Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Hidden Gems of the Fedify CLI: Tips & Tricks You Might Have Missed

While Fedify is primarily known as a framework for building ActivityPub servers, it also comes with a powerful command-line tool called fedify for debugging and testing ActivityPub implementations. Whether you're using the Fedify framework…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

While Fedify is primarily known as a framework for building ActivityPub servers, it also comes with a powerful command-line tool called fedify for debugging and testing ActivityPub implementations. Whether you're using the Fedify framework or not, this CLI tool can be invaluable for ActivityPub development.






Installation



Before diving into the features, you'll need to install the fedify command. You have several options:



Using npm (Node.js):




npm install -g @fedify/cli






Using Bun:




bun install -g @fedify/cli






Using Deno:




deno install -A --unstable-fs --unstable-kv --unstable-temporal -n fedify jsr:@fedify/cli






You can also download pre-built executables from the releases page.



For more detailed installation instructions and requirements, see the official documentation.






Smart Object Lookup with Content Type Negotiation



The fedify lookup command is smarter than it looks—it can handle various formats of the same identifier and provides multiple output formats to suit your needs:




# Three equivalent ways to look up the same actor:
fedify lookup @[email protected]
fedify lookup [email protected]
fedify lookup acct:[email protected]

# View the raw JSON response:
fedify lookup --raw @[email protected]

# Get a compact JSON-LD representation:
fedify lookup --compact @[email protected]

# See the fully expanded JSON-LD:
fedify lookup --expanded @[email protected]






Some ActivityPub servers require authorized fetch (also known as “secure mode”), which means all HTTP GET requests must be signed—even for public content. The -a/--authorized-fetch flag helps with this:




fedify lookup --authorized-fetch @[email protected]






This spins up a temporary ActivityPub server and signs the request with its key. This is particularly useful when:




  • Accessing servers that require signatures for all requests (like certain Mastodon instances in secure mode)

  • Fetching non-public content like followers-only posts (assuming you have permission)

  • Testing how your server behaves with signed requests






Interactive Inbox Testing



The fedify inbox command not only provides a quick way to test federation but also comes with a powerful web interface for inspecting incoming ActivityPub activities. When you receive an activity, it shows you everything about the request, including:




  • HTTP method and headers

  • Request body (in multiple formats)

  • Response details

  • Server logs



The fedify inbox web interface showing detailed request information



You can see the raw HTTP headers that other servers send, which is invaluable when debugging signature verification issues or content negotiation problems. The interface includes tabs for viewing the activity in different formats:




  • Raw HTTP request/response

  • Compact Activity (normalized JSON-LD)

  • Expanded Activity (fully expanded JSON-LD)

  • Raw Activity (as received)

  • Server logs



The command is highly configurable—you can control which follow requests to accept:




# Only accept follows from specific actors
fedify inbox -a @[email protected] -a @[email protected]

# Accept all follow requests
fedify inbox -a "*"









Rich NodeInfo Visualization



The fedify node command helps you understand how other instances are configured by visualizing their NodeInfo data in a user-friendly format:




# Show standard NodeInfo data with server icon
fedify node mastodon.social

# Include extra metadata that instances expose
fedify node -m mastodon.social

# Try to parse non-compliant NodeInfo responses
fedify node --best-effort problematic-instance.social

# Skip favicon fetching for faster results
fedify node --no-favicon mastodon.social









Flexible Local Development



For testing your ActivityPub implementation locally, the fedify tunnel command lets you temporarily expose your local server to the internet. You can choose from multiple tunneling services if the default one isn't working well:




# Use the default service
fedify tunnel 3000

# Use an alternative service
fedify tunnel --service serveo.net 3000









Shell Integration



Save yourself some typing by enabling shell completions—available for bash, fish, and zsh:




# For bash
source <(fedify completions bash)

# For fish
source (fedify completions fish | psub)

# For zsh
source <(fedify completions zsh)









Coming in Fedify 1.3.0: Custom User-Agent Support



The upcoming Fedify 1.3.0 release will include a feature to set custom User-Agent headers, which is helpful for tracking your requests in server logs:




# Set a custom User-Agent for lookup
fedify lookup --user-agent "MyApp/1.0" @[email protected]

# Set a custom User-Agent for NodeInfo requests
fedify node --user-agent "MyApp/1.0" mastodon.social









These features might not be immediately obvious when you first start using the Fedify CLI, but they can be incredibly helpful when debugging federation issues or testing your ActivityPub implementation.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Hidden Gems of the Fedify CLI: Tips & Tricks You Might Have Missed
id: 8d158db4-5748-4c48-b693-7122a77aa8a8
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Hidden Gems of the Fedify CLI:" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Hidden Gems of the Fedify CLI Tips  Tric")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Hidden Gems of the Fedify CLI Tips  Tric*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Hidden Gems of the Fedify CLI Tips  Tric"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Hidden Gems of the Fedify CLI: Tips &amp; Tr.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Hidden Gems of the Fedify CLI: Tips & Tricks You Might Have Missed

Thematisch verwandte Begriffe: Hidden, Gems, Fedify, Tips · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-88003 | InvoicePlane is a self-hosted open source application for managing invoi…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag