Hi, I'm who's behind Fedify, Hollo, BotKit, and this website, Hackers' Pub! My main account is at @hongminhee.
Fedify, Hollo, BotKit, 그리고 보고 계신 이 사이트 Hackers' Pub을 만들고 있습니다. 제 메인 계정은: @hongminhee.
Fedify、Hollo、BotKit、そしてこのサイト、Hackers' Pubを作っています。私のメインアカウントは「@hongminhee」に。
Websitehongminhee.org
GitHub@dahlia
Hollo@hongminhee@hollo.social
DEV@hongminhee
velog@hongminhee
Qiita@hongminhee
Zenn@hongminhee
Matrix@hongminhee:matrix.org
X@hongminhee洪 民憙 (Hong Minhee) shared
Aqueous의 2026-10-31 스냅샷이 나왔습니다! 변경점이 하도 많아서 여기서 다 설명하긴 힘들고 특히 강조하고 싶은 것만 몇 개 골라 보면:
• 이전 버전에 비해 압축에 메모리를 훠어어얼씬 덜 씁니다.
• 압축 과정을 시각적으로 보여 줍니다.
• 클립스튜디오 파일 포맷(.clip) 지원이 추가되었습니다.
• 한글로 된 텍스트 파일에 대한 별도의 지원이 추가되었습니다. 아래아 한/글은 아직 지원 안합니다.
• --stats=report.html 하면 압축·해제 이후 아래와 같은 예쁜 리포트 파일이 생성됩니다. 뭔가 느리다 싶으면 이 파일을 저에게 보내 주십숑.
• 공식적으로 exe 파일 다운로드를 지원합니다. (중요)
아직은 명령줄 도구일 뿐이지만 많은 관심 부탁드립... 헤헤헿
洪 民憙 (Hong Minhee) shared
洪 民憙 (Hong Minhee) shared
DongU Kang (@nyanrus@sukhi.f3liz.casa) and I (@hongminhee@hollo.social) have drafted a proposal for announcing temporary suspensions of ActivityPub inbox delivery, primarily for scheduled maintenance. Peers can defer queued and new deliveries until the announced end time or an earlier cancellation, avoiding predictable failed requests during the interruption. This complements 503 Service Unavailable and Retry-After rather than replacing existing retry policies.
洪 民憙 (Hong Minhee) shared
@hollo@hollo.socialIf you run Hollo, update to 0.8.17 or 0.9.25 now. These releases fix GHSA-r48c-xx2h-fv4g, a DNS rebinding vulnerability in Fedify that could bypass Hollo's server-side request forgery (SSRF) protection and cause requests to reach internal services.
Fedify checked that a hostname resolved only to public addresses, then let the HTTP client resolve it again when connecting. An attacker controlling the hostname's DNS answers could return a public address for validation and a private or loopback address for the connection. Redirects and alternate-document links had the same gap.
The affected Fedify paths used by Hollo include remote document loading (authenticated or not), outbound activity delivery, and WebFinger lookups. On Node.js, which Hollo uses, the fix restricts connections to addresses that passed validation. Hollo's ALLOW_PRIVATE_ADDRESS=true option still permits private destinations; leave it unset for public federation. For full technical details, see the Fedify security announcement and the advisory linked above.
All releases on the supported Hollo 0.8.x and 0.9.x lines up to and including 0.8.16 and 0.9.24 are affected. 0.8.17 and 0.9.25 are the first fixed releases and the latest on those lines, incorporating Fedify 2.1.31 and 2.2.20 respectively. Hollo 0.7.x and earlier are no longer supported under the Hollo security policy; operators on those lines should move to a supported release.
For 0.8.x deployments, update to 0.8.17:
Hackers' Pub
docker pull ghcr.io/fedify-dev/hollo:0.8.17For 0.9.x deployments, update to 0.9.25:
docker pull ghcr.io/fedify-dev/hollo:0.9.25After pulling the image, recreate your Hollo container using the new image. With Docker Compose, update the image tag in your Compose file and run docker compose up -d. For source deployments, check out the corresponding release tag, run pnpm install --frozen-lockfile using the pnpm version pinned in that tag's package.json, run pnpm run build, and restart the server.
If you have a large 0.9.x database and are upgrading from a release before 0.9.20, follow the 0.9.20 index preparation instructions before starting the new version to avoid blocking writes during the new version's automatic migration.
Thanks to 
@finalchild파차 / finalchild for reporting the DNS rebinding issue to the Fedify project.
If anything is unclear, ask below.
