
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
block or follow lists for ssb.
This implements block/follow lists. (the main use-case was block lists) but a system that could both block and follow was not more complicated.
A user creates a list by publishing a {type: "list/create"} message.
Then they add contacts to that list using a list/contact message.
{
type: 'list/contact',
list: <list_id>, //the id of the list/create message.
blocking: true
// OR
following: true
// OR
following: false
}
this is the same format as contact messages, except with a reference to a list.
Then other users can subscribe to that list.
{
type: 'list/subscribe',
list: <list_id>, //id of the list/create message
subscribe: true || false
}
This uses the createLayer feature of the ssb-friends plugin.
The blocklist makes a map from the list_id to the contacts
(who are either blocked or followed or unfollowed/unblocked)
but the trick is that subscribing uses a low hop count of 0.1.
(as same-as would) this means that if you subscribe to a block
list, it's follows/blocks are treated the same as your own.
I just wrote this! so currently no ssb clients support this. (will link here when some clients implement support!)
However, if you install this plugin manually, and use via the command line, it will work!
ssb-server plugins.install ssb-lists
create relavant messages manually like this:
#create a list, you'll need the "key" output for following commands
ssb-server publish --type list/create
{"key": <list_id>, value:...}
# have the list block someone
ssb-server publish --type list/contact \
--list <list_id> --contact <feed_id> \
--blocking --reason <optional_reason>
# subscribe to the list
ssb-server publish --type list/subscribe \
--list <list_id> --subscribe
Because this integrates with ssb-friends and ssb-friends
handles deciding who to replicate, anyone blocked on a list
you have subscribed to will not be replicated!
MIT
FAQs
block or follow lists for ssb.
We found that ssb-lists demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.