Emelia

You can do it, as long as you have always had media served from a custom domain (e.g., media.myserver.example instead of like s3.digitalocean.com or something) I'd recommend doing the migration offline, just take the hit with downtime. For media, rsync running on a server is your friend, but first prune your caches (that's the likely bulk of your media storage). This query run against the database will give you media storage consumed per account (local and remote) SELECT a.username || '@' || COALESCE(a.domain, 'local') AS account_identifier, SUM(m.file_file_size) AS total_storage, '/admin/accounts/' || a.id AS admin_url FROM media_attachments m JOIN accounts a ON m.account_id = a.id GROUP BY account_identifier, admin_url HAVING SUM(m.file_file_size) > 0 ORDER BY total_storage DESC; That'll help you prune more effectively — there's some accounts that use an incredible amount of storage, and cause problems for the rest of the network (i.e., reposting the same media every week, rather than referencing the same upload across multiple posts — at a technical level, it'd be better to do content-addressed uploads where the media file key is actually a CID of the binary contents; that's how AT Protocol deduplicates blob storage). For moving the database, first spin up the new server, then setup a database and redis, but without any data. You may need the rails migrations run just to get the sql database structure. Then shutdown the mastodon processes (ALL OF THEM) on the source server. Then take a dump of the mastodon database in postgresql AND take a dump of the redis database (I assume you're using the standard setup, so timelines and sidekiq queues in one redis database). Then you can just scp those across to the target server. For redis, shutdown the redis service, and just move the rdb file to the redis location. For postgresql use the standard data restore tools. The copy with scp and postgresql restore will take some time, but in my experience it's like ~30 minutes downtime. At the same time, you can update your DNS — as you've not the mastodon processes running on the new server yet, they'll see the "we're currently down" placeholder. It's perfectly doable. But, if you're concerned about being able to actually pull this off, you can always hire me. I provide this as a service to clients.

Yeah, but both, if I have a yubikey enabled, I can't use TOTP instead of yubikey from my tests. And yeah, I'm using a 1password passkey, instead of a yubikey — normally 1password handles those fine. On iOS Safari I received the system prompt, and it bypassed 1password completely.

@hongminhee@hollo.social nice! though I'd encourage using a root identity that's an actual DID document (not just did:key), and points to the service(s) through which it works. Whether that's did:web/vh or did:plc or some other did method, the properties of a full DID document are very useful.

Please propose agenda items!

Agenda:

1. IP Protection Note Reminder:
   • Anyone can participate in these calls. However, all substantive contributors to any Taskforce Work Items must be members of the Social Web CG with full IPR agreements signed. https://www.w3.org/community/socialcg/join
   • To contribute to Work Items: ensure you have a W3 account: https://www.w3.org/accounts/request, and sign the W3C Community Contributor License Agreement (CLA): https://www.w3.org/community/about/agreements/cla/
2. Reminder of Code of Conduct
3. Introductions, if necessary
4. TBD

We support contributions to the Agenda, please comment if there is something that we need to address during the meeting.

You can find information on how to join the meeting in the SWICG calendar

GitHub issue for the meeting: https://github.com/swicg/activitypub-trust-and-safety/issues/128

Agenda:

1. Introductions, if necessary
2. Task force reorganization and reorientation - Iterations, Milestones, and Workstreams (preparing for publication of deliverables): https://github.com/swicg/activitypub-trust-and-safety/issues/137
3. Grant Funding / NLNet: https://github.com/swicg/activitypub-trust-and-safety/issues/102
4. Taskforce co-lead selection / information: https://github.com/swicg/activitypub-trust-and-safety/issues/135
5. Review all "needs review" issues
   We support contributions to the Agenda, please comment if there is something that we need to address during the meeting.

You can find information on how to join the meeting in the SWICG calendar

Administrivia:

1. IP Protection Note Reminder:
   • Anyone can participate in these calls. However, all substantive contributors to any Taskforce Work Items must be members of the Social Web CG with full IPR agreements signed. https://www.w3.org/community/socialcg/join
   • To contribute to Work Items: ensure you have a W3 account: https://www.w3.org/accounts/request, and sign the W3C Community Contributor License Agreement (CLA): https://www.w3.org/community/about/agreements/cla/
2. Reminder of Code of Conduct
3. Scribe volunteer(s)? If we can't find a scribe, I'll need to record the meeting and use AI/ML to prepare the meeting notes, or the meeting cannot proceed.

NOTE: This is a catch up meeting at a different time than normal, the meetings may move to 5pm CEST in the future depending on attendance from US people.

Administrivia:

1. IP Protection Note Reminder:
   • Anyone can participate in these calls. However, all substantive contributors to any Taskforce Work Items must be members of the Social Web CG with full IPR agreements signed. https://www.w3.org/community/socialcg/join
   • To contribute to Work Items: ensure you have a W3 account: https://www.w3.org/accounts/request, and sign the W3C Community Contributor License Agreement (CLA): https://www.w3.org/community/about/agreements/cla/
2. Reminder of Code of Conduct
3. Scribe volunteer(s)? If we can't find a scribe, I'll need to record the meeting and use AI/ML to prepare the meeting notes, or the meeting cannot proceed.

Agenda:

1. Introductions, if necessary
2. Pull Request #122 - Content Warning Processing Model
3. Pull Request #116 - Content Labelling
4. Issue #24 - Addressing for Moderators (#132 was opened but we need to discuss)
5. Time permitting: PR #121 & #129 (these will probably be bumped to July's meeting)

We support contributions to the Agenda, please comment if there is something that we need to address during the meeting.

You can find information on how to join the meeting in the SWICG calendar

Background on the mid-month meeting

This meeting was originally 2026-06-03 @ 4pm CEST, however, Emelia was unavailable due to her chronic illness.

The new meeting to catch up is scheduled for 2026-06-17 @ 6pm CEST / Noon EDT / 9am PDT.

@julian said: @thisismissem hmm if I set sensitive to false wouldn't that communicate the same intent, just explicitly? Yes: as:sensitive of false is the same as as:sensitive being omitted more or less. You could split hairs and say it's an "unknown" sensitive state, but as it's a boolean I'd be inclined to say missing is equal to false. See: https://swicg.github.io/miscellany/#sensitive This is also a processing model document that @trwnh@mastodon.social has written: https://github.com/swicg/activitypub-trust-and-safety/pull/122/ — it's intended to describe how things currently are.

Then their implementation is less than ideal. Without as:sensitive set to true, summary is just a summary, that may mean it's treated as a collapsible area between summary & content or rendered slightly differently (e.g., tap through to view long-form content), but content warnings are specifically communicated in today's fediverse by the use of summary + as:sensitive set to true. The T&S task force looked at alternatives and couldn't find one that solved the migration issues

@unattributed@gotosocial.social that's what the ATP IETF WG is all about, obviously standardisation tasks time. Little known thing, that as far as I know is true, is that ActivityPub is based on a thing Evan's startup used to do (iirc, Pump.io), and then it was brought to the W3C for standardisation

There were a few other things (conflicting standards such as ACP vs WAC), but the JSON-LD was repeatedly the thing that developers found hard to wrap their head around. "How do I create a schema?" is a pretty normal question for an application developer, when you're used to working with traditional web app stacks. "Oh, it's JSON" and then they learn, nope, it's not: every property is optional, every property is one value or an array of values. The JSON-LD learning curve is so high that even people I think know it, generally go "yeah, nah, I still don't fully get it" So to develop an application with JSON-LD you basically need to deal with garbage in hopefully data out. It's not familiar nor simple to 99% of web developers. It's an incredibly niche community of people who actually get it, and they tend to work at companies who really benefit from the properties of JSON-LD.

@Profpatsch@mastodon.xyz OAuth 2.1, which is what I've been steering people towards is much safer and easier to implement than OAuth 2.0 as a lot of the security footguns have been solved or very well documented. We will end up with an OAuth profile for ActivityPub, but it'll probably just be mostly identical to the OAuth profile from AT Protocol. Though, at the same time I'll often ask "do we really need OAuth for this, or would ... be a better solution?"

@Profpatsch@mastodon.xyz and as you'll see in that conversation, I'm saying we don't actually need 20-50 permissions, but rather Rich Authorization Requests, which are specifically designed for this type of thing.

@smallcircles@social.coop said: the Solid team and Inrupt were not really interested in their community, hardly giving attention while people were building interesting stuff there. Yeah, the Inrupt leader ship were all not startup people. They didn't get devrel or really startups. There were more managers at Inrupt when I left than people actually doing the work when I left. (at least, that's how it felt). I think after I left like 2-3 other people also had enough and left.