

F-Droid has Drip, Bluemoon and Periodical.
Web developer. Lead developer of PieFed


F-Droid has Drip, Bluemoon and Periodical.


Yeah there are other signs too. Look at those commit messages, all vague, all perfectly capitalized. All with a nice long description with bullet points.
No one does that in a project they’re building for themselves.


I was going to recommend this to someone I know but when I realised your readme.md is entirely AI-generated, I guess the whole project is probably vibe-coded. I can’t in good conscience recommend someone trust their health data to a vide-coded app because they tend to have security problems.
Also all ai-generated code is public domain so your AGPL license is kinda empty. Might as well use MIT.
PieFed is fairly straightforward if you already know sysadmin basics or have Yunohost. - https://codeberg.org/rimu/pyfedi/src/branch/main/INSTALL-docker.md
But for blogging only, you’ll find Ghost or Wordpress with the ActivityPub plugin federate with Mastodon better, which is a bigger audience.


No, it’s legit. Elena has been tooting and peertubing about the fedi and her self hosting journey for over a year.


Is there any way to know this is legit?


OpenWRT is basically Linux for routers and can be installed on a variety of devices - https://openwrt.org/
There is also https://www.gargoyle-router.com/


Yes, do the S3 integration before moving, for sure.


Oh right, yeah, Wordpress does tend to use up an awful lot of storage - every image gets copied 5 or 6 times, in different sizes just incase you need that size. It’s nuts.
You don’t need to store those images in your server though, they can be uploaded to S3 (object storage) where it is 10x cheaper to store them and then you can have a cheaper VPS. This way the VPS only needs to have enough storage for your MySQL database.
https://wordpress.org/plugins/amazon-s3-and-cloudfront/
There are many providers of S3-compatible storage, you don’t need to use AWS. Cloudflare R2 is super cheap - https://www.cloudflare.com/en-gb/developer-platform/products/r2/ or Hetzner - https://www.hetzner.com/storage/object-storage/


This is good advise, listen to dan. WP Super Cache is amazing although getting it working just right can take some tweaking.
The Redis Object Cache plugin is worth a try. It’ll only take a minute to set up.
Is it 200k users or 200k page loads? Those are really different as each user will load multiple pages in a month. If it’s 200k page loads then that server is way way too powerful (and expensive). Don’t let a crappy developer hide their lack of optimization skills by throwing your money at the problem.


It exists and I’ve tried it - https://en.wikipedia.org/wiki/Davfs2
Thing is, when an app thinks a directory is on a local disk, it does things which do not scale well over a network. e.g. reading every file in the directory to make thumbnails.


A live streaming drone would be ideal.
Ah ok.
That docker-dirs.sh script is trying to set the right permissions onto these directories:
“pgdata”, “media”, “logs”, “tmp”.
The owner of those directories needs to be the same user as the one running docker.
Nowhere in https://codeberg.org/rimu/pyfedi/src/branch/main/INSTALL-docker.md does the word chmod appear.
When you say ‘ran the script in it’, what do you mean?


Yes, you’re right.


The person who is using that character found a way around that somehow! So the next release doesn’t try to restrict it anymore.
https://codeberg.org/rimu/pyfedi/commit/40f6472f8ea8d2542d0c073c0aa893e4273e4c23


deleted by creator


I have built functionality into PieFed that detects AI posts and comments.
This poster is AI for sure. He’s done one or two real comments, for camouflage, but the rest are A-grade slop.
And it’s lying about it. That’s kinda creepy.
I recommend you set the Content-Security-Policy http header so that inline javascript (commonly used for XSS attacks) cannot be executed.
https://web.dev/articles/strict-csp
CSP being off is not exactly a security hole but it makes security holes much more likely. By using a strict CSP configuration you close off the possibility of a whole class of holes.
Also think about setting the
Access-Control-Allow-Originheader and enable CORS on your REST endpoints.https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin
Again, kind of a pain in the ass but gets rid of a bunch of potential problems before they start.