('Dereferencing a URL did not result in a valid JSON-LD object. Possible causes are an inaccessible URL perhaps due to a same-origin policy (ensure the server uses CORS if you are using client-side JavaScript), too many redirects, a non-JSON response, or more than one HTTP Link Header was provided for a remote context.',)
Type: jsonld.InvalidUrl
Code: loading remote context failed
Details: {'url': 'https://www.w3.org/ns/activitystreams', 'cause': JsonLdError('Could not retrieve a JSON-LD document from the URL.')} File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1219, in to_rdf
expanded = self.expand(input_, options)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 870, in expand
expanded = self._expand(active_ctx, None, document, options,
inside_list=False)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 2302, in _expand
active_ctx = self._process_context(
active_ctx, element['@context'], options)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 3049, in _process_context
resolved = options['contextResolver'].resolve(active_ctx, local_ctx, options.get('base', ''))
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 58, in resolve
resolved = self._resolve_remote_context(
active_ctx, ctx, base, cycles)
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 108, in _resolve_remote_context
context, remote_doc = self._fetch_context(active_ctx, url, cycles)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 148, in _fetch_context
raise jsonld.JsonLdError(
...<8 lines>...
code='loading remote context failed')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/flask/app.py", line 1511, in wsgi_app
response = self.full_dispatch_request()
File "/usr/local/lib/python3.13/site-packages/flask/app.py", line 919, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/local/lib/python3.13/site-packages/flask/app.py", line 917, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/local/lib/python3.13/site-packages/flask/app.py", line 902, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
File "/app/app/activitypub/routes.py", line 613, in shared_inbox
LDSignature.verify_signature(request_json, actor.public_key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/app/activitypub/signature.py", line 485, in verify_signature
final_hash = cls.normalized_hash(options) + cls.normalized_hash(document)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
File "/app/app/activitypub/signature.py", line 544, in normalized_hash
norm_form = jsonld.normalize(
document,
{"algorithm": "URDNA2015", "format": "application/n-quads"},
)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 272, in normalize
return JsonLdProcessor().normalize(input_, options)
~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1130, in normalize
raise JsonLdError(
'Could not convert input to RDF dataset before normalization.',
'jsonld.NormalizeError', cause=cause)
pyld.jsonld.JsonLdError: ('Could not convert input to RDF dataset before normalization.',)
Type: jsonld.NormalizeError
Cause: ('Could not expand input before serialization to RDF.',)
Type: jsonld.RdfError
Cause: ('Dereferencing a URL did not result in a valid JSON-LD object. Possible causes are an inaccessible URL perhaps due to a same-origin policy (ensure the server uses CORS if you are using client-side JavaScript), too many redirects, a non-JSON response, or more than one HTTP Link Header was provided for a remote context.',)
Type: jsonld.InvalidUrl
Code: loading remote context failed
Details: {'url': 'https://www.w3.org/ns/activitystreams', 'cause': JsonLdError('Could not retrieve a JSON-LD document from the URL.')} File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1219, in to_rdf
expanded = self.expand(input_, options)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 870, in expand
expanded = self._expand(active_ctx, None, document, options,
inside_list=False)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 2302, in _expand
active_ctx = self._process_context(
active_ctx, element['@context'], options)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 3049, in _process_context
resolved = options['contextResolver'].resolve(active_ctx, local_ctx, options.get('base', ''))
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 58, in resolve
resolved = self._resolve_remote_context(
active_ctx, ctx, base, cycles)
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 108, in _resolve_remote_context
context, remote_doc = self._fetch_context(active_ctx, url, cycles)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/pyld/context_resolver.py", line 148, in fetch_context
raise jsonld.JsonLdError(
...<8 lines>...
code='loading remote context failed')
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1128, in normalize
dataset = self.to_rdf(input, opts)
File "/usr/local/lib/python3.13/site-packages/pyld/jsonld.py", line 1221, in to_rdf
raise JsonLdError(
'Could not expand input before serialization to '
'RDF.', 'jsonld.RdfError', cause=cause)