July 2026
Howdy Wagoneers!
The mood here at Bandwagon HQ has been silent, but not still. Yesterday (July 25th, 2026) I posted a big update to your Bandwagon server, so now’s the time to start jawing.
You may have heard that I’ve been working with Bonfire Networks and the Social Web Foundation on an encrypted messenger for ActivityPub. Here’s a post with lots of technical details, if that’s what you’re into.
That work completed last month and now we’re turning the flamethrower of software development back towards Bandwagon – and there’s lots of great stuff happening.
Hold up. This is not the encrypted messenger. Read “About End-to-End Encryption” at the bottom of this page if those details are important to you. Instead, there are a bunch of big wins from this project that have rolled up to Bandwagon, which should have a big impact on what it can do for you today.
Conversations
Check out the new “Chat Bubble” icon in the top navigation.
This is the “Conversations” messenger for Bandwagon, and every server that runs Emissary. This is the messenger app I’ve been building since January (with encryption disabled) and it’s the kind of “chat” interface that I’ve always wanted from Mastodon.
I believe it’s going to open up new ways for you to use Bandwagon. With direct messages in place, you can do a lot more than just publish albums. You can interact directly with everyone on the Fediverse - fans, friends, and industry - right from your Bandwagon page.
And, direct messages are clearly separated from your regular news feeds - directly addressing one of the items of Tim Chambers Seven Deadly UX Sins of the Fediverse. Conversations feels like a normal chat client, without a mess of @mentions listing every person in the conversation.
I’ve been testing this thoroughly (see below) but software always goes sideways when it hits the wild. So, I’m considering this a “beta” test for a short while. Please try it out and let me know how it works for you. I’ll be on point for the next few weeks to smooth out any problems you may find.
Notifications
There’s also a little “bell” in the top navigation, too. This is the new notifications section that keeps you up to date whenever you’re mentioned online, or there’s activity on one of your posts. This is a pretty standard social networking affordance, but we’re trying to push the envelope here, too.
A straightforward settings page helps you choose which kinds of notifications actually grab your attention, and which simply stay in the background. And, you can even turn on “Web Push” notifications, which give you real OS-level desktop alerts even if your browser is off.
It’s a smaller change, but together with the “Conversations” app, Bandwagon is finally feeling like the Fediverse client I’ve always wanted to use.
Security and Software Quality
I’ve spent the past six weeks (ish) on another really big project – a full end-to-end sweep of every line of code within Emissary and all of its dependent libraries. In addition to my own scans, I’ve contracted with Better QA, a European software company, to hunt for bugs, vulnerabilities, inconsistencies, and ease-of-use issues throughout the software stack.
It’s been a humbling experience.
Together, we’ve found and fixed hundreds of “little cuts” and closed all manner of subtle vulnerabilities in the Emissary core. And, there’s still more to go.
The upshot for you is this: Bandwagon looks and feels the same as it always has. But under the hood, it’s a radically improved system that should perform better, break less, and be much more secure compared to what it was on Friday.
Trigger Warning
One more note about this process: both the Better QA team and I have been using various LLMs to scan Emissary’s code base. I’ve been using Claude Opus and Claude Fable to analyze and attack every one of the 100k lines of code within Emissary. It’s the kind of tedious work that a human would just never complete.
I’m mentioning this up-front because LLMs (they’re not Artificial Intelligence) are a controversial topic on the Fediverse. And, there are many legitimate reasons for people to be skeptical of this technology and the companies behind it. But this is not a simple black-and-white issue.
After 30+ years as a professional software developer, product designer, and CTO, this experience has taught me a lot about the current state of technology. The LLMs found real issues in the software that I doubt I ever would have, and have made Emissary more robust and more safe in the process. I think we’re fast approaching a reality where all computer systems will either be secured by LLMs, or hacked by LLMs. Emissary will not be the later.
I will continue to build the the best software I can, with whatever teams and tools are available, and will do my best to help make the Fediverse a viable alternative to the networks that have so damaged our societies.
About End-to-End Encryption
This goes at the bottom because, while lots of people may want details about this project, it’s not really a Bandwagon thing. I mean, does your drummer really need to send forward-secrecy messages using a post-quantum ratchet tree?
Ok, here’s the deal. Our contract from the Social Web Foundation was to build a working, interoperable “end-to-end encrypted” messenger using the “Messaging Layer Security” or MLS protocol and the MLS in ActivityPub draft specification. We did that, and it works really well. 🎉
In the course of building our prototypes, we found a few “gotchas” in the ActivityPub protocol that should be addressed before this protocol gets adopted by everyone on the Fediverse.
Avid cryptographer and Fediverse furry “Soatok” wrote a pretty detailed description of where they see the state of E2EE on ActivityPub, and what’s left to do. The blog article is even titled “The Long Tail….” get it?
Since these big changes would very likely NOT be compatible with our current apps, I’m holding back the encryption portions of this app on my own production servers. If you really want to experiment with E2EE, you should set up your own Emissary server. I’m happy to help you do that.
This is a companion discussion topic for the original entry at https://bandwagon.fm/6a663c7e2227fcf7e15aafc0